deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2002-1252
Published: 2003-02-07
Description: The Application Messaging Gateway for PeopleTools 8.1x before 8.19, as used in various PeopleSoft products, allows remote attackers to read arbitrary files via certain XML External Entities (XXE) fields in an HTTP POST request that is processed by the SimpleFileHandler handler.
CVSS Score: 5.0 (MEDIUM)
References: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21811; http://www.iss.net/security_center/static/10520.php; http://www.securityfocus.com/bid/6647
CVE: CVE-2003-0002
Published: 2003-02-07
Description: Cross-site scripting vulnerability (XSS) in ManualLogin.asp script for Microsoft Content Management Server (MCMS) 2001 allows remote attackers to execute arbitrary script via the REASONTXT parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0719&w=2; http://www.iss.net/security_center/static/10318.php; http://www.securityfocus.com/bid/5922
CVE: CVE-2003-0003
Published: 2003-02-07
Description: Buffer overflow in the RPC Locator service for Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute arbitrary code via an RPC call to the service containing certain parameter information.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3415&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]2166&w=2; http://www.cert.org/advisories/CA-2003-03.html
CVE: CVE-2003-0007
Published: 2003-02-07
Description: Microsoft Outlook 2002 does not properly handle requests to encrypt email messages with V1 Exchange Server Security certificates, which causes Outlook to send the email in plaintext, aka "Flaw in how Outlook 2002 handles V1 Exchange Server Security Certificates could lead to Information Disclosure."
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/bid/6667; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-003; https://exchange.xforce.ibmcloud.com/vulnerabilities/11133
CVE: CVE-2003-0015
Published: 2003-02-07
Description: Double-free vulnerability in CVS 1.11.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed Directory request, as demonstrated by bypassing write checks to execute Update-prog and Checkin-prog commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0028.html; http://ccvs.cvshome.org/servlets/NewsItemView?newsID=51&JServSessionIdservlets=5of2iuhr14; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0589&w=2
CVE: CVE-2003-0016
Published: 2003-02-07
Description: Apache before 2.0.44, when running on unpatched Windows 9x and Me operating systems, allows remote attackers to cause a denial of service or execute arbitrary code via an HTTP request containing MS-DOS device names.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=apache-httpd-announce&m=[PII_REDACTED]1017&w=2; http://www.apacheweek.com/issues/03-01-24#security; http://www.kb.cert.org/vuls/id/825177
CVE: CVE-2003-0017
Published: 2003-02-07
Description: Apache 2.0 before 2.0.44 on Windows platforms allows remote attackers to obtain certain files via an HTTP request that ends in certain illegal characters such as ">", which causes a different filename to be processed and served.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=apache-httpd-announce&m=[PII_REDACTED]1017&w=2; https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E; https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E
CVE: CVE-2003-0027
Published: 2003-02-07
Description: Directory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9850&w=2; http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/50104; http://www.entercept.com/news/uspr/01-22-03.asp
CVE: CVE-2003-0034
Published: 2003-02-07
Description: Buffer overflow in the mtink status monitor, as included in the printer-drivers package in Mandrake Linux, allows local users to execute arbitrary code via a long HOME environment variable.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0029.html; http://www.idefense.com/advisory/01.21.03.txt; http://www.mandriva.com/security/advisories?name=MDKSA-2003:010
CVE: CVE-2003-0035
Published: 2003-02-07
Description: Buffer overflow in escputil, as included in the printer-drivers package in Mandrake Linux, allows local users to execute arbitrary code via a long printer-name command line argument.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0029.html; http://www.idefense.com/advisory/01.21.03.txt; http://www.mandriva.com/security/advisories?name=MDKSA-2003:010
CVE: CVE-2003-0036
Published: 2003-02-07
Description: ml85p, as included in the printer-drivers package for Mandrake Linux, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable filenames of the form "mlg85p%d".
CVSS Score: 6.2 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0029.html; http://www.idefense.com/advisory/01.21.03.txt; http://www.mandriva.com/security/advisories?name=MDKSA-2003:010
CVE: CVE-2003-0037
Published: 2003-02-07
Description: Buffer overflows in noffle news server 1.0.1 and earlier allow remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/7955; http://www.debian.org/security/2003/dsa-244; http://www.securityfocus.com/bid/6695
CVE: CVE-2003-0038
Published: 2003-02-07
Description: Cross-site scripting (XSS) vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the (1) email or (2) language parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6111; http://telia.dl.sourceforge.net/sourceforge/mailman/xss-2.1.0-patch.txt; http://www.debian.org/security/2004/dsa-436
CVE: CVE-2003-0039
Published: 2003-02-07
Description: ISC dhcrelay (dhcp-relay) 3.0rc9 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (packet storm) via a certain BOOTP packet that is forwarded to a broadcast MAC address, causing an infinite loop that is not restricted by a hop count.
CVSS Score: 5.0 (MEDIUM)
References: http://cc.turbolinux.com/security/TLSA-2003-26.txt; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000616; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3830&w=2
CVE: CVE-2003-0042
Published: 2003-02-07
Description: Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
CVSS Score: 5.0 (MEDIUM)
References: http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/; http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6290&w=2
CVE: CVE-2003-0043
Published: 2003-02-07
Description: Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.
CVSS Score: 5.0 (MEDIUM)
References: http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/; http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt; http://www.ciac.org/ciac/bulletins/n-060.shtml
CVE: CVE-2003-0044
Published: 2003-02-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.
CVSS Score: 6.8 (MEDIUM)
References: http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/; http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt; http://secunia.com/advisories/7972
CVE: CVE-2003-0045
Published: 2003-02-07
Description: Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.
CVSS Score: 5.0 (MEDIUM)
References: http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/12102; http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
CVE: CVE-2003-1080
Published: 2003-02-11
Description: Unknown vulnerability in mail for Solaris 2.6 through 9 allows local users to read the email of other users.
CVSS Score: 1.2 (LOW)
References: http://secunia.com/advisories/8058/; http://sunsolve.sun.com/search/document.do?assetkey=1-26-50751-1; http://www.securityfocus.com/bid/6838
CVE: CVE-2003-1079
Published: 2003-02-18
Description: Unknown vulnerability in UDP RPC for Solaris 2.5.1 through 9 for SPARC, and 2.5.1 through 8 for x86, allows remote attackers to cause a denial of service (memory consumption) via certain arguments in RPC calls that cause large amounts of memory to be allocated.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/8092/; http://sunsolve.sun.com/search/document.do?assetkey=1-26-50626-1; http://www.securityfocus.com/bid/6883
CVE: CVE-2002-0036
Published: 2003-02-19
Description: Integer signedness error in MIT Kerberos V5 ASN.1 decoder before krb5 1.2.5 allows remote attackers to cause a denial of service via a large unsigned data element length, which is later used as a negative value.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000639; http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2003-001-multiple.txt; http://www.kb.cert.org/vuls/id/587579
CVE: CVE-2002-0669
Published: 2003-02-19
Description: The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows administrators to cause a denial of service by modifying the SIP_AUTHENTICATE_SCHEME value to force authentication of incoming calls, which does not notify the user when an authentication failure occurs.
CVSS Score: 5.0 (MEDIUM)
References: http://www.atstake.com/research/advisories/2002/a071202-1.txt; http://www.iss.net/security_center/static/9564.php; http://www.atstake.com/research/advisories/2002/a071202-1.txt
CVE: CVE-2002-1160
Published: 2003-02-19
Description: The default configuration of the pam_xauth module forwards MIT-Magic-Cookies to new X sessions, which could allow local users to gain root privileges by stealing the cookies from a temporary .xauth file, which is created with the original user's credentials after root uses su.
CVSS Score: 7.2 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000693; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8954&w=2; http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/55760
CVE: CVE-2002-1348
Published: 2003-02-19
Description: w3m before 0.3.2.2 does not properly escape HTML tags in the ALT attribute of an IMG tag, which could allow remote attackers to access files or cookies.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7323&w=2; http://sourceforge.net/project/shownotes.php?release_id=126233; http://www.debian.org/security/2003/dsa-249
CVE: CVE-2002-1404
Published: 2003-02-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2002-1348.  Reason: This candidate is a reservation duplicate of CVE-2002-1348.  Notes: All CVE users should reference CVE-2002-1348 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2002-1405
Published: 2003-02-19
Description: CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace characters.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-049.0.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1977&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8021&w=2
CVE: CVE-2002-1508
Published: 2003-02-19
Description: slapd in OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allows local users to overwrite arbitrary files via a race condition during the creation of a log file for rejected replication requests.
CVSS Score: 1.2 (LOW)
References: http://www.debian.org/security/2003/dsa-227; http://www.iss.net/security_center/static/11288.php; http://www.mandriva.com/security/advisories?name=MDKSA-2003:006
CVE: CVE-2003-0004
Published: 2003-02-19
Description: Buffer overflow in the Windows Redirector function in Microsoft Windows XP allows local users to execute arbitrary code via a long parameter.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0154.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8534&w=2; http://www.iss.net/security_center/static/11260.php
CVE: CVE-2003-0018
Published: 2003-02-19
Description: Linux kernel 2.4.10 through 2.4.21-pre4 does not properly handle the O_DIRECT feature, which allows local attackers with write privileges to read portions of previously deleted files, or cause file system corruption.
CVSS Score: 3.6 (LOW)
References: http://linux.bkbits.net:8080/linux-2.4/cset%403e2f193drGJDBg9SG6JwaDQwCBnAMQ; http://www.debian.org/security/2003/dsa-358; http://www.debian.org/security/2004/dsa-423
CVE: CVE-2003-0019
Published: 2003-02-19
Description: uml_net in the kernel-utils package for Red Hat Linux 8.0 has incorrect setuid root privileges, which allows local users to modify network interfaces, e.g. by modifying ARP entries or placing interfaces into promiscuous mode.
CVSS Score: 7.2 (HIGH)
References: http://www.ciac.org/ciac/bulletins/n-044.shtml; http://www.iss.net/security_center/static/11276.php; http://www.kb.cert.org/vuls/id/134025
CVE: CVE-2003-0040
Published: 2003-02-19
Description: SQL injection vulnerability in the PostgreSQL auth module for courier 0.40 and earlier allows remote attackers to execute SQL code via the user name.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2003/dsa-247; http://www.securityfocus.com/bid/6738; https://exchange.xforce.ibmcloud.com/vulnerabilities/11213
CVE: CVE-2003-0041
Published: 2003-02-19
Description: Kerberos FTP client allows remote FTP sites to execute arbitrary code via a pipe (|) character in a filename that is retrieved by the client.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0047.html; http://secunia.com/advisories/7979; http://secunia.com/advisories/8114
CVE: CVE-2003-0046
Published: 2003-02-19
Description: AbsoluteTelnet SSH2 client does not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2014&w=2; http://www.celestialsoftware.net/telnet/beta_software.html; http://www.idefense.com/advisory/01.28.03.txt
CVE: CVE-2003-0047
Published: 2003-02-19
Description: SSH2 clients for VanDyke (1) SecureCRT 4.0.2 and 3.4.7, (2) SecureFX 2.1.2 and 2.0.4, and (3) Entunnel 1.0.2 and earlier, do not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2014&w=2; http://www.idefense.com/advisory/01.28.03.txt; http://www.securityfocus.com/bid/6726
CVE: CVE-2003-0048
Published: 2003-02-19
Description: PuTTY 0.53b and earlier does not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2014&w=2; http://www.idefense.com/advisory/01.28.03.txt; http://www.securityfocus.com/bid/6724
CVE: CVE-2003-0056
Published: 2003-02-19
Description: Buffer overflow in secure locate (slocate) before 2.7 allows local users to execute arbitrary code via a long (1) -c or (2) -r command line argument.
CVSS Score: 7.2 (HIGH)
References: ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-009.0.txt; ftp://patches.sgi.com/support/free/security/advisories/20040202-01-U.asc; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8213&w=2
CVE: CVE-2003-0057
Published: 2003-02-19
Description: Multiple buffer overflows in Hypermail 2 before 2.1.6 allows remote attackers to cause a denial of service and possibly execute arbitrary code (1) via a long attachment filename that is not properly handled by the hypermail executable, or (2) by connecting to the mail CGI program from an IP address that reverse-resolves to a long hostname.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0042.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3903&w=2; http://secunia.com/advisories/8030
CVE: CVE-2003-0058
Published: 2003-02-19
Description: MIT Kerberos V5 Key Distribution Center (KDC) before 1.2.5 allows remote authenticated attackers to cause a denial of service (crash) on KDCs within the same realm via a certain protocol request that causes a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000639; http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/50142; http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2003-001-multiple.txt
CVE: CVE-2003-0059
Published: 2003-02-19
Description: Unknown vulnerability in the chk_trans.c of the libkrb5 library for MIT Kerberos V5 before 1.2.5 allows users from one realm to impersonate users in other realms that have the same inter-realm keys.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000639; http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2003-001-multiple.txt; http://www.kb.cert.org/vuls/id/684563
CVE: CVE-2003-0060
Published: 2003-02-19
Description: Format string vulnerabilities in the logging routines for MIT Kerberos V5 Key Distribution Center (KDC) before 1.2.5 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in Kerberos principal names.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000639; http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2003-001-multiple.txt; http://www.kb.cert.org/vuls/id/787523
CVE: CVE-2003-0062
Published: 2003-02-19
Description: Buffer overflow in Eset Software NOD32 for UNIX before 1.013 allows local users to execute arbitrary code via a long path name.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4360&w=2; http://www.idefense.com/advisory/02.10.03.txt; http://www.iss.net/security_center/static/11282.php
CVE: CVE-2003-0073
Published: 2003-02-19
Description: Double-free vulnerability in mysqld for MySQL before 3.23.55 allows attackers with MySQL access to cause a denial of service (crash) via mysql_change_user.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000743; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7879&w=2; http://www.debian.org/security/2003/dsa-303
CVE: CVE-2003-0074
Published: 2003-02-19
Description: Format string vulnerability in mpmain.c for plpnfsd of the plptools package allows remote attackers to execute arbitrary code via the functions (1) debuglog, (2) errorlog, and (3) infolog.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8969&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5019&w=2; http://www.iss.net/security_center/static/11193.php
CVE: CVE-2003-0075
Published: 2003-02-19
Description: Integer signedness error in the myFseek function of samplein.c for Blade encoder (BladeEnc) 0.94.2 and earlier allows remote attackers to execute arbitrary code via a negative offset value following a "fmt" wave chunk.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6672&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7432&w=2; http://www.iss.net/security_center/static/11227.php
CVE: CVE-2003-0076
Published: 2003-02-19
Description: Unknown vulnerability in the directory parser for Direct Connect 4 Linux (dcgui) before 0.2.2 allows remote attackers to read files outside the sharelist.
CVSS Score: 6.4 (MEDIUM)
References: http://dc.ketelhot.de/pipermail/dc/2003-January/000094.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6243&w=2; http://www.iss.net/security_center/static/11246.php
CVE: CVE-2003-1326
Published: 2003-02-19
Description: Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model to run malicious script or arbitrary programs via dialog boxes, aka "Improper Cross Domain Security Validation with dialog box."
CVSS Score: 7.5 (HIGH)
References: http://www.ciac.org/ciac/bulletins/n-038.shtml; http://www.iss.net/security_center/static/11258.php; http://www.securityfocus.com/bid/6779
CVE: CVE-2003-1328
Published: 2003-02-19
Description: The showHelp() function in Microsoft Internet Explorer 5.01, 5.5, and 6.0 supports certain types of pluggable protocols that allow remote attackers to bypass the cross-domain security model and execute arbitrary code, aka "Improper Cross Domain Security Validation with ShowHelp functionality."
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2003-02/0083.html; http://www.ciac.org/ciac/bulletins/n-038.shtml; http://www.iss.net/security_center/static/11259.php
CVE: CVE-2003-1078
Published: 2003-02-28
Description: The FTP client for Solaris 2.6, 7, and 8 with the debug (-d) flag enabled displays the user password on the screen during login.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/8186/; http://sunsolve.sun.com/search/document.do?assetkey=1-26-51081-1; http://www.securityfocus.com/bid/6989
CVE: CVE-2002-0841
Published: 2003-03-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2002-0842.  Reason: This candidate is a duplicate of CVE-2002-0842.  The duplicate assignment was made before public disclosure.  Notes: none
CVE: CVE-2002-0842
Published: 2003-03-03
Description: Format string vulnerability in certain third party modifications to mod_dav for logging bad gateway messages (e.g. Oracle9i Application Server 9.0.2) allows remote attackers to execute arbitrary code via a destination URI that forces a "502 Bad Gateway" response, which causes the format string specifiers to be returned from dav_lookup_uri() in mod_dav.c, which is then used in a call to ap_log_rerror().
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0076.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6309&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6309&w=2
CVE: CVE-2002-1472
Published: 2003-03-03
Description: Untrusted search path vulnerability in libX11.so in xfree86, when used in setuid or setgid programs, allows local users to gain root privileges via a modified LD_PRELOAD environment variable that points to a malicious module.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/linux/suse/2002-q3/1116.html; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000529; http://www.iss.net/security_center/static/10137.php