CVEs

343,267 total · page 6715 of 6,866

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2003-1511	Bajie Java HTTP Server	0.03	—	0.04	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in Bajie Java HTTP Server 0.95 through 0.95zxv4 allows remote attackers to inject arbitrary web script or HTML via (1) the query string to test.txt, (2) the guestName parameter to the custMsg servlet, or (3) the cookiename parameter to…
CVE-2003-1512	Khaled Mardam Bey Mirc	0.03	—	0.02	Dec 31, 2003	Buffer overflow in mIRC 6.1 and 6.11 allows remote attackers to cause a denial of service (crash) via a long DCC SEND request.
CVE-2003-1513	Caucho Technology Resin	0.03	—	0.01	Dec 31, 2003	Multiple cross-site scripting (XSS) vulnerabilities in example scripts in Caucho Technology Resin 2.0 through 2.1.2 allow remote attackers to inject arbitrary web script or HTML via (1) env.jsp, (2) form.jsp, (3) session.jsp, (4) the move parameter to tictactoe.jsp, or the (5)…
CVE-2003-1514	Emule Emule	0.00	—	0.02	Dec 31, 2003	eMule 0.29c allows remote attackers to cause a denial of service (crash) via a long password, possibly due to a buffer overflow.
CVE-2003-1515	Origo ASR-8100 ADSL Router	0.00	—	0.02	Dec 31, 2003	Origo ASR-8100 ADSL Router 3.21 has an administration service running on port 254 that does not require a password, which allows remote attackers to cause a denial of service by restoring the factory defaults.
CVE-2003-1516	Apache Xalan Java	0.03	—	0.04	Dec 31, 2003	The org.apache.xalan.processor.XSLProcessorVersion class in Java Plug-in 1.4.2_01 allows signed and unsigned applets to share variables, which violates the Java security model and could allow remote attackers to read or write data belonging to a signed applet.
CVE-2003-1517	Dansie Shopping Cart	0.03	—	0.02	Dec 31, 2003	cart.pl in Dansie shopping cart allows remote attackers to obtain the installation path via an invalid db parameter, which leaks the path in an error message.
CVE-2003-1518	Adiscon Winsyslog	0.04	—	0.07	Dec 31, 2003	Adiscon WinSyslog 4.21 SP1 allows remote attackers to cause a denial of service (CPU consumption) via a long syslog message.
CVE-2003-1519	Vivisimo Clustering Engine	0.03	—	0.01	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in Vivisimo clustering engine allows remote attackers to inject arbitrary web script or HTML via the query parameter to the search program.
CVE-2003-1520	Fuzzymonkey Myclassifieds	0.03	—	0.01	Dec 31, 2003	SQL injection vulnerability in FuzzyMonkey My Classifieds 2.11 allows remote attackers to execute arbitrary SQL commands via the email parameter.
CVE-2003-1521	Sun Corporation Java Plugin	0.03	—	0.05	Dec 31, 2003	Sun Java Plug-In 1.4 through 1.4.2_02 allows remote attackers to repeatedly access the floppy drive via the createXmlDocument method in the org.apache.crimson.tree.XmlDocument class, which violates the Java security model.
CVE-2003-1522	Pscs Vpop3 Web Mail Server	0.03	—	0.01	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in PSCS VPOP3 Web Mail server 2.0e and 2.0f allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to the admin/index.html page.
CVE-2003-1523	Dbmail Dbmail	0.00	—	0.01	Dec 31, 2003	SQL injection vulnerability in the IMAP daemon in dbmail 1.1 allows remote attackers to execute arbitrary SQL commands via the (1) login username, (2) mailbox name, and possibly other attack vectors.
CVE-2003-1524	PGP Corporation Pgpdisk	0.00	—	0.00	Dec 31, 2003	PGPi PGPDisk 6.0.2i does not unmount a PGP partition when the switch user function in Windows XP is used, which could allow local users to access data on another user's PGP partition.
CVE-2003-1525	My Photo Gallery My Photo Gallery	0.00	—	0.01	Dec 31, 2003	Unspecified vulnerability in My Photo Gallery 3.5, and possibly earlier versions, has unknown impact and attack vectors.
CVE-2003-1526	PHP-Nuke PHP Nuke	0.00	—	0.01	Dec 31, 2003	PHP-Nuke 7.0 allows remote attackers to obtain the installation path via certain characters such as (1) ", (2) ', or (3) > in the search field, which reveals the path in an error message.
CVE-2003-1527	Iss Blackice Defender	0.00	—	0.01	Dec 31, 2003	BlackICE Defender 2.9.cap and Server Protection 3.5.cdf, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial of service via spoofed packets.
CVE-2003-1528	Fujitsu Siemens Networker	0.00	—	0.00	Dec 31, 2003	nsr_shutdown in Fujitsu Siemens NetWorker 6.0 allows local users to overwrite arbitrary files via a symlink attack on the nsrsh[PID] temporary file.
CVE-2003-1529	Seagull Software Systems J Walk Application Server	0.00	—	0.02	Dec 31, 2003	Directory traversal vulnerability in Seagull Software Systems J Walk application server 3.2C9, and other versions before 3.3c4, allows remote attackers to read arbitrary files via a ".%252e" (encoded dot dot) in the URL.
CVE-2003-1530	PhpBB phpBB	0.00	—	0.01	Dec 31, 2003	SQL injection vulnerability in privmsg.php in phpBB 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the mark[] parameter.
CVE-2003-1531	Lilikoi Ceilidh	0.00	—	0.01	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in testcgi.exe in Lilikoi Software Ceilidh 2.70 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string.
CVE-2003-1532	Julien Desaunay Phpmyshop	0.03	—	0.01	Dec 31, 2003	SQL injection vulnerability in compte.php in PhpMyShop 1.00 allows remote attackers to execute arbitrary SQL commands via the (1) identifiant and (2) password parameters.
CVE-2003-1533	Phppass Phppass	0.03	—	0.01	Dec 31, 2003	SQL injection vulnerability in accesscontrol.php in PhpPass 2 allows remote attackers to execute arbitrary SQL commands via the (1) uid and (2) pwd parameters.
CVE-2003-1534	Justice Media Guestbook	0.00	—	0.01	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in jgb.php3 in Justice Guestbook 1.3 allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) homepage, (3) aim, (4) yim, (5) location, and (6) comment variables.
CVE-2003-1535	Justice Media Guestbook	0.03	—	0.02	Dec 31, 2003	Justice Guestbook 1.3 allows remote attackers to obtain the full installation path via a direct request to cfooter.php3, which leaks the path in an error message.
CVE-2003-1536	Dcp Portal Dcp Portal	0.03	—	0.02	Dec 31, 2003	Multiple cross-site scripting (XSS) vulnerabilities in Codeworx Technologies DCP-Portal 5.3.1 allow remote attackers to inject arbitrary web script or HTML via (1) the q parameter to search.php and (2) the year parameter to calendar.php.
CVE-2003-1537	Postnuke Postnuke	0.00	—	0.01	Dec 31, 2003	Directory traversal vulnerability in PostNuke 0.723 and earlier allows remote attackers to include arbitrary files named theme.php via the theme parameter to index.php.
CVE-2003-1538	SUSE S.A. Linux	0.00	—	0.03	Dec 31, 2003	susehelp in SuSE Linux 8.1, Enterprise Server 8, Office Server, and Openexchange Server 4 does not properly filter shell metacharacters, which allows remote attackers to execute arbitrary commands via CGI queries.
CVE-2003-1539	Onedotoh Simple File Manager	0.00	—	0.01	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in ONEdotOH Simple File Manager (SFM) before 0.21 allows remote attackers to inject arbitrary web script or HTML via (1) file names and (2) directory names.
CVE-2003-1540	WF-Chat Wfchat	0.03	—	0.03	Dec 31, 2003	WF-Chat 1.0 Beta stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain authentication information via a direct request to (1) !pwds.txt and (2) !nicks.txt.
CVE-2003-1541	Planetmoon Guestbook	0.03	—	0.03	Dec 31, 2003	PlanetMoon Guestbook tr3.a stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the admin script password, and other passwords, via a direct request to files/passwd.txt.
CVE-2003-1542	Ondrej Jombik Phpwebfilemanager	0.00	—	0.02	Dec 31, 2003	Directory traversal vulnerability in plugins/file.php in phpWebFileManager before 0.4.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the fm_path parameter.
CVE-2003-1543	Bajie Java HTTP Server	0.00	—	0.02	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in Bajie Http Web Server 0.95zxe, 0.95zxc, and possibly others, allows remote attackers to inject arbitrary web script or HTML via the query string, which is reflected in an error message.
CVE-2003-1544	Microsoft Windows 2000	0.01	—	0.17	Dec 31, 2003	Unrestricted critical resource lock in Terminal Services for Windows 2000 before SP4 and Windows XP allows remote authenticated users to cause a denial of service (reboot) by obtaining a read lock on msgina.dll, which prevents msgina.dll from being loaded.
CVE-2003-1545	nukestyles.com Viewpage	0.03	—	0.04	Dec 31, 2003	Absolute path traversal vulnerability in nukestyles.com viewpage.php addon for PHP-Nuke allows remote attackers to read arbitrary files via a full pathname in the file parameter. NOTE: This was originally reported as an issue in PHP-Nuke 6.5, but this is an independent addon.
CVE-2003-1546	Filebased Guestbook	0.00	—	0.01	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in gbook.php in Filebased guestbook 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the comment section.
CVE-2003-1547	Splatt Splatt Forum	0.00	—	0.01	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in block-Forums.php in the Splatt Forum module for PHP-Nuke 6.x allows remote attackers to inject arbitrary web script or HTML via the subject parameter.
CVE-2003-1548	Myabracadaweb Myabracadaweb	0.04	—	0.07	Dec 31, 2003	MyABraCaDaWeb 1.0.2 and earlier allows remote attackers to obtain sensitive information via an invalid IDAdmin or other parameter, which reveals the installation path in an error message.
CVE-2003-1549	Myabracadaweb Myabracadaweb	0.00	—	0.01	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in header.php in MyABraCaDaWeb 1.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the ma_kw parameter.
CVE-2003-1550	XOOPS Xoops	0.03	—	0.03	Dec 31, 2003	XOOPS 2.0, and possibly earlier versions, allows remote attackers to obtain sensitive information via an invalid xoopsOption parameter, which reveals the installation path in an error message.
CVE-2003-1551	Novell Groupwise	0.00	—	0.02	Dec 31, 2003	Unspecified vulnerability in Novell GroupWise 6 SP3 WebAccess before Revision F has unknown impact and attack vectors related to "malicious script."
CVE-2003-1552	Graeme Uploader	0.00	—	0.02	Dec 31, 2003	Unrestricted file upload vulnerability in uploader.php in Uploader 1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/.
CVE-2003-1553	Sips Sips	0.03	—	0.02	Dec 31, 2003	Haakon Nilsen Simple Internet Publishing System (SIPS) 0.2.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain password and other user information via a direct request to a user-specific configuration…
CVE-2003-1554	Scoznet Scozbook	0.00	—	0.01	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in scozbook/add.php in ScozNet ScozBook 1.1 BETA allows remote attackers to inject arbitrary web script or HTML via the (1) username, (2) useremail, (3) aim, (4) msn, (5) sitename and (6) siteaddy variables.
CVE-2003-1555	Scoznet Scozbook	0.03	—	0.03	Dec 31, 2003	ScozNet ScozBook 1.1 BETA allows remote attackers to obtain sensitive information via an invalid PG parameter in view.php, which reveals the installation path in an error message.
CVE-2003-1556	Cgi City Cc Guestbook	0.00	—	0.02	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in cc_guestbook.pl in CGI City CC GuestBook allows remote attackers to inject arbitrary web script or HTML via the (1) name and (2) homepage_title (webpage title) parameters.
CVE-2003-1557	Spamassassin Spamassassin	0.00	—	0.05	Dec 31, 2003	Off-by-one buffer overflow in spamc of SpamAssassin 2.40 through 2.43, when using BSMTP mode ("-B"), allows remote attackers to execute arbitrary code via email containing headers with leading "." characters.
CVE-2003-1558	Fefe Fnord	0.00	—	0.03	Dec 31, 2003	Buffer overflow in httpd.c of fnord 1.6 allows remote attackers to create a denial of service (crash) and possibly execute arbitrary code via a long CGI request passed to the do_cgi function.
CVE-2003-1559	Microsoft Internet Explorer	0.01	—	0.16	Dec 31, 2003	Microsoft Internet Explorer 5.22, and other 5 through 6 SP1 versions, sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
CVE-2003-1560	Netscape Netscape	0.00	—	0.01	Dec 31, 2003	Netscape 4 sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.

CVE-2003-1511Dec 31, 2003
Bajie
Java HTTP Server
risk 0.03cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in Bajie Java HTTP Server 0.95 through 0.95zxv4 allows remote attackers to inject arbitrary web script or HTML via (1) the query string to test.txt, (2) the guestName parameter to the custMsg servlet, or (3) the cookiename parameter to…
CVE-2003-1512Dec 31, 2003
Khaled Mardam Bey
Mirc
risk 0.03cvss —epss 0.02
Buffer overflow in mIRC 6.1 and 6.11 allows remote attackers to cause a denial of service (crash) via a long DCC SEND request.
CVE-2003-1513Dec 31, 2003
Caucho Technology
Resin
risk 0.03cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in example scripts in Caucho Technology Resin 2.0 through 2.1.2 allow remote attackers to inject arbitrary web script or HTML via (1) env.jsp, (2) form.jsp, (3) session.jsp, (4) the move parameter to tictactoe.jsp, or the (5)…
CVE-2003-1514Dec 31, 2003
Emule
Emule
risk 0.00cvss —epss 0.02
eMule 0.29c allows remote attackers to cause a denial of service (crash) via a long password, possibly due to a buffer overflow.
CVE-2003-1515Dec 31, 2003
Origo
ASR-8100 ADSL Router
risk 0.00cvss —epss 0.02
Origo ASR-8100 ADSL Router 3.21 has an administration service running on port 254 that does not require a password, which allows remote attackers to cause a denial of service by restoring the factory defaults.
CVE-2003-1516Dec 31, 2003
Apache
Xalan Java
risk 0.03cvss —epss 0.04
The org.apache.xalan.processor.XSLProcessorVersion class in Java Plug-in 1.4.2_01 allows signed and unsigned applets to share variables, which violates the Java security model and could allow remote attackers to read or write data belonging to a signed applet.
CVE-2003-1517Dec 31, 2003
Dansie
Shopping Cart
risk 0.03cvss —epss 0.02
cart.pl in Dansie shopping cart allows remote attackers to obtain the installation path via an invalid db parameter, which leaks the path in an error message.
CVE-2003-1518Dec 31, 2003
Adiscon
Winsyslog
risk 0.04cvss —epss 0.07
Adiscon WinSyslog 4.21 SP1 allows remote attackers to cause a denial of service (CPU consumption) via a long syslog message.
CVE-2003-1519Dec 31, 2003
Vivisimo
Clustering Engine
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Vivisimo clustering engine allows remote attackers to inject arbitrary web script or HTML via the query parameter to the search program.
CVE-2003-1520Dec 31, 2003
Fuzzymonkey
Myclassifieds
risk 0.03cvss —epss 0.01
SQL injection vulnerability in FuzzyMonkey My Classifieds 2.11 allows remote attackers to execute arbitrary SQL commands via the email parameter.
CVE-2003-1521Dec 31, 2003
Sun Corporation
Java Plugin
risk 0.03cvss —epss 0.05
Sun Java Plug-In 1.4 through 1.4.2_02 allows remote attackers to repeatedly access the floppy drive via the createXmlDocument method in the org.apache.crimson.tree.XmlDocument class, which violates the Java security model.
CVE-2003-1522Dec 31, 2003
Pscs
Vpop3 Web Mail Server
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in PSCS VPOP3 Web Mail server 2.0e and 2.0f allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to the admin/index.html page.
CVE-2003-1523Dec 31, 2003
Dbmail
Dbmail
risk 0.00cvss —epss 0.01
SQL injection vulnerability in the IMAP daemon in dbmail 1.1 allows remote attackers to execute arbitrary SQL commands via the (1) login username, (2) mailbox name, and possibly other attack vectors.
CVE-2003-1524Dec 31, 2003
PGP Corporation
Pgpdisk
risk 0.00cvss —epss 0.00
PGPi PGPDisk 6.0.2i does not unmount a PGP partition when the switch user function in Windows XP is used, which could allow local users to access data on another user's PGP partition.
CVE-2003-1525Dec 31, 2003
My Photo Gallery
My Photo Gallery
risk 0.00cvss —epss 0.01
Unspecified vulnerability in My Photo Gallery 3.5, and possibly earlier versions, has unknown impact and attack vectors.
CVE-2003-1526Dec 31, 2003
PHP-Nuke
PHP Nuke
risk 0.00cvss —epss 0.01
PHP-Nuke 7.0 allows remote attackers to obtain the installation path via certain characters such as (1) ", (2) ', or (3) > in the search field, which reveals the path in an error message.
CVE-2003-1527Dec 31, 2003
Iss
Blackice Defender
risk 0.00cvss —epss 0.01
BlackICE Defender 2.9.cap and Server Protection 3.5.cdf, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial of service via spoofed packets.
CVE-2003-1528Dec 31, 2003
Fujitsu
Siemens Networker
risk 0.00cvss —epss 0.00
nsr_shutdown in Fujitsu Siemens NetWorker 6.0 allows local users to overwrite arbitrary files via a symlink attack on the nsrsh[PID] temporary file.
CVE-2003-1529Dec 31, 2003
Seagull Software Systems
J Walk Application Server
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in Seagull Software Systems J Walk application server 3.2C9, and other versions before 3.3c4, allows remote attackers to read arbitrary files via a ".%252e" (encoded dot dot) in the URL.
CVE-2003-1530Dec 31, 2003
PhpBB
phpBB
risk 0.00cvss —epss 0.01
SQL injection vulnerability in privmsg.php in phpBB 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the mark[] parameter.
CVE-2003-1531Dec 31, 2003
Lilikoi
Ceilidh
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in testcgi.exe in Lilikoi Software Ceilidh 2.70 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string.
CVE-2003-1532Dec 31, 2003
Julien Desaunay
Phpmyshop
risk 0.03cvss —epss 0.01
SQL injection vulnerability in compte.php in PhpMyShop 1.00 allows remote attackers to execute arbitrary SQL commands via the (1) identifiant and (2) password parameters.
CVE-2003-1533Dec 31, 2003
Phppass
Phppass
risk 0.03cvss —epss 0.01
SQL injection vulnerability in accesscontrol.php in PhpPass 2 allows remote attackers to execute arbitrary SQL commands via the (1) uid and (2) pwd parameters.
CVE-2003-1534Dec 31, 2003
Justice Media
Guestbook
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in jgb.php3 in Justice Guestbook 1.3 allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) homepage, (3) aim, (4) yim, (5) location, and (6) comment variables.
CVE-2003-1535Dec 31, 2003
Justice Media
Guestbook
risk 0.03cvss —epss 0.02
Justice Guestbook 1.3 allows remote attackers to obtain the full installation path via a direct request to cfooter.php3, which leaks the path in an error message.
CVE-2003-1536Dec 31, 2003
Dcp Portal
Dcp Portal
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Codeworx Technologies DCP-Portal 5.3.1 allow remote attackers to inject arbitrary web script or HTML via (1) the q parameter to search.php and (2) the year parameter to calendar.php.
CVE-2003-1537Dec 31, 2003
Postnuke
Postnuke
risk 0.00cvss —epss 0.01
Directory traversal vulnerability in PostNuke 0.723 and earlier allows remote attackers to include arbitrary files named theme.php via the theme parameter to index.php.
CVE-2003-1538Dec 31, 2003
SUSE S.A.
Linux
risk 0.00cvss —epss 0.03
susehelp in SuSE Linux 8.1, Enterprise Server 8, Office Server, and Openexchange Server 4 does not properly filter shell metacharacters, which allows remote attackers to execute arbitrary commands via CGI queries.
CVE-2003-1539Dec 31, 2003
Onedotoh
Simple File Manager
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in ONEdotOH Simple File Manager (SFM) before 0.21 allows remote attackers to inject arbitrary web script or HTML via (1) file names and (2) directory names.
CVE-2003-1540Dec 31, 2003
WF-Chat
Wfchat
risk 0.03cvss —epss 0.03
WF-Chat 1.0 Beta stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain authentication information via a direct request to (1) !pwds.txt and (2) !nicks.txt.
CVE-2003-1541Dec 31, 2003
Planetmoon
Guestbook
risk 0.03cvss —epss 0.03
PlanetMoon Guestbook tr3.a stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the admin script password, and other passwords, via a direct request to files/passwd.txt.
CVE-2003-1542Dec 31, 2003
Ondrej Jombik
Phpwebfilemanager
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in plugins/file.php in phpWebFileManager before 0.4.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the fm_path parameter.
CVE-2003-1543Dec 31, 2003
Bajie
Java HTTP Server
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Bajie Http Web Server 0.95zxe, 0.95zxc, and possibly others, allows remote attackers to inject arbitrary web script or HTML via the query string, which is reflected in an error message.
CVE-2003-1544Dec 31, 2003
Microsoft
Windows 2000
risk 0.01cvss —epss 0.17
Unrestricted critical resource lock in Terminal Services for Windows 2000 before SP4 and Windows XP allows remote authenticated users to cause a denial of service (reboot) by obtaining a read lock on msgina.dll, which prevents msgina.dll from being loaded.
CVE-2003-1545Dec 31, 2003
nukestyles.com
Viewpage
risk 0.03cvss —epss 0.04
Absolute path traversal vulnerability in nukestyles.com viewpage.php addon for PHP-Nuke allows remote attackers to read arbitrary files via a full pathname in the file parameter. NOTE: This was originally reported as an issue in PHP-Nuke 6.5, but this is an independent addon.
CVE-2003-1546Dec 31, 2003
Filebased
Guestbook
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in gbook.php in Filebased guestbook 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the comment section.
CVE-2003-1547Dec 31, 2003
Splatt
Splatt Forum
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in block-Forums.php in the Splatt Forum module for PHP-Nuke 6.x allows remote attackers to inject arbitrary web script or HTML via the subject parameter.
CVE-2003-1548Dec 31, 2003
Myabracadaweb
Myabracadaweb
risk 0.04cvss —epss 0.07
MyABraCaDaWeb 1.0.2 and earlier allows remote attackers to obtain sensitive information via an invalid IDAdmin or other parameter, which reveals the installation path in an error message.
CVE-2003-1549Dec 31, 2003
Myabracadaweb
Myabracadaweb
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in header.php in MyABraCaDaWeb 1.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the ma_kw parameter.
CVE-2003-1550Dec 31, 2003
XOOPS
Xoops
risk 0.03cvss —epss 0.03
XOOPS 2.0, and possibly earlier versions, allows remote attackers to obtain sensitive information via an invalid xoopsOption parameter, which reveals the installation path in an error message.
CVE-2003-1551Dec 31, 2003
Novell
Groupwise
risk 0.00cvss —epss 0.02
Unspecified vulnerability in Novell GroupWise 6 SP3 WebAccess before Revision F has unknown impact and attack vectors related to "malicious script."
CVE-2003-1552Dec 31, 2003
Graeme
Uploader
risk 0.00cvss —epss 0.02
Unrestricted file upload vulnerability in uploader.php in Uploader 1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/.
CVE-2003-1553Dec 31, 2003
Sips
Sips
risk 0.03cvss —epss 0.02
Haakon Nilsen Simple Internet Publishing System (SIPS) 0.2.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain password and other user information via a direct request to a user-specific configuration…
CVE-2003-1554Dec 31, 2003
Scoznet
Scozbook
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in scozbook/add.php in ScozNet ScozBook 1.1 BETA allows remote attackers to inject arbitrary web script or HTML via the (1) username, (2) useremail, (3) aim, (4) msn, (5) sitename and (6) siteaddy variables.
CVE-2003-1555Dec 31, 2003
Scoznet
Scozbook
risk 0.03cvss —epss 0.03
ScozNet ScozBook 1.1 BETA allows remote attackers to obtain sensitive information via an invalid PG parameter in view.php, which reveals the installation path in an error message.
CVE-2003-1556Dec 31, 2003
Cgi City
Cc Guestbook
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in cc_guestbook.pl in CGI City CC GuestBook allows remote attackers to inject arbitrary web script or HTML via the (1) name and (2) homepage_title (webpage title) parameters.
CVE-2003-1557Dec 31, 2003
Spamassassin
Spamassassin
risk 0.00cvss —epss 0.05
Off-by-one buffer overflow in spamc of SpamAssassin 2.40 through 2.43, when using BSMTP mode ("-B"), allows remote attackers to execute arbitrary code via email containing headers with leading "." characters.
CVE-2003-1558Dec 31, 2003
Fefe
Fnord
risk 0.00cvss —epss 0.03
Buffer overflow in httpd.c of fnord 1.6 allows remote attackers to create a denial of service (crash) and possibly execute arbitrary code via a long CGI request passed to the do_cgi function.
CVE-2003-1559Dec 31, 2003
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.16
Microsoft Internet Explorer 5.22, and other 5 through 6 SP1 versions, sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
CVE-2003-1560Dec 31, 2003
Netscape
Netscape
risk 0.00cvss —epss 0.01
Netscape 4 sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.