CVE-2003-0023

The CVE-2003-0023 vulnerability affects rxvt 2.7.8 where the menuBar feature can be manipulated via a specific character escape sequence to insert commands into the menu, allowing an attacker to modify menu entries and execute arbitrary commands. The NVD description explicitly states that the men...

CVE-2003-0066

The CVE-2003-0066 issue affects rxvt 2.7.8 and earlier. A vulnerable escape sequence allows an attacker to modify the window title and have that title re-enter the shell as a command, enabling arbitrary command execution when a user views a file containing the malicious sequence. The root cause i...

CVE-2003-0002

The CVE-2003-0002 entry concerns a Cross-site scripting (XSS) vulnerability in Microsoft Content Management Server (MCMS) 2001, specifically in the ManualLogin.asp script. The issue allows remote attackers to inject and execute arbitrary script through the REASONTXT parameter. The incident is doc...

CVE-2003-0903

CVE-2003-0903 corresponds to a buffer overflow in Microsoft Data Access Components (MDAC) 2.5–2.8. The vulnerability resides in a MDAC component that handles responses to SQL Server discovery broadcasts; a malicious UDP reply to a broadcast request can trigger a buffer overrun. Exploitation could...

CVE-2003-0125

CVE-2003-0125 describes a buffer overflow in the web interface of the SOHO Routefinder 550 prior to firmware 4.63. The issue allows remote attackers to trigger a reboot and potentially execute arbitrary code via a long GET /OPTIONS value. OpenVAS-based findings corroborate a related “too long URL...

CVE-2003-0052

CVE-2003-0052 applies to Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1, where parse_xml.cgi allows remote attackers to list arbitrary directories due to unvalidated input. Public sources (ATstake advisory, vendor notices) describe it as a directory-listin...

CVE-2003-0077

The CVE concerns hanterm/hanterm-xf terminal emulators (2.0.5 and earlier). Affected component is the escape sequence that sets the window title; an attacker could craft a sequence that places a command into the title and, when the user views the file containing it, that command could be executed...

CVE-2003-0058

MIT Kerberos V5 KDC before 1.2.5 is vulnerable to remote authenticated DoS via a protocol request that triggers a null pointer dereference, causing KDC crashes within the same realm. Affected component: KDC in MIT Kerberos V5. Impact: service denial (crash) of KDCs in the realm. Root cause: null ...

CVE-2003-0107

The CVE-2003-0107 issue is a buffer overflow in zlib 1.1.4’s gzprintf() when compiled without vsnprintf or when long inputs are truncated. Affected: zlib (1.1.4 and earlier). Impact per sources: denial of service and potential remote code execution. Public advisories (e.g., Red Hat RHSA-2003:081 ...

CVE-2003-0120

The CVE-2003-0120 issue affects adb2mhc in the mhc-utils package prior to version 0.25+20010625-7.1. The root cause is a symlink attack in a default temporary directory with a predictable name, allowing local users to overwrite arbitrary files they can write to. This is a local-privilege affectin...

CVE-2003-0825

CVE-2003-0825 concerns the Windows Internet Naming Service (WINS) in Windows NT/2000/Server 2003 families, where malformed packets with improper lengths bypass WINS’ length validation. The result is a remote denial of service on Windows Server 2003 and, for older platforms, potential denial of se...

CVE-2003-1022

CVE-2003-1022: FSP Suite daemon directory traversal vulnerability. The FSP client/server allowed remote access to files outside the FSP root due to improper filtering of paths (trailing slash or leading slash). Affects FSP Suite prior to 2.81.b18; impact is partial confidentiality/integrity/avail...

CVE-2003-0143

CVE-2003-0143 affects qpopper 4.0.x prior to 4.0.5fc2. The pop_msg function fails to null-terminate the message buffer after Qvsnprintf, enabling an authenticated user to trigger a buffer overflow in a mdef command with a long macro name and execute arbitrary code. The CVE is associated with remo...

CVE-2003-0021

The CVE-2003-0021 issue affects Eterm 0.9.1 and earlier, where the terminal’s screen-dump feature can be abused by a crafted escape sequence to overwrite arbitrary files when echoed to a user’s terminal (e.g., during viewing a file containing the sequence). The root cause is a vulnerability in ho...

CVE-2003-0097

The CVE-2003-0097 entry concerns PHP 4.3.0’s CGI module, where a flaw in force redirect handling (cgi.force_redirect or --enable-force-cgi-redirect) can allow an attacker to access arbitrary files as the PHP user and potentially execute PHP code. Public sources describe this as a by-design bypass...

CVE-2003-0094

CVE-2003-0094 affects Mandrake Linux 8.2/9.0 util-linux mcookie. The patch changed the entropy source from /dev/random to /dev/urandom, making mcookie output more predictable and potentially aiding certain attacks. The Nessus advisory notes the patch was removed in these updates, restoring a bett...

CVE-2003-1328

The CVE concerns Microsoft Internet Explorer 5.01, 5.5, and 6.0, where the showHelp() function supports certain pluggable protocols that can bypass the cross‑domain security model and allow remote code execution. The OpenVAS entries reference the affected patches (MS03-004 and MS05-020) and indic...

CVE-2003-0071

CVE-2003-0071 affects the xterm terminal emulator in XFree86 up to version 4.2.99.4 and earlier, where the DEC UDK processing feature can be abused by a crafted escape sequence to drive the terminal into a tight loop, producing a denial of service. The MiracleLinux note links this issue to relate...

CVE-2003-0993

CVE-2003-0993 concerns Apache 1.3.x mod_access on big-endian 64-bit systems. The issue arises because Allow/Deny rules that specify IP addresses without a netmask are not parsed correctly, potentially allowing remote attackers to bypass access restrictions. Multiple OpenVAS entries and vendor adv...

CVE-2003-0067

CVE-2003-0067 affects the aterm terminal emulator (version 0.42). The vulnerability stems from a window-title escape sequence feature that can be manipulated to place a crafted title on the command line, enabling an attacker to inject and execute arbitrary commands when the user views a file cont...