CVE-2003-1271

Cross-site scripting vulnerability XSS in AN HTTP 1.41e allows remote attackers to execute arbitrary web script or HTML as other users via a URL containing the script...

CVE-2003-1282

IBM Net.Data allows remote attackers to obtain sensitive information such as path names, server names and possibly user names and passwords by causing the 1 $DTWCURRENTFILENAME, 2 $DATABASE, 3 $LOGIN, 4 $PASSWORD, and possibly other predefined variables that can be echoed back to the user via a w...

CVE-2003-1286

HTTP Proxy in Sambar Server before 6.0 beta 6, when security.ini lacks a 127.0.0.1 proxydeny entry, allows remote attackers to send proxy HTTP requests to the Sambar Server's administrative interface and external web servers, by making a "Connection: keep-alive" request before the proxy requests...

CVE-2003-1290

BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, with RMI and anonymous admin lookup enabled, allows remote attackers to obtain configuration information by accessing MBeanHome via the Java Naming and Directory Interface JNDI...

CVE-2003-1296

Easy File Sharing EFS Web Server 1.2 allows remote authenticated users to cause a denial of service via 1 an "empty symbol" in the Title field or 2 certain data in the Your Message field, possibly a long argument...

CVE-2003-1308

CRLF injection vulnerability in fvwm-menu-directory for fvwm 2.5.x before 2.5.10 and 2.4.x before 2.4.18 allows local users to execute arbitrary commands via carriage returns in a filename...

CVE-2003-1324

Race condition in the canopen function in Elm ME+ 2.4, when installed setgid mail and the operating system lacks POSIX saved ID support, allows local users to read and modify certain files with the privileges of the mail group...

CVE-2003-1335

Directory traversal vulnerability in Kai Blankenhorn Bitfolge simple and nice index file aka snif before 1.2.5 allows remote attackers to download files from locations above the snif directory...

CVE-2003-1306

Microsoft URLScan 2.5, with the RemoveServerHeader option enabled, allows remote attackers to obtain sensitive information server name and version via an HTTP request that generates certain errors such as 400 "Bad Request," which leak the Server header in the response...

CVE-2003-1311

siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder does not ensure that the TARGET parameter names a valid redirection resource, which allows remote attackers to construct a URL that might trick users into visiting an arbitrary web site referenced by this parameter...

CVE-2003-1312

siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder places a session ID string in the value of the SMSESSION parameter in a URL, which might allow remote attackers to obtain the ID by sniffing, reading Referer logs, or other methods...

CVE-2003-1323

Elm ME+ 2.4 before PL109S, when installed setgid mail and the operating system lacks POSIX saved ID support, allows local users to read and modify certain files with the privileges of the mail group via unspecified vectors...

CVE-2003-1331

Stack-based buffer overflow in the mysqlrealconnect function in the MySql client library libmysqlclient 4.0.13 and earlier allows local users to execute arbitrary code via a long socket name, a different vulnerability than CVE-2001-1453...

CVE-2003-1076

Unknown vulnerability in sendmail for Solaris 7, 8, and 9 allows local users to cause a denial of service unknown impact and possibly gain privileges via certain constructs in a .forward file...

CVE-2003-1528

nsrshutdown in Fujitsu Siemens NetWorker 6.0 allows local users to overwrite arbitrary files via a symlink attack on the nsrshPID temporary file...

CVE-2003-1303

Buffer overflow in the imapfetchoverview function in the IMAP functionality phpimap.c in PHP before 4.3.3 allows remote attackers to cause a denial of service segmentation fault and possibly execute arbitrary code via a long e-mail address in a 1 To or 2 From header...

SonicWALL Firmware CVE-2003-1320 Denial-Of-Service Vulnerability

SonicWALL firmware before 6.4.0.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted Internet Key Exchange IKE response packets, possibly including 1 a large Security Parameter Index SPI field, 2 a large number of payloads, or 3 a long payload. CV...

CVE-2003-1294

Xscreensaver before 4.15 creates temporary files insecurely in 1 driver/passwd-kerberos.c, 2 driver/xscreensaver-getimage-video, 3 driver/xscreensaver.kss.in, and the 4 vidwhacker and 5 webcollage screensavers, which allows local users to overwrite arbitrary files via a symlink attack...

CVE-2003-1521

Sun Java Plug-In 1.4 through 1.4.202 allows remote attackers to repeatedly access the floppy drive via the createXmlDocument method in the org.apache.crimson.tree.XmlDocument class, which violates the Java security model...

CVE-2003-1301

Sun Java Runtime Environment JRE 1.x before 1.4.211 and 1.5.x before 1.5.006, and as used in multiple web browsers, allows remote attackers to cause a denial of service application crash via deeply nested object arrays, which are not properly handled by the garbage collector and trigger invalid...