Overview 3,478 matches · 60 in Waratek scope · 4 protected · 8 exploited · 0 CISA KEV · 1,062 public PoC · 35 EPSS ≥ 0.5
3,478matches
60in Waratek scope1.7%
4protected0.1%
8exploited0.2%
0CISA KEV0.0%
1,062public PoC30.5%
35EPSS ≥ 0.51.0%
Protected by Waratek
4
0.1%
Rule in development
0
0.0%
Mitigation candidate
16
0.5%
No exploit published
40
1.2%
Outside Waratek scope
13
0.4%
Not applicable
3,405
97.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
4
0.1%
partly blocked
0
0.0%
not blocked
3,474
99.9%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
8
0.2%
Working exploit published
1,061
30.5%
Proof of concept only
0
0.0%
Forecast only
5
0.1%
No public exploit
2,404
69.1%
split by
peak 980 / year
19891
Not applicable1
Medium1
not blocked1
No public exploit1
19902
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
19914
Not applicable4
Medium4
not blocked4
No public exploit4
19920
19933
Not applicable3
Medium3
not blocked3
No public exploit3
199410
Not applicable10
Medium10
not blocked10
Working exploit published2
No public exploit8
19956
Not applicable6
Medium6
not blocked6
Working exploit published2
No public exploit4
199621
Not applicable21
Medium21
not blocked21
Working exploit published5
No public exploit16
199789
Not applicable89
Medium89
not blocked89
Working exploit published18
No public exploit71
199885
Not applicable85
Medium85
not blocked85
Working exploit published11
No public exploit74
1999357
Outside Waratek scope1
Not applicable356
Medium357
not blocked357
Working exploit published119
No public exploit238
2000467
Mitigation candidate4
No exploit published3
Not applicable460
Medium467
not blocked467
Exploited2
Working exploit published195
No public exploit270
2001706
Mitigation candidate2
No exploit published4
Outside Waratek scope7
Not applicable693
Medium706
not blocked706
Exploited3
Working exploit published219
Forecast only2
No public exploit482
2002980
Protected by Waratek2
Mitigation candidate6
No exploit published15
Outside Waratek scope4
Not applicable953
Medium980
blocked by ARMR today2
not blocked978
Exploited3
Working exploit published246
Forecast only3
No public exploit728
2003747
Protected by Waratek2
Mitigation candidate4
No exploit published18
Outside Waratek scope1
Not applicable722
Medium747
blocked by ARMR today2
not blocked745
Working exploit published243
No public exploit504
19891991199319951997199920012003
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2003-1564 | Medium | 2003-12-31 | Not applicable | No public exploit | libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack." |
| CVE-2003-1563 | Medium | 2003-12-31 | Not applicable | No public exploit | Sun Cluster 2.2 through 3.2 for Oracle Parallel Server / Real Application Clusters (OPS/RAC) allows local users to cause a denial of service (cluster node panic or abort) by launching a daemon listening on a TCP port that would otherwise be used by the Distributed Lock Manager (DLM), possibly involving this daemon responding in a manner that spoofs a cluster reconfiguration. |
| CVE-2003-1561 | Medium | 2003-12-31 | Not applicable | No public exploit | Opera, probably before 7.50, sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data. |
| CVE-2003-1560 | Medium | 2003-12-31 | Not applicable | No public exploit | Netscape 4 sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data. |
| CVE-2003-1559 | Medium | 2003-12-31 | Not applicable | No public exploit | Microsoft Internet Explorer 5.22, and other 5 through 6 SP1 versions, sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data. |
| CVE-2003-1558 | Medium | 2003-12-31 | Not applicable | No public exploit | Buffer overflow in httpd.c of fnord 1.6 allows remote attackers to create a denial of service (crash) and possibly execute arbitrary code via a long CGI request passed to the do_cgi function. |
| CVE-2003-1556 | Medium | 2003-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in cc_guestbook.pl in CGI City CC GuestBook allows remote attackers to inject arbitrary web script or HTML via the (1) name and (2) homepage_title (webpage title) parameters. |
| CVE-2003-1555 | Medium | 2003-12-31 | Not applicable | Working exploit published | ScozNet ScozBook 1.1 BETA allows remote attackers to obtain sensitive information via an invalid PG parameter in view.php, which reveals the installation path in an error message. |
| CVE-2003-1554 | Medium | 2003-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in scozbook/add.php in ScozNet ScozBook 1.1 BETA allows remote attackers to inject arbitrary web script or HTML via the (1) username, (2) useremail, (3) aim, (4) msn, (5) sitename and (6) siteaddy variables. |
| CVE-2003-1553 | Medium | 2003-12-31 | Not applicable | Working exploit published | Haakon Nilsen Simple Internet Publishing System (SIPS) 0.2.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain password and other user information via a direct request to a user-specific configuration directory. |
| CVE-2003-1552 | Medium | 2003-12-31 | Not applicable | No public exploit | Unrestricted file upload vulnerability in uploader.php in Uploader 1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/. |
| CVE-2003-1550 | Medium | 2003-12-31 | Not applicable | Working exploit published | XOOPS 2.0, and possibly earlier versions, allows remote attackers to obtain sensitive information via an invalid xoopsOption parameter, which reveals the installation path in an error message. |
| CVE-2003-1549 | Medium | 2003-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in header.php in MyABraCaDaWeb 1.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the ma_kw parameter. |
| CVE-2003-1548 | Medium | 2003-12-31 | Not applicable | Working exploit published | MyABraCaDaWeb 1.0.2 and earlier allows remote attackers to obtain sensitive information via an invalid IDAdmin or other parameter, which reveals the installation path in an error message. |
| CVE-2003-1547 | Medium | 2003-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in block-Forums.php in the Splatt Forum module for PHP-Nuke 6.x allows remote attackers to inject arbitrary web script or HTML via the subject parameter. |
| CVE-2003-1546 | Medium | 2003-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in gbook.php in Filebased guestbook 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the comment section. |
| CVE-2003-1545 | Medium | 2003-12-31 | Not applicable | Working exploit published | Absolute path traversal vulnerability in nukestyles.com viewpage.php addon for PHP-Nuke allows remote attackers to read arbitrary files via a full pathname in the file parameter. NOTE: This was originally reported as an issue in PHP-Nuke 6.5, but this is an independent addon. |
| CVE-2003-1544 | Medium | 2003-12-31 | Not applicable | No public exploit | Unrestricted critical resource lock in Terminal Services for Windows 2000 before SP4 and Windows XP allows remote authenticated users to cause a denial of service (reboot) by obtaining a read lock on msgina.dll, which prevents msgina.dll from being loaded. |
| CVE-2003-1543 | Medium | 2003-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Bajie Http Web Server 0.95zxe, 0.95zxc, and possibly others, allows remote attackers to inject arbitrary web script or HTML via the query string, which is reflected in an error message. |
| CVE-2003-1542 | Medium | 2003-12-31 | Not applicable | No public exploit | Directory traversal vulnerability in plugins/file.php in phpWebFileManager before 0.4.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the fm_path parameter. |
| CVE-2003-1541 | Medium | 2003-12-31 | Not applicable | Working exploit published | PlanetMoon Guestbook tr3.a stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the admin script password, and other passwords, via a direct request to files/passwd.txt. |
| CVE-2003-1540 | Medium | 2003-12-31 | Not applicable | Working exploit published | WF-Chat 1.0 Beta stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain authentication information via a direct request to (1) !pwds.txt and (2) !nicks.txt. |
| CVE-2003-1539 | Medium | 2003-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in ONEdotOH Simple File Manager (SFM) before 0.21 allows remote attackers to inject arbitrary web script or HTML via (1) file names and (2) directory names. |
| CVE-2003-1538 | Medium | 2003-12-31 | Not applicable | No public exploit | susehelp in SuSE Linux 8.1, Enterprise Server 8, Office Server, and Openexchange Server 4 does not properly filter shell metacharacters, which allows remote attackers to execute arbitrary commands via CGI queries. |
| CVE-2003-1537 | Medium | 2003-12-31 | Not applicable | No public exploit | Directory traversal vulnerability in PostNuke 0.723 and earlier allows remote attackers to include arbitrary files named theme.php via the theme parameter to index.php. |
| CVE-2003-1536 | Medium | 2003-12-31 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Codeworx Technologies DCP-Portal 5.3.1 allow remote attackers to inject arbitrary web script or HTML via (1) the q parameter to search.php and (2) the year parameter to calendar.php. |
| CVE-2003-1535 | Medium | 2003-12-31 | Not applicable | Working exploit published | Justice Guestbook 1.3 allows remote attackers to obtain the full installation path via a direct request to cfooter.php3, which leaks the path in an error message. |
| CVE-2003-1534 | Medium | 2003-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in jgb.php3 in Justice Guestbook 1.3 allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) homepage, (3) aim, (4) yim, (5) location, and (6) comment variables. |
| CVE-2003-1531 | Medium | 2003-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in testcgi.exe in Lilikoi Software Ceilidh 2.70 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string. |
| CVE-2003-1529 | Medium | 2003-12-31 | Not applicable | No public exploit | Directory traversal vulnerability in Seagull Software Systems J Walk application server 3.2C9, and other versions before 3.3c4, allows remote attackers to read arbitrary files via a ".%252e" (encoded dot dot) in the URL. |
| CVE-2003-1527 | Medium | 2003-12-31 | Not applicable | No public exploit | BlackICE Defender 2.9.cap and Server Protection 3.5.cdf, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial of service via spoofed packets. |
| CVE-2003-1526 | Medium | 2003-12-31 | Not applicable | No public exploit | PHP-Nuke 7.0 allows remote attackers to obtain the installation path via certain characters such as (1) ", (2) ', or (3) > in the search field, which reveals the path in an error message. |
| CVE-2003-1524 | Medium | 2003-12-31 | Not applicable | No public exploit | PGPi PGPDisk 6.0.2i does not unmount a PGP partition when the switch user function in Windows XP is used, which could allow local users to access data on another user's PGP partition. |
| CVE-2003-1522 | Medium | 2003-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in PSCS VPOP3 Web Mail server 2.0e and 2.0f allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to the admin/index.html page. |
| CVE-2003-1521 | Medium | 2003-12-31 | Not applicable | Working exploit published | Sun Java Plug-In 1.4 through 1.4.2_02 allows remote attackers to repeatedly access the floppy drive via the createXmlDocument method in the org.apache.crimson.tree.XmlDocument class, which violates the Java security model. |
| CVE-2003-1520 | Medium | 2003-12-31 | Not applicable | Working exploit published | SQL injection vulnerability in FuzzyMonkey My Classifieds 2.11 allows remote attackers to execute arbitrary SQL commands via the email parameter. |
| CVE-2003-1519 | Medium | 2003-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in Vivisimo clustering engine allows remote attackers to inject arbitrary web script or HTML via the query parameter to the search program. |
| CVE-2003-1517 | Medium | 2003-12-31 | Not applicable | Working exploit published | cart.pl in Dansie shopping cart allows remote attackers to obtain the installation path via an invalid db parameter, which leaks the path in an error message. |
| CVE-2003-1516 | Medium | 2003-12-31 | Not applicable | Working exploit published | The org.apache.xalan.processor.XSLProcessorVersion class in Java Plug-in 1.4.2_01 allows signed and unsigned applets to share variables, which violates the Java security model and could allow remote attackers to read or write data belonging to a signed applet. |
| CVE-2003-1513 | Medium | 2003-12-31 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in example scripts in Caucho Technology Resin 2.0 through 2.1.2 allow remote attackers to inject arbitrary web script or HTML via (1) env.jsp, (2) form.jsp, (3) session.jsp, (4) the move parameter to tictactoe.jsp, or the (5) name or (6) comment fields to guestbook.jsp. |
| CVE-2003-1512 | Medium | 2003-12-31 | Not applicable | Working exploit published | Buffer overflow in mIRC 6.1 and 6.11 allows remote attackers to cause a denial of service (crash) via a long DCC SEND request. |
| CVE-2003-1511 | Medium | 2003-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in Bajie Java HTTP Server 0.95 through 0.95zxv4 allows remote attackers to inject arbitrary web script or HTML via (1) the query string to test.txt, (2) the guestName parameter to the custMsg servlet, or (3) the cookiename parameter to the CookieExample servlet. |
| CVE-2003-1508 | Medium | 2003-12-31 | Not applicable | No public exploit | Buffer overflow in mIRC 6.12, when the DCC get dialog window has been minimized and the user opens the minimized window, allows remote attackers to cause a denial of service (crash) via a long filename. |
| CVE-2003-1506 | Medium | 2003-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in dansguardian.pl in Adelix CensorNet 3.0 through 3.2 allows remote attackers to execute arbitrary script as other users by injecting arbitrary HTML or script into the DENIEDURL parameter. |
| CVE-2003-1505 | Medium | 2003-12-31 | Not applicable | Working exploit published | Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (crash) by creating a web page or HTML e-mail with a textarea in a div element whose scrollbar-base-color is modified by a CSS style, which is then moved. |
| CVE-2003-1502 | Medium | 2003-12-31 | Not applicable | No public exploit | mod_throttle 3.0 allows local users with Apache privileges to access shared memory that points to a file that is writable by the apache user, which could allow local users to gain privileges. |
| CVE-2003-1501 | Medium | 2003-12-31 | Not applicable | No public exploit | Directory traversal vulnerability in the file upload CGI of Gast Arbeiter 1.3 allows remote attackers to write arbitrary files via a .. (dot dot) in the req_file parameter. |
| CVE-2003-1500 | Medium | 2003-12-31 | Not applicable | No public exploit | PHP remote file inclusion vulnerability in _functions.php in cpCommerce 0.5f allows remote attackers to execute arbitrary code via the prefix parameter. |
| CVE-2003-1499 | Medium | 2003-12-31 | Not applicable | Working exploit published | Directory traversal vulnerability in index.php in Bytehoard 0.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the infolder parameter. |
| CVE-2003-1498 | Medium | 2003-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in search.php for WRENSOFT Zoom Search Engine 2.0 Build 1018 and earlier allows remote attackers to inject arbitrary web script or HTML via the zoom_query parameter. |
| CVE-2003-1497 | Medium | 2003-12-31 | Not applicable | No public exploit | Buffer overflow in the system log viewer of Linksys BEFSX41 1.44.3 allows remote attackers to cause a denial of service via an HTTP request with a long Log_Page_Num variable. |
| CVE-2003-1494 | Medium | 2003-12-31 | Not applicable | No public exploit | Unspecified vulnerability in HP OpenView Network Node Manager (NNM) 6.2 and 6.4 allows remote attackers to cause a denial of service (CPU consumption) via a crafted TCP packet. |
| CVE-2003-1493 | Medium | 2003-12-31 | Not applicable | No public exploit | Memory leak in HP OpenView Network Node Manager (NNM) 6.2 and 6.4 allows remote attackers to cause a denial of service (memory exhaustion) via crafted TCP packets. |
| CVE-2003-1492 | Medium | 2003-12-31 | Not applicable | No public exploit | Netscape Navigator 7.0.2 and Mozilla allows remote attackers to access cookie information in a different domain via an HTTP request for a domain with an extra . (dot) at the end. |
| CVE-2003-1489 | Medium | 2003-12-31 | Not applicable | No public exploit | upload.php in Truegalerie 1.0 allows remote attackers to read arbitrary files by specifying the target filename in the file cookie in form.php, then downloading the file from the image gallery. |
| CVE-2003-1488 | Medium | 2003-12-31 | Not applicable | Working exploit published | The (1) verif_admin.php and (2) check_admin.php scripts in Truegalerie 1.0 allow remote attackers to gain administrator access via a request to admin.php without the connect parameter and with the loggedin parameter set to any value, such as 1. |
| CVE-2003-1486 | Medium | 2003-12-31 | Not applicable | No public exploit | Phorum 3.4 through 3.4.2 allows remote attackers to obtain the full path of the web server via an incorrect HTTP request to (1) smileys.php, (2) quick_listrss.php, (3) purge.php, (4) news.php, (5) memberlist.php, (6) forum_listrss.php, (7) forum_list_rdf.php, (8) forum_list.php, or (9) move.php, which leaks the information in an error message. |
| CVE-2003-1485 | Medium | 2003-12-31 | Not applicable | No public exploit | Clearswift MAILsweeper 4.0 through 4.3.7 allows remote attackers to bypass filtering via a file attachment that contains "multiple extensions combined with large blocks of white space." |
| CVE-2003-1484 | Medium | 2003-12-31 | Not applicable | No public exploit | Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service (crash) by creating a DHTML link that uses the AnchorClick "A" object with a blank href attribute. |
| CVE-2003-1483 | Medium | 2003-12-31 | Not applicable | No public exploit | FlashFXP 1.4 uses a weak encryption algorithm for user passwords, which allows attackers to decrypt the passwords and gain access. |
| CVE-2003-1482 | Medium | 2003-12-31 | Not applicable | No public exploit | The backup configuration file for Microsoft MN-500 wireless base station stores administrative passwords in plaintext, which allows local users to gain access. |
| CVE-2003-1481 | Medium | 2003-12-31 | Not applicable | Working exploit published | CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack mail sessions via an e-mail with an IMG tag that references a malicious URL that captures the referer. |
| CVE-2003-1480 | Medium | 2003-12-31 | Not applicable | Working exploit published | MySQL 3.20 through 4.1.0 uses a weak algorithm for hashed passwords, which makes it easier for attackers to decrypt the password via brute force methods. |
| CVE-2003-1479 | Medium | 2003-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in webcamXP 1.02.432 and 1.02.535 allows remote attackers to inject arbitrary web script or HTML via the message field. |
| CVE-2003-1478 | Medium | 2003-12-31 | Not applicable | Working exploit published | Konqueror in KDE 3.0.3 allows remote attackers to cause a denial of service (core dump) via a web page that begins with a "xFFxFE" byte sequence and a large number of CRLF sequences, as demonstrated using freeze.htm. |
| CVE-2003-1475 | Medium | 2003-12-31 | Not applicable | No public exploit | Netbus 1.5 through 1.7 allows more than one client to be connected at the same time, but only prompts the first connection for authentication, which allows remote attackers to gain access. |
| CVE-2003-1473 | Medium | 2003-12-31 | Not applicable | Working exploit published | Buffer overflow in LTris 1.0.1 of FreeBSD Ports Collection 2003-02-25 and earlier allows local users to execute arbitrary code with gid "games" permission via a long HOME environment variable. |
| CVE-2003-1472 | Medium | 2003-12-31 | Not applicable | Working exploit published | Buffer overflow in 3D-FTP client 4.0 allows remote FTP servers to cause a denial of service (crash) and possibly execute arbitrary code via a long banner. |
| CVE-2003-1471 | Medium | 2003-12-31 | Not applicable | No public exploit | MDaemon POP server 6.0.7 and earlier allows remote authenticated users to cause a denial of service (crash) via a (1) DELE or (2) UIDL with a negative number. |
| CVE-2003-1469 | Medium | 2003-12-31 | Not applicable | Working exploit published | The default configuration of ColdFusion MX has the "Enable Robust Exception Information" option selected, which allows remote attackers to obtain the full path of the web server via a direct request to CFIDE/probe.cfm, which leaks the path in an error message. |
| CVE-2003-1468 | Medium | 2003-12-31 | Not applicable | Working exploit published | The Web_Links module in PHP-Nuke 6.0 through 6.5 final allows remote attackers to obtain the full web server path via an invalid cid parameter that is non-numeric or null, which leaks the pathname in an error message. |
| CVE-2003-1467 | Medium | 2003-12-31 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in (1) login.php, (2) register.php, (3) post.php, and (4) common.php in Phorum before 3.4.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors. |
| CVE-2003-1465 | Medium | 2003-12-31 | Not applicable | No public exploit | Directory traversal vulnerability in download.php in Phorum 3.4 through 3.4.2 allows remote attackers to read arbitrary files. |
| CVE-2003-1462 | Medium | 2003-12-31 | Not applicable | No public exploit | mod_survey 3.0.0 through 3.0.15-pre6 does not check whether a survey exists before creating a subdirectory for it, which allows remote attackers to cause a denial of service (disk consumption and possible crash). |
| CVE-2003-1459 | Medium | 2003-12-31 | Not applicable | Working exploit published | Multiple PHP remote file inclusion vulnerabilities in ttCMS 2.2 and ttForum allow remote attackers to execute arbitrary PHP code via the (1) template parameter in News.php or (2) installdir parameter in install.php. |
| CVE-2003-1457 | Medium | 2003-12-31 | Not applicable | No public exploit | Auerswald COMsuite CTI ControlCenter 3.1 creates a default "runasositron" user account with an easily guessable password, which allows local users or remote attackers to gain access. |
| CVE-2003-1456 | Medium | 2003-12-31 | Not applicable | Working exploit published | Album.pl 6.1 allows remote attackers to execute arbitrary commands, when an alternative configuration file is used, via unknown attack vectors. |
| CVE-2003-1454 | Medium | 2003-12-31 | Not applicable | No public exploit | Invision Power Services Invision Board 1.0 through 1.1.1, when a forum is password protected, stores the administrator password in a cookie in plaintext, which could allow remote attackers to gain access. |
| CVE-2003-1453 | Medium | 2003-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the MytextSanitizer function in XOOPS 1.3.5 through 1.3.9 and XOOPS 2.0 through 2.0.1 allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in an IMG tag. |
| CVE-2003-1451 | Medium | 2003-12-31 | Not applicable | No public exploit | Buffer overflow in Symantec Norton AntiVirus 2002 allows remote attackers to execute arbitrary code via an e-mail attachment with a compressed ZIP file that contains a file with a long filename. |
| CVE-2003-1450 | Medium | 2003-12-31 | Not applicable | Working exploit published | BitchX 75p3 and 1.0c16 through 1.0c20cvs allows remote attackers to cause a denial of service (segmentation fault) via a malformed RPL_NAMREPLY numeric 353 message. |
| CVE-2003-1446 | Medium | 2003-12-31 | Not applicable | No public exploit | Buffer overflow in the save_into_file function in save.c for Rogue 5.2-2 allows local users to execute arbitrary code with games group privileges by setting a long HOME environment variable and invoking the save game function with a ~ (tilde). |
| CVE-2003-1445 | Medium | 2003-12-31 | Not applicable | Working exploit published | Stack-based buffer overflow in Far Manager 1.70beta1 and earlier allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long pathname. |
| CVE-2003-1444 | Medium | 2003-12-31 | Not applicable | No public exploit | Kaspersky Antivirus (KAV) 4.0.9.0 allows local users to cause a denial of service (CPU consumption or crash) and prevent malicious code from being detected via a file with a long pathname. |
| CVE-2003-1443 | Medium | 2003-12-31 | Not applicable | No public exploit | Kaspersky Antivirus (KAV) 4.0.9.0 does not detect viruses in files with MS-DOS device names in their filenames, which allows local users to bypass virus protection, as demonstrated using aux.vbs and aux.com. |
| CVE-2003-1441 | Medium | 2003-12-31 | Not applicable | No public exploit | Posadis 0.50.4 through 0.50.8 allows remote attackers to cause a denial of service (crash) via a DNS message without a question section, which triggers null dereference. |
| CVE-2003-1440 | Medium | 2003-12-31 | Not applicable | No public exploit | SpamProbe 0.8a allows remote attackers to cause a denial of service (crash) via HTML e-mail with newline characters within an href tag, which is not properly handled by certain regular expressions. |
| CVE-2003-1439 | Medium | 2003-12-31 | Not applicable | No public exploit | Secure Internet Live Conferencing (SILC) 0.9.11 and 0.9.12 stores passwords and sessions in plaintext in memory, which could allow local users to obtain sensitive information. |
| CVE-2003-1438 | Medium | 2003-12-31 | No exploit published | No public exploit | Race condition in BEA WebLogic Server and Express 5.1 through 7.0.0.1, when using in-memory session replication or replicated stateful session beans, causes the same buffer to be provided to two users, which could allow one user to see session data that was intended for another user. |
| CVE-2003-1436 | Medium | 2003-12-31 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in nukebrowser.php in Nukebrowser 2.1 to 2.5 allows remote attackers to execute arbitrary PHP code via the filhead parameter. |
| CVE-2003-1434 | Medium | 2003-12-31 | Not applicable | No public exploit | login_ldap 3.1 and 3.2 allows remote attackers to initiate unauthenticated bind requests if (1) bind_anon_dn is on, which allows a bind with no password provided, (2) bind_anon_cred is on, which allows a bind with no DN, or (3) bind_anon is on, which allows a bind with no DN or password. |
| CVE-2003-1433 | Medium | 2003-12-31 | Not applicable | No public exploit | Epic Games Unreal Engine 226f through 436 does not validate the challenge key, which allows remote attackers to exhaust the player limit by joining the game multiple times. |
| CVE-2003-1430 | Medium | 2003-12-31 | Not applicable | Working exploit published | Directory traversal vulnerability in Unreal Tournament Server 436 and earlier allows remote attackers to access known files via a ".." (dot dot) in an unreal:// URL. |
| CVE-2003-1428 | Medium | 2003-12-31 | Not applicable | No public exploit | Gallery 1.3.3 creates directories with insecure permissions, which allows local users to read, modify, or delete photos. |
| CVE-2003-1427 | Medium | 2003-12-31 | Not applicable | Working exploit published | Directory traversal vulnerability in the web configuration interface in Netgear FM114P 1.4 allows remote attackers to read arbitrary files, such as the netgear.cfg configuration file, via a hex-encoded (%2e%2e%2f) ../ (dot dot slash) in the port parameter. |
| CVE-2003-1424 | Medium | 2003-12-31 | Not applicable | No public exploit | message.php in Petitforum does not properly authenticate users, which allows remote attackers to impersonate forum users via a modified connect cookie. |
| CVE-2003-1423 | Medium | 2003-12-31 | Not applicable | No public exploit | Petitforum stores the liste.txt data file under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as e-mail addresses and encrypted passwords. |
| CVE-2003-1421 | Medium | 2003-12-31 | Not applicable | No public exploit | Unspecified vulnerability in mod_mysql_logger shared object in SuckBot 0.006 allows remote attackers to cause a denial of service (seg fault) via unknown attack vectors. |
| CVE-2003-1420 | Medium | 2003-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Opera 6.0 through 7.0 with automatic redirection disabled allows remote attackers to inject arbitrary web script or HTML via the HTTP Location header. |
| CVE-2003-1419 | Medium | 2003-12-31 | Not applicable | Working exploit published | Netscape 7.0 allows remote attackers to cause a denial of service (crash) via a web page with an invalid regular expression argument to the JavaScript reformatDate function. |