Weekly Vulnerabilities Reports > June 5 to 11, 2000

Overview

4 new vulnerabilities reported during this period, including 0 critical vulnerabilities and 3 high severity vulnerabilities. This weekly summary report vulnerabilities in 4 products from 4 vendors including IBM, Unify, BEA, and ICQ. Vulnerabilities are notably categorized as "Improper Handling of Case Sensitivity", and "Incomplete Cleanup".

  • 3 reported vulnerabilities are remotely exploitables.
  • 3 reported vulnerabilities are exploitable by an anonymous user.
  • IBM has the most reported vulnerabilities, with 1 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

0 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS

3 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2000-06-08 CVE-2000-0499 BEA Improper Handling of Case Sensitivity vulnerability in BEA Weblogic Server

The default configuration of BEA WebLogic 3.1.8 through 4.5.1 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case.
7.5
2000-06-08 CVE-2000-0498 Unify Improper Handling of Case Sensitivity vulnerability in Unify Ewave Servletexec

Unify eWave ServletExec allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case.
7.5
2000-06-08 CVE-2000-0497 IBM Improper Handling of Case Sensitivity vulnerability in IBM Websphere Application Server 3.0.2

IBM WebSphere server 3.0.2 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case.
7.5

1 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2000-06-06 CVE-2000-0552 ICQ Incomplete Cleanup vulnerability in ICQ 2000A

ICQwebmail client for ICQ 2000A creates a world readable temporary file during login and does not delete it, which allows local users to obtain sensitive information.
5.5

0 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS