CVE-2003-1421

CVE-2003-1421 concerns an unspecified vulnerability in the mod_mysql_logger shared object used by SuckBot 0.006. The issue is described as allowing remote attackers to cause a denial of service via unknown attack vectors, resulting in a segfault. The available documents do not provide concrete ex...

CVE-2003-1402

CVE-2003-1402 concerns a PHP remote file inclusion vulnerability in hit.php affecting Kietu 2.0 and 2.3. The flaw enables an attacker to run arbitrary PHP code by supplying a crafted value to the url_hit parameter. The description specifies the impact as remote code execution and contrasts this v...

CVE-2003-1427

Affected product: Netgear FM114P (firmware 1.4) web configuration interface. Vulnerability: Directory traversal via a hex-encoded (../../ )../ in the port parameter, allowing remote attackers to read arbitrary files (e.g., netgear.cfg). Root cause: Insufficient validation of the port parameter en...

CVE-2003-1410

The CVE-2003-1410 entry refers to a PHP remote file inclusion in Cedric Email Reader (versions 0.2 and 0.3) where the cer_skin parameter in email.php (aka email.php3) can allow an attacker to execute arbitrary PHP code. Connected documents confirm the affected software and the vulnerability class...

CVE-2003-1424

The CVE-2003-1424 issue involves Petitforum’s message.php, where improper authentication allows remote attackers to impersonate forum users by altering the connect cookie. This reflects insufficient session/cookie validation with an impact described as PARTIAL confidentiality/integrity/availabili...

CVE-2003-1404

DotBr 0.1 stores its config.inc under the web document root with insufficient access control, enabling remote attackers to obtain sensitive data such as SQL usernames and passwords. The CVE entry (CVE-2003-1404) lists a high impact (base score 7.5, confidentiality and integrity partial) and notes...

CVE-2003-1423

Vulnerability summary: Petitforum stores the liste.txt data file under the web document root with insufficient access control, allowing remote attackers to obtain sensitive information (e-mails and encrypted passwords). Root cause: improper access restrictions on the data file within the web root...

CVE-2003-1403

foo.php3 in DotBr 0.1 allows remote attackers to obtain sensitive information via a direct request, which calls the phpinfo function...

CVE-2003-1405

Technical details about CVE-2003-1405 are not publicly provided in the supplied documents; monitor for updates.

CVE-2003-1418

CVE-2003-1418 affects Apache HTTP Server 1.3.22–1.3.27 on OpenBSD. The root cause is information disclosure via (1) ETag headers that reveal inode numbers and (2) multipart MIME boundaries that reveal child process IDs (PIDs). Practical impact is partial information disclosure that can aid reconn...

Microsoft Windows XP/2003 Macrovision SecDrv.sys privilege escalation (0day)

Hi, Symantec researcher Elia Florip has warned, at the company's weblog 1,of a 0day attack in Windows XP and 2003 that allows unprivileged users to gain SYSTEM privileges via a buggy driver installed by default. In his/her post, Elia brings us an important clue:"At the moment, it's still not clea...

CVE-2007-5587

The CVE-2007-5587 entry describes a local privilege-escalation vulnerability in Macrovision SafeDisc’s secdrv.sys driver. The root cause is a buffer overflow in secdrv.sys before 4.3.86.0, triggered by a crafted argument to a METHOD_NEITHER IOCTL, affecting Windows XP SP2, XP x64, Server 2003 SP1...

CVE-2007-5587

Buffer overflow in Macrovision SafeDisc secdrv.sys before 4.3.86.0, as shipped in Microsoft Windows XP SP2, XP Professional x64 and x64 SP2, Server 2003 SP1 and SP2, and Server 2003 x64 and x64 SP2 allows local users to overwrite arbitrary memory locations and gain privileges via a crafted argume...

CVE-2003-1377

CVE-2003-1377 affects Smart IRC Daemon (SIRCD) versions 0.4.0 and 0.4.4. The vulnerability is a buffer overflow in the reverse DNS lookup triggered by a client with a long hostname, allowing remote code execution. The available sources document the affected component and the underlying cause (bou...

CVE-2003-1393

CVE-2003-1393 affects Gupta SQLBase 8.1.0 and earlier. A bug in the EXECUTE command can overflow a buffer when the parameter exceeds ~700 characters, allowing a remote attacker over the network to cause a denial of service and potentially execute arbitrary code on the server. The available source...

CVE-2003-1395

Technical details about CVE-2003-1395 are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2003-1383

WEB-ERP 0.1.4 and earlier are affected by an information-disclosure vulnerability: an HTTP request can retrieve the logicworks.ini file, exposing the MySQL database username and password. Root cause is improper access to the configuration file in the webERP application. Impact is partial confiden...

CVE-2003-1386

Affected product: Axis 2400 Video Server 2.00–2.33. The vulnerability allows remote attackers to obtain sensitive information by requesting /support/messages, which displays the server’s /var/log/messages log. This is a network-based information disclosure with low attack complexity and no authen...

CVE-2003-1385

CVE-2003-1385 affects Invision Power Board 1.1.1 via ipchat.php: the root_path parameter allows remote file inclusion when register_globals is enabled, enabling an attacker to reference a URL containing PHP code and execute it on the server. This results in remote code execution with the web serv...

CVE-2003-1390

CVE-2003-1390 affects RTS CryptoBuddy 1.2 and earlier. The root cause is that bytes 53–55 of a 55‑byte passphrase are stored in plaintext, enabling local users to infer part of the passphrase. The documents do not specify exploitation status or a remediation/patch. No explicit details on affected...