deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2003-0804
Published: 2003-11-17
Description: The arplookup function in FreeBSD 5.1 and earlier, Mac OS X before 10.2.8, and possibly other BSD-based systems, allows remote attackers on a local subnet to cause a denial of service (resource starvation and panic) via a flood of spoofed ARP requests.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:14.arp.asc; ftp://patches.sgi.com/support/free/security/advisories/20040502-01-P.asc; http://docs.info.apple.com/article.html?artnum=61798
CVE: CVE-2003-0809
Published: 2003-11-17
Description: Internet Explorer 5.01 through 6.0 does not properly handle object tags returned from a Web server during XML data binding, which allows remote attackers to execute arbitrary code via an HTML e-mail message or web page.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/7887; http://www.securityfocus.com/bid/8565; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-040
CVE: CVE-2003-0813
Published: 2003-11-17
Description: A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by causing two threads to process the same RPC request, which causes one thread to use memory after it has been freed, a different vulnerability than CVE-2003-0352 (Blaster/Nachi), CVE-2003-0715, and CVE-2003-0528, and as demonstrated by certain exploits against those vulnerabilities.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-367
References: http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/011870.html; http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/011886.html; http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/011901.html
CVE: CVE-2003-0830
Published: 2003-11-17
Description: Buffer overflow in marbles 1.0.2 and earlier allows local users to gain privileges via a long HOME environment variable.
CVSS Score: 4.6 (MEDIUM)
References: http://www.debian.org/security/2003/dsa-390; http://www.debian.org/security/2003/dsa-390
CVE: CVE-2003-0831
Published: 2003-11-17
Description: ProFTPD 1.2.7 through 1.2.9rc2 does not properly translate newline characters when transferring files in ASCII mode, which allows remote attackers to execute arbitrary code via a buffer overflow using certain files.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/012072.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7816&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1269&w=2
CVE: CVE-2003-0832
Published: 2003-11-17
Description: Directory traversal vulnerability in webfs before 1.20 allows remote attackers to read arbitrary files via .. (dot dot) sequences in a Hostname header.
CVSS Score: 5.0 (MEDIUM)
References: http://www.debian.org/security/2003/dsa-392; http://www.debian.org/security/2003/dsa-392
CVE: CVE-2003-0833
Published: 2003-11-17
Description: Stack-based buffer overflow in webfs before 1.20 allows attackers to execute arbitrary code by creating directories that result in a long pathname.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2003/dsa-392; http://www.debian.org/security/2003/dsa-392
CVE: CVE-2003-0835
Published: 2003-11-17
Description: Multiple buffer overflows in asf_http_request of MPlayer before 0.92 allows remote attackers to execute arbitrary code via an ASX header with a long hostname.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000760; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1455&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1618&w=2
CVE: CVE-2003-0836
Published: 2003-11-17
Description: Stack-based buffer overflow in IBM DB2 Universal Data Base 7.2 before Fixpak 10 and 10a, and 8.1 before Fixpak 2, allows attackers with "Connect" privileges to execute arbitrary code via a LOAD command.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-2003-0836; https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-2003-0836
CVE: CVE-2003-0837
Published: 2003-11-17
Description: Stack-based buffer overflow in IBM DB2 Universal Data Base 7.2 for Windows, before Fixpak 10a, allows attackers with "Connect" privileges to execute arbitrary code via the INVOKE command.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4622&w=2; http://www.securityfocus.com/bid/8743; https://exchange.xforce.ibmcloud.com/vulnerabilities/13331
CVE: CVE-2003-0838
Published: 2003-11-17
Description: Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a "data" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but later executes as an HTA application, a different vulnerability than CVE-2003-0532, and as exploited using the QHosts Trojan horse (aka Trojan.Qhosts, QHosts-1, VBS.QHOSTS, or aolfix.exe).
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009639.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1753&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3459&w=2
CVE: CVE-2003-0839
Published: 2003-11-17
Description: Directory traversal vulnerability in the "Shell Folders" capability in Microsoft Windows Server 2003 allows remote attackers to read arbitrary files via .. (dot dot) sequences in a "shell:" link.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2028&w=2; http://www.geocities.co.jp/SiliconValley/1667/advisory08e.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2028&w=2
CVE: CVE-2003-0840
Published: 2003-11-17
Description: Buffer overflow in dtprintinfo on HP-UX 11.00, and possibly other operating systems, allows local users to gain root privileges via a long DISPLAY environment variable.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3571&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3571&w=2
CVE: CVE-2003-0841
Published: 2003-11-17
Description: The grid option in PeopleSoft 8.42 stores temporary .xls files in guessable directories under the web document root, which allows remote attackers to steal search results by directly accessing the files via a URL request.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0847&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0847&w=2
CVE: CVE-2003-0842
Published: 2003-11-17
Description: Stack-based buffer overflow in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode, allows remote attackers to execute arbitrary code via a long filename in a GET request with an "Accept-Encoding: gzip" header.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9860&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9860&w=2
CVE: CVE-2003-0843
Published: 2003-11-17
Description: Format string vulnerability in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode and using the Apache log, allows remote attackers to execute arbitrary code via format string characters in an HTTP GET request with an "Accept-Encoding: gzip" header.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9860&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9860&w=2
CVE: CVE-2003-0844
Published: 2003-11-17
Description: mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode without the Apache log, allows local users to overwrite arbitrary files via (1) a symlink attack on predictable temporary filenames on Unix systems, or (2) an NTFS hard link on Windows systems when the "Strengthen default permissions of internal system objects" policy is not enabled.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9860&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9860&w=2
CVE: CVE-2003-0845
Published: 2003-11-17
Description: Unknown vulnerability in the HSQLDB component in JBoss 3.2.1 and 3.0.8 on Java 1.4.x platforms, when running in the default configuration, allows remote attackers to conduct unauthorized activities and possibly execute arbitrary code via certain SQL statements to (1) TCP port 1701 in JBoss 3.2.1, and (2) port 1476 in JBoss 3.0.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6498&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3252&w=2; http://secunia.com/advisories/27914
CVE: CVE-2003-0846
Published: 2003-11-17
Description: SuSEconfig.javarunt in the javarunt package on SuSE Linux 7.3Pro allows local users to overwrite arbitrary files via a symlink attack on the .java_wrapper temporary file.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8140&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2379&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8140&w=2
CVE: CVE-2003-0847
Published: 2003-11-17
Description: SuSEconfig.susewm in the susewm package on SuSE Linux 8.2Pro allows local users to overwrite arbitrary files via a symlink attack on the susewm.$$ temporary file.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5578&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2379&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5578&w=2
CVE: CVE-2003-0848
Published: 2003-11-17
Description: Heap-based buffer overflow in main.c of slocate 2.6, and possibly other versions, may allow local users to gain privileges via a modified slocate database that causes a negative "pathlen" value to be used.
CVSS Score: 4.6 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-001.0/CSSA-2004-001.0.txt; ftp://patches.sgi.com/support/free/security/advisories/20040201-01-U.asc; ftp://patches.sgi.com/support/free/security/advisories/20040202-01-U.asc
CVE: CVE-2003-0849
Published: 2003-11-17
Description: Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length values, which is trusted by the ReceiveTransaction function when using a buffer provided by the BusyWithConnection function.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9552&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8280&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6984&w=2
CVE: CVE-2003-0850
Published: 2003-11-17
Description: The TCP reassembly functionality in libnids before 1.18 allows remote attackers to cause "memory corruption" and possibly execute arbitrary code via "overlarge TCP packets."
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000773; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0446&w=2; http://secunia.com/advisories/10543
CVE: CVE-2003-0852
Published: 2003-11-17
Description: Format string vulnerability in send_message.c for Sylpheed-claws 0.9.4 through 0.9.6 allows remote SMTP servers to cause a denial of service (crash) in sylpheed via format strings in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/012542.html; http://sylpheed.good-day.net/#changes; http://www.guninski.com/sylph.html
CVE: CVE-2003-0853
Published: 2003-11-17
Description: An integer overflow in ls in the fileutils or coreutils packages may allow local users to cause a denial of service or execute arbitrary code via a large -w value, which could be remotely exploited via applications that use ls, such as wu-ftpd.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000768; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000771; http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/012548.html
CVE: CVE-2003-0854
Published: 2003-11-17
Description: ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via applications that use ls, such as wu-ftpd.
CVSS Score: 2.1 (LOW)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000768; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000771; http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/012548.html
CVE: CVE-2003-0860
Published: 2003-11-17
Description: Buffer overflows in PHP before 4.3.3 have unknown impact and unknown attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.php.net/ChangeLog-4.php#4.3.3; http://www.php.net/release_4_3_3.php; http://www.php.net/ChangeLog-4.php#4.3.3
CVE: CVE-2003-0861
Published: 2003-11-17
Description: Integer overflows in (1) base64_encode and (2) the GD library for PHP before 4.3.3 have unknown impact and unknown attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.php.net/ChangeLog-4.php#4.3.3; http://www.php.net/release_4_3_3.php; http://www.php.net/ChangeLog-4.php#4.3.3
CVE: CVE-2003-0862
Published: 2003-11-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2003-0813.  Reason: This candidate is a duplicate of CVE-2003-0813.  Notes: All CVE users should reference CVE-2003-0813 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2003-0863
Published: 2003-11-17
Description: The php_check_safe_mode_include_dir function in fopen_wrappers.c of PHP 4.3.x returns a success value (0) when the safe_mode_include_dir variable is not specified in configuration, which differs from the previous failure value and may allow remote attackers to exploit file include vulnerabilities in PHP applications.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4227; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4227
CVE: CVE-2003-0864
Published: 2003-11-17
Description: Buffer overflow in m_join in channel.c for IRCnet IRCD 2.10.x to 2.10.3p3 allows remote attackers to cause a denial of service.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.irc.org/irc/server/ChangeLog; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000765; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1446&w=2
CVE: CVE-2003-0865
Published: 2003-11-17
Description: Heap-based buffer overflow in readstring of httpget.c for mpg123 0.59r and 0.59s allows remote attackers to execute arbitrary code via a long request.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-002.0/CSSA-2004-002.0.txt; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000781; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1198&w=2
CVE: CVE-2003-0866
Published: 2003-11-17
Description: The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=215506; http://secunia.com/advisories/30899; http://secunia.com/advisories/30908
CVE: CVE-2003-0867
Published: 2003-11-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2003-0662.  Reason: This candidate is a duplicate of CVE-2003-0662.  Notes: All CVE users should reference CVE-2003-0662 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2003-0870
Published: 2003-11-17
Description: Heap-based buffer overflow in Opera 7.11 and 7.20 allows remote attackers to execute arbitrary code via an HREF with a large number of escaped characters in the server name.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q4/0016.html; http://www.atstake.com/research/advisories/2003/a102003-1.txt; http://www.securityfocus.com/bid/8853
CVE: CVE-2003-0872
Published: 2003-11-17
Description: Certain scripts in OpenServer before 5.0.6 allow local users to overwrite files and conduct other unauthorized activities via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: ftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.27/CSSA-2003-SCO.27.txt; http://www.securityfocus.com/bid/8864; ftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.27/CSSA-2003-SCO.27.txt
CVE: CVE-2003-0874
Published: 2003-11-17
Description: Multiple SQL injection vulnerabilities in DeskPRO 1.1.0 and earlier allow remote attackers to insert arbitrary SQL and conduct unauthorized activities via (1) the cat parameter in faq.php, (2) the article parameter in faq.php, (3) the tickedid parameter in view.php, and (4) the Password entry on the logon screen.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q4/0017.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3311&w=2; http://www.securiteam.com/unixfocus/6R0052K8KM.html
CVE: CVE-2003-0875
Published: 2003-11-17
Description: Symbolic link vulnerability in the slpd script slpd.all_init for OpenSLP before 1.0.11 allows local users to overwrite arbitrary files via the route.check temporary file.
CVSS Score: 2.1 (LOW)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000723; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6336&w=2; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000723
CVE: CVE-2003-0879
Published: 2003-11-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2003-0518.  Reason: This candidate is a reservation duplicate of CVE-2003-0518.  Notes: All CVE users should reference CVE-2003-0518 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2003-0894
Published: 2003-11-17
Description: Buffer overflow in the (1) oracle and (2) oracleO programs in Oracle 9i Database 9.0.x and 9.2.x before 9.2.0.4 allows local users to execute arbitrary code via a long command line argument.
CVSS Score: 4.6 (MEDIUM)
References: http://otn.oracle.com/deploy/security/pdf/2003alert59.pdf; http://securitytracker.com/id?1007956; http://www.kb.cert.org/vuls/id/496340
CVE: CVE-2003-0896
Published: 2003-11-17
Description: The loadClass method of the sun.applet.AppletClassLoader class in the Java Virtual Machine (JVM) in Sun SDK and JRE 1.4.1_03 and earlier allows remote attackers to bypass sandbox restrictions and execute arbitrary code via a loaded class name that contains "/" (slash) instead of "." (dot) characters, which bypasses a call to the Security Manager's checkPackageAccess method.
CVSS Score: 7.5 (HIGH)
References: http://lsd-pl.net/code/JVM/jre.tar.gz; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3819&w=2; http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57221
CVE: CVE-2003-0897
Published: 2003-11-17
Description: "Shatter" vulnerability in CommCtl32.dll in Windows XP may allow local users to execute arbitrary code by sending (1) BCM_GETTEXTMARGIN or (2) BCM_SETTEXTMARGIN button control messages to privileged applications.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0010&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/13558; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0010&w=2
CVE: CVE-2003-0898
Published: 2003-11-17
Description: IBM DB2 7.2 before FixPak 10a, and earlier versions including 7.1, allows local users to overwrite arbitrary files and gain privileges via a symlink attack on (1) db2job and (2) db2job2.
CVSS Score: 4.6 (MEDIUM)
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2aixv7/FP10a_U495172/FixpakReadme.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1672&w=2; ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2aixv7/FP10a_U495172/FixpakReadme.txt
CVE: CVE-2003-0964
Published: 2003-11-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: N/A. Notes: none
CVE: CVE-2003-1059
Published: 2003-11-20
Description: Unknown vulnerability in the libraries for the PGX32 frame buffer in Solaris 2.5.1 and 2.6 through 9 allows local users to gain root access.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/10267; http://sunsolve.sun.com/search/document.do?assetkey=1-26-57360-1; http://www.ciac.org/ciac/bulletins/o-029.shtml
CVE: CVE-2003-1195
Published: 2003-11-23
Description: SQL injection vulnerability in getmember.asp in VieBoard 2.6 Beta 1 allows remote attackers to execute arbitrary SQL commands via the msn variable.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2003-November/014065.html; http://www.osvdb.org/4606; https://exchange.xforce.ibmcloud.com/vulnerabilities/13819
CVE: CVE-2003-1084
Published: 2003-11-24
Description: Monit 1.4 to 4.1 allows remote attackers to cause a denial of service (daemon crash) via an HTTP POST request with a negative Content-Length field.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/10280; http://security.gentoo.org/glsa/glsa-200403-14.xml; http://www.kb.cert.org/vuls/id/206382
CVE: CVE-2003-1216
Published: 2003-11-27
Description: SQL injection vulnerability in search.php for phpBB 2.0.6 and earlier allows remote attackers to execute arbitrary SQL and gain privileges via the search_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5576&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6609&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2970&w=2
CVE: CVE-2003-0564
Published: 2003-12-01
Description: Multiple vulnerabilities in multiple vendor implementations of the Secure/Multipurpose Internet Mail Extensions (S/MIME) protocol allow remote attackers to cause a denial of service and possibly execute arbitrary code via an S/MIME email message containing certain unexpected ASN.1 constructs, as demonstrated using the NISSC test suite.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20040402-01-U.asc; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9944&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9363&w=2
CVE: CVE-2003-0565
Published: 2003-12-01
Description: Multiple vulnerabilities in multiple vendor implementations of the X.400 protocol allow remote attackers to cause a denial of service and possibly execute arbitrary code via an X.400 message containing certain unexpected ASN.1 constructs, as demonstrated using the NISSC test suite.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/927278; http://www.uniras.gov.uk/vuls/2003/006489/x400.htm; http://www.kb.cert.org/vuls/id/927278
CVE: CVE-2003-0621
Published: 2003-12-01
Description: The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to determine the existence of files outside the web root via modified paths in the INIFILE argument.
CVSS Score: 5.0 (MEDIUM)
References: http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7681&w=2; http://www.securityfocus.com/bid/8931
CVE: CVE-2003-0622
Published: 2003-12-01
Description: The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to cause a denial of service (hang) via pathname arguments that contain MS-DOS device names such as CON and AUX.
CVSS Score: 5.0 (MEDIUM)
References: http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7681&w=2; http://www.securityfocus.com/bid/8931
CVE: CVE-2003-0623
Published: 2003-12-01
Description: Cross-site scripting (XSS) vulnerability in the Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to inject arbitrary web script via the INIFILE argument.
CVSS Score: 4.3 (MEDIUM)
References: http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/advisory03_38_00.jsp; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7681&w=2; http://www.securityfocus.com/bid/8931