WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Published to 2003-12-31✕
Overview 8,024 matches · 104 in Waratek scope · 6 protected · 46 exploited · 1 CISA KEV · 2,422 public PoC · 136 EPSS ≥ 0.5
8,024matches 104in Waratek scope1.3% 6protected0.1% 46exploited0.6% 1CISA KEV0.0% 2,422public PoC30.2% 136EPSS ≥ 0.51.7%
Protected by Waratek 6 0.1% Rule in development 0 0.0% Mitigation candidate 23 0.3% No exploit published 75 0.9% Outside Waratek scope 35 0.4% Not applicable 7,812 97.4% Withdrawn CVE 73 0.9%
Critical 40 0.5% High 3,747 46.7% Medium 3,478 43.3% Low 686 8.5% None 0 0.0% Unknown 73 0.9%
blocked by ARMR today 6 0.1% partly blocked 0 0.0% not blocked 8,018 99.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 46 0.6% Working exploit published 2,389 29.8% Proof of concept only 0 0.0% Forecast only 16 0.2% No public exploit 5,573 69.5%
split by peak 2,170 / year
Withdrawn CVE: 73Not applicable: 7,812Outside Waratek scope: 35No exploit published: 75Mitigation candidate: 23Protected by Waratek: 6 Unknown: 73Low: 686Medium: 3,478High: 3,747Critical: 40 not blocked: 8,018blocked by ARMR today: 6 No public exploit: 5,573Forecast only: 16Working exploit published: 2,389Exploited: 46
19882 Not applicable2 High2 not blocked2 Working exploit published1 No public exploit1 19893 Not applicable3 High2 Medium1 not blocked3 No public exploit3 199011 Not applicable11 High8 Medium2 Low1 not blocked11 Working exploit published1 No public exploit10 199115 Not applicable15 High11 Medium4 not blocked15 Working exploit published2 No public exploit13 199214 Not applicable13 Withdrawn CVE1 High12 Low1 Unknown1 not blocked14 No public exploit14 199313 Not applicable13 High8 Medium3 Low2 not blocked13 No public exploit13 199426 Not applicable25 Withdrawn CVE1 High14 Medium10 Low1 Unknown1 not blocked26 Working exploit published6 No public exploit20 199525 Not applicable25 Critical1 High17 Medium6 Low1 not blocked25 Working exploit published5 No public exploit20 199675 No exploit published1 Not applicable73 Withdrawn CVE1 Critical1 High43 Medium21 Low9 Unknown1 not blocked75 Working exploit published18 Forecast only1 No public exploit56 1997253 Not applicable252 Withdrawn CVE1 Critical1 High143 Medium89 Low19 Unknown1 not blocked253 Exploited2 Working exploit published73 Forecast only2 No public exploit176 1998247 Not applicable246 Withdrawn CVE1 Critical1 High137 Medium85 Low23 Unknown1 not blocked247 Exploited1 Working exploit published50 No public exploit196 1999923 No exploit published2 Outside Waratek scope1 Not applicable891 Withdrawn CVE29 Critical3 High423 Medium357 Low111 Unknown29 not blocked923 Exploited2 Working exploit published282 No public exploit639 20001,020 Mitigation candidate6 No exploit published6 Outside Waratek scope2 Not applicable1,005 Withdrawn CVE1 Critical2 High454 Medium467 Low96 Unknown1 not blocked1,020 Exploited5 Working exploit published427 Forecast only1 No public exploit587 20011,679 Protected by Waratek1 Mitigation candidate2 No exploit published10 Outside Waratek scope14 Not applicable1,649 Withdrawn CVE3 Critical12 High776 Medium706 Low182 Unknown3 blocked by ARMR today1 not blocked1,678 Exploited14 Working exploit published480 Forecast only2 No public exploit1,183 20022,170 Protected by Waratek3 Mitigation candidate8 No exploit published26 Outside Waratek scope12 Not applicable2,107 Withdrawn CVE14 Critical10 High1,023 Medium980 Low143 Unknown14 blocked by ARMR today3 not blocked2,167 Exploited12 Working exploit published545 Forecast only9 No public exploit1,604 20031,548 Protected by Waratek2 Mitigation candidate7 No exploit published30 Outside Waratek scope6 Not applicable1,482 Withdrawn CVE21 Critical9 High674 Medium747 Low97 Unknown21 blocked by ARMR today2 not blocked1,546 Exploited10 Working exploit published499 Forecast only1 No public exploit1,038
19891991199319951997199920012003
8,024 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 81 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2003-1564 Medium 2003-12-31 Not applicable No public exploit libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack."
CVE-2003-1563 Medium 2003-12-31 Not applicable No public exploit Sun Cluster 2.2 through 3.2 for Oracle Parallel Server / Real Application Clusters (OPS/RAC) allows local users to cause a denial of service (cluster node panic or abort) by launching a daemon listening on a TCP port that would otherwise be used by the Distributed Lock Manager (DLM), possibly involving this daemon responding in a manner that spoofs a cluster reconfiguration.
CVE-2003-1562 High 2003-12-31 Not applicable No public exploit sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.
CVE-2003-1561 Medium 2003-12-31 Not applicable No public exploit Opera, probably before 7.50, sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
CVE-2003-1560 Medium 2003-12-31 Not applicable No public exploit Netscape 4 sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
CVE-2003-1559 Medium 2003-12-31 Not applicable No public exploit Microsoft Internet Explorer 5.22, and other 5 through 6 SP1 versions, sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
CVE-2003-1558 Medium 2003-12-31 Not applicable No public exploit Buffer overflow in httpd.c of fnord 1.6 allows remote attackers to create a denial of service (crash) and possibly execute arbitrary code via a long CGI request passed to the do_cgi function.
CVE-2003-1557 High 2003-12-31 Not applicable No public exploit Off-by-one buffer overflow in spamc of SpamAssassin 2.40 through 2.43, when using BSMTP mode ("-B"), allows remote attackers to execute arbitrary code via email containing headers with leading "." characters.
CVE-2003-1556 Medium 2003-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in cc_guestbook.pl in CGI City CC GuestBook allows remote attackers to inject arbitrary web script or HTML via the (1) name and (2) homepage_title (webpage title) parameters.
CVE-2003-1555 Medium 2003-12-31 Not applicable Working exploit published ScozNet ScozBook 1.1 BETA allows remote attackers to obtain sensitive information via an invalid PG parameter in view.php, which reveals the installation path in an error message.
CVE-2003-1554 Medium 2003-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in scozbook/add.php in ScozNet ScozBook 1.1 BETA allows remote attackers to inject arbitrary web script or HTML via the (1) username, (2) useremail, (3) aim, (4) msn, (5) sitename and (6) siteaddy variables.
CVE-2003-1553 Medium 2003-12-31 Not applicable Working exploit published Haakon Nilsen Simple Internet Publishing System (SIPS) 0.2.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain password and other user information via a direct request to a user-specific configuration directory.
CVE-2003-1552 Medium 2003-12-31 Not applicable No public exploit Unrestricted file upload vulnerability in uploader.php in Uploader 1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/.
CVE-2003-1551 High 2003-12-31 Not applicable No public exploit Unspecified vulnerability in Novell GroupWise 6 SP3 WebAccess before Revision F has unknown impact and attack vectors related to "malicious script."
CVE-2003-1550 Medium 2003-12-31 Not applicable Working exploit published XOOPS 2.0, and possibly earlier versions, allows remote attackers to obtain sensitive information via an invalid xoopsOption parameter, which reveals the installation path in an error message.
CVE-2003-1549 Medium 2003-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in header.php in MyABraCaDaWeb 1.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the ma_kw parameter.
CVE-2003-1548 Medium 2003-12-31 Not applicable Working exploit published MyABraCaDaWeb 1.0.2 and earlier allows remote attackers to obtain sensitive information via an invalid IDAdmin or other parameter, which reveals the installation path in an error message.
CVE-2003-1547 Medium 2003-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in block-Forums.php in the Splatt Forum module for PHP-Nuke 6.x allows remote attackers to inject arbitrary web script or HTML via the subject parameter.
CVE-2003-1546 Medium 2003-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in gbook.php in Filebased guestbook 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the comment section.
CVE-2003-1545 Medium 2003-12-31 Not applicable Working exploit published Absolute path traversal vulnerability in nukestyles.com viewpage.php addon for PHP-Nuke allows remote attackers to read arbitrary files via a full pathname in the file parameter. NOTE: This was originally reported as an issue in PHP-Nuke 6.5, but this is an independent addon.
CVE-2003-1544 Medium 2003-12-31 Not applicable No public exploit Unrestricted critical resource lock in Terminal Services for Windows 2000 before SP4 and Windows XP allows remote authenticated users to cause a denial of service (reboot) by obtaining a read lock on msgina.dll, which prevents msgina.dll from being loaded.
CVE-2003-1543 Medium 2003-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Bajie Http Web Server 0.95zxe, 0.95zxc, and possibly others, allows remote attackers to inject arbitrary web script or HTML via the query string, which is reflected in an error message.
CVE-2003-1542 Medium 2003-12-31 Not applicable No public exploit Directory traversal vulnerability in plugins/file.php in phpWebFileManager before 0.4.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the fm_path parameter.
CVE-2003-1541 Medium 2003-12-31 Not applicable Working exploit published PlanetMoon Guestbook tr3.a stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the admin script password, and other passwords, via a direct request to files/passwd.txt.
CVE-2003-1540 Medium 2003-12-31 Not applicable Working exploit published WF-Chat 1.0 Beta stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain authentication information via a direct request to (1) !pwds.txt and (2) !nicks.txt.
CVE-2003-1539 Medium 2003-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in ONEdotOH Simple File Manager (SFM) before 0.21 allows remote attackers to inject arbitrary web script or HTML via (1) file names and (2) directory names.
CVE-2003-1538 Medium 2003-12-31 Not applicable No public exploit susehelp in SuSE Linux 8.1, Enterprise Server 8, Office Server, and Openexchange Server 4 does not properly filter shell metacharacters, which allows remote attackers to execute arbitrary commands via CGI queries.
CVE-2003-1537 Medium 2003-12-31 Not applicable No public exploit Directory traversal vulnerability in PostNuke 0.723 and earlier allows remote attackers to include arbitrary files named theme.php via the theme parameter to index.php.
CVE-2003-1536 Medium 2003-12-31 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in Codeworx Technologies DCP-Portal 5.3.1 allow remote attackers to inject arbitrary web script or HTML via (1) the q parameter to search.php and (2) the year parameter to calendar.php.
CVE-2003-1535 Medium 2003-12-31 Not applicable Working exploit published Justice Guestbook 1.3 allows remote attackers to obtain the full installation path via a direct request to cfooter.php3, which leaks the path in an error message.
CVE-2003-1534 Medium 2003-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in jgb.php3 in Justice Guestbook 1.3 allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) homepage, (3) aim, (4) yim, (5) location, and (6) comment variables.
CVE-2003-1533 High 2003-12-31 Not applicable Working exploit published SQL injection vulnerability in accesscontrol.php in PhpPass 2 allows remote attackers to execute arbitrary SQL commands via the (1) uid and (2) pwd parameters.
CVE-2003-1532 High 2003-12-31 Not applicable Working exploit published SQL injection vulnerability in compte.php in PhpMyShop 1.00 allows remote attackers to execute arbitrary SQL commands via the (1) identifiant and (2) password parameters.
CVE-2003-1531 Medium 2003-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in testcgi.exe in Lilikoi Software Ceilidh 2.70 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string.
CVE-2003-1530 High 2003-12-31 Not applicable Working exploit published SQL injection vulnerability in privmsg.php in phpBB 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the mark[] parameter.
CVE-2003-1529 Medium 2003-12-31 Not applicable No public exploit Directory traversal vulnerability in Seagull Software Systems J Walk application server 3.2C9, and other versions before 3.3c4, allows remote attackers to read arbitrary files via a ".%252e" (encoded dot dot) in the URL.
CVE-2003-1528 High 2003-12-31 Not applicable No public exploit nsr_shutdown in Fujitsu Siemens NetWorker 6.0 allows local users to overwrite arbitrary files via a symlink attack on the nsrsh[PID] temporary file.
CVE-2003-1527 Medium 2003-12-31 Not applicable No public exploit BlackICE Defender 2.9.cap and Server Protection 3.5.cdf, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial of service via spoofed packets.
CVE-2003-1526 Medium 2003-12-31 Not applicable No public exploit PHP-Nuke 7.0 allows remote attackers to obtain the installation path via certain characters such as (1) ", (2) ', or (3) > in the search field, which reveals the path in an error message.
CVE-2003-1525 High 2003-12-31 Not applicable No public exploit Unspecified vulnerability in My Photo Gallery 3.5, and possibly earlier versions, has unknown impact and attack vectors.
CVE-2003-1524 Medium 2003-12-31 Not applicable No public exploit PGPi PGPDisk 6.0.2i does not unmount a PGP partition when the switch user function in Windows XP is used, which could allow local users to access data on another user's PGP partition.
CVE-2003-1523 High 2003-12-31 Not applicable No public exploit SQL injection vulnerability in the IMAP daemon in dbmail 1.1 allows remote attackers to execute arbitrary SQL commands via the (1) login username, (2) mailbox name, and possibly other attack vectors.
CVE-2003-1522 Medium 2003-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in PSCS VPOP3 Web Mail server 2.0e and 2.0f allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to the admin/index.html page.
CVE-2003-1521 Medium 2003-12-31 Not applicable Working exploit published Sun Java Plug-In 1.4 through 1.4.2_02 allows remote attackers to repeatedly access the floppy drive via the createXmlDocument method in the org.apache.crimson.tree.XmlDocument class, which violates the Java security model.
CVE-2003-1520 Medium 2003-12-31 Not applicable Working exploit published SQL injection vulnerability in FuzzyMonkey My Classifieds 2.11 allows remote attackers to execute arbitrary SQL commands via the email parameter.
CVE-2003-1519 Medium 2003-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in Vivisimo clustering engine allows remote attackers to inject arbitrary web script or HTML via the query parameter to the search program.
CVE-2003-1518 High 2003-12-31 Not applicable Working exploit published Adiscon WinSyslog 4.21 SP1 allows remote attackers to cause a denial of service (CPU consumption) via a long syslog message.
CVE-2003-1517 Medium 2003-12-31 Not applicable Working exploit published cart.pl in Dansie shopping cart allows remote attackers to obtain the installation path via an invalid db parameter, which leaks the path in an error message.
CVE-2003-1516 Medium 2003-12-31 Not applicable Working exploit published The org.apache.xalan.processor.XSLProcessorVersion class in Java Plug-in 1.4.2_01 allows signed and unsigned applets to share variables, which violates the Java security model and could allow remote attackers to read or write data belonging to a signed applet.
CVE-2003-1515 High 2003-12-31 Not applicable No public exploit Origo ASR-8100 ADSL Router 3.21 has an administration service running on port 254 that does not require a password, which allows remote attackers to cause a denial of service by restoring the factory defaults.
CVE-2003-1514 High 2003-12-31 Not applicable No public exploit eMule 0.29c allows remote attackers to cause a denial of service (crash) via a long password, possibly due to a buffer overflow.
CVE-2003-1513 Medium 2003-12-31 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in example scripts in Caucho Technology Resin 2.0 through 2.1.2 allow remote attackers to inject arbitrary web script or HTML via (1) env.jsp, (2) form.jsp, (3) session.jsp, (4) the move parameter to tictactoe.jsp, or the (5) name or (6) comment fields to guestbook.jsp.
CVE-2003-1512 Medium 2003-12-31 Not applicable Working exploit published Buffer overflow in mIRC 6.1 and 6.11 allows remote attackers to cause a denial of service (crash) via a long DCC SEND request.
CVE-2003-1511 Medium 2003-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in Bajie Java HTTP Server 0.95 through 0.95zxv4 allows remote attackers to inject arbitrary web script or HTML via (1) the query string to test.txt, (2) the guestName parameter to the custMsg servlet, or (3) the cookiename parameter to the CookieExample servlet.
CVE-2003-1510 High 2003-12-31 Not applicable No public exploit TinyWeb 1.9 allows remote attackers to cause a denial of service (CPU consumption) via a ".%00." in an HTTP GET request to the cgi-bin directory.
CVE-2003-1509 High 2003-12-31 Not applicable No public exploit Real Networks RealOne Enterprise Desktop 6.0.11.774, RealOne Player 2.0, and RealOne Player 6.0.11.818 through RealOne Player 6.0.11.853 allows remote attackers to execute arbitrary script in the local security zone by embedding script in a temp file before the temp file is executed by the default web browser.
CVE-2003-1508 Medium 2003-12-31 Not applicable No public exploit Buffer overflow in mIRC 6.12, when the DCC get dialog window has been minimized and the user opens the minimized window, allows remote attackers to cause a denial of service (crash) via a long filename.
CVE-2003-1507 High 2003-12-31 Not applicable No public exploit Planet Technology WGSD-1020 and WSW-2401 Ethernet switches use a default "superuser" account with the "planet" password, which allows remote attackers to gain administrative access.
CVE-2003-1506 Medium 2003-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in dansguardian.pl in Adelix CensorNet 3.0 through 3.2 allows remote attackers to execute arbitrary script as other users by injecting arbitrary HTML or script into the DENIEDURL parameter.
CVE-2003-1505 Medium 2003-12-31 Not applicable Working exploit published Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (crash) by creating a web page or HTML e-mail with a textarea in a div element whose scrollbar-base-color is modified by a CSS style, which is then moved.
CVE-2003-1504 High 2003-12-31 Not applicable Working exploit published SQL injection vulnerability in variables.php in Goldlink 3.0 allows remote attackers to execute arbitrary SQL commands via the (1) vadmin_login or (2) vadmin_pass cookie in a request to goldlink.php.
CVE-2003-1503 High 2003-12-31 Not applicable No public exploit Buffer overflow in AOL Instant Messenger (AIM) 5.2.3292 allows remote attackers to execute arbitrary code via an aim:getfile URL with a long screen name.
CVE-2003-1502 Medium 2003-12-31 Not applicable No public exploit mod_throttle 3.0 allows local users with Apache privileges to access shared memory that points to a file that is writable by the apache user, which could allow local users to gain privileges.
CVE-2003-1501 Medium 2003-12-31 Not applicable No public exploit Directory traversal vulnerability in the file upload CGI of Gast Arbeiter 1.3 allows remote attackers to write arbitrary files via a .. (dot dot) in the req_file parameter.
CVE-2003-1500 Medium 2003-12-31 Not applicable No public exploit PHP remote file inclusion vulnerability in _functions.php in cpCommerce 0.5f allows remote attackers to execute arbitrary code via the prefix parameter.
CVE-2003-1499 Medium 2003-12-31 Not applicable Working exploit published Directory traversal vulnerability in index.php in Bytehoard 0.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the infolder parameter.
CVE-2003-1498 Medium 2003-12-31 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in search.php for WRENSOFT Zoom Search Engine 2.0 Build 1018 and earlier allows remote attackers to inject arbitrary web script or HTML via the zoom_query parameter.
CVE-2003-1497 Medium 2003-12-31 Not applicable No public exploit Buffer overflow in the system log viewer of Linksys BEFSX41 1.44.3 allows remote attackers to cause a denial of service via an HTTP request with a long Log_Page_Num variable.
CVE-2003-1496 High 2003-12-31 Not applicable No public exploit Unspecified vulnerability in CDE dtmailpr of HP Tru64 4.0F through 5.1B allows local users to gain privileges via unknown attack vectors. NOTE: due to lack of details in the vendor advisory, it is not clear whether this is the same issue as CVE-1999-0840.
CVE-2003-1495 High 2003-12-31 Not applicable No public exploit Unspecified vulnerability in the non-SSL web agent in various HP Management Agent products allows local users or remote attackers to gain privileges or cause a denial of service via unknown attack vectors.
CVE-2003-1494 Medium 2003-12-31 Not applicable No public exploit Unspecified vulnerability in HP OpenView Network Node Manager (NNM) 6.2 and 6.4 allows remote attackers to cause a denial of service (CPU consumption) via a crafted TCP packet.
CVE-2003-1493 Medium 2003-12-31 Not applicable No public exploit Memory leak in HP OpenView Network Node Manager (NNM) 6.2 and 6.4 allows remote attackers to cause a denial of service (memory exhaustion) via crafted TCP packets.
CVE-2003-1492 Medium 2003-12-31 Not applicable No public exploit Netscape Navigator 7.0.2 and Mozilla allows remote attackers to access cookie information in a different domain via an HTTP request for a domain with an extra . (dot) at the end.
CVE-2003-1491 High 2003-12-31 Not applicable No public exploit Kerio Personal Firewall (KPF) 2.1.4 has a default rule to accept incoming packets from DNS (UDP port 53), which allows remote attackers to bypass the firewall filters via packets with a source port of 53.
CVE-2003-1490 High 2003-12-31 Not applicable No public exploit SonicWall Pro running firmware 6.4.0.1 allows remote attackers to cause a denial of service (device reset) via a long HTTP POST to the internal interface, possibly due to a buffer overflow.
CVE-2003-1489 Medium 2003-12-31 Not applicable No public exploit upload.php in Truegalerie 1.0 allows remote attackers to read arbitrary files by specifying the target filename in the file cookie in form.php, then downloading the file from the image gallery.
CVE-2003-1488 Medium 2003-12-31 Not applicable Working exploit published The (1) verif_admin.php and (2) check_admin.php scripts in Truegalerie 1.0 allow remote attackers to gain administrator access via a request to admin.php without the connect parameter and with the loggedin parameter set to any value, such as 1.
CVE-2003-1487 High 2003-12-31 Not applicable No public exploit Multiple "command injection" vulnerabilities in Phorum 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify the Phorum configuration files via the (1) UserAdmin program, (2) Edit user profile, or (3) stats program.
CVE-2003-1486 Medium 2003-12-31 Not applicable No public exploit Phorum 3.4 through 3.4.2 allows remote attackers to obtain the full path of the web server via an incorrect HTTP request to (1) smileys.php, (2) quick_listrss.php, (3) purge.php, (4) news.php, (5) memberlist.php, (6) forum_listrss.php, (7) forum_list_rdf.php, (8) forum_list.php, or (9) move.php, which leaks the information in an error message.
CVE-2003-1485 Medium 2003-12-31 Not applicable No public exploit Clearswift MAILsweeper 4.0 through 4.3.7 allows remote attackers to bypass filtering via a file attachment that contains "multiple extensions combined with large blocks of white space."
CVE-2003-1484 Medium 2003-12-31 Not applicable No public exploit Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service (crash) by creating a DHTML link that uses the AnchorClick "A" object with a blank href attribute.
CVE-2003-1483 Medium 2003-12-31 Not applicable No public exploit FlashFXP 1.4 uses a weak encryption algorithm for user passwords, which allows attackers to decrypt the passwords and gain access.
CVE-2003-1482 Medium 2003-12-31 Not applicable No public exploit The backup configuration file for Microsoft MN-500 wireless base station stores administrative passwords in plaintext, which allows local users to gain access.
CVE-2003-1481 Medium 2003-12-31 Not applicable Working exploit published CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack mail sessions via an e-mail with an IMG tag that references a malicious URL that captures the referer.
CVE-2003-1480 Medium 2003-12-31 Not applicable Working exploit published MySQL 3.20 through 4.1.0 uses a weak algorithm for hashed passwords, which makes it easier for attackers to decrypt the password via brute force methods.
CVE-2003-1479 Medium 2003-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in webcamXP 1.02.432 and 1.02.535 allows remote attackers to inject arbitrary web script or HTML via the message field.
CVE-2003-1478 Medium 2003-12-31 Not applicable Working exploit published Konqueror in KDE 3.0.3 allows remote attackers to cause a denial of service (core dump) via a web page that begins with a "xFFxFE" byte sequence and a large number of CRLF sequences, as demonstrated using freeze.htm.
CVE-2003-1477 High 2003-12-31 Not applicable No public exploit MAILsweeper for SMTP 4.3.6 and 4.3.7 allows remote attackers to cause a denial of service (CPU consumption) via a PowerPoint attachment that either (1) is corrupt or (2) contains "embedded objects."
CVE-2003-1476 Low 2003-12-31 Not applicable No public exploit Cerberus FTP Server 2.1 stores usernames and passwords in plaintext, which could allow local users to gain access.
CVE-2003-1475 Medium 2003-12-31 Not applicable No public exploit Netbus 1.5 through 1.7 allows more than one client to be connected at the same time, but only prompts the first connection for authentication, which allows remote attackers to gain access.
CVE-2003-1474 High 2003-12-31 Not applicable No public exploit slashem-tty in the FreeBSD Ports Collection is installed with write permissions for the games group, which allows local users with group games privileges to modify slashem-tty and execute arbitrary code as other users, as demonstrated using a separate vulnerability in LTris.
CVE-2003-1473 Medium 2003-12-31 Not applicable Working exploit published Buffer overflow in LTris 1.0.1 of FreeBSD Ports Collection 2003-02-25 and earlier allows local users to execute arbitrary code with gid "games" permission via a long HOME environment variable.
CVE-2003-1472 Medium 2003-12-31 Not applicable Working exploit published Buffer overflow in 3D-FTP client 4.0 allows remote FTP servers to cause a denial of service (crash) and possibly execute arbitrary code via a long banner.
CVE-2003-1471 Medium 2003-12-31 Not applicable No public exploit MDaemon POP server 6.0.7 and earlier allows remote authenticated users to cause a denial of service (crash) via a (1) DELE or (2) UIDL with a negative number.
CVE-2003-1470 High 2003-12-31 Not applicable No public exploit Buffer overflow in IMAP service in MDaemon 6.7.5 and earlier allows remote authenticated users to cause a denial of service (crash) and execute arbitrary code via a CREATE command with a long mailbox name.
CVE-2003-1469 Medium 2003-12-31 Not applicable Working exploit published The default configuration of ColdFusion MX has the "Enable Robust Exception Information" option selected, which allows remote attackers to obtain the full path of the web server via a direct request to CFIDE/probe.cfm, which leaks the path in an error message.
CVE-2003-1468 Medium 2003-12-31 Not applicable Working exploit published The Web_Links module in PHP-Nuke 6.0 through 6.5 final allows remote attackers to obtain the full web server path via an invalid cid parameter that is non-numeric or null, which leaks the pathname in an error message.
CVE-2003-1467 Medium 2003-12-31 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in (1) login.php, (2) register.php, (3) post.php, and (4) common.php in Phorum before 3.4.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVE-2003-1466 High 2003-12-31 Not applicable No public exploit Unspecified vulnerability in Phorum 3.4 through 3.4.2 allows remote attackers to use Phorum as a connection proxy to other sites via (1) register.php or (2) login.php.
CVE-2003-1465 Medium 2003-12-31 Not applicable No public exploit Directory traversal vulnerability in download.php in Phorum 3.4 through 3.4.2 allows remote attackers to read arbitrary files.
‹ prev page 1 of 81 next ›