CVE-2003-1372

CVE-2003-1372 is an XSS vulnerability affecting myPHPNuke 1.8.8 (and possibly earlier) in the links.php script. The issue allows remote attackers to inject arbitrary HTML and client-side scripts via the (1) ratenum or (2) query parameters, enabling cross-site scripting. The available connected so...

CVE-2003-1373

The provided documents describe CVE-2003-1373 as a vulnerability in PhpBB versions 1.4.0 through 1.4.4. The issue is a directory traversal that lets remote attackers read and include arbitrary files via dot-dot sequences followed by NULL (%00) characters in CGI parameters, demonstrated for the la...

CVE-2003-1369

The vulnerability is a buffer overflow in the ByteCatcher FTP client version 1.04b , exploitable by sending a long FTP server banner. This can cause a denial of service (crash) and, per the CVE description, may allow arbitrary code execution . No exploit details, affected products, versions beyon...

CVE-2003-1368

CVE-2003-1368: Buffer overflow in the 32bit FTP client 9.49.1 allows remote attackers to crash the client and possibly execute arbitrary code via a long FTP server banner. Affected software/version is stated in CVE entries; no concrete patch/version remediation is provided in the supplied documen...

CVE-2003-1362

Bastille B.02.00.00 on HP-UX 11.00/11.11 does not properly configure NOVRFY and NOEXPN in sendmail.cf, enabling potential remote user enumeration and alias expansion via the mail system. Affected component is sendmail configuration handling in Bastille’s HP-UX environment; root cause is misconfig...

CVE-2003-1366

CVE-2003-1366 affects OpenBSD versions 2.0–3.2 in the chpass utility, enabling local users to read portions of arbitrary files via a hard link attack on a temporary file used to store user database information. The vulnerability is described with a CVSS v2 base score of 3.3 (LOCAL, MEDIUM complex...

CVE-2003-1370

Nuked-Klan 1.2b is affected by multiple XSS vulnerabilities. An attacker can inject arbitrary HTML or script via (1) the Author field in the Guestbook, (2) the Titre or Pseudo fields in the Forum, or (3) the La Tribune Libre entry in the Shoutbox. The description confirms remote XSS with these sp...

CVE-2003-1364

Summary: CVE-2003-1364 affects Aprelium Technologies Abyss Web Server (likely 1.1.2 and possibly older before 1.1.4). A remote attacker can cause a denial of service (server crash) by sending an HTTP GET request with empty headers in the Connection or Range fields. The OpenVAS/Nessus entries corr...

CVE-2003-1371

CVE-2003-1371 affects Nuked-Klan up to version 1.3b (and possibly earlier). A remote attacker can trigger phpinfo via the op parameter in the Team, News, or Liens modules, causing information disclosure about the server. The available documents do not specify a fixed patch or remediation. If need...

CVE-2003-1363

The CVE affects Aprelium Technologies Abyss Web Server 1.1.2 and earlier, where the remote web management interface on port 9999 fails to log connection attempts. This lack of logging can enable remote brute-force attacks against the administration console without detection. The available connect...

CVE-2003-1360

CVE-2003-1360 describes a buffer overflow in the setupterm function of the HP-UX programs lanadmin and landiag , affecting HP-UX 10.0 through 10.34. The overflow is triggered by a long TERM environment variable, enabling a local user to potentially execute arbitrary code. The available documents ...

CVE-2003-1367

The vulnerable software is Majordomo (2.0 through 1.94.4, possibly earlier). The which_access variable defaults to open, enabling remote attackers to enumerate mailing-list member addresses using the which command. The provided sources confirm the underlying issue but do not specify a vendor patc...

CVE-2003-1358

rs.F300 for HP-UX 10.0 through 11.22 uses the PATH environment variable to find and execute programs such as rm while operating at raised privileges, which allows local users to gain privileges by modifying the path to point to a malicious rm program...

CVE-2003-1365

The CVE-2003-1365 entry concerns the escape_dangerous_chars function in CGI::Lite 2.0 and earlier. The function fails to remove certain dangerous characters (backslash, ?, ~, ^, newline, and carriage return), allowing remote attackers to read or write arbitrary files or execute arbitrary commands...

CVE-2003-1372

Cross-site scripting XSS vulnerability in links.php script in myPHPNuke 1.8.8, and possibly earlier versions, allows remote attackers to inject arbitrary HTML and web script via the 1 ratenum or 2 query parameters...

CVE-2003-1359

The CVE-2003-1359 entry concerns HP-UX 10.0–11.22 with the stmkfont utility. A buffer overflow triggered by a long command line argument could allow local privilege escalation. The documents specify the affected component and the underlying cause but do not provide concrete patch versions or reme...

CVE-2003-1361

The CVE-2003-1361 entry concerns VERITAS Bare Metal Restore (BMR) within Tivoli Storage Manager (TSM) versions 3.1.0 through 3.2.1. It states that a vulnerability could allow remote attackers to gain root privileges on the BMR Main Server. The documents do not provide further technical details on...

[security bulletin] HPSBMA02230 SSRT071436 rev.1 - HP Select Identity, Remote Unauthorized Access

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01081130 Version: 1 HPSBMA02230 SSRT071436 rev.1 - HP Select Identity, Remote Unauthorized Access NOTICE: The information in this Security Bulletin should be acted upon as...

CVE-2003-1356

The CVE-2003-1356 entry concerns HP-UX sort(1) file handling being incorrect, enabling local attackers to gain access or cause DoS. Affected HP-UX versions: 10.01–10.20 and 11.00–11.11. The issue is addressed by HP patches referenced in the connected documents (e.g., HPSBUX00237 SSRT3454; PHCO_25...

CVE-2003-1348

The CVE-2003-1348 entry describes a Cross-site Scripting (XSS) vulnerability in the guestbook.cgi component of ftls.org Guestbook 1.1. The issue allows remote attackers to inject arbitrary web script or HTML via the (1) comment, (2) name, or (3) title fields. Public references in the initial docu...