CVE-2003-1213

MaxWebPortal 1.30 stores its portal database under the web document root with insecure access control, allowing remote retrieval of database/db2000.mdb via a direct request. This causes partial confidentiality impact (CVSS: AV:N/AC:L/Au:N/C:P/I:P/A:P). The CVE entry provides no exploitation detai...

CVE-2003-1203

CVE-2003-1203 affects Mambo Site Server 4.0.10. A cross-site scripting vulnerability exists in index.php via the ?option parameter, enabling remote attackers to run script in other clients. OpenVAS entries document the XSS issue; NVD/NVD-derived entries confirm the same. No remediation or fix ver...

CVE-2003-1210

The CVE-2003-1210 entry describes multiple SQL injection vulnerabilities in the PHP-Nuke Downloads module (versions 5.x through 6.5). The root cause is unsafely constructed SQL queries exposed via the lid parameter to getit and the min parameter to search, allowing remote attackers to execute arb...

CVE-2003-1209

The vulnerability CVE-2003-1209 affects Monkey HTTP Daemon prior to 0.6.2. A POST request without a Content-Type header can cause the server to crash, resulting in a denial of service. The description and connected records confirm the affected product (Monkey HTTP Daemon) and the root cause (like...

CVE-2005-1649

CVE-2005-1649 affects Windows XP SP2, Windows Server 2003 SP1, and Longhorn. It describes a LAND-like denial-of-service vector in IPv6 TCP/IP where a crafted TCP SYN packet uses the same source and destination IP and port, causing high CPU or unresponsiveness. The vulnerability is a variant of CV...

CVE-2003-1151

Fastream NETFile Server 6.0.3.588 is affected by a cross-site scripting (XSS) vulnerability in which an attacker can inject arbitrary web script or HTML via the URL, which is then reflected on the 404 Not Found page. This is a remote exploit path through the URL parameter handling and page render...

CVE-2003-1145

CVE-2003-1145 describes a Cross-site scripting (XSS) vulnerability in OpenAutoClassifieds 1.0, specifically in the friendmail.php script. The flaw allows remote attackers to inject arbitrary web script or HTML by manipulating the listing parameter. Public references and CVE records corroborate th...

CVE-2003-1174

Technical details about CVE-2003-1174 are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2003-1201

OpenLDAP prior to 2.1.13 is affected by a denial-of-service vulnerability in the back-ldbm backend. Specifically, ldbm_back_exop_passwd frees an uninitialized pointer when slap_passwd_parse does not return LDAP_SUCCESS, potentially causing a segmentation fault on remote attack. Affected versions ...

CVE-2003-1168

CVE-2003-1168 affects HTTP Commander 4.0. A remote attacker can cause an error message to disclose the installation path by supplying a dot (.) in the file parameter, resulting in partial confidentiality impact. The description and linked sources indicate an information-disclosure vulnerability t...

CVE-2003-1175

CVE-2003-1175 concerns a cross-site scripting (XSS) vulnerability in Sympoll 1.5, where the tainted vo parameter in index.php can be exploited to inject arbitrary script/HTML. The NVD entry lists a CVSSv2 base score of 6.8 (MEDIUM) with network impact, partial confidentiality, integrity and avail...

CVE-2003-1155

X-CD-Roast 0.98 alpha10 through alpha14 is vulnerable to a local symlink attack that allows a local user to overwrite arbitrary files. Affected: X-CD-Roast 0.98 alpha10–alpha14. Root cause: symlink manipulation enabling file overwrite. Impact: as described, enables partial impact to confidentiali...

CVE-2003-1190

CVE-2003-1190 affects PHPRecipeBook versions 1.24 through 2.17, where an XSS vulnerability allows remote attackers to inject arbitrary web script or HTML via a recipe. The underlying cause and affected component are described in the entry; exploitation details and live remediation are not provide...

CVE-2003-1144

CVE-2003-1144: Buffer overflow in the log viewing interface of Perception LiteServe (versions 1.25–2.2) can be triggered by a GET request with a long file name, allowing remote code execution. Affected software is Perception LiteServe; root cause is a buffer overflow in the log viewer handling of...

CVE-2003-1170

CVE-2003-1170 affects kpopup (versions 0.9.1 and 0.9.5pre2). A format string vulnerability in main.cpp can allow local users to cause a denial of service (segmentation fault) and possibly execute arbitrary code via command line arguments. Additional VuXML/OpenVAS/Nessus entries note that misc.cpp...

CVE-2003-1169

CVE-2003-1169 affects DATEV Nutzungskontrolle 2.1 and 2.2. The root cause is insecure write permissions on critical registry keys, which lets local users bypass access restrictions by importing NukoInfo values into certain DATEV keys, thereby disabling Nutzungskontrolle. Connected sources confirm...

CVE-2003-1184

The CVE describes multiple cross-site scripting (XSS) vulnerabilities in ThWboard Beta 2.8 and 2.81. The flaws allow remote attackers to inject arbitrary web script or HTML via inputs such as (1) time in board.php, (2) the profile Homepage-Feld, (3) pictures, and (4) other “Diverse XSS Bugs.” The...

CVE-2003-1166

CVE-2003-1166 describes a directory traversal vulnerability in HTTP Commander 4.0. The flaw affects the Openfile.aspx and Html.aspx components, where a .. (dot dot) in the file parameter can be used to view arbitrary files (remote access). Root cause: insufficient validation of the file parameter...

CVE-2003-1156

CVE-2003-1156 concerns Java Runtime Environment (JRE) and SDK 1.4.2 through 1.4.2_02. A local attacker can cause arbitrary file overwrite via a symbolic link race on (1) unpack.log (created by the unpack program) or (2) .mailcap1 and .mime.types1 (created by the RPM package). The vulnerability is...

CVE-2003-1139

Musicqueue 1.2.0 is affected. The vulnerability allows a local user to overwrite arbitrary files by triggering a segmentation fault and using a symlink attack on the resulting musicqueue.crash file, enabling potentially unauthorized modification of files. Root cause: a crash-generated file name (...