VYPR

CVEs

343,267 total · page 6719 of 6,866

AllCriticalHighKEV
  • CVE-2003-0899CriNov 3, 2003
    Acme
    Thttpd
    risk 0.68cvss 9.8epss 0.22

    Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '<' or '>' characters, which trigger the overflow when the characters are expanded to "<" and ">" sequences.

  • CVE-2003-0901Nov 3, 2003
    PostgreSQL
    PostgreSQL
    risk 0.00cvss —epss 0.05

    Buffer overflow in to_ascii for PostgreSQL 7.2.x, and 7.3.x before 7.3.4, allows remote attackers to execute arbitrary code.

  • CVE-2003-1142Nov 3, 2003
    Network Instruments
    Niprint Lpd Lpr Print Server
    risk 0.03cvss —epss 0.06

    Help in NIPrint LPD-LPR Print Server 4.10 and earlier executes Windows Explorer with SYSTEM privileges, which allows local users to gain privileges.

  • CVE-2003-1145Nov 3, 2003
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in friendmail.php in OpenAutoClassifieds 1.0 allows remote attackers to inject arbitrary web script or HTML via the listing parameter.

  • CVE-2003-1182Nov 3, 2003
    Mpm
    Mpm Guestbook
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in MPM Guestbook 1.2 allows remote attackers to inject arbitrary web script or HTML via the lng parameter.

  • CVE-2003-1184Nov 3, 2003
    Thwboard
    Thwboard
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ThWboard Beta 2.8 and 2.81 allow remote attackers to inject arbitrary web script or HTML via (1) time in board.php, (2) the profile Homepage-Feld, (3) pictures, and (4) other "Diverse XSS Bugs."

  • CVE-2003-1185Nov 3, 2003
    Thwboard
    Thwboard
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ThWboard before Beta 2.8.2 allow remote attackers to inject arbitrary SQL commands via various vectors including (1) Admin-Center, (2) Announcements, (3) admin/calendar.php, and (4) showevent.php.

  • CVE-2003-1190Nov 3, 2003
    Phprecipebook
    Phprecipebook
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in PHPRecipeBook 1.24 through 2.17 allows remote attackers to inject arbitrary web script or HTML via a recipe.

  • CVE-2003-1192Nov 3, 2003
    True North
    Ia Webmail Server
    risk 0.09cvss —epss 0.69

    Stack-based buffer overflow in IA WebMail Server 3.1.0 allows remote attackers to execute arbitrary code via a long GET request.

  • CVE-2003-1193Nov 3, 2003
    Oracle Corporation
    Oracle9i
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the Portal DB (1) List of Values (LOVs), (2) Forms, (3) Hierarchy, and (4) XML components packages in Oracle Oracle9i Application Server 9.0.2.00 through 3.0.9.8.5 allow remote attackers to execute arbitrary SQL commands via the URL.

  • CVE-2003-1196Nov 3, 2003
    Vienuke
    Vieboard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in viewtopic.asp in VieBoard 2.6 allows remote attackers to execute arbitrary SQL commands via the forumid parameter.

  • CVE-2003-1187Nov 2, 2003
    Phpkit
    Phpkit
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in include.php in PHPKIT 1.6.02 and 1.6.03 allows remote attackers to inject arbitrary web script or HTML via the contact_email parameter.

  • CVE-2003-1188Nov 2, 2003
    Unichat
    Unichat
    risk 0.00cvss —epss 0.02

    Unichat allows remote attackers to cause a denial of service (crash) by adding extra chat characters (avatars) and logging in to a chat room, as demonstrated using duplicate ACTOR entries in u2res000.rit.

  • CVE-2003-1159Oct 31, 2003
    Plug And Play
    Proxy
    risk 0.00cvss —epss 0.02

    Plug and Play Web Server Proxy 1.0002c allows remote attackers to cause a denial of service (server crash) via an invalid URI in an HTTP GET request to TCP port 8080.

  • CVE-2003-1143Oct 30, 2003
    Croteam
    Serious Sam demo test 2
    risk 0.03cvss —epss 0.03

    Croteam Serious Sam demo test 2 2.1a, Serious Sam: the First Encounter 1.05, and Serious Sam: the Second Encounter 1.05 allow remote attackers to cause a denial of service (crash or freeze) via a TCP packet with an invalid first parameter.

  • CVE-2003-1160Oct 30, 2003
    FlexWATCH
    Network video server 132
    risk 0.03cvss —epss 0.05

    FlexWATCH Network video server 132 allows remote attackers to bypass authentication and gain administrative privileges via an HTTP request to aindex.htm that contains double leading slashes (//).

  • CVE-2003-1194Oct 30, 2003
    Booby
    Booby
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Booby .1 through 0.2.3 allows remote attackers to inject arbitrary web script or HTML via the error message.

  • CVE-2003-1197Oct 30, 2003
    Ledscripts.com
    LedForums
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in index.php for Ledscripts.com LedForums Beta 1 allows remote attackers to inject arbitrary web script or HTML via the (1) top_message parameter or (2) topic field of a new thread.

  • CVE-2003-1186Oct 29, 2003
    Telcondex
    Simplewebserver
    risk 0.00cvss —epss 0.04

    Buffer overflow in TelCondex SimpleWebServer 2.12.30210 Build3285 allows remote attackers to execute arbitrary code via a long HTTP Referer header.

  • CVE-2003-1189Oct 29, 2003
    Nokia
    Ipso
    risk 0.00cvss —epss 0.02

    Unknown vulnerability in Nokia IPSO 3.7, configured as IP Clusters, allows remote attackers to cause a denial of service via unknown attack vectors.

  • CVE-2003-1191Oct 29, 2003
    E107
    E107
    risk 0.04cvss —epss 0.08

    chatbox.php in e107 0.554 and 0.603 allows remote attackers to cause a denial of service (pages fail to load) via HTML in the Name field, which prevents the main.php form from being loaded.

  • CVE-2003-1151Oct 28, 2003
    Fastream
    Netfile FTP Web Server
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Fastream NETFile Server 6.0.3.588 allows remote attackers to inject arbitrary web script or HTML via the URL, which is displayed on a "404 Not Found" error page.

  • CVE-2003-1183Oct 28, 2003
    Oracle Corporation
    Files
    risk 0.00cvss —epss 0.01

    The WebCache component in Oracle Files 9.0.3.1.0, 9.0.3.2.0, and 9.0.3.3.0 of Oracle Collaboration Suite Release 1 caches files despite the cacheability rules imposed by Oracle Files, which allows local users to gain access.

  • CVE-2003-1060Oct 27, 2003
    Sun Corporation
    Solaris
    risk 0.00cvss —epss 0.02

    The NFS Server for Solaris 7, 8, and 9 allows remote attackers to cause a denial of service (UFS panic) via certain invalid UFS requests, which triggers a null dereference.

  • CVE-2003-1137Oct 27, 2003
    Charles Steinkuehler
    Sh Httpd
    risk 0.04cvss —epss 0.07

    Charles Steinkuehler sh-httpd 0.3 and 0.4 allows remote attackers to read files or execute arbitrary CGI scripts via a GET request that contains an asterisk (*) wildcard character.

  • CVE-2003-1138Oct 27, 2003
    Apache
    HTTP Server
    risk 0.03cvss —epss 0.05

    The default configuration of Apache 2.0.40, as shipped with Red Hat Linux 9.0, allows remote attackers to list directory contents, even if auto indexing is turned off and there is a default web page configured, via a GET request containing a double slash (//).

  • CVE-2003-1139Oct 27, 2003
    Musicqueue
    Musicqueue
    risk 0.03cvss —epss 0.02

    Musicqueue 1.2.0 allows local users to overwrite arbitrary files by triggering a segmentation fault and using a symlink attack on the resulting musicqueue.crash file.

  • CVE-2003-1140Oct 27, 2003
    Musicqueue
    Musicqueue
    risk 0.03cvss —epss 0.06

    Buffer overflow in Musicqueue 1.2.0 allows local users to execute arbitrary code via a long language variable in the configuration file.

  • CVE-2003-1149Oct 27, 2003
    Symantec
    Norton Internet Security
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Symantec Norton Internet Security 2003 6.0.4.34 allows remote attackers to inject arbitrary web script or HTML via a URL to a blocked site, which is displayed on the blocked sites error page.

  • CVE-2003-1150Oct 27, 2003
    Novell
    Netware
    risk 0.00cvss —epss 0.04

    Buffer overflow in the portmapper service (PMAP.NLM) in Novell NetWare 6 SP3 and ZenWorks for Desktops 3.2 SP2 through 4.0.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via unknown attack vectors.

  • CVE-2003-1148Oct 25, 2003
    J Pierre Dezelus
    Les Visiteurs
    risk 0.04cvss —epss 0.09

    Multiple PHP remote file inclusion vulnerabilities in J-Pierre DEZELUS Les Visiteurs 2.0.1, as used in phpMyConferences (phpMyConference) 8.0.2 and possibly other products, allow remote attackers to execute arbitrary PHP code via a URL in the lvc_include_dir parameter to (1)…

  • CVE-2003-1181Oct 25, 2003
    Advanced Poll
    Advanced Poll
    risk 0.04cvss —epss 0.08

    Advanced Poll 2.0.2 allows remote attackers to obtain sensitive information via an HTTP request to info.php, which invokes the phpinfo() function.

  • CVE-2003-1136Oct 23, 2003
    Chi Kien Uong
    Chi Kien Uong Guestbook
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in Chi Kien Uong Guestbook 1.51 allows remote attackers to inject arbitrary web script or HTML via (1) HTML in a posted message or (2) Javascript in an onmouseover attribute in an e-mail address or URL.

  • CVE-2003-0347Oct 20, 2003
    Microsoft
    Visual Basic
    risk 0.08cvss —epss 0.68

    Heap-based buffer overflow in VBE.DLL and VBE6.DLL of Microsoft Visual Basic for Applications (VBA) SDK 5.0 through 6.3 allows remote attackers to execute arbitrary code via a document with a long ID parameter.

  • CVE-2003-0630Oct 20, 2003
    Atari800
    Atari800
    risk 0.00cvss —epss 0.00

    Multiple buffer overflows in the atari800.svgalib setuid program of the Atari 800 emulator (atari800) before 1.2.2 allow local users to gain privileges via long command line arguments, as demonstrated with the -osa_rom argument.

  • CVE-2003-0658Oct 20, 2003
    Caldera
    Openlinux
    risk 0.00cvss —epss 0.02

    Docview before 1.1-18 in Caldera OpenLinux 3.1.1, SCO Linux 4.0, OpenServer 5.0.7, configures the Apache web server in a way that allows remote attackers to read arbitrary publicly readable files via a certain URL, possibly related to rewrite rules.

  • CVE-2003-0661Oct 20, 2003
    Microsoft
    Windows Nt
    risk 0.02cvss —epss 0.22

    The NetBT Name Service (NBNS) for NetBIOS in Windows NT 4.0, 2000, XP, and Server 2003 may include random memory in a response to a NBNS query, which could allow remote attackers to obtain sensitive information.

  • CVE-2003-0664Oct 20, 2003
    Microsoft
    Word
    risk 0.00cvss —epss 0.04

    Microsoft Word 2002, 2000, 97, and 98(J) does not properly check certain properties of a document, which allows attackers to bypass the macro security model and automatically execute arbitrary macros via a malicious document.

  • CVE-2003-0665Oct 20, 2003
    Microsoft
    Access
    risk 0.05cvss —epss 0.28

    Buffer overflow in the ActiveX control for Microsoft Access Snapshot Viewer for Access 97, 2000, and 2002 allows remote attackers to execute arbitrary code via long parameters to the control.

  • CVE-2003-0666Oct 20, 2003
    Microsoft
    Wordperfect Converter
    risk 0.05cvss —epss 0.21

    Buffer overflow in Microsoft Wordperfect Converter allows remote attackers to execute arbitrary code via modified data offset and data size parameters in a Corel WordPerfect file.

  • CVE-2003-0686Oct 20, 2003
    Dave Airlie
    Pam SMB
    risk 0.05cvss —epss 0.25

    Buffer overflow in PAM SMB module (pam_smb) 1.1.6 and earlier, when authenticating to a remote service, allows remote attackers to execute arbitrary code.

  • CVE-2003-0688Oct 20, 2003
    Sendmail, Inc.
    Sendmail
    risk 0.00cvss —epss 0.03

    The DNS map code in Sendmail 8.12.8 and earlier, when using the "enhdnsbl" feature, does not properly initialize certain data structures, which allows remote attackers to cause a denial of service (process crash) via an invalid DNS response that causes Sendmail to free incorrect…

  • CVE-2003-0689Oct 20, 2003
    GNU
    Glibc
    risk 0.00cvss —epss 0.02

    The getgrouplist function in GNU libc (glibc) 2.2.4 and earlier allows attackers to cause a denial of service (segmentation fault) and execute arbitrary code when a user is a member of a large number of groups, which can cause a buffer overflow.

  • CVE-2003-0702Oct 20, 2003
    Iss
    Server Sensor
    risk 0.00cvss —epss 0.03

    Unknown vulnerability in an ISAPI plugin for ISS Server Sensor 7.0 XPU 20.16, 20.18, and possibly other versions before 20.19, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code in Internet Information Server (IIS) via a certain URL…

  • CVE-2003-0707Oct 20, 2003
    LinuxNode
    node
    risk 0.00cvss —epss 0.02

    Buffer overflow in LinuxNode (node) before 0.3.2 allows remote attackers to execute arbitrary code.

  • CVE-2003-0708Oct 20, 2003
    LinuxNode
    node
    risk 0.00cvss —epss 0.02

    Format string vulnerability in LinuxNode (node) before 0.3.2 may allow attackers to cause a denial of service or execute arbitrary code.

  • CVE-2003-0709Oct 20, 2003
    Whois
    Whois
    risk 0.00cvss —epss 0.03

    Buffer overflow in the whois client, which is not setuid but is sometimes called from within CGI programs, may allow remote attackers to execute arbitrary code via a long command line option.

  • CVE-2003-0723Oct 20, 2003
    Gkrellm
    Gkrellm
    risk 0.03cvss —epss 0.04

    Buffer overflow in gkrellmd for gkrellm 2.1.x before 2.1.14 may allow remote attackers to execute arbitrary code.

  • CVE-2003-0724Oct 20, 2003
    Compaq
    Tru64
    risk 0.00cvss —epss 0.01

    ssh on HP Tru64 UNIX 5.1B and 5.1A does not properly handle RSA signatures when digital certificates and RSA keys are used, which could allow local and remote attackers to gain privileges.

  • CVE-2003-0725Oct 20, 2003
    RealNetworks
    Realserver
    risk 0.07cvss —epss 0.51

    Buffer overflow in the RTSP protocol parser for the View Source plug-in (vsrcplin.so or vsrcplin3260.dll) for RealNetworks Helix Universal Server 9 and RealSystem Server 8, 7 and RealServer G2 allows remote attackers to execute arbitrary code.