CVE-2003-1213

The default installation of MaxWebPortal 1.30 stores the portal database under the web document root with insecure access control, which allows remote attackers to obtain sensitive information via a direct request to database/db2000.mdb...

CVE-2003-1242

Sage 1.0 b3 allows remote attackers to obtain the root web server path via a URL request for a non-existent module, which returns the path in an error message...

CVE-2003-1263

ICAL.EXE in iCal 3.7 allows remote attackers to cause a denial of service crash via a malformed HTTP request, possibly due to an invalid method name...

CVE-2003-1293

Multiple cross-site scripting XSS vulnerabilities in NukedWeb GuestBookHost allow remote attackers to inject arbitrary web script or HTML via the 1 Name, 2 Email and 3 Message fields when signing the guestbook...

CVE-2003-1302

The IMAP functionality in PHP before 4.3.1 allows remote attackers to cause a denial of service via an e-mail message with a 1 To or 2 From header with an address that contains a large number of "" backslash characters...

CVE-2003-1115

The Session Initiation Protocol SIP implementation in Nortel Networks Succession Communication Server 2000, when using SIP-T, allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suit...

CVE-2003-1163

hash.c in Ganglia gmond 2.5.3 allows remote attackers to cause a denial of service segmentation fault via a UDP packet that contains a single-byte name string, which is used as an out-of-bounds array index...

CVE-2003-1172

Directory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoon 2.1 and 2.2 allows remote attackers to access arbitrary files via a .. dot dot in the filename parameter...

CVE-2003-1204

Multiple cross-site scripting XSS vulnerabilities in Mambo Site Server 4.0.12 BETA and earlier allow remote attackers to execute script on other clients via 1 the link parameter in sectionswindow.php, the directory parameter in 2 gallery.php, 3 navigation.php, or 4 uploadimage.php, the path...

CVE-2003-1258

activate.php in versatileBulletinBoard vBB 0.9.5 and 0.9.6 allows remote attackers to gain unauthorized administrative access via a URL request with the uid parameter set to the webmaster uid...

CVE-2003-1261

Buffer overflow in CuteFTP 5.0 and 5.0.1 allows local users to cause a denial of service crash by copying a long URL into a clipboard...

CVE-2003-1292

PHP remote file include vulnerability in Derek Ashauer ashNews 0.83 allows remote attackers to include and execute arbitrary remote files via a URL in the pathtoashnews parameter to 1 ashnews.php and 2 ashheadlines.php...

CVE-2003-1073

A race condition in the at command for Solaris 2.6 through 9 allows local users to delete arbitrary files via the -r argument with .. dot dot sequences in the job name, then modifying the directory structure after at checks permissions to delete the file and before the deletion actually takes pla...

CVE-2003-1091

Integer overflow in MP3Broadcaster for Apple QuickTime/Darwin Streaming Server 4.1.3 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via malformed ID3 tags in MP3 files...

CVE-2003-1098

The Xserver for HP-UX 11.22 was not properly built, which introduced a vulnerability that allows local users to gain privileges...

CVE-2003-1119

SSH Secure Shell before 3.2.9 allows remote attackers to cause a denial of service via malformed BER/DER packets...

CVE-2003-1128

XMMS.pm in X2 XMMS Remote, as obtained from the vendor server between 4 AM 11 AM PST on May 7, 2003, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to TCP port 8086...

CVE-2003-1227

PHP remote file include vulnerability in index.php for Gallery 1.4 and 1.4-pl1, when running on Windows or in Configuration mode on Unix, allows remote attackers to inject arbitrary PHP code via a URL in the GALLERYBASEDIR parameter, a different vulnerability than CVE-2002-1412. NOTE: this issue...

CVE-2003-1285

Multiple cross-site scripting XSS vulnerabilities in Sambar Server before 6.0 beta 6 allow remote attackers to inject arbitrary web script or HTML via the query string to 1 isapi/testisa.dll, 2 testcgi.exe, 3 environ.pl, 4 the query parameter to samples/search.dll, 5 the price parameter to...

CVE-2003-1316

mod.php in eNdonesia 8.2 allows remote attackers to obtain sensitive information via a ' quote value in the lng parameter, which reveals the path in an error message. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...