CVE-2003-0389

Cross-site scripting XSS vulnerability in the secure redirect function of RSA ACE/Agent 5.0 for Windows, and 5.x for Web, allows remote attackers to insert arbitrary web script and possibly cause users to enter a passphrase via a GET request containing the script...

CVE-2003-0449

Progress Database 9.1 to 9.1D06 trusts user input to find and load libraries using dlopen, which allows local users to gain privileges via 1 a PATH environment variable that points to malicious libraries, as demonstrated using libjutil.so inproapsv, or 2 the -installdir command line parameter, as...

CVE-2003-0427

CVE-2003-0427 describes a buffer overflow in mikmod 3.1.6 and earlier triggered by an archive containing a file with a long filename, enabling remote code execution. The issue is documented across multiple advisories (RHSA-2005:506, CESA-2005:506, Debian DSA-320, CentOS/Nessus entries) and affect...

CVE-2003-0381

CVE-2003-0381 affects noweb 2.9 and earlier. The vulnerability stems from insecure temporary file creation in the noroff script, enabling a local user to overwrite arbitrary files. Public references in Debian DSA-323-1 and the OpenVAS Debian advisory corroborate the issue; no exploitation details...

CVE-2003-0437

Buffer overflow in search.cgi for mnoGoSearch 3.2.10 allows remote attackers to execute arbitrary code via a long tmplt parameter...

CVE-2003-0447

The Custom HTTP Errors capability in Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute script in the Local Zone via an argument to shdocvw.dll that causes a "javascript:" link to be generated...

CVE-2003-0450

The CVE-2003-0450 issue affects Cistron RADIUS daemon (radiusd-cistron) older than or equal to 1.6.6. The vulnerability arises when processing a large NAS-Port attribute, which is interpreted as a negative value and triggers a buffer overflow. This can lead to a remote denial of service and, in s...

CVE-2003-0446

Cross-site scripting XSS in Internet Explorer 5.5 and 6.0, possibly in a component that is also used by other Microsoft products, allows remote attackers to insert arbitrary web script via an XML file that contains a parse error, which inserts the script in the resulting error message...

CVE-2003-0446

The CVE-2003-0446 entry concerns Cross-site Scripting (XSS) in Internet Explorer 5.5 and 6.0, potentially in a shared component used by other Microsoft products. The vulnerability arises when processing an XML file that contains a parse error, which allows remote attackers to inject arbitrary web...

CVE-2003-0389

RSA ACE/Agent (Web) 5.x is affected by an XSS vulnerability in the secure redirect/login handling. Public advisories (SEC-CONSULT/Sec-20051025-1) reference RSA ACE/Agent Web 5.1 and 5.1.1 as vulnerable, exploitable via an unfiltered parameter (e.g., GET or form field like postdata) on web login f...

CVE-2003-0442

Cross-site scripting XSS vulnerability in the transparent SID support capability for PHP before 4.3.2 session.usetranssid allows remote attackers to insert arbitrary script via the PHPSESSID parameter...

CVE-2003-0442

The CVE-2003-0442 issue concerns the PHP4 transparent session ID feature (session.use_trans_sid). Multiple sources describe a Cross-Site Scripting (XSS) vulnerability in PHP4 prior to 4.3.2 where the PHPSESSID parameter could be used by a remote attacker to inject scripts. The Debian advisory DSA...

CVE-2003-0450

Cistron RADIUS daemon radiusd-cistron 1.6.6 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large value in an NAS-Port attribute, which is interpreted as a negative number and causes a buffer overflow...

CVE-2003-0448

Portmon 1.7 and possibly earlier versions allows local users to read and write arbitrary files via the 1 -c host file or 2 -l log file command line options...

CVE-2003-0436

The CVE-2003-0436 issue affects mnoGoSearch 3.1.20, with a buffer overflow in search.cgi triggered by a long ul parameter that enables remote code execution with the webserver’s privileges. The Conectiva advisory Colorado 2003:711 notes this vulnerability and provides upgrade guidance to a newer ...

CVE-2003-0437

The CVE-2003-0437 entry concerns the mnoGoSearch 3.2.10 search.cgi CGI. A buffer overflow is triggered by a long tmplt parameter, allowing remote attackers to execute arbitrary code. Connected sources corroborate a history of remote-overflow vulnerabilities in the mnoGoSearch search.cgi component...

CVE-2003-0447

The CVE-2003-0447 issue affects Internet Explorer versions 5.01, 5.5 and 6.0, where the Custom HTTP Errors capability can be abused via an argument to shdocvw.dll to generate a javascript: link, enabling remote script execution in the Local Zone. The vulnerability is described as allowing remote ...

CVE-2003-0449

Progress Database 9.1 to 9.1D06 is affected by an input-trust flaw in library loading via dlopen. Local users can exploit this by placing malicious libraries referenced through PATH or via the -installdir parameter. Affected components include libjutil.so in_proapsv and librocket_r.so in _dbagent...

CVE-2003-0427

Buffer overflow in mikmod 3.1.6 and earlier allows remote attackers to execute arbitrary code via an archive file that contains a file with a long filename...

CVE-2003-0388

CVE-2003-0388 concerns the pam_wheel module in Linux-PAM where, if the trust option is enabled and use_uid is disabled, local users can spoof getlogin() results and potentially gain privileges. The issue affects Linux-PAM versions up to 0.77 (notably around the pam_wheel and pam_lastlog handling ...