deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2003-1112
Published: 2003-12-31
Description: The Session Initiation Protocol (SIP) implementation in Ingate Firewall and Ingate SIParator before 3.1.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.
CVSS Score: 7.5 (HIGH)
References: http://www.cert.org/advisories/CA-2003-06.html; http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/sip/; http://www.kb.cert.org/vuls/id/528719
CVE: CVE-2003-1113
Published: 2003-12-31
Description: The Session Initiation Protocol (SIP) implementation in IPTel SIP Express Router 0.8.9 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.
CVSS Score: 7.5 (HIGH)
References: http://www.cert.org/advisories/CA-2003-06.html; http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/sip/; http://www.iptel.org/ser/security/
CVE: CVE-2003-1114
Published: 2003-12-31
Description: The Session Initiation Protocol (SIP) implementation in Mediatrix Telecom VoIP Access Devices and Gateways running SIPv2.4 and SIPv4.3 firmware allows remote attackers to cause a denial of service or execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.
CVSS Score: 7.5 (HIGH)
References: http://www.cert.org/advisories/CA-2003-06.html; http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/sip/; http://www.kb.cert.org/vuls/id/528719
CVE: CVE-2003-1115
Published: 2003-12-31
Description: The Session Initiation Protocol (SIP) implementation in Nortel Networks Succession Communication Server 2000, when using SIP-T, allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.
CVSS Score: 7.5 (HIGH)
References: http://www.cert.org/advisories/CA-2003-06.html; http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/sip/; http://www.kb.cert.org/vuls/id/528719
CVE: CVE-2003-1116
Published: 2003-12-31
Description: The communications protocol for the Report Review Agent (RRA), aka FND File Server (FNDFS) program, in Oracle E-Business Suite 10.7, 11.0, and 11.5.1 to 11.5.8 allows remote attackers to bypass authentication and obtain sensitive information from the Oracle Applications Concurrent Manager by spoofing requests to the TNS Listener.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8415&w=2; http://otn.oracle.com/deploy/security/pdf/2003alert53.pdf; http://securitytracker.com/id?1006550
CVE: CVE-2003-1117
Published: 2003-12-31
Description: Buffer overflow in RealSystem Server 6.x, 7.x and 8.x, and RealSystem Proxy 8.x, related to URL error handling, allows remote attackers to cause a denial of service and possibly execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1003604; http://service.real.com/help/faq/security/bufferoverflow.html; http://www.kb.cert.org/vuls/id/143627
CVE: CVE-2003-1118
Published: 2003-12-31
Description: Buffer overflow in the SETI@home client 3.03 and other versions allows remote attackers to cause a denial of service (client crash) and execute arbitrary code via a spoofed server response containing a long string followed by a \n (newline) character.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004383.html; http://www.kb.cert.org/vuls/id/146785; http://www.securityfocus.com/bid/7292
CVE: CVE-2003-1119
Published: 2003-12-31
Description: SSH Secure Shell before 3.2.9 allows remote attackers to cause a denial of service via malformed BER/DER packets.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/333980; http://www.ssh.com/company/newsroom/article/476/; http://www.kb.cert.org/vuls/id/333980
CVE: CVE-2003-1120
Published: 2003-12-31
Description: Race condition in SSH Tectia Server 4.0.3 and 4.0.4 for Unix, when the password change plugin (ssh-passwd-plugin) is enabled, allows local users to obtain the server's private key.
CVSS Score: 3.7 (LOW)
References: http://secunia.com/advisories/11193; http://securitytracker.com/alerts/2004/Mar/1009532.html; http://www.kb.cert.org/vuls/id/814198
CVE: CVE-2003-1121
Published: 2003-12-31
Description: Services in ScriptLogic 4.01, and possibly other versions before 4.14, process client requests at raised privileges, which allows remote attackers to (1) modify arbitrary registry entries via the ScriptLogic RPC service (SLRPC) or (2) modify arbitrary configuration via the RunAdmin services (SLRAserver.exe and SLRAclient.exe).
CVSS Score: 10.0 (HIGH)
References: http://www.kb.cert.org/vuls/id/231705; http://www.kb.cert.org/vuls/id/609137; http://www.kb.cert.org/vuls/id/CRDY-5EXQRP
CVE: CVE-2003-1122
Published: 2003-12-31
Description: ScriptLogic 4.01, and possibly other versions before 4.14, uses insecure permissions for the LOGS$ share, which allows users to modify log records and possibly execute arbitrary code.
CVSS Score: 2.1 (LOW)
References: http://www.kb.cert.org/vuls/id/813737; http://www.kb.cert.org/vuls/id/CRDY-5EXQT9; http://www.securityfocus.com/bid/7476
CVE: CVE-2003-1123
Published: 2003-12-31
Description: Sun Java Runtime Environment (JRE) and SDK 1.4.0_01 and earlier allows untrusted applets to access certain information within trusted applets, which allows attackers to bypass the restrictions of the Java security model.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/8958; http://securitytracker.com/id?1006935; http://sunsolve.sun.com/search/document.do?assetkey=1-26-55100-1
CVE: CVE-2003-1124
Published: 2003-12-31
Description: Unknown vulnerability in Sun Management Center (SunMC) 2.1.1, 3.0, and 3.0 Revenue Release (RR), when installed and run by root, allows local users to create or modify arbitrary files.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/9073; http://sunsolve.sun.com/search/document.do?assetkey=1-26-55141-1; http://www.kb.cert.org/vuls/id/758932
CVE: CVE-2003-1125
Published: 2003-12-31
Description: Unknown vulnerability in ns-ldapd for Sun ONE Directory Server 4.16, 5.0, and 5.1 allows LDAP clients to cause a denial of service (service halt).
CVSS Score: 5.0 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-52102-1; http://www.kb.cert.org/vuls/id/195644; http://sunsolve.sun.com/search/document.do?assetkey=1-26-52102-1
CVE: CVE-2003-1126
Published: 2003-12-31
Description: Unknown vulnerability in SunOne/iPlanet Web Server SP3 through SP5 on Windows platforms allows remote attackers to cause a denial of service.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/9541; http://sunsolve.sun.com/search/document.do?assetkey=1-26-56180-1; http://www.kb.cert.org/vuls/id/636964
CVE: CVE-2003-1127
Published: 2003-12-31
Description: Whale Communications e-Gap 2.5 on Windows 2000 allows remote attackers to obtain the source code for the login page via the HTTP TRACE method, which bypasses the preprocessor.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/371470; http://www.procheckup.com/security_info/vuln_pr0307.html; http://www.securityfocus.com/bid/9431
CVE: CVE-2003-1128
Published: 2003-12-31
Description: XMMS.pm in X2 XMMS Remote, as obtained from the vendor server between 4 AM 11 AM PST on May 7, 2003, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to TCP port 8086.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/8775; http://www.kb.cert.org/vuls/id/583020; http://www.securityfocus.com/bid/7534
CVE: CVE-2003-1129
Published: 2003-12-31
Description: Buffer overflow in the Yahoo! Audio Conferencing (aka Voice Chat) ActiveX control before 1,0,0,45 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a URL with a long hostname to Yahoo! Messenger or Yahoo! Chat.
CVSS Score: 2.6 (LOW)
References: http://help.yahoo.com/help/us/mesg/use/use-45.html; http://secunia.com/advisories/8924; http://www.kb.cert.org/vuls/id/272644
CVE: CVE-2003-1130
Published: 2003-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2003-1071.  Reason: This candidate is a duplicate of CVE-2003-1071.  Notes: All CVE users should reference CVE-2003-1071 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2003-1131
Published: 2003-12-31
Description: PHP remote file inclusion vulnerability in index.php in KnowledgeBuilder, referred to as KnowledgeBase, allows remote attackers to execute arbitrary PHP code by modifying the page parameter to reference a URL on a remote web server that contains the code.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3543&w=2; http://secunia.com/advisories/10504; http://www.osvdb.org/3228
CVE: CVE-2003-1132
Published: 2003-12-31
Description: The DNS server for Cisco Content Service Switch (CSS) 11000 and 11500, when prompted for a nonexistent AAAA record, responds with response code 3 (NXDOMAIN or "Name Error") instead of response code 0 ("No Error"), which allows remote attackers to cause a denial of service (inaccessible domain) by forcing other DNS servers to send and cache a request for a AAAA record to the vulnerable server.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/cisco-sa-20030430-dns.shtml; http://www.kb.cert.org/vuls/id/714121; http://www.cisco.com/warp/public/707/cisco-sa-20030430-dns.shtml
CVE: CVE-2003-1133
Published: 2003-12-31
Description: Rit Research Labs The Bat! 1.0.11 through 2.0 creates new accounts with insecure ACLs, which allows local users to read other users' email messages.
CVSS Score: 2.1 (LOW)
References: http://securitytracker.com/id?1008004; http://www.securityfocus.com/archive/1/342485; http://www.securityfocus.com/bid/8891
CVE: CVE-2003-1134
Published: 2003-12-31
Description: Sun Java 1.3.1, 1.4.1, and 1.4.2 allows local users to cause a denial of service (JVM crash), possibly by calling the ClassDepth function with a null parameter, which causes a crash instead of generating a null pointer exception.
CVSS Score: 2.1 (LOW)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/012773.html; http://www.securityfocus.com/bid/8892; http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/012773.html
CVE: CVE-2003-1135
Published: 2003-12-31
Description: Buffer overflow in Yahoo! Messenger 5.6 allows remote attackers to cause a denial of service (crash) via a file send request (sendfile) with a large number of "%" (percent) characters after the Yahoo ID.
CVSS Score: 2.6 (LOW)
References: http://www.securityfocus.com/archive/1/342472; http://www.securityfocus.com/bid/8894; http://www.securityfocus.com/archive/1/342472
CVE: CVE-2003-1147
Published: 2003-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2003-0955.  Reason: This candidate is a duplicate of CVE-2003-0955.  Notes: All CVE users should reference CVE-2003-0955 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2003-1152
Published: 2003-12-31
Description: WebTide 7.04 allows remote attackers to list arbitrary directories via an HTTP request for %3f.jsp (encoded "?").
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/012811.html; http://secunia.com/advisories/10078; http://securitytracker.com/id?1008016
CVE: CVE-2003-1153
Published: 2003-12-31
Description: byteHoard 0.7 and 0.71 allows remote attackers to list arbitrary files and directories via a direct request to files.inc.php.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/012801.html; http://secunia.com/advisories/10082; http://www.osvdb.org/2700
CVE: CVE-2003-1154
Published: 2003-12-31
Description: MAILsweeper for SMTP 4.3 allows remote attackers to bypass virus protection via a mail message with a malformed zip attachment, as exploited by certain MIMAIL virus variants.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/10148; http://www.computerworld.co.nz/cw.nsf/0/BF9E8E6E2D313E5FCC256DD70016473F?OpenDocument&More=; http://www.osvdb.org/2772
CVE: CVE-2003-1155
Published: 2003-12-31
Description: X-CD-Roast 0.98 alpha10 through alpha14 allows local users to overwrite arbitrary files via a symlink attack on an unknown file.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/10162; http://securitytracker.com/id?1008094; http://www.osvdb.org/2786
CVE: CVE-2003-1156
Published: 2003-12-31
Description: Java Runtime Environment (JRE) and Software Development Kit (SDK) 1.4.2 through 1.4.2_02 allows local users to overwrite arbitrary files via a symlink attack on (1) unpack.log, as created by the unpack program, or (2) .mailcap1 and .mime.types1, as created by the RPM program.
CVSS Score: 4.6 (MEDIUM)
References: http://www.securityfocus.com/archive/1/343038; http://www.securityfocus.com/bid/8937; https://exchange.xforce.ibmcloud.com/vulnerabilities/13570
CVE: CVE-2003-1157
Published: 2003-12-31
Description: Cross-site scripting (XSS) vulnerability in login.asp in Citrix MetaFrame XP Server 1.0 allows remote attackers to inject arbitrary web script or HTML via the NFuse_Message parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/10127; http://www.osvdb.org/2762; http://www.securityfocus.com/archive/1/343040
CVE: CVE-2003-1158
Published: 2003-12-31
Description: Multiple buffer overflows in the FTP service in Plug and Play Web Server 1.0002c allow remote attackers to cause a denial of service (crash) via long (1) dir, (2) ls, (3) delete, (4) mkdir, (5) DELE, (6) RMD, or (7) MKD commands.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2003-09/0275.html; http://www.securityfocus.com/bid/8667; https://exchange.xforce.ibmcloud.com/vulnerabilities/13219
CVE: CVE-2003-1161
Published: 2003-12-31
Description: exit.c in Linux kernel 2.6-test9-CVS, as stored on kernel.bkbits.net, was modified to contain a backdoor, which could allow local users to elevate their privileges by passing __WCLONE|__WALL to the sys_wait4 function.
CVSS Score: 7.2 (HIGH)
References: http://www.securityfocus.com/bid/8987; http://www.ussg.iu.edu/hypermail/linux/kernel/0311.0/0621.html; http://www.ussg.iu.edu/hypermail/linux/kernel/0311.0/0627.html
CVE: CVE-2003-1162
Published: 2003-12-31
Description: index.php in Tritanium Bulletin Board 1.2.3 allows remote attackers to read and reply to arbitrary messages by modifying the thread_id, forum_id, and sid parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2003-10/0348.html; http://secunia.com/advisories/10135; http://www.osvdb.org/2770
CVE: CVE-2003-1163
Published: 2003-12-31
Description: hash.c in Ganglia gmond 2.5.3 allows remote attackers to cause a denial of service (segmentation fault) via a UDP packet that contains a single-byte name string, which is used as an out-of-bounds array index.
CVSS Score: 5.0 (MEDIUM)
References: http://ganglia.sourceforge.net/; http://secunia.com/advisories/10166; http://www.osvdb.org/2787
CVE: CVE-2003-1164
Published: 2003-12-31
Description: Cross-site scripting (XSS) vulnerability in Mldonkey 2.5-4 allows remote attackers to inject arbitrary web script or HTML via the URI, which is injected into the HTML error page.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/013070.html; http://secunia.com/advisories/10134; http://www.securityfocus.com/bid/8946
CVE: CVE-2003-1165
Published: 2003-12-31
Description: Buffer overflow in BRS WebWeaver 1.06 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP request with a long User-Agent header.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/343111; http://www.securityfocus.com/bid/8947; https://exchange.xforce.ibmcloud.com/vulnerabilities/13571
CVE: CVE-2003-1166
Published: 2003-12-31
Description: Directory traversal vulnerability in (1) Openfile.aspx and (2) Html.aspx in HTTP Commander 4.0 allows remote attackers to view arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/10125; http://www.http-com.com/Default.asp?section=Features; http://www.osvdb.org/2780
CVE: CVE-2003-1167
Published: 2003-12-31
Description: misc.cpp in KPopup 0.9.1 trusts the PATH variable when executing killall, which allows local users to elevate their privileges by modifying the PATH variable to reference a malicious killall program.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/10105; http://www.osvdb.org/2742; http://www.securityfocus.com/archive/1/342736
CVE: CVE-2003-1168
Published: 2003-12-31
Description: HTTP Commander 4.0 allows remote attackers to obtain sensitive information via an HTTP request that contains a . (dot) in the file parameter, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/10125; http://www.securityfocus.com/bid/8949; http://secunia.com/advisories/10125
CVE: CVE-2003-1169
Published: 2003-12-31
Description: DATEV Nutzungskontrolle 2.1 and 2.2 has insecure write permissions for critical registry keys, which allows local users to bypass access restrictions by importing NukoInfo values in certain DATEV keys, which disables Nutzungskontrolle.
CVSS Score: 4.6 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2003-November/013113.html; http://www.securityfocus.com/bid/8950; https://exchange.xforce.ibmcloud.com/vulnerabilities/13589
CVE: CVE-2003-1170
Published: 2003-12-31
Description: Format string vulnerability in main.cpp in kpopup 0.9.1 and 0.9.5pre2 allows local users to cause a denial of service (segmentation fault) and possibly execute arbitrary code via format string specifiers in command line arguments.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/10105; http://www.osvdb.org/3290; http://www.securityfocus.com/archive/1/342736
CVE: CVE-2003-1171
Published: 2003-12-31
Description: Heap-based buffer overflow in the sec_filter_out function in mod_security 1.7RC1 through 1.7.1 in Apache 2 allows remote attackers to execute arbitrary code via a server side script that sends a large amount of data.
CVSS Score: 7.5 (HIGH)
References: http://adsystems.com.pl/adg-mod_security171.txt; http://secunia.com/advisories/10085; http://securitytracker.com/id?1008025
CVE: CVE-2003-1172
Published: 2003-12-31
Description: Directory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoon 2.1 and 2.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the filename parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://issues.apache.org/bugzilla/show_bug.cgi?id=23949; http://secunia.com/advisories/10064; http://securitytracker.com/id?1007993
CVE: CVE-2003-1173
Published: 2003-12-31
Description: Centrinity FirstClass 7.1 allows remote attackers to access sensitive information by appending search to the end of the URL and checking all of the search option checkboxes and leaving the text field blank, which will return all files in the searched directory.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/10084; http://www.osvdb.org/2723; http://www.securityfocus.com/archive/1/342765
CVE: CVE-2003-1174
Published: 2003-12-31
Description: Buffer overflow in NullSoft Shoutcast Server 1.9.2 allows local users to cause a denial of service via (1) icy-name followed by a long server name or (2) icy-url followed by a long URL.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/10146; http://securitytracker.com/id?1008080; http://www.osvdb.org/2776
CVE: CVE-2003-1175
Published: 2003-12-31
Description: Cross-site scripting (XSS) vulnerability in index.php in Sympoll 1.5 allows remote attackers to inject arbitrary web script or HTML via the vo parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/10165; http://sourceforge.net/tracker/index.php?func=detail&aid=834374&group_id=64442&atid=507493; http://www.osvdb.org/2790
CVE: CVE-2003-1176
Published: 2003-12-31
Description: post_message_form.asp in Web Wiz Forums 6.34 through 7.5, when quote mode is used, allows remote attackers to read or write to private forums by modifying the FID (forum ID) parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/10137; http://securitytracker.com/id?1008100; http://www.osvdb.org/2768
CVE: CVE-2003-1177
Published: 2003-12-31
Description: Buffer overflow in the base64 decoder in MERCUR Mailserver 4.2 before SP3a allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long (1) AUTH command to the POP3 server or (2) AUTHENTICATE command to the IMAP server.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2003-q4/1459.html; http://secunia.com/advisories/10038; http://www.atrium-software.com/mail%20server/pub/mcr42sp3a.html
CVE: CVE-2003-1178
Published: 2003-12-31
Description: Eval injection vulnerability in comments.php in Advanced Poll 2.0.2 allows remote attackers to execute arbitrary PHP code via the (1) id, (2) template_set, or (3) action parameter.
CVSS Score: 7.5 (HIGH)
References: http://attrition.org/pipermail/vim/2006-October/001080.html; http://secunia.com/advisories/10068; http://www.osvdb.org/2743
CVE: CVE-2003-1179
Published: 2003-12-31
Description: Multiple PHP remote file inclusion vulnerabilities in Advanced Poll 2.0.2 allow remote attackers to execute arbitrary PHP code via the include_path parameter in (1) booth.php, (2) png.php, (3) poll_ssi.php, or (4) popup.php, the (5) base_path parameter to common.inc.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/10068; http://www.osvdb.org/28988; http://www.osvdb.org/3291
CVE: CVE-2003-1180
Published: 2003-12-31
Description: Directory traversal vulnerability in Advanced Poll 2.0.2 allows remote attackers to read arbitrary files or inject arbitrary local PHP files via .. sequences in the base_path or pollvars[lang] parameters to the admin files (1) index.php, (2) admin_tpl_new.php, (3) admin_tpl_misc_new.php, (4) admin_templates_misc.php, (5) admin_templates.php, (6) admin_stats.php, (7) admin_settings.php, (8) admin_preview.php, (9) admin_password.php, (10) admin_logout.php, (11) admin_license.php, (12) admin_help.php, (13) admin_embed.php, (14) admin_edit.php, or (15) admin_comment.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/10068; http://www.osvdb.org/3291; http://www.securityfocus.com/archive/1/342493
CVE: CVE-2003-1204
Published: 2003-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mambo Site Server 4.0.12 BETA and earlier allow remote attackers to execute script on other clients via (1) the link parameter in sectionswindow.php, the directory parameter in (2) gallery.php, (3) navigation.php, or (4) uploadimage.php, the path parameter in (5) view.php, (6) the choice parameter in upload.php, (7) the sitename parameter in mambosimple.php, (8) the type parameter in upload.php, or the id parameter in (9) emailarticle.php, (10) emailfaq.php, or (11) emailnews.php.
CVSS Score: 6.8 (MEDIUM)
References: http://www.osvdb.org/7495; http://www.osvdb.org/7496; http://www.osvdb.org/7497
CVE: CVE-2003-1209
Published: 2003-12-31
Description: The Post_Method function in Monkey HTTP Daemon before 0.6.2 allows remote attackers to cause a denial of service (crash) via a POST request without a Content-Type header.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://monkeyd.sourceforge.net/Changelog.txt; http://www.securityfocus.com/bid/7201; https://exchange.xforce.ibmcloud.com/vulnerabilities/11650