Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2002-0487

Quick assessment

Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Intellisol Xpede是一款基于浏览器结合使用的时间和费用，项目成本管理的金融相关系统，运行在Microsoft Windows操作系统下。 Intellisol Xpede由于在超时重新验证上处理存在漏洞，可导致密码信息以明文方式泄露。 如果用户的浏览器设置为'Remember my password'功能的话，当对超时会话进行重新验证的时候，通过浏览javascript脚本源代码就可以获得用户的明文密码。如果系统是多用户系统的话，就可以导致密码被其他用户获得。

AI Predicted 4.3 Difficulty: Easy EPSS 0.44% · P37
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2002-0487

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Intellisol Xpede 4.1 stores passwords in plaintext in a Javascript "session timeout" re-authentication capability, which could allow local users with access to gain privileges of other Xpede users by reading the password from the source file, e.g. from the browser's cache.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WorkforceROI Xpede重验证明文密码泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Intellisol Xpede是一款基于浏览器结合使用的时间和费用，项目成本管理的金融相关系统，运行在Microsoft Windows操作系统下。 Intellisol Xpede由于在超时重新验证上处理存在漏洞，可导致密码信息以明文方式泄露。 如果用户的浏览器设置为'Remember my password'功能的话，当对超时会话进行重新验证的时候，通过浏览javascript脚本源代码就可以获得用户的明文密码。如果系统是多用户系统的话，就可以导致密码被其他用户获得。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2002-0487

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2002-0487

请登录查看更多情报信息。

Vendor Advisories for CVE-2002-0487 (3)

Same Patch Batch · n/a · 2002-06-11 · 167 CVEs total

CVE-2002-0549 Anthill存在跨站脚本执行漏洞
CVE-2002-0530 Microsoft Internet Explorer BR549.DLL ActiveX控件缓冲区溢出漏洞(MS03-032)
CVE-2002-0533 PHPBB BBCode导致拒绝服务攻击漏洞
CVE-2002-0534 PostBoard BBCode存在拒绝服务攻击漏洞
CVE-2002-0535 PostBoard IMG标记脚本执行漏洞
CVE-2002-0537 StepWeb搜索引擎管理员页面访问漏洞
CVE-2002-0540 Nortel CVX 1800多服务访问网关存在默认SNMP口令漏洞
CVE-2002-0541 Tivoli Storage Manager提交用户名过长导致缓冲溢出漏洞
CVE-2002-0544 Abyss Web Server明文管理绕过漏洞
CVE-2002-0547 Nullsoft Winamp Minibrowser ID3v2缓冲区溢出漏洞
CVE-2002-0548 Anthill postbug.php认证可绕过漏洞
CVE-2002-0555 IBM Informix Web DataBlade SQL查询语句HTML条目自动解码漏洞
CVE-2002-0559 Oracle 9iAS PL/SQL Apache模块存在多个缓冲区溢出漏洞
CVE-2002-0558 TYPSoft FTP Server目录遍历漏洞
CVE-2002-0557 OpenBSD rexecd、rshd、atrun BSD错误认证实现漏洞
CVE-2002-0556 Quik-Serv Web服务器任意文件泄露漏洞
CVE-2002-0552 Melange聊天系统melange.conf配置行处理存在缓冲区溢出漏洞
CVE-2002-0550 Dynamic Guestbook远程执行任意命令漏洞
CVE-2002-0551 Dynamic Guestbook存在跨站脚本执行漏洞
CVE-2002-0529 HP Photosmart Mac OS X打印驱动程序文件权限不正确漏洞

Showing top 20 of 167 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2002-0487

No comments yet

Leave a comment