VYPR

CVEs

343,267 total · page 6713 of 6,866

AllCriticalHighKEV
  • CVE-2003-1411Dec 31, 2003
    Isoca
    Cedric Email Reader
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in emailreader_execute_on_each_page.inc.php in Cedric Email Reader 0.4 allows remote attackers to execute arbitrary PHP code via the emailreader_ini parameter.

  • CVE-2003-1412Dec 31, 2003
    gosa-project
    Gosa
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in index.php for GONiCUS System Administrator (GOsa) 1.0 allows remote attackers to execute arbitrary PHP code via the plugin parameter to (1) 3fax/1blocklists/index.php; (2) 6departamentadmin/index.php, (3) 5terminals/index.php, (4)…

  • CVE-2003-1413Dec 31, 2003
    Apple Inc.
    Darwin Streaming Server
    risk 0.00cvss —epss 0.01

    parse_xml.cgi in Apple Darwin Streaming Server 4.1.1 allows remote attackers to determine the existence of arbitrary files by using ".." sequences in the filename parameter and comparing the resulting error messages.

  • CVE-2003-1414Dec 31, 2003
    Apple Inc.
    Darwin Streaming Server
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in parse_xml.cg Apple Darwin Streaming Server 4.1.2 and Apple Quicktime Streaming Server 4.1.1 allows remote attackers to read arbitrary files via a ... (triple dot) in the filename parameter.

  • CVE-2003-1415Dec 31, 2003
    NetCharts
    XBRL Server
    risk 0.00cvss —epss 0.01

    NetCharts XBRL Server 4.0.0 allows remote attackers to obtain sensitive information via an HTTP request with an invalid chunked transfer encoding specification.

  • CVE-2003-1416Dec 31, 2003
    Bisonware
    Bisonftp Server 4
    risk 0.00cvss —epss 0.01

    BisonFTP Server 4 release 2 allows remote attackers to cause a denial of service (CPU consumption) via a long (1) ls or (2) cwd command.

  • CVE-2003-1417Dec 31, 2003
    Ncipher
    Support Software
    risk 0.00cvss —epss 0.00

    nCipher Support Software 6.00, when using generatekey KeySafe to import keys, does not delete the temporary copies of the key, which may allow local users to gain access to the key by reading the (1) key.pem or (2) key.der files.

  • CVE-2003-1418Dec 31, 2003
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.07

    Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child process IDs (PID).

  • CVE-2003-1419Dec 31, 2003
    Netscape
    Netscape
    risk 0.03cvss —epss 0.02

    Netscape 7.0 allows remote attackers to cause a denial of service (crash) via a web page with an invalid regular expression argument to the JavaScript reformatDate function.

  • CVE-2003-1420Dec 31, 2003
    Opera
    Opera
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Opera 6.0 through 7.0 with automatic redirection disabled allows remote attackers to inject arbitrary web script or HTML via the HTTP Location header.

  • CVE-2003-1421Dec 31, 2003
    Suckbot
    Suckbot
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in mod_mysql_logger shared object in SuckBot 0.006 allows remote attackers to cause a denial of service (seg fault) via unknown attack vectors.

  • CVE-2003-1422Dec 31, 2003
    Syslinux
    SYSLINUX
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in the installer for SYSLINUX 2.01, when running setuid root, allow local users to gain privileges via unknown vectors.

  • CVE-2003-1423Dec 31, 2003
    Petitforum
    Petitforum
    risk 0.00cvss —epss 0.01

    Petitforum stores the liste.txt data file under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as e-mail addresses and encrypted passwords.

  • CVE-2003-1424Dec 31, 2003
    Petitforum
    Petitforum
    risk 0.00cvss —epss 0.01

    message.php in Petitforum does not properly authenticate users, which allows remote attackers to impersonate forum users via a modified connect cookie.

  • CVE-2003-1425Dec 31, 2003
    CPanel
    Cpanel
    risk 0.04cvss —epss 0.11

    guestbook.cgi in cPanel 5.0 allows remote attackers to execute arbitrary commands via the template parameter.

  • CVE-2003-1426Dec 31, 2003
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.00

    Openwebmail in cPanel 5.0, when run using suid Perl, adds the directory in the SCRIPT_FILENAME environment variable to Perl's @INC include array, which allows local users to execute arbitrary code by modifying SCRIPT_FILENAME to reference a directory containing a malicious…

  • CVE-2003-1427Dec 31, 2003
    Netgear
    Fm114p
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in the web configuration interface in Netgear FM114P 1.4 allows remote attackers to read arbitrary files, such as the netgear.cfg configuration file, via a hex-encoded (%2e%2e%2f) ../ (dot dot slash) in the port parameter.

  • CVE-2003-1428Dec 31, 2003
    Bharat Mediratta
    Gallery
    risk 0.00cvss —epss 0.01

    Gallery 1.3.3 creates directories with insecure permissions, which allows local users to read, modify, or delete photos.

  • CVE-2003-1429Dec 31, 2003
    Proxomitron
    Proxomitron Naoko
    risk 0.00cvss —epss 0.03

    Buffer overflow in Proxomitron Naoko 4.4 allows remote attackers to execute arbitrary code via a long request.

  • CVE-2003-1430Dec 31, 2003
    Epic Games
    Unreal Tournament
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in Unreal Tournament Server 436 and earlier allows remote attackers to access known files via a ".." (dot dot) in an unreal:// URL.

  • CVE-2003-1431Dec 31, 2003
    Epic Games
    Unreal Engine
    risk 0.03cvss —epss 0.05

    Buffer overflow in Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of service (crash) via a long host string in the Unreal URL.

  • CVE-2003-1432Dec 31, 2003
    Epic Games
    Unreal Engine
    risk 0.01cvss —epss 0.08

    Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of service (CPU consumption or crash) and possibly execute arbitrary code via (1) a packet with a negative size value, which is treated as a large positive number during memory allocation, or (2)…

  • CVE-2003-1433Dec 31, 2003
    Epic Games
    Unreal Engine
    risk 0.00cvss —epss 0.01

    Epic Games Unreal Engine 226f through 436 does not validate the challenge key, which allows remote attackers to exhaust the player limit by joining the game multiple times.

  • CVE-2003-1434Dec 31, 2003
    Pete Werner
    Login LDAP
    risk 0.00cvss —epss 0.01

    login_ldap 3.1 and 3.2 allows remote attackers to initiate unauthenticated bind requests if (1) bind_anon_dn is on, which allows a bind with no password provided, (2) bind_anon_cred is on, which allows a bind with no DN, or (3) bind_anon is on, which allows a bind with no DN or…

  • CVE-2003-1435Dec 31, 2003
    PHP-Nuke
    PHP Nuke
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in PHP-Nuke 5.6 and 6.0 allows remote attackers to execute arbitrary SQL commands via the days parameter to the search module.

  • CVE-2003-1436Dec 31, 2003
    Crossnuke
    Nukebrowser
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in nukebrowser.php in Nukebrowser 2.1 to 2.5 allows remote attackers to execute arbitrary PHP code via the filhead parameter.

  • CVE-2003-1437Dec 31, 2003
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.00

    BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or trust certificate authorities, which allows local users to gain access.

  • CVE-2003-1438Dec 31, 2003
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.01

    Race condition in BEA WebLogic Server and Express 5.1 through 7.0.0.1, when using in-memory session replication or replicated stateful session beans, causes the same buffer to be provided to two users, which could allow one user to see session data that was intended for another…

  • CVE-2003-1439Dec 31, 2003
    Silc
    Secure Internet Live Conferencing
    risk 0.00cvss —epss 0.01

    Secure Internet Live Conferencing (SILC) 0.9.11 and 0.9.12 stores passwords and sessions in plaintext in memory, which could allow local users to obtain sensitive information.

  • CVE-2003-1440Dec 31, 2003
    Burton Computer Corporation
    Spamprobe
    risk 0.00cvss —epss 0.01

    SpamProbe 0.8a allows remote attackers to cause a denial of service (crash) via HTML e-mail with newline characters within an href tag, which is not properly handled by certain regular expressions.

  • CVE-2003-1441Dec 31, 2003
    Posadis
    Posadis
    risk 0.00cvss —epss 0.01

    Posadis 0.50.4 through 0.50.8 allows remote attackers to cause a denial of service (crash) via a DNS message without a question section, which triggers null dereference.

  • CVE-2003-1442Dec 31, 2003
    Ericsson
    Hm220dp Adsl Modem
    risk 0.03cvss —epss 0.03

    The web administration page for the Ericsson HM220dp ADSL modem does not require authentication, which could allow remote attackers to gain access from the LAN side.

  • CVE-2003-1443Dec 31, 2003
    Kaspersky Lab
    Antivirus (KAV)
    risk 0.00cvss —epss 0.00

    Kaspersky Antivirus (KAV) 4.0.9.0 does not detect viruses in files with MS-DOS device names in their filenames, which allows local users to bypass virus protection, as demonstrated using aux.vbs and aux.com.

  • CVE-2003-1444Dec 31, 2003
    Kaspersky Lab
    Antivirus (KAV)
    risk 0.00cvss —epss 0.00

    Kaspersky Antivirus (KAV) 4.0.9.0 allows local users to cause a denial of service (CPU consumption or crash) and prevent malicious code from being detected via a file with a long pathname.

  • CVE-2003-1445Dec 31, 2003
    Rarlab
    Far Manager
    risk 0.03cvss —epss 0.01

    Stack-based buffer overflow in Far Manager 1.70beta1 and earlier allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long pathname.

  • CVE-2003-1446Dec 31, 2003
    Rogue
    Rogue
    risk 0.00cvss —epss 0.01

    Buffer overflow in the save_into_file function in save.c for Rogue 5.2-2 allows local users to execute arbitrary code with games group privileges by setting a long HOME environment variable and invoking the save game function with a ~ (tilde).

  • CVE-2003-1447Dec 31, 2003
    IBM
    WebSphere Advanced Server Edition
    risk 0.00cvss —epss 0.00

    IBM WebSphere Advanced Server Edition 4.0.4 uses a weak encryption algorithm (XOR and base64 encoding), which allows local users to decrypt passwords when the configuration file is exported to XML.

  • CVE-2003-1448Dec 31, 2003
    Microsoft
    Windows 2000
    risk 0.01cvss —epss 0.15

    Memory leak in the Windows 2000 kernel allows remote attackers to cause a denial of service (SMB request hang) via a NetBIOS continuation packet.

  • CVE-2003-1449Dec 31, 2003
    Aladdin Knowledge Systems
    Esafe Gateway
    risk 0.00cvss —epss 0.01

    Aladdin Knowlege Systems eSafe Gateway 3.5.126.0 does not check the entire stream of Content Vectoring Protocol (CVP) data, which allows remote attackers to bypass virus protection.

  • CVE-2003-1450Dec 31, 2003
    Bitchx
    Bitchx
    risk 0.03cvss —epss 0.04

    BitchX 75p3 and 1.0c16 through 1.0c20cvs allows remote attackers to cause a denial of service (segmentation fault) via a malformed RPL_NAMREPLY numeric 353 message.

  • CVE-2003-1451Dec 31, 2003
    Symantec
    Norton Antivirus
    risk 0.00cvss —epss 0.03

    Buffer overflow in Symantec Norton AntiVirus 2002 allows remote attackers to execute arbitrary code via an e-mail attachment with a compressed ZIP file that contains a file with a long filename.

  • CVE-2003-1452Dec 31, 2003
    Qualcomm
    Qpopper
    risk 0.03cvss —epss 0.01

    Untrusted search path vulnerability in Qualcomm qpopper 4.0 through 4.05 allows local users to execute arbitrary code by modifying the PATH environment variable to reference a malicious smbpasswd program.

  • CVE-2003-1453Dec 31, 2003
    XOOPS
    Xoops
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the MytextSanitizer function in XOOPS 1.3.5 through 1.3.9 and XOOPS 2.0 through 2.0.1 allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in an IMG tag.

  • CVE-2003-1454Dec 31, 2003
    Invision Power Services
    Power Board
    risk 0.00cvss —epss 0.01

    Invision Power Services Invision Board 1.0 through 1.1.1, when a forum is password protected, stores the administrator password in a cookie in plaintext, which could allow remote attackers to gain access.

  • CVE-2003-1455Dec 31, 2003
    Poptop
    PoPToP
    risk 0.00cvss —epss 0.00

    Multiple buffer overflows in the launch_bcrelay function in pptpctrl.c in PoPToP 1.1.4-b1 through PoPToP 1.1.4-b3 allow local users to execute arbitrary code.

  • CVE-2003-1456Dec 31, 2003
    Mike Bobbitt
    Album.pl
    risk 0.03cvss —epss 0.03

    Album.pl 6.1 allows remote attackers to execute arbitrary commands, when an alternative configuration file is used, via unknown attack vectors.

  • CVE-2003-1457Dec 31, 2003
    Auerswald
    Comsuite Cti Controlcenter
    risk 0.00cvss —epss 0.01

    Auerswald COMsuite CTI ControlCenter 3.1 creates a default "runasositron" user account with an easily guessable password, which allows local users or remote attackers to gain access.

  • CVE-2003-1458Dec 31, 2003
    Ttcms
    Ttforum
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Profile.php in ttCMS 2.2 and ttForum allows remote attackers to execute arbitrary SQL commands via the member name.

  • CVE-2003-1459Dec 31, 2003
    Ttcms
    Ttforum
    risk 0.04cvss —epss 0.07

    Multiple PHP remote file inclusion vulnerabilities in ttCMS 2.2 and ttForum allow remote attackers to execute arbitrary PHP code via the (1) template parameter in News.php or (2) installdir parameter in install.php.

  • CVE-2003-1460Dec 31, 2003
    Ralf Hoffmann
    Worker Filemanager
    risk 0.00cvss —epss 0.00

    Worker Filemanager 1.0 through 2.7 sets the permissions on the destination directory to world-readable and executable while copying data, which could allow local users to obtain sensitive information.