badblue vulnerabilities and fixes

Recent CVEs affecting badblue, with upgrade or downgrade steps. 24 tracked.

badblue has 24 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2008-04-28. Highest priority: CVE-2001-0277 (score 64/100).

• CVE-2008-2003 HIGH 7.5 DOWNGRADE BadBlue 2.72 Personal Edition stores multiple programs in the web document root with insufficient access contr
• CVE-2007-6379 MEDIUM 5.0 UPGRADE BadBlue 2.72b and earlier allows remote attackers to obtain sensitive information via an invalid browse parame
• CVE-2007-6378 HIGH 7.5 UPGRADE Directory traversal vulnerability in upload.dll in BadBlue 2.72b and earlier allows remote attackers to create
• CVE-2007-6377 HIGH 7.5 UPGRADE Stack-based buffer overflow in the PassThru functionality in ext.dll in BadBlue 2.72b and earlier allows remot
• CVE-2005-0595 HIGH 7.5 DOWNGRADE Buffer overflow in ext.dll in BadBlue 2.55 allows remote attackers to execute arbitrary code via a long mfcisa
• CVE-2004-2374 MEDIUM 5.0 DOWNGRADE BadBlue 2.4 allows remote attackers to obtain the location of the server installation path via a request for p
• CVE-2004-1727 MEDIUM 5.0 DOWNGRADE BadBlue 2.5 allows remote attackers to cause a denial of service (refuse HTTP connections) via a large number
• CVE-2003-0332 HIGH 7.6 UPGRADE The ISAPI extension in BadBlue 1.7 through 2.2, and possibly earlier versions, modifies the first two letters
• CVE-2002-2289 MEDIUM 5.0 DOWNGRADE soinfo.php in BadBlue 1.7.1 calls the phpinfo function, which allows remote attackers to gain sensitive inform
• CVE-2002-2170 HIGH 7.5 DOWNGRADE Working Resources Inc
• CVE-2002-1973 HIGH 7.5 DOWNGRADE DOWNGRADE Buffer overflow in CHttpServer::OnParseError in the ISAPI extension (Isapi.cpp) when built using Microsoft Fou
• CVE-2002-1685 MEDIUM 4.3 DOWNGRADE Cross-site scripting vulnerability (XSS) in BadBlue Enterprise Edition and Personal Edition 1.7 and 1.7.2 allo
• CVE-2002-1684 MEDIUM 5.0 DOWNGRADE DOWNGRADE Directory traversal vulnerability in (1) Deerfield D2Gfx 1.0.2 or (2) BadBlue Enterprise Edition 1.5.x and Bad
• CVE-2002-1683 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in BadBlue Personal Edition 1.7.3 allows remote attackers to execute
• CVE-2002-1541 HIGH 7.5 DOWNGRADE BadBlue 1.7 allows remote attackers to bypass password protections for directories and files via an HTTP reque
• CVE-2002-1023 MEDIUM 5.0 DOWNGRADE BadBlue server allows remote attackers to cause a denial of service (crash) via an HTTP GET request without a
• CVE-2002-1022 HIGH 7.5 DOWNGRADE BadBlue server stores passwords in plaintext in the ext.ini file, which could allow local and possibly remote
• CVE-2002-1021 MEDIUM 5.0 DOWNGRADE BadBlue server allows remote attackers to read restricted files, such as EXT.INI, via an HTTP request that con
• CVE-2002-0800 MEDIUM 5.0 DOWNGRADE BadBlue 1.7.0 allows remote attackers to list the contents of directories via a URL with an encoded '%' charac
• CVE-2002-0326 HIGH 7.5 DOWNGRADE Cross-site scripting vulnerability in BadBlue before 1.6.1 beta allows remote attackers to execute arbitrary s
• CVE-2002-0325 MEDIUM 5.0 DOWNGRADE Directory traversal vulnerability in BadBlue before 1.6.1 allows remote attackers to read arbitrary files via
• CVE-2001-1140 MEDIUM 5.0 DOWNGRADE BadBlue Personal Edition v1.02 beta allows remote attackers to read source code for executable programs by app
• CVE-2001-0277 HIGH 10.0 DOWNGRADE Buffer overflow in ext.dll in BadBlue 1.02.07 Personal Edition allows remote attackers to cause a denial of se
• CVE-2001-0276 MEDIUM 6.4 DOWNGRADE ext.dll in BadBlue 1.02.07 Personal Edition web server allows remote attackers to determine the physical path

FAQ

How do I fix badblue vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is badblue being exploited right now?

None of the tracked badblue CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which badblue CVE should I patch first?

CVE-2001-0277 currently ranks highest (64/100): Buffer overflow in ext.dll in BadBlue 1.02.07 Personal Edition allows remote attackers to cause a denial of se.

RSS feed for badblue · ← Back to latest CVEs