CVE-2003-1443

Kaspersky Antivirus (KAV) 4.0.9.0 is affected: it fails to detect viruses in files whose names use MS-DOS device names, allowing local bypass of protection. The issue is demonstrated with aux.vbs and aux.com. The available references confirm the vulnerability exists but do not provide a publicly ...

CVE-2003-1434

The CVE concerns login_ldap 3.1 and 3.2, where remote attackers can initiate unauthenticated binds if (a) bind_anon_dn is on (bind with no password), (b) bind_anon_cred is on (bind with no DN), or (c) bind_anon is on (bind with no DN or password). Root cause is misconfiguration allowing unauthent...

CVE-2003-1435

This CVE (CVE-2003-1435) describes an SQL injection in PHP-Nuke versions 5.6 and 6.0, exploitable via the days parameter in the search module to allow remote execution of arbitrary SQL. The underlying issue is an input validation flaw in the search component, enabling attackers to influence the b...

CVE-2003-1449

Affected product: Aladdin Knowledge Systems eSafe Gateway 3.5.126.0. Issue: CVP data stream incomplete validation allows remote attackers to bypass virus protection. Root cause: CVP data is not checked in full. Impact (per sources): partial confidentiality, integrity, and availability; CVSS v2 ba...

CVE-2003-1457

Auerswald COMsuite CTI ControlCenter 3.1 creates a default user account “runasositron” with an easily guessable password, enabling local or remote access for attackers. The connected sources corroborate the existence of the default account and access impact; exploitation details, affected version...

CVE-2003-1460

The vulnerability CVE-2003-1460 affects Worker Filemanager 1.0–2.7 . During copy operations, the destination directory is left with world-readable and executable permissions, enabling local users to obtain sensitive information. The root cause is a mis-set filesystem permission during copy. Impac...

CVE-2003-1441

CVE-2003-1441 affects Posadis 0.50.4 through 0.50.8. A DNS message with no question section can trigger a null dereference, causing a denial of service. The provided documents do not specify any exploit details beyond this behavior, nor any official remediation or mitigations. No further vendor o...

CVE-2003-1430

The CVE-2003-1430 entry describes a directory traversal in Unreal Tournament Server versions 436 and earlier. A remote attacker can access known files by supplying a dot-dot sequence in an unreal:// URL, indicating a vulnerability in the server’s handling of custom protocol URLs. The public sourc...

CVE-2003-1456

The CVE-2003-1456 issue affects the CGI program album.pl. The provided NASL/Nessus reference confirms that the vulnerability exists in versions older than 6.2 and can enable an attacker to execute arbitrary commands on the host with the HTTP daemon’s privileges, using an alternative configuration...

CVE-2003-1437

BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or trust certificate authorities, which allows local users to gain access...

CVE-2003-1429

The CVE-2003-1429 entry concerns Proxomitron Naoko 4.4, where a buffer overflow vulnerability in handling long requests allows remote attackers to execute arbitrary code. The core affected component is the input handling/buffer management in Naoko 4.4. The impact is remote code execution with par...

CVE-2003-1435

SQL injection vulnerability in PHP-Nuke 5.6 and 6.0 allows remote attackers to execute arbitrary SQL commands via the days parameter to the search module...

CVE-2003-1452

CVE-2003-1452 describes an untrusted search path vulnerability in Qualcomm qpopper 4.0–4.05. The root cause is PATH environment variable manipulation that causes the daemon to execute a malicious smbpasswd program, enabling local users to run arbitrary code. The available records consistently sta...

CVE-2003-1440

SpamProbe 0.8a is affected: remote DoS via HTML e-mail containing newline characters inside an href tag, due to how certain regular expressions are not handling this input. The root cause is the incorrect handling of newlines in href attributes. Impact is described as a crash/partial availability...

CVE-2003-1450

CVE-2003-1450 affects BitchX IRC client versions 75p3 and 1.0c16–1.0c20cvs. The issue allows remote attackers to cause a denial of service (segmentation fault) by sending a malformed RPL_NAMREPLY numeric 353 message. The connected sources confirm the vulnerable component and the impact but do not...

CVE-2003-1437

BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1 store passwords in plaintext when a keystore is used to store a private key or trust certificate authorities. This plaintext storage enables local users to gain access. The vulnerability affects the authentication/secret handling in the key...

CVE-2003-1453

The vulnerability is an XSS in XOOPS MytextSanitizer affecting XOOPS 1.3.5–1.3.9 and 2.0–2.0.1, exploitable via a javascript: URL in an IMG tag to inject arbitrary script/HTML. The provided documents do not include concrete exploit details, affected product versions beyond those ranges, or a reme...

CVE-2003-1459

CVE-2003-1459 affects ttCMS 2.2 and ttForum, with multiple PHP remote file inclusion vulnerabilities. The issue allows remote attackers to execute arbitrary PHP code via (1) the template parameter in News.php or (2) the installdir parameter in install.php. Exploitation details indicate that this ...

CVE-2003-1445

Stack-based buffer overflow in Far Manager 1.70beta1 and earlier allows local users to cause a denial of service crash and possibly execute arbitrary code via a long pathname...

CVE-2003-1448

The CVE-2003-1448 issue affects the Windows 2000 kernel, where a memory leak can be exploited by remote attackers to cause a denial of service through SMB by sending a NetBIOS continuation packet. The description explicitly states a DoS condition (SMB request hang). No specific affected product v...