deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2003-0421
Published: 2003-08-27
Description: Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to cause a denial of service (crash) via an MS-DOS device name (e.g. AUX) in a request to HTTP port 1220, a different vulnerability than CVE-2003-0502.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0040.html; http://www.rapid7.com/advisories/R7-0015.html; http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0040.html
CVE: CVE-2003-0422
Published: 2003-08-27
Description: Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to cause a denial of service (crash) via a request to view_broadcast.cgi that does not contain the required parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0040.html; http://www.rapid7.com/advisories/R7-0015.html; http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0040.html
CVE: CVE-2003-0423
Published: 2003-08-27
Description: parse_xml.cgi in Apple QuickTime / Darwin Streaming Server before 4.1.3g allows remote attackers to obtain the source code for parseable files via the filename parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0040.html; http://www.rapid7.com/advisories/R7-0015.html; http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0040.html
CVE: CVE-2003-0424
Published: 2003-08-27
Description: Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to obtain the source code for scripts by appending encoded space (%20) or . (%2e) characters to an HTTP request for the script, e.g. view_broadcast.cgi.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0040.html; http://www.rapid7.com/advisories/R7-0015.html; http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0040.html
CVE: CVE-2003-0425
Published: 2003-08-27
Description: Directory traversal vulnerability in Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to read arbitrary files via a ... (triple dot) in an HTTP request.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0040.html; http://www.rapid7.com/advisories/R7-0015.html; http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0040.html
CVE: CVE-2003-0426
Published: 2003-08-27
Description: The installation of Apple QuickTime / Darwin Streaming Server before 4.1.3f starts the administration server with a "Setup Assistant" page that allows remote attackers to set the administrator password and gain privileges before the real administrator.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0040.html; http://www.rapid7.com/advisories/R7-0015.html; http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0040.html
CVE: CVE-2003-0459
Published: 2003-08-27
Description: KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000747; http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/007300.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8061&w=2
CVE: CVE-2003-0460
Published: 2003-08-27
Description: The rotatelogs program on Apache before 1.3.28, for Windows and OS/2 systems, does not properly ignore certain control characters that are received over the pipe, which could allow remote attackers to cause a denial of service.
CVSS Score: 5.0 (MEDIUM)
References: http://www.apache.org/dist/httpd/Announcement.html; http://www.kb.cert.org/vuls/id/694428; https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E
CVE: CVE-2003-0461
Published: 2003-08-27
Description: /proc/tty/driver/serial in Linux 2.4.x reveals the exact number of characters used in serial links, which could allow local users to obtain potentially sensitive information such as the length of passwords.
CVSS Score: 2.1 (LOW)
References: http://rsbac.dyndns.org/pipermail/rsbac/2002-May/000162.html; http://www.debian.org/security/2004/dsa-358; http://www.debian.org/security/2004/dsa-423
CVE: CVE-2003-0462
Published: 2003-08-27
Description: A race condition in the way env_start and env_end pointers are initialized in the execve system call and used in fs/proc/base.c on Linux 2.4 allows local users to cause a denial of service (crash).
CVSS Score: 1.2 (LOW)
References: http://www.debian.org/security/2004/dsa-358; http://www.debian.org/security/2004/dsa-423; http://www.redhat.com/support/errata/RHSA-2003-198.html
CVE: CVE-2003-0464
Published: 2003-08-27
Description: The RPC code in Linux kernel 2.4 sets the reuse flag when sockets are created, which could allow local users to bind to UDP ports that are used by privileged services such as nfsd.
CVSS Score: 4.6 (MEDIUM)
References: http://www.redhat.com/support/errata/RHSA-2003-238.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A311; http://www.redhat.com/support/errata/RHSA-2003-238.html
CVE: CVE-2003-0466
Published: 2003-08-27
Description: Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-193
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-011.txt.asc; http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0065.html; http://download.immunix.org/ImmunixOS/7+/Updates/errata/IMNX-2003-7+-019-01
CVE: CVE-2003-0467
Published: 2003-08-27
Description: Unknown vulnerability in ip_nat_sack_adjust of Netfilter in Linux kernels 2.4.20, and some 2.5.x, when CONFIG_IP_NF_NAT_FTP or CONFIG_IP_NF_NAT_IRC is enabled, or the ip_nat_ftp or ip_nat_irc modules are loaded, allows remote attackers to cause a denial of service (crash) in systems using NAT, possibly due to an integer signedness error.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4758&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4758&w=2
CVE: CVE-2003-0468
Published: 2003-08-27
Description: Postfix 1.1.11 and earlier allows remote attackers to use Postfix to conduct "bounce scans" or DDos attacks of other hosts via an email address to the local host containing the target IP address and service name followed by a "!" string, which causes Postfix to attempt to use SMTP to communicate with the target on the associated port.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000717; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0257&w=2; http://secunia.com/advisories/9433
CVE: CVE-2003-0502
Published: 2003-08-27
Description: Apple QuickTime / Darwin Streaming Server before 4.1.3g allows remote attackers to cause a denial of service (crash) via a .. (dot dot) sequence followed by an MS-DOS device name (e.g. AUX) in a request to HTTP port 1220, a different vulnerability than CVE-2003-0421.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0040.html; http://www.rapid7.com/advisories/R7-0015.html; http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0040.html
CVE: CVE-2003-0511
Published: 2003-08-27
Description: The web server for Cisco Aironet AP1x00 Series Wireless devices running certain versions of IOS 12.2 allow remote attackers to cause a denial of service (reload) via a malformed URL.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0055.html; http://www.cisco.com/warp/public/707/cisco-sa-20030728-ap1x00.shtml; http://www.vigilante.com/inetsecurity/advisories/VIGILANTE-2003001.htm
CVE: CVE-2003-0512
Published: 2003-08-27
Description: Cisco IOS 12.2 and earlier generates a "% Login invalid" message instead of prompting for a password when an invalid username is provided, which allows remote attackers to identify valid usernames on the system and conduct brute force password guessing, as reported for the Aironet Bridge.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0056.html; http://www.cisco.com/warp/public/707/cisco-sn-20030724-ios-enum.shtml; http://www.kb.cert.org/vuls/id/886796
CVE: CVE-2003-0525
Published: 2003-08-27
Description: The getCanonicalPath function in Windows NT 4.0 may free memory that it does not own and cause heap corruption, which allows attackers to cause a denial of service (crash) via requests that cause a long file name to be passed to getCanonicalPath, as demonstrated on the IBM JVM using a long string to the java.io.getCanonicalPath Java method.
CVSS Score: 5.0 (MEDIUM)
References: http://www.atstake.com/research/advisories/2003/a072303-1.txt; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-029; https://exchange.xforce.ibmcloud.com/vulnerabilities/12701
CVE: CVE-2003-0530
Published: 2003-08-27
Description: Buffer overflow in the BR549.DLL ActiveX control for Internet Explorer 5.01 SP3 through 6.0 SP1 allows remote attackers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/9580; http://securitytracker.com/id?1007538; http://www.cert.org/advisories/CA-2003-22.html
CVE: CVE-2003-0531
Published: 2003-08-27
Description: Internet Explorer 5.01 SP3 through 6.0 SP1 allows remote attackers to access and execute script in the My Computer domain using the browser cache via crafted Content-Type and Content-Disposition headers, aka the "Browser Cache Script Execution in My Computer Zone" vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/9580; http://www.cert.org/advisories/CA-2003-22.html; http://www.kb.cert.org/vuls/id/205148
CVE: CVE-2003-0532
Published: 2003-08-27
Description: Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type, aka the "Object Type" vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0084.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1753&w=2; http://www.eeye.com/html/Research/Advisories/AD20030820.html
CVE: CVE-2003-0540
Published: 2003-08-27
Description: The address parser code in Postfix 1.1.12 and earlier allows remote attackers to cause a denial of service (lock) via (1) a malformed envelope address to a local host that would generate a bounce and contains the ".!" string in the MAIL FROM or Errors-To headers, which causes nqmgr to lock up, or (2) via a valid MAIL FROM with a RCPT TO containing a ".!" string, which causes an instance of the SMTP listener to lock up.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000717; http://lists.grok.org.uk/pipermail/full-disclosure/2003-August/007693.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0257&w=2
CVE: CVE-2003-0546
Published: 2003-08-27
Description: up2date 3.0.7 and 3.1.23 does not properly verify RPM GPG signatures, which could allow remote attackers to cause unsigned packages to be installed from the Red Hat Network, if that network is compromised.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5539&w=2; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A631; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5539&w=2
CVE: CVE-2003-0547
Published: 2003-08-27
Description: GDM before 2.4.1.6, when using the "examine session errors" feature, allows local users to read arbitrary files via a symlink attack on the ~/.xsession-errors file.
CVSS Score: 2.1 (LOW)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000729; http://mail.gnome.org/archives/gnome-hackers/2003-August/msg00045.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4122&w=2
CVE: CVE-2003-0548
Published: 2003-08-27
Description: The X Display Manager Control Protocol (XDMCP) support for GDM before 2.4.1.6 allows attackers to cause a denial of service (daemon crash) when a chosen host expires, a different issue than CVE-2003-0549.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000729; http://mail.gnome.org/archives/gnome-hackers/2003-August/msg00045.html; http://www.redhat.com/support/errata/RHSA-2003-258.html
CVE: CVE-2003-0549
Published: 2003-08-27
Description: The X Display Manager Control Protocol (XDMCP) support for GDM before 2.4.1.6 allows attackers to cause a denial of service (daemon crash) via a short authorization key name.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000729; http://mail.gnome.org/archives/gnome-hackers/2003-August/msg00045.html; http://www.redhat.com/support/errata/RHSA-2003-258.html
CVE: CVE-2003-0550
Published: 2003-08-27
Description: The STP protocol, as enabled in Linux 2.4.x, does not provide sufficient security by design, which allows attackers to modify the bridge topology.
CVSS Score: 5.0 (MEDIUM)
References: http://www.debian.org/security/2004/dsa-358; http://www.debian.org/security/2004/dsa-423; http://www.redhat.com/support/errata/RHSA-2003-238.html
CVE: CVE-2003-0551
Published: 2003-08-27
Description: The STP protocol implementation in Linux 2.4.x does not properly verify certain lengths, which could allow attackers to cause a denial of service.
CVSS Score: 5.0 (MEDIUM)
References: http://www.debian.org/security/2004/dsa-358; http://www.debian.org/security/2004/dsa-423; http://www.redhat.com/support/errata/RHSA-2003-198.html
CVE: CVE-2003-0552
Published: 2003-08-27
Description: Linux 2.4.x allows remote attackers to spoof the bridge Forwarding table via forged packets whose source addresses are the same as the target.
CVSS Score: 5.0 (MEDIUM)
References: http://www.debian.org/security/2004/dsa-358; http://www.debian.org/security/2004/dsa-423; http://www.redhat.com/support/errata/RHSA-2003-198.html
CVE: CVE-2003-0562
Published: 2003-08-27
Description: Buffer overflow in the CGI2PERL.NLM PERL handler in Novell Netware 5.1 and 6.0 allows remote attackers to cause a denial of service (ABEND) via a long input string.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0041.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9347&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1665&w=2
CVE: CVE-2003-0575
Published: 2003-08-27
Description: Heap-based buffer overflow in the name services daemon (nsd) in SGI IRIX 6.5.x through 6.5.21f, and possibly earlier versions, allows attackers to gain root privileges via the AUTH_UNIX gid list.
CVSS Score: 10.0 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20030704-01-P; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9302&w=2; http://secunia.com/advisories/9390
CVE: CVE-2003-0576
Published: 2003-08-27
Description: Unknown vulnerability in the NFS daemon (nfsd) in SGI IRIX 6.5.19f and earlier allows remote attackers to cause a denial of service (kernel panic) via certain packets that cause XDR decoding errors, a different vulnerability than CVE-2003-0619.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20030801-01-P; ftp://patches.sgi.com/support/free/security/advisories/20030801-02-P; ftp://patches.sgi.com/support/free/security/advisories/20030801-01-P
CVE: CVE-2003-0591
Published: 2003-08-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate is a duplicate number that was created during the refinement phase.  Notes: All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2003-0595
Published: 2003-08-27
Description: Buffer overflow in WiTango Application Server and Tango 2000 allows remote attackers to execute arbitrary code via a long cookie to Witango_UserReference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0038.html; http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0038.html
CVE: CVE-2003-0596
Published: 2003-08-27
Description: FDclone 2.00a, and other versions before 2.02a, creates temporary directories with predictable names and uses them if they already exist, which allows local users to read or modify files of other fdclone users by creating the directory ahead of time.
CVSS Score: 3.6 (LOW)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?archive=no&bug=186219; https://www.debian.org/security/2003/dsa-352; http://bugs.debian.org/cgi-bin/bugreport.cgi?archive=no&bug=186219
CVE: CVE-2003-0597
Published: 2003-08-27
Description: Unknown vulnerability in display of Merge before 5.3.23a in UnixWare 7.1.x allows local users to gain root privileges.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4201&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4201&w=2
CVE: CVE-2003-0598
Published: 2003-08-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2003-0657.  Reason: This candidate is a reservation duplicate of CVE-2003-0657.  Notes: All CVE users should reference CVE-2003-0657 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2003-0599
Published: 2003-08-27
Description: Unknown vulnerability in the Virtual File System (VFS) capability for phpGroupWare 0.9.16preRC and versions before 0.9.14.004 with unknown implications, related to the VFS path being under the web document root.
CVSS Score: 10.0 (HIGH)
References: http://mail.gnu.org/archive/html/phpgroupware-users/2003-07/msg00035.html; http://www.debian.org/security/2003/dsa-365; http://www.phpgroupware.org
CVE: CVE-2003-0602
Published: 2003-08-27
Description: Multiple cross-site scripting vulnerabilities (XSS) in Bugzilla 2.16.x before 2.16.3 and 2.17.x before 2.17.4 allow remote attackers to insert arbitrary HTML or web script via (1) multiple default German and Russian HTML templates or (2) ALT and NAME attributes in AREA tags as used by the GraphViz graph generation feature for local dependency graphs.
CVSS Score: 6.8 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000653; http://www.bugzilla.org/security/2.16.2/; http://www.securityfocus.com/bid/6861
CVE: CVE-2003-0603
Published: 2003-08-27
Description: Bugzilla 2.16.x before 2.16.3, 2.17.x before 2.17.4, and earlier versions allows local users to overwrite arbitrary files via a symlink attack on temporary files that are created in directories with group-writable or world-writable permissions.
CVSS Score: 2.1 (LOW)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000653; http://www.bugzilla.org/security/2.16.2/; http://www.securityfocus.com/bid/7412
CVE: CVE-2003-0604
Published: 2003-08-27
Description: Windows Media Player (WMP) 7 and 8, as running on Internet Explorer and possibly other Microsoft products that process HTML, allows remote attackers to bypass zone restrictions and access or execute arbitrary files via an IFRAME tag pointing to an ASF file whose Content-location contains a File:// URL.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8572&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2856&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]0292&w=2
CVE: CVE-2003-0605
Published: 2003-08-27
Description: The RPC DCOM interface in Windows 2000 SP3 and SP4 allows remote attackers to cause a denial of service (crash), and local attackers to use the DoS to hijack the epmapper pipe to gain privileges, via certain messages to the __RemoteGetClassObject interface that cause a NULL pointer to be passed to the PerformScmStage function.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/006851.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8706&w=2; http://www.cert.org/advisories/CA-2003-19.html
CVE: CVE-2003-0606
Published: 2003-08-27
Description: sup 1.8 and earlier does not properly create temporary files, which allows local users to overwrite arbitrary files.
CVSS Score: 4.6 (MEDIUM)
References: http://www.debian.org/security/2003/dsa-353; http://www.debian.org/security/2003/dsa-353
CVE: CVE-2003-0609
Published: 2003-08-27
Description: Stack-based buffer overflow in the runtime linker, ld.so.1, on Solaris 2.6 through 9 allows local users to gain root privileges via a long LD_PRELOAD environment variable.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8667&w=2; http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/55680; http://www.idefense.com/advisory/07.29.03.txt
CVE: CVE-2003-0610
Published: 2003-08-27
Description: Directory traversal vulnerability in ePO agent for McAfee ePolicy Orchestrator 3.0 allows remote attackers to read arbitrary files via a certain HTTP request.
CVSS Score: 5.0 (MEDIUM)
References: http://www.nai.com/us/promos/mcafee/epo_vulnerabilities.asp; http://www.nai.com/us/promos/mcafee/epo_vulnerabilities.asp
CVE: CVE-2003-0611
Published: 2003-08-27
Description: Multiple buffer overflows in xtokkaetama 1.0 allow local users to gain privileges via a long (1) -display command line argument or (2) XTOKKAETAMADIR environment variable.
CVSS Score: 4.6 (MEDIUM)
References: http://www.debian.org/security/2003/dsa-356; http://www.securityfocus.com/bid/8312; http://www.debian.org/security/2003/dsa-356
CVE: CVE-2003-0613
Published: 2003-08-27
Description: Buffer overflow in zblast-svgalib of zblast 1.2.1 and earlier allows local users to execute arbitrary code via the high score file.
CVSS Score: 4.6 (MEDIUM)
References: http://www.debian.org/security/2003/dsa-369; http://www.debian.org/security/2003/dsa-369
CVE: CVE-2003-0614
Published: 2003-08-27
Description: Cross-site scripting (XSS) vulnerability in search.php of Gallery 1.1 through 1.3.4 allows remote attackers to insert arbitrary web script via the searchstring parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=82&mode=thread&order=0&thold=0; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1469&w=2; http://www.debian.org/security/2003/dsa-355
CVE: CVE-2003-0615
Published: 2003-08-27
Description: Cross-site scripting (XSS) vulnerability in start_form() of CGI.pm allows remote attackers to insert web script via a URL that is fed into the form's action parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000713; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8877&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4468&w=2
CVE: CVE-2003-0616
Published: 2003-08-27
Description: Format string vulnerability in ePO service for McAfee ePolicy Orchestrator 2.0, 2.5, and 2.5.1 allows remote attackers to execute arbitrary code via a POST request with format strings in the computerlist parameter, which are used when logging a failed name resolution.
CVSS Score: 7.5 (HIGH)
References: http://www.atstake.com/research/advisories/2003/a073103-1.txt; http://www.nai.com/us/promos/mcafee/epo_vulnerabilities.asp; http://www.atstake.com/research/advisories/2003/a073103-1.txt
CVE: CVE-2003-0617
Published: 2003-08-27
Description: mindi 0.58 and earlier does not properly create temporary files, which allows local users to overwrite arbitrary files.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1549&w=2; http://www.debian.org/security/2003/dsa-362; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1549&w=2