Overview 2,989 matches · 42 in Waratek scope · 3 protected · 8 exploited · 0 CISA KEV · 902 public PoC · 34 EPSS ≥ 0.5
2,989matches
42in Waratek scope1.4%
3protected0.1%
8exploited0.3%
0CISA KEV0.0%
902public PoC30.2%
34EPSS ≥ 0.51.1%
Protected by Waratek
3
0.1%
Rule in development
0
0.0%
Mitigation candidate
13
0.4%
No exploit published
26
0.9%
Outside Waratek scope
12
0.4%
Not applicable
2,935
98.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
3
0.1%
partly blocked
0
0.0%
not blocked
2,986
99.9%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
8
0.3%
Working exploit published
901
30.1%
Proof of concept only
0
0.0%
Forecast only
5
0.2%
No public exploit
2,075
69.4%
split by
peak 980 / year
19891
Not applicable1
Medium1
not blocked1
No public exploit1
19902
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
19914
Not applicable4
Medium4
not blocked4
No public exploit4
19920
19933
Not applicable3
Medium3
not blocked3
No public exploit3
199410
Not applicable10
Medium10
not blocked10
Working exploit published2
No public exploit8
19956
Not applicable6
Medium6
not blocked6
Working exploit published2
No public exploit4
199621
Not applicable21
Medium21
not blocked21
Working exploit published5
No public exploit16
199789
Not applicable89
Medium89
not blocked89
Working exploit published18
No public exploit71
199885
Not applicable85
Medium85
not blocked85
Working exploit published11
No public exploit74
1999357
Outside Waratek scope1
Not applicable356
Medium357
not blocked357
Working exploit published119
No public exploit238
2000467
Mitigation candidate4
No exploit published3
Not applicable460
Medium467
not blocked467
Exploited2
Working exploit published195
No public exploit270
2001706
Mitigation candidate2
No exploit published4
Outside Waratek scope7
Not applicable693
Medium706
not blocked706
Exploited3
Working exploit published219
Forecast only2
No public exploit482
2002980
Protected by Waratek2
Mitigation candidate6
No exploit published15
Outside Waratek scope4
Not applicable953
Medium980
blocked by ARMR today2
not blocked978
Exploited3
Working exploit published246
Forecast only3
No public exploit728
2003258
Protected by Waratek1
Mitigation candidate1
No exploit published4
Not applicable252
Medium258
blocked by ARMR today1
not blocked257
Working exploit published83
No public exploit175
19891991199319951997199920012003
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2003-0417 | Medium | 2003-06-30 | Not applicable | No public exploit | Directory traversal vulnerability in Son hServer 0.2 allows remote attackers to read arbitrary files via ".|." (modified dot-dot) sequences. |
| CVE-2003-0416 | Medium | 2003-06-30 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in index.cgi for Bandmin 1.4 allows remote attackers to insert arbitrary HTML or script via (1) the year parameter in a showmonth action, (2) the month parameter in a showmonth action, or (3) the host parameter in a showhost action. |
| CVE-2003-0415 | Medium | 2003-06-30 | Not applicable | No public exploit | Remote PC Access Server 2.2 allows remote attackers to cause a denial of service (crash) by receiving packets from the server and sending them back to the server. |
| CVE-2003-0413 | Medium | 2003-06-30 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the webapps-simple sample application for (1) Sun ONE Application Server 7.0 for Windows 2000/XP or (2) Sun Java System Web Server 6.1 allows remote attackers to insert arbitrary web script or HTML via an HTTP request that generates an "Invalid JSP file" error, which inserts the text in the resulting error message. |
| CVE-2003-0412 | Medium | 2003-06-30 | Not applicable | No public exploit | Sun ONE Application Server 7.0 for Windows 2000/XP does not log the complete URI of a long HTTP request, which could allow remote attackers to hide malicious activities. |
| CVE-2003-0405 | Medium | 2003-06-30 | Not applicable | No public exploit | Vignette StoryServer 5 and Vignette V/6 allows remote attackers to execute arbitrary TCL code via (1) an HTTP query or cookie which is processed in the NEEDS command, or (2) an HTTP Referrer that is processed in the VALID_PATHS command. |
| CVE-2003-0404 | Medium | 2003-06-30 | Not applicable | Working exploit published | Multiple Cross Site Scripting (XSS) vulnerabilities in Vignette StoryServer 4 and 5, and Vignette V/5 and V/6, allow remote attackers to insert arbitrary HTML and script via text variables, as demonstrated using the errInfo parameter of the default login template. |
| CVE-2003-0402 | Medium | 2003-06-30 | Not applicable | No public exploit | The default login template (/vgn/login) in Vignette StoryServer 5 and Vignette V/5 generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks. |
| CVE-2003-0401 | Medium | 2003-06-30 | Not applicable | No public exploit | Vignette StoryServer and Vignette V/5 allows remote attackers to obtain sensitive information via a request for the /vgn/style template. |
| CVE-2003-0400 | Medium | 2003-06-30 | Not applicable | Working exploit published | Vignette StoryServer and Vignette V/5 does not properly calculate the size of text variables, which causes Vignette to return unauthorized portions of memory, as demonstrated using the "-->" string in a CookieName argument to the login template, referred to as a "memory leak" in some reports. |
| CVE-2003-0376 | Medium | 2003-06-16 | Not applicable | Working exploit published | Buffer overflow in Eudora 5.2.1 allows remote attackers to cause a denial of service (crash and failed restart) and possibly execute arbitrary code via an Attachment Converted argument with a large number of . (dot) characters. |
| CVE-2003-0375 | Medium | 2003-06-16 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in member.php of XMBforum XMB 1.8.x (aka Partagium) allows remote attackers to insert arbitrary HTML and web script via the "member" parameter. |
| CVE-2003-0373 | Medium | 2003-06-16 | Not applicable | No public exploit | Multiple buffer overflows in libnasl in Nessus before 2.0.6 allow local users with plugin upload privileges to cause a denial of service (core dump) and possibly execute arbitrary code via (1) a long proto argument to the scanner_add_port function, (2) a long user argument to the ftp_log_in function, (3) a long pass argument to the ftp_log_in function. |
| CVE-2003-0372 | Medium | 2003-06-16 | Not applicable | Working exploit published | Signed integer vulnerability in libnasl in Nessus before 2.0.6 allows local users with plugin upload privileges to cause a denial of service (core dump) and possibly execute arbitrary code by causing a negative argument to be provided to the insstr function as used in a NASL script. |
| CVE-2003-0365 | Medium | 2003-06-16 | Not applicable | No public exploit | ICQLite 2003a creates the ICQ Lite directory with an ACE for "Full Control" privileges for Interactive Users, which allows local users to gain privileges as other users by replacing the executables with malicious programs. |
| CVE-2003-0364 | Medium | 2003-06-16 | Not applicable | No public exploit | The TCP/IP fragment reassembly handling in the Linux kernel 2.4 allows remote attackers to cause a denial of service (CPU consumption) via certain packets that cause a large number of hash table collisions. |
| CVE-2003-0316 | Medium | 2003-06-16 | Not applicable | No public exploit | Venturi Client before 2.2, as used in certain Fourelle and Venturi Wireless products, can be used as an open proxy for various protocols, including an open relay for SMTP, which allows it to be abused by spammers. |
| CVE-2003-0314 | Medium | 2003-06-16 | Not applicable | Working exploit published | Snowblind Web Server 1.0 allows remote attackers to cause a denial of service (crash) via a URL that ends in a "</" sequence. |
| CVE-2003-0313 | Medium | 2003-06-16 | Not applicable | No public exploit | Directory traversal vulnerability in Snowblind Web Server 1.0 allows remote attackers to list arbitrary directory contents via a ... (triple dot) in an HTTP request. |
| CVE-2003-0312 | Medium | 2003-06-16 | Not applicable | Working exploit published | Directory traversal vulnerability in Snowblind Web Server 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP request. |
| CVE-2003-0310 | Medium | 2003-06-16 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in articleview.php for eZ publish 2.2 allows remote attackers to insert arbitrary web script. |
| CVE-2003-0302 | Medium | 2003-06-16 | Not applicable | No public exploit | The IMAP Client for Eudora 5.2.1 allows remote malicious IMAP servers to cause a denial of service and possibly execute arbitrary code via certain large literal size values that cause either integer signedness errors or integer overflow errors. |
| CVE-2003-0301 | Medium | 2003-06-16 | Not applicable | No public exploit | The IMAP Client for Outlook Express 6.00.2800.1106 allows remote malicious IMAP servers to cause a denial of service (crash) via certain large literal size values that cause either integer signedness errors or integer overflow errors. |
| CVE-2003-0300 | Medium | 2003-06-16 | Not applicable | No public exploit | The IMAP Client for Sylpheed 0.8.11 allows remote malicious IMAP servers to cause a denial of service (crash) via certain large literal size values that cause either integer signedness errors or integer overflow errors. |
| CVE-2003-0295 | Medium | 2003-06-16 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in private.php for vBulletin 3.0.0 Beta 2 allows remote attackers to inject arbitrary web script and HTML via the "Preview Message" capability. |
| CVE-2003-0294 | Medium | 2003-06-16 | Not applicable | No public exploit | autohtml.php in php-proxima 6.0 and earlier allows remote attackers to read arbitrary files via the name parameter in a modload operation. |
| CVE-2003-0293 | Medium | 2003-06-16 | Not applicable | Working exploit published | PalmOS allows remote attackers to cause a denial of service (CPU consumption) via a flood of ICMP echo request (ping) packets. |
| CVE-2003-0292 | Medium | 2003-06-16 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Inktomi Traffic-Server 5.5.1 allows remote attackers to insert arbitrary web script or HTML into an error page that appears to come from the domain that the client is visiting, aka "Man-in-the-Middle" XSS. |
| CVE-2003-0291 | Medium | 2003-06-16 | Not applicable | No public exploit | 3com OfficeConnect Remote 812 ADSL Router 1.1.7 does not properly clear memory from DHCP responses, which allows remote attackers to identify the contents of previous HTTP requests by sniffing DHCP packets. |
| CVE-2003-0290 | Medium | 2003-06-16 | Not applicable | Working exploit published | Memory leak in eServ 2.9x allows remote attackers to cause a denial of service (memory exhaustion) via a large number of connections, whose memory is not freed when the connection is terminated. |
| CVE-2003-0287 | Medium | 2003-06-16 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Movable Type before 2.6, and possibly other versions including 2.63, allows remote attackers to insert arbitrary web script or HTML via the Name textbox, possibly when the "Allow HTML in comments?" option is enabled. |
| CVE-2003-0285 | Medium | 2003-06-16 | Not applicable | No public exploit | IBM AIX 5.2 and earlier distributes Sendmail with a configuration file (sendmail.cf) with the (1) promiscuous_relay, (2) accept_unresolvable_domains, and (3) accept_unqualified_senders features enabled, which allows Sendmail to be used as an open mail relay for sending spam e-mail. |
| CVE-2003-0283 | Medium | 2003-06-16 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in Phorum before 3.4.3 allows remote attackers to inject arbitrary web script and HTML tags via a message with a "<<" before a tag name in the (1) subject, (2) author's name, or (3) author's e-mail. |
| CVE-2003-0281 | Medium | 2003-06-16 | Not applicable | Working exploit published | Buffer overflow in Firebird 1.0.2 and other versions before 1.5, and possibly other products that use the InterBase codebase, allows local users to execute arbitrary code via a long INTERBASE environment variable when calling (1) gds_inet_server, (2) gds_lock_mgr, or (3) gds_drop. |
| CVE-2003-0278 | Medium | 2003-06-16 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in normal_html.cgi in Happycgi.com Happymall 4.3 and 4.4 allows remote attackers to insert arbitrary web script via the file parameter. |
| CVE-2003-0277 | Medium | 2003-06-16 | Not applicable | Working exploit published | Directory traversal vulnerability in normal_html.cgi in Happycgi.com Happymall 4.3 and 4.4 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the file parameter. |
| CVE-2003-0276 | Medium | 2003-06-16 | Not applicable | Working exploit published | Buffer overflow in Pi3Web 2.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a GET request with a large number of / characters. |
| CVE-2003-0275 | Medium | 2003-06-16 | Not applicable | No public exploit | SSI.php in YaBB SE 1.5.2 allows remote attackers to execute arbitrary PHP code by modifying the sourcedir parameter to reference a URL on a remote web server that contains the code. |
| CVE-2003-0247 | Medium | 2003-06-16 | Not applicable | No public exploit | Unknown vulnerability in the TTY layer of the Linux kernel 2.4 allows attackers to cause a denial of service ("kernel oops"). |
| CVE-2003-0217 | Medium | 2003-06-16 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Neoteris Instant Virtual Extranet (IVE) 3.01 and earlier allows remote attackers to insert arbitrary web script and bypass authentication via a certain CGI script. |
| CVE-2003-0195 | Medium | 2003-06-16 | Not applicable | Working exploit published | CUPS before 1.1.19 allows remote attackers to cause a denial of service via a partial printing request to the IPP port (631), which does not time out. |
| CVE-2003-0420 | Medium | 2003-06-13 | Not applicable | No public exploit | Information leak in dsimportexport for Apple Macintosh OS X Server 10.2.6 allows local users to obtain the username and password of the account running the tool. |
| CVE-2003-0362 | Medium | 2003-06-09 | Not applicable | No public exploit | Buffer overflow in gPS before 0.10.2 may allow local users to cause a denial of service (SIGSEGV) in rgpsp via long command lines. |
| CVE-2003-0358 | Medium | 2003-06-09 | Not applicable | Working exploit published | Buffer overflow in (1) nethack 3.4.0 and earlier, and (2) falconseye 1.9.3 and earlier, which is based on nethack, allows local users to gain privileges via a long -s command line option. |
| CVE-2003-0355 | Medium | 2003-06-09 | Not applicable | No public exploit | Safari 1.0 Beta 2 (v73) and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates. |
| CVE-2003-0330 | Medium | 2003-06-09 | Not applicable | No public exploit | Buffer overflow in unknown versions of Maelstrom allows local users to execute arbitrary code via a long -player command line argument. |
| CVE-2003-0329 | Medium | 2003-06-09 | Not applicable | No public exploit | CesarFTP 0.99g stores user names and passwords in plaintext in the settings.ini file, which could allow local users to gain privileges. |
| CVE-2003-0326 | Medium | 2003-06-09 | Not applicable | No public exploit | Integer overflow in parse_decode_path() of slocate may allow attackers to execute arbitrary code via a LOCATE_PATH with a large number of ":" (colon) characters, whose count is used in a call to malloc. |
| CVE-2003-0325 | Medium | 2003-06-09 | Not applicable | Working exploit published | Buffer overflow in Maelstrom 3.0.6, 3.0.5, and earlier allows local users to execute arbitrary code via a long -server command line argument. |
| CVE-2003-0322 | Medium | 2003-06-09 | Not applicable | No public exploit | Integer overflow in BitchX IRC client 1.0-0c19 and earlier allows remote malicious IRC servers to cause a denial of service (crash). |
| CVE-2003-0318 | Medium | 2003-06-09 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Statistics module for PHP-Nuke 6.0 and earlier allows remote attackers to insert arbitrary web script via the year parameter. |
| CVE-2003-0305 | Medium | 2003-06-09 | Not applicable | No public exploit | The Service Assurance Agent (SAA) in Cisco IOS 12.0 through 12.2, aka Response Time Reporter (RTR), allows remote attackers to cause a denial of service (crash) via malformed RTR packets to port 1967. |
| CVE-2003-0303 | Medium | 2003-06-09 | Not applicable | Working exploit published | SQL injection vulnerability in one||zero (aka One or Zero) Helpdesk 1.4 rc4 allows remote attackers to modify arbitrary ticket number descriptions via the sg parameter. |
| CVE-2003-0245 | Medium | 2003-06-09 | Not applicable | Working exploit published | Vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library for Apache 2.0.37 through 2.0.45 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors. |
| CVE-2003-0227 | Medium | 2003-06-09 | Not applicable | Working exploit published | The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0 and 2000, nsiislog.dll, allows remote attackers to cause a denial of service in Internet Information Server (IIS) and execute arbitrary code via a certain network request. |
| CVE-2003-0226 | Medium | 2003-06-09 | Not applicable | Working exploit published | Microsoft Internet Information Services (IIS) 5.0 and 5.1 allows remote attackers to cause a denial of service via a long WebDAV request with a (1) PROPFIND or (2) SEARCH method, which generates an error condition that is not properly handled. |
| CVE-2003-0225 | Medium | 2003-06-09 | Not applicable | No public exploit | The ASP function Response.AddHeader in Microsoft Internet Information Server (IIS) 4.0 and 5.0 does not limit memory requests when constructing headers, which allow remote attackers to generate a large header to cause a denial of service (memory consumption) with an ASP page. |
| CVE-2003-0223 | Medium | 2003-06-09 | Not applicable | No public exploit | Cross-site scripting vulnerability (XSS) in the ASP function responsible for redirection in Microsoft Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to embed a URL containing script in a redirection message. |
| CVE-2003-0194 | Medium | 2003-06-09 | Not applicable | No public exploit | tcpdump does not properly drop privileges to the pcap user when starting up. |
| CVE-2003-0189 | Medium | 2003-06-09 | Not applicable | No public exploit | The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions, which allows remote attackers to cause a denial of service (failed Basic authentication with valid usernames and passwords) when a threaded MPM is used. |
| CVE-2002-1564 | Medium | 2003-06-09 | Not applicable | No public exploit | Internet Explorer 5.5 and 6.0 allows remote attackers to steal potentially sensitive information from cookies via a cookie that contains script which is executed when a page is loaded, aka the "Script within Cookies Reading Cookies" vulnerability. |
| CVE-2002-1462 | Medium | 2003-06-09 | Not applicable | No public exploit | details2.php in OrganicPHP PHP-affiliate 1.0, and possibly later versions, allows remote attackers to modify information of other users by modifying certain hidden form fields. |
| CVE-2002-1460 | Medium | 2003-06-09 | Not applicable | No public exploit | L-Forum 2.40 and earlier does not properly verify whether a file was uploaded or if the associated variables were set by POST (attachment, attachment_name, attachment_size and attachment_type), which allows remote attackers to read arbitrary files. |
| CVE-2002-1455 | Medium | 2003-06-09 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in OmniHTTPd allow remote attackers to insert script or HTML into web pages via (1) test.php, (2) test.shtml, or (3) redir.exe. |
| CVE-2002-1454 | Medium | 2003-06-09 | Not applicable | No public exploit | MyWebServer 1.0.2 allows remote attackers to determine the absolute path of the web document root via a request for a directory that does not exist, which leaks the pathname in an error message. |
| CVE-2003-1206 | Medium | 2003-06-03 | Not applicable | No public exploit | Format string vulnerability in Crob FTP Server 2.60.1 allows remote attackers to cause a denial of service (crash) via "%s" or "%n" sequences in (1) the username during login, or other FTP commands such as (2) dir. |
| CVE-2003-1069 | Medium | 2003-06-03 | Not applicable | No public exploit | The Telnet daemon (in.telnetd) for Solaris 2.6 through 9 allows remote attackers to cause a denial of service (CPU consumption by infinite loop). |
| CVE-2003-0273 | Medium | 2003-05-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the web interface for Request Tracker (RT) 1.0 through 1.0.7 allows remote attackers to execute script via message bodies. |
| CVE-2003-0268 | Medium | 2003-05-27 | Not applicable | No public exploit | SLWebMail 3 on Windows systems allows remote attackers to identify the full path of the server via invalid requests to DLLs such as WebMailReq.dll, which reveals the path in an error message. |
| CVE-2003-0267 | Medium | 2003-05-27 | Not applicable | No public exploit | ShowGodLog.dll in SLWebMail 3 on Windows systems allows remote attackers to read arbitrary files by directly calling ShowGodLog.dll with an argument specifying the full path of the target file. |
| CVE-2003-0265 | Medium | 2003-05-27 | Not applicable | Working exploit published | Race condition in SDBINST for SAP database 7.3.0.29 creates critical files with world-writable permissions before initializing the setuid bits, which allows local attackers to gain root privileges by modifying the files before the permissions are changed. |
| CVE-2003-0261 | Medium | 2003-05-27 | Not applicable | No public exploit | fuzz 0.6 and earlier creates temporary files insecurely, which could allow local users to gain root privileges. |
| CVE-2003-0260 | Medium | 2003-05-27 | Not applicable | No public exploit | Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client 2.x.x through 3.6.7A allow remote attackers to cause a denial of service (slowdown and possibly reload) via a flood of malformed ICMP packets. |
| CVE-2003-0259 | Medium | 2003-05-27 | Not applicable | No public exploit | Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client 2.x.x through 3.6.7 allows remote attackers to cause a denial of service (reload) via a malformed SSH initialization packet. |
| CVE-2003-0244 | Medium | 2003-05-27 | Not applicable | No public exploit | The route cache implementation in Linux 2.4, and the Netfilter IP conntrack module, allows remote attackers to cause a denial of service (CPU consumption) via packets with forged source addresses that cause a large number of hash table collisions. |
| CVE-2003-0239 | Medium | 2003-05-27 | Not applicable | No public exploit | icqateimg32.dll parsing/rendering library in Mirabilis ICQ Pro 2003a allows remote attackers to cause a denial of service via malformed GIF89a headers that do not contain a GCT (Global Color Table) or an LCT (Local Color Table) after an Image Descriptor. |
| CVE-2003-0238 | Medium | 2003-05-27 | Not applicable | No public exploit | The Message Session window in Mirabilis ICQ Pro 2003a allows remote attackers to cause a denial of service (CPU consumption) by spoofing the address of an ADS server and sending HTML with a -1 width in a table tag. |
| CVE-2003-0337 | Medium | 2003-05-22 | Not applicable | No public exploit | The ckconfig command in lsadmin for Load Sharing Facility (LSF) 5.1 allows local users to execute arbitrary programs by modifying the LSF_ENVDIR environment variable to reference an alternate lsf.conf file, then modifying LSF_SERVERDIR to point to a malicious lim program, which lsadmin then executes. |
| CVE-2003-0336 | Medium | 2003-05-22 | Not applicable | Working exploit published | Qualcomm Eudora 5.2.1 allows remote attackers to read arbitrary files via an email message with a carriage return (CR) character in a spoofed "Attachment Converted:" string, which is not properly handled by Eudora. |
| CVE-2003-0343 | Medium | 2003-05-21 | Not applicable | No public exploit | BlackMoon FTP Server 2.6 Free Edition, and possibly other distributions and versions, generates an "Account does not exist" error message when an invalid username is entered, which makes it easier for remote attackers to conduct brute force attacks. |
| CVE-2003-0341 | Medium | 2003-05-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Owl Intranet Engine 0.71 and earlier allows remote attackers to insert arbitrary script via the Search field. |
| CVE-2003-0338 | Medium | 2003-05-21 | Not applicable | Working exploit published | Directory traversal vulnerability in WsMp3 daemon (WsMp3d) 0.0.10 and earlier allows remote attackers to read and execute arbitrary files via .. (dot dot) sequences in HTTP GET or POST requests. |
| CVE-2003-0342 | Medium | 2003-05-20 | Not applicable | No public exploit | BlackMoon FTP Server 2.6 Free Edition, and possibly other distributions and versions, stores user names and passwords in plaintext in the blackmoon.mdb file, which can allow local users to gain privileges. |
| CVE-2003-0214 | Medium | 2003-05-12 | Not applicable | No public exploit | run-mailcap in mime-support 3.22 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files. |
| CVE-2003-0206 | Medium | 2003-05-12 | Not applicable | No public exploit | gkrellm-newsticker gkrellm plugin before 0.3-3.1 allows remote attackers to cause a denial of service (crash) via (1) link or (2) title elements that contain multiple lines. |
| CVE-2003-0190 | Medium | 2003-05-12 | Not applicable | Working exploit published | OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack. |
| CVE-2003-0116 | Medium | 2003-05-12 | Not applicable | No public exploit | Microsoft Internet Explorer 5.01, 5.5 and 6.0 does not properly check the Cascading Style Sheet input parameter for Modal dialogs, which allows remote attackers to read files on the local system via a web page containing script that creates a dialog and then accesses the target files, aka "Modal Dialog script execution." |
| CVE-2003-0114 | Medium | 2003-05-12 | Not applicable | No public exploit | The file upload control in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to automatically upload files from the local system via a web page containing a script to upload the files. |
| CVE-2003-0112 | Medium | 2003-05-12 | Not applicable | No public exploit | Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger. |
| CVE-2002-1562 | Medium | 2003-05-12 | Not applicable | No public exploit | Directory traversal vulnerability in thttpd, when using virtual hosting, allows remote attackers to read arbitrary files via .. (dot dot) sequences in the Host: header. |
| CVE-2003-1146 | Medium | 2003-05-11 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in John Beatty Easy PHP Photo Album 1.0 allows remote attackers to inject arbitrary web script or HTML via the dir parameter. |
| CVE-2003-0211 | Medium | 2003-05-05 | Not applicable | Working exploit published | Memory leak in xinetd 2.3.10 allows remote attackers to cause a denial of service (memory consumption) via a large number of rejected connections. |
| CVE-2003-0208 | Medium | 2003-05-05 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Macromedia Flash ad user tracking capability allows remote attackers to insert arbitrary Javascript via the clickTAG field. |
| CVE-2003-0198 | Medium | 2003-05-05 | Not applicable | No public exploit | Mac OS X before 10.2.5 allows guest users to modify the permissions of the DropBox folder and read unauthorized files. |
| CVE-2003-0163 | Medium | 2003-05-05 | Not applicable | No public exploit | decrypt_msg for the Gaim-Encryption GAIM plugin 1.15 and earlier does not properly validate a message length parameter, which allows remote attackers to cause a denial of service (crash) via a negative length, which overwrites arbitrary heap memory with a zero byte. |
| CVE-2003-0133 | Medium | 2003-05-05 | Not applicable | No public exploit | GtkHTML, as included in Evolution before 1.2.4, allows remote attackers to cause a denial of service (crash) via certain malformed messages. |
| CVE-2003-0110 | Medium | 2003-05-05 | Not applicable | No public exploit | The Winsock Proxy service in Microsoft Proxy Server 2.0 and the Microsoft Firewall service in Internet Security and Acceleration (ISA) Server 2000 allow remote attackers to cause a denial of service (CPU consumption or packet storm) via a spoofed, malformed packet to UDP port 1745. |
| CVE-2003-1070 | Medium | 2003-04-28 | Not applicable | No public exploit | Unknown vulnerability in rpcbind for Solaris 2.6 through 9 allows remote attackers to cause a denial of service (rpcbind crash). |
| CVE-2002-1483 | Medium | 2003-04-22 | Not applicable | Working exploit published | db4web_c and db4web_c.exe programs in DB4Web 3.4 and 3.6 allow remote attackers to read arbitrary files via an HTTP request whose argument is a filename of the form (1) C: (drive letter), (2) //absolute/path (double-slash), or (3) .. (dot-dot). |
| CVE-2002-1480 | Medium | 2003-04-22 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in phpGB before 1.20 allows remote attackers to inject arbitrary HTML or script into guestbook pages, which is executed when the administrator deletes the entry. |