CVEs

378,138 total · page 7413 of 7,563

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2003-1539	Onedotoh Simple File Manager		0.00	—	0.01	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in ONEdotOH Simple File Manager (SFM) before 0.21 allows remote attackers to inject arbitrary web script or HTML via (1) file names and (2) directory names.
CVE-2003-1540	WF-Chat Wfchat		0.03	—	0.03	Dec 31, 2003	WF-Chat 1.0 Beta stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain authentication information via a direct request to (1) !pwds.txt and (2) !nicks.txt.
CVE-2003-1541	Planetmoon Guestbook		0.03	—	0.03	Dec 31, 2003	PlanetMoon Guestbook tr3.a stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the admin script password, and other passwords, via a direct request to files/passwd.txt.
CVE-2003-1542	Ondrej Jombik Phpwebfilemanager		0.00	—	0.02	Dec 31, 2003	Directory traversal vulnerability in plugins/file.php in phpWebFileManager before 0.4.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the fm_path parameter.
CVE-2003-1543	Bajie Java HTTP Server		0.00	—	0.02	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in Bajie Http Web Server 0.95zxe, 0.95zxc, and possibly others, allows remote attackers to inject arbitrary web script or HTML via the query string, which is reflected in an error message.
CVE-2003-1544	Microsoft Windows 2000		0.01	—	0.17	Dec 31, 2003	Unrestricted critical resource lock in Terminal Services for Windows 2000 before SP4 and Windows XP allows remote authenticated users to cause a denial of service (reboot) by obtaining a read lock on msgina.dll, which prevents msgina.dll from being loaded.
CVE-2003-1545	nukestyles.com Viewpage		0.03	—	0.04	Dec 31, 2003	Absolute path traversal vulnerability in nukestyles.com viewpage.php addon for PHP-Nuke allows remote attackers to read arbitrary files via a full pathname in the file parameter. NOTE: This was originally reported as an issue in PHP-Nuke 6.5, but this is an independent addon.
CVE-2003-1546	Filebased Guestbook		0.00	—	0.01	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in gbook.php in Filebased guestbook 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the comment section.
CVE-2003-1547	Splatt Splatt Forum		0.00	—	0.01	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in block-Forums.php in the Splatt Forum module for PHP-Nuke 6.x allows remote attackers to inject arbitrary web script or HTML via the subject parameter.
CVE-2003-1548	Myabracadaweb Myabracadaweb		0.04	—	0.07	Dec 31, 2003	MyABraCaDaWeb 1.0.2 and earlier allows remote attackers to obtain sensitive information via an invalid IDAdmin or other parameter, which reveals the installation path in an error message.
CVE-2003-1549	Myabracadaweb Myabracadaweb		0.00	—	0.01	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in header.php in MyABraCaDaWeb 1.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the ma_kw parameter.
CVE-2003-1550	XOOPS Xoops		0.03	—	0.03	Dec 31, 2003	XOOPS 2.0, and possibly earlier versions, allows remote attackers to obtain sensitive information via an invalid xoopsOption parameter, which reveals the installation path in an error message.
CVE-2003-1551	Novell Groupwise		0.00	—	0.02	Dec 31, 2003	Unspecified vulnerability in Novell GroupWise 6 SP3 WebAccess before Revision F has unknown impact and attack vectors related to "malicious script."
CVE-2003-1552	Graeme Uploader		0.00	—	0.02	Dec 31, 2003	Unrestricted file upload vulnerability in uploader.php in Uploader 1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/.
CVE-2003-1553	Sips Sips		0.03	—	0.02	Dec 31, 2003	Haakon Nilsen Simple Internet Publishing System (SIPS) 0.2.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain password and other user information via a direct request to a user-specific configuration…
CVE-2003-1554	Scoznet Scozbook		0.00	—	0.01	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in scozbook/add.php in ScozNet ScozBook 1.1 BETA allows remote attackers to inject arbitrary web script or HTML via the (1) username, (2) useremail, (3) aim, (4) msn, (5) sitename and (6) siteaddy variables.
CVE-2003-1555	Scoznet Scozbook		0.03	—	0.03	Dec 31, 2003	ScozNet ScozBook 1.1 BETA allows remote attackers to obtain sensitive information via an invalid PG parameter in view.php, which reveals the installation path in an error message.
CVE-2003-1556	Cgi City Cc Guestbook		0.00	—	0.02	Dec 31, 2003	Cross-site scripting (XSS) vulnerability in cc_guestbook.pl in CGI City CC GuestBook allows remote attackers to inject arbitrary web script or HTML via the (1) name and (2) homepage_title (webpage title) parameters.
CVE-2003-1557	Spamassassin Spamassassin		0.00	—	0.05	Dec 31, 2003	Off-by-one buffer overflow in spamc of SpamAssassin 2.40 through 2.43, when using BSMTP mode ("-B"), allows remote attackers to execute arbitrary code via email containing headers with leading "." characters.
CVE-2003-1558	Fefe Fnord		0.00	—	0.03	Dec 31, 2003	Buffer overflow in httpd.c of fnord 1.6 allows remote attackers to create a denial of service (crash) and possibly execute arbitrary code via a long CGI request passed to the do_cgi function.
CVE-2003-1559	Microsoft Internet Explorer		0.01	—	0.16	Dec 31, 2003	Microsoft Internet Explorer 5.22, and other 5 through 6 SP1 versions, sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
CVE-2003-1560	Netscape Netscape		0.00	—	0.01	Dec 31, 2003	Netscape 4 sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
CVE-2003-1561	Opera Opera		0.00	—	0.01	Dec 31, 2003	Opera, probably before 7.50, sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
CVE-2003-1562	OpenSSL Project OpenSSL		0.00	—	0.06	Dec 31, 2003	sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to…
CVE-2003-1563	Sun Corporation Cluster		0.00	—	0.00	Dec 31, 2003	Sun Cluster 2.2 through 3.2 for Oracle Parallel Server / Real Application Clusters (OPS/RAC) allows local users to cause a denial of service (cluster node panic or abort) by launching a daemon listening on a TCP port that would otherwise be used by the Distributed Lock Manager…
CVE-2003-1564	Xmlsoft Libxml2	Med	0.42	6.5	0.02	Dec 31, 2003	libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka…
CVE-2003-1200	Alt N Mdaemon		0.08	—	0.65	Dec 29, 2003	Stack-based buffer overflow in FORM2RAW.exe in Alt-N MDaemon 6.5.2 through 6.8.5 allows remote attackers to execute arbitrary code via a long From parameter to Form2Raw.cgi.
CVE-2003-1215	PhpBB phpBB		0.00	—	0.00	Dec 29, 2003	SQL injection vulnerability in groupcp.php for phpBB 2.0.6 and earlier allows group moderators to perform unauthorized activities via the sql_in parameter.
CVE-2003-1198	Cherokee Cherokee Httpd		0.00	—	0.02	Dec 26, 2003	connection.c in Cherokee web server before 0.4.6 allows remote attackers to cause a denial of service via an HTTP POST request without a Content-Length header field.
CVE-2003-0089	Microfocus Hpux		0.03	—	0.01	Dec 15, 2003	Buffer overflow in the Software Distributor utilities for HP-UX B.11.00 and B.11.11 allows local users to execute arbitrary code via a long LANG environment variable to setuid programs such as (1) swinstall and (2) swmodify.
CVE-2003-0327	Sybase Adaptive Server Enterprise		0.00	—	0.02	Dec 15, 2003	Sybase Adaptive Server Enterprise (ASE) 12.5 allows remote attackers to cause a denial of service (hang) via a remote password array with an invalid length, which triggers a heap-based buffer overflow.
CVE-2003-0628	Oracle Corporation Peopletools		0.00	—	0.01	Dec 15, 2003	PeopleSoft Gateway Administration servlet (gateway.administration) in PeopleTools 8.43 and earlier allows remote attackers to obtain the full pathnames for server-side include (SSI) files via an HTTP request with an invalid value.
CVE-2003-0629	Oracle Corporation Peopletools		0.00	—	0.01	Dec 15, 2003	Cross-site scripting (XSS) vulnerability in PeopleSoft IScript environment for PeopleTools 8.43 and earlier allows remote attackers to insert arbitrary web script via a certain HTTP request to IScript.
CVE-2003-0795	GNU Zebra		0.04	—	0.08	Dec 15, 2003	The vty layer in Quagga before 0.96.4, and Zebra 0.93b and earlier, does not verify that sub-negotiation is taking place when processing the SE marker, which allows remote attackers to cause a denial of service (crash) via a malformed telnet command to the telnet CLI port, which…
CVE-2003-0812	Microsoft Windows Workstation Service		0.09	—	0.81	Dec 15, 2003	Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long entries to be written to a debug log file ("NetSetup.LOG"), as demonstrated using the…
CVE-2003-0820	Microsoft Word		0.02	—	0.26	Dec 15, 2003	Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack.
CVE-2003-0821	Microsoft Excel		0.02	—	0.19	Dec 15, 2003	Microsoft Excel 97, 2000, and 2002 allows remote attackers to execute arbitrary code via a spreadsheet with a malicious XLM (Excel 4) macro that bypasses the macro security model.
CVE-2003-0822	Microsoft Frontpage Server Extensions		0.10	—	0.81	Dec 15, 2003	Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request.
CVE-2003-0824	Microsoft Frontpage Server Extensions		0.03	—	0.35	Dec 15, 2003	Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request.
CVE-2003-0856	Stephen Hemminger Iproute		0.00	—	0.00	Dec 15, 2003	iproute 2.4.7 and earlier allows local users to cause a denial of service via spoofed messages as other users to the kernel netlink interface.
CVE-2003-0858	GNU Zebra		0.00	—	0.00	Dec 15, 2003	Zebra 0.93b and earlier, and quagga before 0.95, allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.
CVE-2003-0859	GNU Glibc		0.00	—	0.00	Dec 15, 2003	The getifaddrs function in GNU libc (glibc) 2.2.4 and earlier allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.
CVE-2003-0914	Isc Bind		0.00	—	0.03	Dec 15, 2003	ISC BIND 8.3.x before 8.3.7, and 8.4.x before 8.4.3, allows remote attackers to poison the cache via a malicious name server that returns negative responses with a large TTL (time-to-live) value.
CVE-2003-0932	Omega Rpg Omega Rpg		0.00	—	0.00	Dec 15, 2003	Buffer overflow in omega-rpg 0.90 allows local users to execute arbitrary code via a long (1) command line or (2) environment variable.
CVE-2003-0936	Symantec Pcanywhere		0.00	—	0.00	Dec 15, 2003	Symantec PCAnywhere 10.x and 11, when started as a service, allows attackers to gain SYSTEM privileges via the help interface using AWHOST32.exe.
CVE-2003-0937	SCO Group Unixware		0.00	—	0.00	Dec 15, 2003	SCO UnixWare 7.1.1, 7.1.3, and Open UNIX 8.0.0 allows local users to bypass protections for the "as" address space file for a process ID (PID) by obtaining a procfs file descriptor for the file and calling execve() on a setuid or setgid program, which leaves the descriptor open…
CVE-2003-0938	SAP DB		0.00	—	0.00	Dec 15, 2003	vos24u.c in SAP database server (SAP DB) 7.4.03.27 and earlier allows local users to gain SYSTEM privileges via a malicious "NETAPI32.DLL" in the current working directory, which is found and loaded by SAP DB before the real DLL, as demonstrated using the SQLAT stored procedure.
CVE-2003-0939	SAP DB		0.00	—	0.03	Dec 15, 2003	eo420_GetStringFromVarPart in veo420.c for SAP database server (SAP DB) 7.4.03.27 and earlier may allow remote attackers to execute arbitrary code via a connect packet with a 256 byte segment to the niserver (aka serv.exe) process on TCP port 7269, which prevents the server from…
CVE-2003-0940	SAP DB		0.00	—	0.02	Dec 15, 2003	Directory traversal vulnerability in sqlfopenc for web-tools in SAP DB before 7.4.03.30 allows remote attackers to read arbitrary files via .. (dot dot) sequences in a URL.
CVE-2003-0941	SAP DB		0.00	—	0.01	Dec 15, 2003	web-tools in SAP DB before 7.4.03.30 allows remote attackers to access the Web Agent Administration pages and modify configuration via a direct request to waadmin.wa.

CVE-2003-1539Dec 31, 2003
Onedotoh
Simple File Manager
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in ONEdotOH Simple File Manager (SFM) before 0.21 allows remote attackers to inject arbitrary web script or HTML via (1) file names and (2) directory names.
CVE-2003-1540Dec 31, 2003
WF-Chat
Wfchat
risk 0.03cvss —epss 0.03
WF-Chat 1.0 Beta stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain authentication information via a direct request to (1) !pwds.txt and (2) !nicks.txt.
CVE-2003-1541Dec 31, 2003
Planetmoon
Guestbook
risk 0.03cvss —epss 0.03
PlanetMoon Guestbook tr3.a stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the admin script password, and other passwords, via a direct request to files/passwd.txt.
CVE-2003-1542Dec 31, 2003
Ondrej Jombik
Phpwebfilemanager
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in plugins/file.php in phpWebFileManager before 0.4.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the fm_path parameter.
CVE-2003-1543Dec 31, 2003
Bajie
Java HTTP Server
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Bajie Http Web Server 0.95zxe, 0.95zxc, and possibly others, allows remote attackers to inject arbitrary web script or HTML via the query string, which is reflected in an error message.
CVE-2003-1544Dec 31, 2003
Microsoft
Windows 2000
risk 0.01cvss —epss 0.17
Unrestricted critical resource lock in Terminal Services for Windows 2000 before SP4 and Windows XP allows remote authenticated users to cause a denial of service (reboot) by obtaining a read lock on msgina.dll, which prevents msgina.dll from being loaded.
CVE-2003-1545Dec 31, 2003
nukestyles.com
Viewpage
risk 0.03cvss —epss 0.04
Absolute path traversal vulnerability in nukestyles.com viewpage.php addon for PHP-Nuke allows remote attackers to read arbitrary files via a full pathname in the file parameter. NOTE: This was originally reported as an issue in PHP-Nuke 6.5, but this is an independent addon.
CVE-2003-1546Dec 31, 2003
Filebased
Guestbook
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in gbook.php in Filebased guestbook 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the comment section.
CVE-2003-1547Dec 31, 2003
Splatt
Splatt Forum
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in block-Forums.php in the Splatt Forum module for PHP-Nuke 6.x allows remote attackers to inject arbitrary web script or HTML via the subject parameter.
CVE-2003-1548Dec 31, 2003
Myabracadaweb
Myabracadaweb
risk 0.04cvss —epss 0.07
MyABraCaDaWeb 1.0.2 and earlier allows remote attackers to obtain sensitive information via an invalid IDAdmin or other parameter, which reveals the installation path in an error message.
CVE-2003-1549Dec 31, 2003
Myabracadaweb
Myabracadaweb
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in header.php in MyABraCaDaWeb 1.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the ma_kw parameter.
CVE-2003-1550Dec 31, 2003
XOOPS
Xoops
risk 0.03cvss —epss 0.03
XOOPS 2.0, and possibly earlier versions, allows remote attackers to obtain sensitive information via an invalid xoopsOption parameter, which reveals the installation path in an error message.
CVE-2003-1551Dec 31, 2003
Novell
Groupwise
risk 0.00cvss —epss 0.02
Unspecified vulnerability in Novell GroupWise 6 SP3 WebAccess before Revision F has unknown impact and attack vectors related to "malicious script."
CVE-2003-1552Dec 31, 2003
Graeme
Uploader
risk 0.00cvss —epss 0.02
Unrestricted file upload vulnerability in uploader.php in Uploader 1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/.
CVE-2003-1553Dec 31, 2003
Sips
Sips
risk 0.03cvss —epss 0.02
Haakon Nilsen Simple Internet Publishing System (SIPS) 0.2.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain password and other user information via a direct request to a user-specific configuration…
CVE-2003-1554Dec 31, 2003
Scoznet
Scozbook
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in scozbook/add.php in ScozNet ScozBook 1.1 BETA allows remote attackers to inject arbitrary web script or HTML via the (1) username, (2) useremail, (3) aim, (4) msn, (5) sitename and (6) siteaddy variables.
CVE-2003-1555Dec 31, 2003
Scoznet
Scozbook
risk 0.03cvss —epss 0.03
ScozNet ScozBook 1.1 BETA allows remote attackers to obtain sensitive information via an invalid PG parameter in view.php, which reveals the installation path in an error message.
CVE-2003-1556Dec 31, 2003
Cgi City
Cc Guestbook
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in cc_guestbook.pl in CGI City CC GuestBook allows remote attackers to inject arbitrary web script or HTML via the (1) name and (2) homepage_title (webpage title) parameters.
CVE-2003-1557Dec 31, 2003
Spamassassin
Spamassassin
risk 0.00cvss —epss 0.05
Off-by-one buffer overflow in spamc of SpamAssassin 2.40 through 2.43, when using BSMTP mode ("-B"), allows remote attackers to execute arbitrary code via email containing headers with leading "." characters.
CVE-2003-1558Dec 31, 2003
Fefe
Fnord
risk 0.00cvss —epss 0.03
Buffer overflow in httpd.c of fnord 1.6 allows remote attackers to create a denial of service (crash) and possibly execute arbitrary code via a long CGI request passed to the do_cgi function.
CVE-2003-1559Dec 31, 2003
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.16
Microsoft Internet Explorer 5.22, and other 5 through 6 SP1 versions, sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
CVE-2003-1560Dec 31, 2003
Netscape
Netscape
risk 0.00cvss —epss 0.01
Netscape 4 sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
CVE-2003-1561Dec 31, 2003
Opera
Opera
risk 0.00cvss —epss 0.01
Opera, probably before 7.50, sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
CVE-2003-1562Dec 31, 2003
OpenSSL Project
OpenSSL
risk 0.00cvss —epss 0.06
sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to…
CVE-2003-1563Dec 31, 2003
Sun Corporation
Cluster
risk 0.00cvss —epss 0.00
Sun Cluster 2.2 through 3.2 for Oracle Parallel Server / Real Application Clusters (OPS/RAC) allows local users to cause a denial of service (cluster node panic or abort) by launching a daemon listening on a TCP port that would otherwise be used by the Distributed Lock Manager…
CVE-2003-1564MedDec 31, 2003
Xmlsoft
Libxml2
risk 0.42cvss 6.5epss 0.02
libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka…
CVE-2003-1200Dec 29, 2003
Alt N
Mdaemon
risk 0.08cvss —epss 0.65
Stack-based buffer overflow in FORM2RAW.exe in Alt-N MDaemon 6.5.2 through 6.8.5 allows remote attackers to execute arbitrary code via a long From parameter to Form2Raw.cgi.
CVE-2003-1215Dec 29, 2003
PhpBB
phpBB
risk 0.00cvss —epss 0.00
SQL injection vulnerability in groupcp.php for phpBB 2.0.6 and earlier allows group moderators to perform unauthorized activities via the sql_in parameter.
CVE-2003-1198Dec 26, 2003
Cherokee
Cherokee Httpd
risk 0.00cvss —epss 0.02
connection.c in Cherokee web server before 0.4.6 allows remote attackers to cause a denial of service via an HTTP POST request without a Content-Length header field.
CVE-2003-0089Dec 15, 2003
Microfocus
Hpux
risk 0.03cvss —epss 0.01
Buffer overflow in the Software Distributor utilities for HP-UX B.11.00 and B.11.11 allows local users to execute arbitrary code via a long LANG environment variable to setuid programs such as (1) swinstall and (2) swmodify.
CVE-2003-0327Dec 15, 2003
Sybase
Adaptive Server Enterprise
risk 0.00cvss —epss 0.02
Sybase Adaptive Server Enterprise (ASE) 12.5 allows remote attackers to cause a denial of service (hang) via a remote password array with an invalid length, which triggers a heap-based buffer overflow.
CVE-2003-0628Dec 15, 2003
Oracle Corporation
Peopletools
risk 0.00cvss —epss 0.01
PeopleSoft Gateway Administration servlet (gateway.administration) in PeopleTools 8.43 and earlier allows remote attackers to obtain the full pathnames for server-side include (SSI) files via an HTTP request with an invalid value.
CVE-2003-0629Dec 15, 2003
Oracle Corporation
Peopletools
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in PeopleSoft IScript environment for PeopleTools 8.43 and earlier allows remote attackers to insert arbitrary web script via a certain HTTP request to IScript.
CVE-2003-0795Dec 15, 2003
GNU
Zebra
risk 0.04cvss —epss 0.08
The vty layer in Quagga before 0.96.4, and Zebra 0.93b and earlier, does not verify that sub-negotiation is taking place when processing the SE marker, which allows remote attackers to cause a denial of service (crash) via a malformed telnet command to the telnet CLI port, which…
CVE-2003-0812Dec 15, 2003
Microsoft
Windows Workstation Service
risk 0.09cvss —epss 0.81
Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long entries to be written to a debug log file ("NetSetup.LOG"), as demonstrated using the…
CVE-2003-0820Dec 15, 2003
Microsoft
Word
risk 0.02cvss —epss 0.26
Microsoft Word 97, 98(J), 2000, and 2002, and Microsoft Works Suites 2001 through 2004, do not properly check the length of the "Macro names" data value, which could allow remote attackers to execute arbitrary code via a buffer overflow attack.
CVE-2003-0821Dec 15, 2003
Microsoft
Excel
risk 0.02cvss —epss 0.19
Microsoft Excel 97, 2000, and 2002 allows remote attackers to execute arbitrary code via a spreadsheet with a malicious XLM (Excel 4) macro that bypasses the macro security model.
CVE-2003-0822Dec 15, 2003
Microsoft
Frontpage Server Extensions
risk 0.10cvss —epss 0.81
Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request.
CVE-2003-0824Dec 15, 2003
Microsoft
Frontpage Server Extensions
risk 0.03cvss —epss 0.35
Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request.
CVE-2003-0856Dec 15, 2003
Stephen Hemminger
Iproute
risk 0.00cvss —epss 0.00
iproute 2.4.7 and earlier allows local users to cause a denial of service via spoofed messages as other users to the kernel netlink interface.
CVE-2003-0858Dec 15, 2003
GNU
Zebra
risk 0.00cvss —epss 0.00
Zebra 0.93b and earlier, and quagga before 0.95, allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.
CVE-2003-0859Dec 15, 2003
GNU
Glibc
risk 0.00cvss —epss 0.00
The getifaddrs function in GNU libc (glibc) 2.2.4 and earlier allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.
CVE-2003-0914Dec 15, 2003
Isc
Bind
risk 0.00cvss —epss 0.03
ISC BIND 8.3.x before 8.3.7, and 8.4.x before 8.4.3, allows remote attackers to poison the cache via a malicious name server that returns negative responses with a large TTL (time-to-live) value.
CVE-2003-0932Dec 15, 2003
Omega Rpg
Omega Rpg
risk 0.00cvss —epss 0.00
Buffer overflow in omega-rpg 0.90 allows local users to execute arbitrary code via a long (1) command line or (2) environment variable.
CVE-2003-0936Dec 15, 2003
Symantec
Pcanywhere
risk 0.00cvss —epss 0.00
Symantec PCAnywhere 10.x and 11, when started as a service, allows attackers to gain SYSTEM privileges via the help interface using AWHOST32.exe.
CVE-2003-0937Dec 15, 2003
SCO Group
Unixware
risk 0.00cvss —epss 0.00
SCO UnixWare 7.1.1, 7.1.3, and Open UNIX 8.0.0 allows local users to bypass protections for the "as" address space file for a process ID (PID) by obtaining a procfs file descriptor for the file and calling execve() on a setuid or setgid program, which leaves the descriptor open…
CVE-2003-0938Dec 15, 2003
SAP
DB
risk 0.00cvss —epss 0.00
vos24u.c in SAP database server (SAP DB) 7.4.03.27 and earlier allows local users to gain SYSTEM privileges via a malicious "NETAPI32.DLL" in the current working directory, which is found and loaded by SAP DB before the real DLL, as demonstrated using the SQLAT stored procedure.
CVE-2003-0939Dec 15, 2003
SAP
DB
risk 0.00cvss —epss 0.03
eo420_GetStringFromVarPart in veo420.c for SAP database server (SAP DB) 7.4.03.27 and earlier may allow remote attackers to execute arbitrary code via a connect packet with a 256 byte segment to the niserver (aka serv.exe) process on TCP port 7269, which prevents the server from…
CVE-2003-0940Dec 15, 2003
SAP
DB
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in sqlfopenc for web-tools in SAP DB before 7.4.03.30 allows remote attackers to read arbitrary files via .. (dot dot) sequences in a URL.
CVE-2003-0941Dec 15, 2003
SAP
DB
risk 0.00cvss —epss 0.01
web-tools in SAP DB before 7.4.03.30 allows remote attackers to access the Web Agent Administration pages and modify configuration via a direct request to waadmin.wa.