VYPR

CVEs

343,267 total · page 6712 of 6,866

AllCriticalHighKEV
  • CVE-2003-1361Dec 31, 2003
    Symantec
    Bare Metal Restore
    risk 0.00cvss —epss 0.02

    Unknown vulnerability in VERITAS Bare Metal Restore (BMR) of Tivoli Storage Manager (TSM) 3.1.0 through 3.2.1 allows remote attackers to gain root privileges on the BMR Main Server.

  • CVE-2003-1362Dec 31, 2003
    Bastille
    Bastille
    risk 0.00cvss —epss 0.02

    Bastille B.02.00.00 of HP-UX 11.00 and 11.11 does not properly configure the (1) NOVRFY and (2) NOEXPN options in the sendmail.cf file, which could allow remote attackers to verify the existence of system users and expand defined sendmail aliases.

  • CVE-2003-1363Dec 31, 2003
    Aprelium Technologies
    Web Server
    risk 0.00cvss —epss 0.01

    The remote web management interface of Aprelium Technologies Abyss Web Server 1.1.2 and earlier does not log connection attempts to the web management port (9999), which allows remote attackers to mount brute force attacks on the administration console without detection.

  • CVE-2003-1364Dec 31, 2003
    Aprelium Technologies
    Web Server
    risk 0.04cvss —epss 0.07

    Aprelium Technologies Abyss Web Server 1.1.2, and possibly other versions before 1.1.4, allows remote attackers to cause a denial of service (crash) via an HTTP GET message with empty (1) Connection or (2) Range fields.

  • CVE-2003-1365Dec 31, 2003
    Perl Foundation
    Cgi Lite
    risk 0.00cvss —epss 0.02

    The escape_dangerous_chars function in CGI::Lite 2.0 and earlier does not correctly remove special characters including (1) "\" (backslash), (2) "?", (3) "~" (tilde), (4) "^" (carat), (5) newline, or (6) carriage return, which could allow remote attackers to read or write…

  • CVE-2003-1366Dec 31, 2003
    OpenBSD
    OpenBSD
    risk 0.03cvss —epss 0.01

    chpass in OpenBSD 2.0 through 3.2 allows local users to read portions of arbitrary files via a hard link attack on a temporary file used to store user database information.

  • CVE-2003-1367Dec 31, 2003
    Great Circle Associates
    Majordomo
    risk 0.00cvss —epss 0.02

    The which_access variable for Majordomo 2.0 through 1.94.4, and possibly earlier versions, is set to "open" by default, which allows remote attackers to identify the email addresses of members of mailing lists via a "which" command.

  • CVE-2003-1368Dec 31, 2003
    Electrasoft
    FTP Client
    risk 0.03cvss —epss 0.04

    Buffer overflow in the 32bit FTP client 9.49.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long FTP server banner.

  • CVE-2003-1369Dec 31, 2003
    Softx
    FTP Client
    risk 0.03cvss —epss 0.04

    Buffer overflow in ByteCatcher FTP client 1.04b allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long FTP server banner.

  • CVE-2003-1370Dec 31, 2003
    Nuked Klan
    Nuked Klan
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Nuked-Klan 1.2b allow remote attackers to inject arbitrary HTML or web script via (1) the Author field in the Guestbook module, (2) the Titre or Pseudo fields in the Forum module, or (3) "La Tribune Libre" in the Shoutbox…

  • CVE-2003-1371Dec 31, 2003
    Nuked Klan
    Nuked Klan
    risk 0.03cvss —epss 0.03

    Nuked-Klan 1.3b, and possibly earlier versions, allows remote attackers to obtain sensitive server information via an op parameter set to phpinfo for the (1) Team, (2) News, or (3) Liens modules.

  • CVE-2003-1372Dec 31, 2003
    Myphpnuke
    Myphpnuke
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in links.php script in myPHPNuke 1.8.8, and possibly earlier versions, allows remote attackers to inject arbitrary HTML and web script via the (1) ratenum or (2) query parameters.

  • CVE-2003-1373Dec 31, 2003
    PhpBB
    phpBB
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in auth.php for PhpBB 1.4.0 through 1.4.4 allows remote attackers to read and include arbitrary files via .. (dot dot) sequences followed by NULL (%00) characters in CGI parameters, as demonstrated using the lang parameter in prefs.php.

  • CVE-2003-1374Dec 31, 2003
    Microfocus
    disable
    risk 0.00cvss —epss 0.01

    Buffer overflow in disable of HP-UX 11.0 may allow local users to execute arbitrary code via a long argument to the (1) -r or (2)-c options.

  • CVE-2003-1375Dec 31, 2003
    Microfocus
    wall
    risk 0.03cvss —epss 0.02

    Buffer overflow in wall for HP-UX 10.20 through 11.11 may allow local users to execute arbitrary code by calling wall with a large file as an argument.

  • CVE-2003-1376Dec 31, 2003
    Winzip
    Winzip
    risk 0.00cvss —epss 0.00

    WinZip 8.0 uses weak random number generation for password protected ZIP files, which allows local users to brute force the encryption keys and extract the data from the zip file by guessing the state of the stream coder.

  • CVE-2003-1377Dec 31, 2003
    Sircd
    Sircd
    risk 0.00cvss —epss 0.03

    Buffer overflow in the reverse DNS lookup of Smart IRC Daemon (SIRCD) 0.4.0 and 0.4.4 allows remote attackers to execute arbitrary code via a client with a long hostname.

  • CVE-2003-1378Dec 31, 2003
    Microsoft
    Outlook
    risk 0.04cvss —epss 0.16

    Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary programs via an HTML email with the CODEBASE parameter set to the program, a vulnerability similar to CAN-2002-0077.

  • CVE-2003-1379Dec 31, 2003
    ClarkConnect
    ClarkConnect Linux
    risk 0.00cvss —epss 0.02

    clarkconnectd in ClarkConnect Linux 1.2 allows remote attackers to obtain sensitive information about the server via the characters (1) A, which reveals the date and time, (2) F, (3) M, which reveals 'ifconfig' information, (4) P, which lists the processes, (5) Y, which reveals…

  • CVE-2003-1380Dec 31, 2003
    Bisonware
    Bisonftp Server 4
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in BisonFTP Server 4 release 2 allows remote attackers to (1) list directories above the root via an 'ls @../' command, or (2) list files above the root via a "mget @../FILE" command.

  • CVE-2003-1381Dec 31, 2003
    AlliedModders
    Amx Mod
    risk 0.03cvss —epss 0.03

    Format string vulnerability in AMX 0.9.2 and earlier, a plugin for Valve Software's Half-Life Server, allows remote attackers to execute arbitrary commands via format string specifiers in the amx_say command.

  • CVE-2003-1382Dec 31, 2003
    Instantservers Inc.
    Ismail
    risk 0.00cvss —epss 0.03

    Buffer overflow in ISMail 1.4.3 and earlier allow remote attackers to execute arbitrary code via long domain names in (1) MAIL FROM or (2) RCPT TO fields.

  • CVE-2003-1383Dec 31, 2003
    Logicworks
    Web ERP
    risk 0.00cvss —epss 0.02

    WEB-ERP 0.1.4 and earlier allows remote attackers to obtain sensitive information via an HTTP request for the logicworks.ini file, which contains the MySQL database username and password.

  • CVE-2003-1384Dec 31, 2003
    PY Livredor
    PY-Livredor
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in PY-Livredor 1.0 allows remote attackers to insert arbitrary web script or HTML via the (1) titre, (2) Votre pseudo, (3) Votre e-mail, or (4) Votre message fields.

  • CVE-2003-1385Dec 31, 2003
    Invision Power Services
    Power Board
    risk 0.03cvss —epss 0.04

    ipchat.php in Invision Power Board 1.1.1 allows remote attackers to execute arbitrary PHP code, if register_globals is enabled, by modifying the root_path parameter to reference a URL on a remote web server that contains the code.

  • CVE-2003-1386Dec 31, 2003
    Axis
    2400 Video Server
    risk 0.04cvss —epss 0.08

    AXIS 2400 Video Server 2.00 through 2.33 allows remote attackers to obtain sensitive information via an HTTP request to /support/messages, which displays the server's /var/log/messages file.

  • CVE-2003-1387Dec 31, 2003
    Opera
    Opera
    risk 0.04cvss —epss 0.15

    Buffer overflow in Opera 6.05 and 6.06, and possibly other versions, allows remote attackers to execute arbitrary code via a URL with a long username.

  • CVE-2003-1388Dec 31, 2003
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Buffer overflow in Opera 7.02 Build 2668 allows remote attackers to crash Opera via a long HTTP request ending in a .ZIP extension.

  • CVE-2003-1389Dec 31, 2003
    Rts
    CryptoBuddy
    risk 0.00cvss —epss 0.01

    RTS CryptoBuddy 1.2 and earlier truncates long passphrases without warning the user, which may make it easier to conduct certain brute force guessing attacks.

  • CVE-2003-1390Dec 31, 2003
    Rts
    CryptoBuddy
    risk 0.00cvss —epss 0.01

    RTS CryptoBuddy 1.2 and earlier stores bytes 53 through 55 of a 55-byte passphrase in plaintext, which makes it easier for local users to guess the passphrase.

  • CVE-2003-1391Dec 31, 2003
    Rts
    CryptoBuddy
    risk 0.00cvss —epss 0.01

    RTS CryptoBuddy 1.0 and 1.2 uses a weak encryption algorithm for the passphrase and generates predictable keys, which makes it easier for attackers to guess the passphrase.

  • CVE-2003-1392Dec 31, 2003
    CryptoBuddy
    CryptoBuddy
    risk 0.00cvss —epss 0.01

    CryptoBuddy 1.0 and 1.2 does not use the user-supplied passphrase to encrypt data, which could allow local users to use their own passphrase to decrypt the data.

  • CVE-2003-1393Dec 31, 2003
    Gupta Technologies
    Sqlbase
    risk 0.00cvss —epss 0.03

    Buffer overflow in Gupta SQLBase 8.1.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long EXECUTE command.

  • CVE-2003-1394Dec 31, 2003
    CoffeeCup Software
    Coffeecup Password Wizard
    risk 0.00cvss —epss 0.01

    CoffeeCup Software Password Wizard 4.0 stores sensitive information such as usernames and passwords in a .apw file under the web document root with insufficient access control, which allows remote attackers to obtain that information via a direct request for the file.

  • CVE-2003-1395Dec 31, 2003
    Kazaa
    Kazaa Media Desktop
    risk 0.00cvss —epss 0.04

    Buffer overflow in KaZaA Media Desktop 2.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a response to the ad server.

  • CVE-2003-1396Dec 31, 2003
    Opera
    Opera
    risk 0.04cvss —epss 0.09

    Heap-based buffer overflow in Opera 6.05 through 7.10 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a filename with a long extension.

  • CVE-2003-1397Dec 31, 2003
    Opera
    Opera
    risk 0.03cvss —epss 0.06

    The PluginContext object of Opera 6.05 and 7.0 allows remote attackers to cause a denial of service (crash) via an HTTP request containing a long string that gets passed to the ShowDocument method.

  • CVE-2003-1398Dec 31, 2003
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.02

    Cisco IOS 12.0 through 12.2, when IP routing is disabled, accepts false ICMP redirect messages, which allows remote attackers to cause a denial of service (network routing modification).

  • CVE-2003-1399Dec 31, 2003
    Eject
    Eject
    risk 0.00cvss —epss 0.00

    eject 2.0.10, when installed setuid on systems such as SuSE Linux 7.3, generates different error messages depending on whether a specified file exists or not, which allows local users to obtain sensitive information.

  • CVE-2003-1400Dec 31, 2003
    PHP-Nuke
    Your_Account
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Your_Account module for PHP-Nuke 5.0 through 6.0 allows remote attackers to inject arbitrary web script or HTML via the user_avatar parameter.

  • CVE-2003-1401Dec 31, 2003
    PHP Board
    PHP Board
    risk 0.03cvss —epss 0.02

    login.php in php-Board 1.0 stores plaintext passwords in $username.txt with insufficient access control under the web document root, which allows remote attackers to obtain sensitive information via a direct request.

  • CVE-2003-1402Dec 31, 2003
    Kietu
    Kietu
    risk 0.00cvss —epss 0.02

    PHP remote file inclusion vulnerability in hit.php for Kietu 2.0 and 2.3 allows remote attackers to execute arbitrary PHP code via the url_hit parameter, a different vulnerability than CVE-2006-5015.

  • CVE-2003-1403Dec 31, 2003
    Dotbr
    Botbr
    risk 0.00cvss —epss 0.01

    foo.php3 in DotBr 0.1 allows remote attackers to obtain sensitive information via a direct request, which calls the phpinfo function.

  • CVE-2003-1404Dec 31, 2003
    Dotbr
    Botbr
    risk 0.00cvss —epss 0.01

    DotBr 0.1 stores config.inc with insufficient access control under the web document root, which allows remote attackers to obtain sensitive information such as SQL usernames and passwords.

  • CVE-2003-1405Dec 31, 2003
    Dotbr
    DotBr
    risk 0.03cvss —epss 0.04

    DotBr 0.1 allows remote attackers to execute arbitrary shell commands via the cmd parameter to (1) exec.php3 or (2) system.php3.

  • CVE-2003-1406Dec 31, 2003
    Adalis Infomatique
    D Forum
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in D-Forum 1.00 through 1.11 allows remote attackers to execute arbitrary PHP code via a URL in the (1) my_header parameter to header.php3 or (2) my_footer parameter to footer.php3.

  • CVE-2003-1407Dec 31, 2003
    Microsoft
    Windows Nt
    risk 0.03cvss —epss 0.03

    Buffer overflow in cmd.exe in Windows NT 4.0 may allow local users to execute arbitrary code via a long pathname argument to the cd command.

  • CVE-2003-1408Dec 31, 2003
    Lotus
    Domino Server
    risk 0.00cvss —epss 0.01

    Lotus Domino Server 5.0 and 6.0 allows remote attackers to read the source code for files via an HTTP request with a filename with a trailing dot.

  • CVE-2003-1409Dec 31, 2003
    TOPo
    TOPo
    risk 0.03cvss —epss 0.03

    TOPo 1.43 allows remote attackers to obtain sensitive information by sending an HTTP request with an invalid parameter to (1) in.php or (2) out.php, which reveals the path to the TOPo directory in the error message.

  • CVE-2003-1410Dec 31, 2003
    Cedric
    Email Reader
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in email.php (aka email.php3) in Cedric Email Reader 0.2 and 0.3 allows remote attackers to execute arbitrary PHP code via the cer_skin parameter.