CVE-2002-0325

CVE-2002-0325 describes a directory traversal vulnerability in BadBlue prior to 1.6.1 that allows remote attackers to read arbitrary files via a modified dot-dot sequence in the URL. The vulnerability is confirmed in multiple sources (NVD and CVE listings) and is categorized with medium severity ...

CVE-2002-0326

The CVE-2002-0326 entry concerns a cross-site scripting vulnerability in BadBlue prior to version 1.6.1 beta. The issue allows remote attackers to run arbitrary script via a URL containing Javascript, enabling partial confidentiality/ integrity/ availability impact as described in the NVD metrics...

CVE-2002-1973

The CVE-2002-1973 entry describes a buffer overflow in CHttpServer::OnParseError of the ISAPI extension (Isapi.cpp) when built with MFC static libraries in Visual C++ 5.0 and 6.0 before SP3. This flaw, present in multiple products (including BadBlue), can be triggered by a long query string that ...

CVE-2005-0595

CVE-2005-0595 is a public buffer-overflow vulnerability in BadBlue 2.55/2.5 where ext.dll overflows via a long mfcisapicommand parameter, enabling remote code execution. Public disclosures include SPL/Metasploit-era exploits (BadBlue 2.5 EXT.dll Buffer Overflow) and OSVDB/BID/CVE references; CIRC...

CVE-2002-1023

CVE-2002-1023 refers to a Denial-of-Service vulnerability in the BadBlue web server where sending an invalid HTTP GET request without a URI can crash the server. The open-source/NVD records describe the issue as a remote DoS with a network-accessible vector, and multiple security databases/scan s...

CVE-2002-2170

The CVE affects BadBlue Enterprise Edition versions 1.7–1.74. The root cause is insufficient authentication when attempts to restrict administrator actions to localhost IP, allowing a remote attacker to trigger arbitrary code execution via an HTTP POST to the dir.hts page on localhost, which can ...

CVE-2004-1727

CVE-2004-1727 affects BadBlue 2.5, where a denial of service can be triggered by a flood of connections from a single IP, causing the server to refuse HTTP connections. The primary description states a large number of connections from the same IP leads to DoS (availability impact). A Nessus plugi...

CVE-2001-1140

BadBlue Personal Edition v1.02 beta is affected by CVE-2001-1140, where remote attackers can read source code of executables by adding a null byte (%00) to the request. The vulnerability is exploitable over a network with low attack complexity and no authentication, causing partial confidentialit...

CVE-2002-2289

The CVE concerns BadBlue 1.7.1 where soinfo.php calls the PHP phpinfo function, exposing sensitive information and potentially ODBC passwords. The root cause is the phpinfo output being exposed remotely, enabling information disclosure. Publicly documented details are limited to this information;...

CVE-2003-0332

The CVE-2003-0332 vulnerability affects BadBlue ISAPI extension in versions 1.7 through 2.2 (potentially earlier). The issue arises when the ISAPI extension modifies the first two letters of a filename extension after a security check, allowing remote attackers to bypass authentication by using a...

CVE-2001-0276

The vulnerability CVE-2001-0276 affects BadBlue Personal Edition (1.02.07) where ext.dll can be invoked directly without arguments, causing an error message that reveals the server’s physical path. This is a path disclosure issue in the web server software. The available connected documents confi...

CVE-2002-1685

CVE-2002-1685 : BadBlue Enterprise Edition and Personal Edition versions 1.7 and 1.7.2 are affected by a cross-site scripting (XSS) vulnerability in the ext.dll ISAPI. The flaw enables an attacker to execute arbitrary script in the context of other users by injecting script via the ext.dll ISAPI ...

CVE-2002-1684

The CVE-2002-1684 entry concerns a directory traversal vulnerability in Deerfield D2Gfx 1.0.2 and BadBlue Enterprise Edition 1.5.x plus BadBlue Personal Edition 1.5.6. The vulnerability allows remote attackers to read arbitrary files via a ../ traversal in the script used to read Microsoft Office...

CVE-2001-0277

CVE-2001-0277 affects BadBlue 1.02.07 Personal Edition via a buffer overflow in ext.dll . An attacker can trigger a remote denial of service and potentially execute arbitrary commands by sending a long HTTP GET request. The connected documents do not provide remediation details or explicit exploi...

CVE-2002-1683

CVE-2002-1683 is an XSS vulnerability in BadBlue Personal Edition 1.7.3 where an attacker can remotely inject a script via the cleanSearchString() function, causing the script to run in other users’ contexts. The connected sources confirm the vulnerability details but do not provide exploitation ...

CVE-2002-1021

Summary of CVE-2002-1021 (BadBlue Hex-encoded Null Byte) The vulnerability affects the BadBlue web server and allows remote attackers to read restricted files (notably EXT.INI, the BadBlue configuration file) by sending an HTTP request containing a hex-encoded NULL byte. This constitutes an infor...

CVE-2002-1022

CVE-2002-1022 affects BadBlue server. The vulnerability arises because passwords are stored in plaintext in the ext.ini file, enabling local and possibly remote attackers to escalate privileges. The connected documents corroborate the plaintext storage and the potential privilege gain, but do not...

CVE-2004-2374

The CVE-2004-2374 entry concerns BadBlue 2.4. Affected: BadBlue 2.4. Vulnerable behavior: requesting phptest.php embeds server installation pathname in the HTML source, allowing remote disclosure of the installation path. Impact: disclosure of server location information; exact impact described i...

CVE-2002-0800

CVE-2002-0800 affects BadBlue 1.7.0 and permits remote directory listing by requesting a URL that ends with an encoded '%' character. The impact is partial confidentiality (I: Partial) with network access, no authentication required, and no available exploitation details in the provided documents...

CVE-2002-1541

CVE-2002-1541 affects BadBlue 1.7. An HTTP request containing an extra / (slash) can bypass directory/file password protections, enabling remote access. The documents do not specify the exact root cause code or patches. No exploitation details or mitigation steps are provided in the supplied sour...