CVE-2003-0154

CVE-2003-0154 affects the Bonsai Mozilla CVS query tool (CGI suite) used to browse CVS repositories. The vulnerability is a cross-site scripting (XSS) flaw that can be triggered via multiple parameters: cvslog.cgi (file, root, rev), cvsblame.cgi (file, root), cvsquery.cgi (various), showcheckins....

CVE-2003-0155

bonsai Mozilla CVS query tool allows remote attackers to gain access to the parameters page without authentication...

CVE-2003-0152

Unknown vulnerability in bonsai Mozilla CVS query tool allows remote attackers to execute arbitrary commands as the www-data user...

CVE-2003-0160

Multiple cross-site scripting XSS vulnerabilities in SquirrelMail before 1.2.11 allow remote attackers to inject arbitrary HTML code and steal information from a client's web browser...

CVE-2003-0162

CVE-2003-0162 affects Ecartis 1.0.0 (formerly listar) prior to the 20030227 snapshot. The vulnerability lets a remote attacker reset other users’ passwords and gain privileges by tampering with hidden HTML form fields. Debian and OpenVAS records tie this to a remote password-change flaw in ecarti...

CVE-2003-0072

The Key Distribution Center KDC in Kerberos 5 krb5 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service crash on KDCs within the same realm using a certain protocol request that causes an out-of-bounds read of an array aka "array overrun"...

CVE-2003-0152

CVE-2003-0152 concerns the Bonsai Mozilla CVS query tool CGI, allowing remote execution of arbitrary commands as www-data. Public records (Debian DSA-265) show fixes in Bonsai updates (e.g., bonsai 1.3+cvs20020224-1woody1 for woody; later fixes for sid). OpenVAS/Nessus entries corroborate multipl...

CVE-2003-0162

Ecartis 1.0.0 formerly listar before snapshot 20030227 allows remote attackers to reset passwords of other users and gain privileges by modifying hidden form fields in the HTML page...

CVE-2003-0153

bonsai Mozilla CVS query tool leaks the absolute pathname of the tool in certain error messages generated by 1 cvslog.cgi, 2 cvsview2.cgi, or 3 multidiff.cgi...

CVE-2003-0160

CVE-2003-0160 affects SquirrelMail before 1.2.11. The vulnerability is described as multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary HTML and steal information from a client’s web browser. The provided documents do not specify the root cause details or a r...

CVE-2003-0155

CVE-2003-0155 affects bonsai, the Mozilla CVS query tool. It allows remote attackers to access the parameters page without authentication, exposing configuration parameters. CVSS v2 base score is 5.0 (medium) with Network attack vector, low attack complexity, no authentication required, and parti...

CVE-2003-0159

Heap-based buffer overflow in the NTLMSSP code for Ethereal 0.9.9 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code...

CVE-2003-0028

Integer overflow in the xdrmemgetbytes function, and possibly other functions, of XDR external data representation libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different...

J Walk Application Server Encoded Directory Traversal Arbitrary File Access

The version of J Walk running on the remote host has a directory traversal vulnerability. It is possible to read arbitrary files by prepending '.%252e/.%2523' to a filename. A remote attacker could exploit this to read sensitive information that might be used to mount further attacks. %NASLMINLEV...

CVE-2003-0158

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2003-0139. Reason: This candidate is a reservation duplicate of CVE-2003-0139 due to incomplete coordination. Notes: All CVE users should reference CVE-2003-0139 instead of this candidate. All references and descriptions in this...

CVE-2003-0131

The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS 1 v1.5 padding that cause OpenSSL to leak...

CVE-2003-0128

The tryuudecoding function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a malicious uuencoded UUE header, possibly triggering a heap-based buffer overflow...

CVE-2003-0150

MySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain root privileges by using the "SELECT INFO OUTFILE" operator to overwrite a configuration file and cause mysql to run as root upon restart, as demonstrated by modifying my.cnf...

CVE-2003-0140

Buffer overflow in Mutt 1.4.0 and possibly earlier versions, 1.5.x up to 1.5.3, and other programs that use Mutt code such as Balsa before 2.0.10, allows a remote malicious IMAP server to cause a denial of service crash and possibly execute arbitrary code via a crafted folder...

CVE-2003-0139

Certain weaknesses in the implementation of version 4 of the Kerberos protocol krb4 in the krb5 distribution, when triple-DES keys are used to key krb4 services, allow an attacker to create krb4 tickets for unauthorized principals using a cut-and-paste attack and "ticket splicing."...