CVE-2003-1043

SQL injection vulnerability in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote authenticated users with editkeywords privileges to execute arbitrary SQL via the id parameter to editkeywords.cgi...

CVE-2003-1042

CVE-2003-1042 affects Bugzilla up to version 2.16.3. A SQL injection in the script collectstats.pl allows remote authenticated users with editproducts privileges to execute arbitrary SQL via the product name, potentially compromising confidentiality, integrity, and availability. The provided docu...

CVE-2003-0687

CVE-2003-0687 is rejected/not used; this entry does not represent an active vulnerability.

CVE-2004-0503

Microsoft Outlook 2003 allows remote attackers to bypass the default zone restrictions and execute script within media files via a Rich Text Format RTF message containing an OLE object for the Windows Media Player, which bypasses Media Player's setting to disallow scripting and may lead to...

CVE-2003-1045

CVE-2003-1045 affects Bugzilla: votes.cgi in Bugzilla 2.16.3 and earlier, and 2.17.1–2.17.4. The vulnerability lets remote attackers read a user’s voting page if that user voted on a restricted bug, by modifying the who parameter to access potentially sensitive voting information. The underlying ...

CVE-2003-1046

describecomponents.cgi in Bugzilla 2.17.3 and 2.17.4 does not properly verify group membership when bug entry groups are used, which allows remote attackers to list component descriptions for otherwise restricted products...

CVE-2003-1045

votes.cgi in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote attackers to read a user's voting page when that user has voted on a restricted bug, which allows remote attackers to read potentially sensitive voting information by modifying the who parameter...

CVE-2004-0501

Outlook 2003 allows remote attackers to bypass intended access restrictions and cause Outlook to request a URL from a remote site via an HTML e-mail message containing a Vector Markup Language VML entity whose src parameter points to the remote site, which could allow remote attackers to know whe...

CVE-2004-0502

Outlook 2003, when replying to an e-mail message, stores certain files in a predictable location for the "src" of an img tag of the original message, which allows remote attackers to bypass zone restrictions and exploit other issues that rely on predictable locations, as demonstrated using a shel...

CVE-2003-0193

msxlsview.sh in xlsview for catdoc 0.91 and earlier allows local users to overwrite arbitrary files via a symlink attack on predictable temporary file names "word$$.html"...

CVE-2003-1046

The CVE-2003-1046 entry concerns Bugzilla versions 2.17.3 and 2.17.4. Describecomponents.cgi fails to properly verify group membership when bug entry groups are used, allowing remote attackers to list component descriptions for products that should be restricted. The core issue is an insufficient...

CVE-2004-0501

Affected software : Outlook 2003. What is vulnerable : HTML e-mails containing a Vector Markup Language (VML) entity whose src points to a remote site can cause Outlook to request that remote URL, potentially revealing read status and other information. Cause : Bypass of intended access restricti...

CVE-2003-0193

msxlsview.sh in xlsview for catdoc 0.91 and earlier allows local users to overwrite arbitrary files via a symlink attack on predictable temporary file names "word$$.html"...

CVE-2003-1043

CVE-2003-1043 : The vulnerability affects Bugzilla versions 2.16.3 and earlier, and 2.17.1–2.17.4, where remote authenticated users with editkeywords privileges can obtain arbitrary SQL through the id parameter to editkeywords.cgi. The issue is a SQL injection in Bugzilla’s editing keywords flow,...

CVE-2004-0502

CVE-2004-0502 affects Microsoft Outlook 2003. When replying to an email, Outlook 2003 stores certain files in a predictable location used as the src of an img tag in the original message. This behavior can allow remote attackers to bypass zone restrictions and potentially exploit other issues tha...

CVE-2003-0193

The CVE-2003-0193 issue affects xlsview (part of catdoc) prior to 0.91.5, where msxlsview.sh could be abused via a symlink to overwrite arbitrary files with a predictable temporary name (word$$.html), enabling local privilege effects. Debian/DSA-575-1 fixes this by updating catdoc to a newer rele...

CVE-2003-1044

editproducts.cgi in Bugzilla 2.16.3 and earlier, when usebuggroups is enabled, does not properly remove group add privileges from a group that is being deleted, which allows users with those privileges to perform unauthorized additions to the next group that is assigned with the original group ID...

CVE-2004-0119

The Negotiate Security Software Provider SSP interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service crash from null dereference or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selectio...

CVE-2003-0908

The Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges, which allows local users to execute arbitrary code via a "Shatter" style attack using a Windows message that accesses the context sensitive help button in the GUI, as demonstrated using the File Open dialo...

CVE-2003-0909

Windows XP allows local users to execute arbitrary programs by creating a task at an elevated privilege level through the eventtriggers.exe command-line tool or the Task Scheduler service, aka "Windows Management Vulnerability."...