deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2002-1419
Published: 2003-04-11
Description: The upgrade of IRIX on Origin 3000 to 6.5.13 through 6.5.16 changes the MAC address of the system, which could modify intended access restrictions that are based on a MAC address.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20020805-01-I; http://www.iss.net/security_center/static/9868.php; http://www.securityfocus.com/bid/5467
CVE: CVE-2002-1420
Published: 2003-04-11
Description: Integer signedness error in select() on OpenBSD 3.1 and earlier allows local users to overwrite arbitrary kernel memory via a negative value for the size parameter, which satisfies the boundary check as a signed integer, but is later used as an unsigned integer during a data copying operation.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2863&w=2; http://www.iss.net/security_center/static/9809.php; http://www.kb.cert.org/vuls/id/259787
CVE: CVE-2002-1421
Published: 2003-04-11
Description: SQL injection vulnerabilities in FUDforum before 2.2.0 allow remote attackers to perform unauthorized database operations via (1) report.php, (2) selmsg.php, and (3) showposts.php.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html; http://online.securityfocus.com/archive/1/288042; http://www.iss.net/security_center/static/9912.php
CVE: CVE-2002-1422
Published: 2003-04-11
Description: admbrowse.php in FUDforum before 2.2.0 allows remote attackers to create or delete files via URL-encoded pathnames in the cur and dest parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html; http://online.securityfocus.com/archive/1/288042; http://www.iss.net/security_center/static/9901.php
CVE: CVE-2002-1423
Published: 2003-04-11
Description: tmp_view.php in FUDforum before 2.2.0 allows remote attackers to read arbitrary files via an absolute pathname in the file parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html; http://online.securityfocus.com/archive/1/288042; http://www.iss.net/security_center/static/9896.php
CVE: CVE-2002-1424
Published: 2003-04-11
Description: Buffer overflow in munpack in mpack 1.5 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code.
CVSS Score: 5.0 (MEDIUM)
References: http://www.debian.org/security/2002/dsa-141; http://www.iss.net/security_center/static/9747.php; http://www.securityfocus.com/bid/5385
CVE: CVE-2002-1425
Published: 2003-04-11
Description: Directory traversal vulnerability in munpack in mpack 1.5 and earlier allows remote attackers to create new files in the parent directory via a ../ (dot-dot) sequence in the filename to be extracted.
CVSS Score: 6.4 (MEDIUM)
References: http://www.debian.org/security/2002/dsa-141; http://www.iss.net/security_center/static/9748.php; http://www.securityfocus.com/bid/5386
CVE: CVE-2002-1426
Published: 2003-04-11
Description: HP ProCurve Switch 4000M C.07.23 allows remote attackers to cause a denial of service (crash) via an SNMP write request containing 85 characters, possibly triggering a buffer overflow.
CVSS Score: 7.8 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0338.html; http://www.iss.net/security_center/static/9708.php; http://www.phenoelit.de/stuff/HP_ProCurve.txt
CVE: CVE-2002-1427
Published: 2003-04-11
Description: The print_html_to_file function in edit.cgi for Easy Homepage Creator 1.0 does not check user credentials, which allows remote attackers to modify home pages of other users.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0350.html; http://www.iss.net/security_center/static/9696.php; http://www.securityfocus.com/bid/5340
CVE: CVE-2002-1428
Published: 2003-04-11
Description: index.php in dotProject 0.2.1.5 allows remote attackers to bypass authentication via a cookie or URL with the user_cookie parameter set to 1.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0366.html; http://www.iss.net/security_center/static/9720.php; http://www.securityfocus.com/bid/5347
CVE: CVE-2002-1429
Published: 2003-04-11
Description: Cross-site scripting vulnerability in board.php of endity.com ShoutBOX allows remote attackers to inject arbitrary HTML into the shoutbox page via the site parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0389.html; http://endity.com/board/index.php?act=ST&f=3&t=68&s=[PII_REDACTED]25b2d7fcf60c9cd2a292fe; http://www.iss.net/security_center/static/9739.php
CVE: CVE-2002-1430
Published: 2003-04-11
Description: Unknown vulnerability in Sympoll 1.2 allows remote attackers to read arbitrary files when register_globals is enabled, possibly by modifying certain PHP variables through URL parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-07/0401.html; http://www.iss.net/security_center/static/9723.php; http://www.ralusp.net/downloads/sympoll/changelog.txt
CVE: CVE-2002-1431
Published: 2003-04-11
Description: Belkin F5D5230-4 4-Port Cable/DSL Gateway Router 1.20.000 modifies the source IP address of internal packets to that of the router's external interface when forwarding a request from an internal host to an internal web server, which allows remote attackers to hide which host is being used to access the web server.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/276256; http://www.iss.net/security_center/static/9324.php; http://www.securityfocus.com/bid/4982
CVE: CVE-2002-1432
Published: 2003-04-11
Description: MidiCart stores the midicart.mdb database file under the Web document root, which allows remote attackers to steal sensitive information by directly requesting the database.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0074.html; http://www.iss.net/security_center/static/9816.php; http://www.securityfocus.com/bid/5438
CVE: CVE-2002-1433
Published: 2003-04-11
Description: Kerio MailServer 5.0 allows remote attackers to cause a denial of service (hang) via SYN packets to the supported network services.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0183.html; http://www.iss.net/security_center/static/9904.php; http://www.securityfocus.com/bid/5505
CVE: CVE-2002-1434
Published: 2003-04-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Web mail module of Kerio MailServer 5.0 allow remote attackers to execute HTML script as other users via certain URLs.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0183.html; http://www.iss.net/security_center/static/9905.php; http://www.securityfocus.com/bid/5507
CVE: CVE-2002-1435
Published: 2003-04-11
Description: class.atkdateattribute.js.php in Achievo 0.7.0 through 0.9.1, except 0.8.2, allows remote attackers to execute arbitrary PHP code when the 'allow_url_fopen' setting is enabled via a URL in the config_atkroot parameter that points to the code.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0235.html; http://www.achievo.org/lists/2002/Aug/msg00092.html; http://www.iss.net/security_center/static/9947.php
CVE: CVE-2002-1436
Published: 2003-04-11
Description: The web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to execute arbitrary Perl code via an HTTP POST request.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0202.html; http://support.novell.com/servlet/tidfinder/2963307; http://www.iss.net/security_center/static/9916.php
CVE: CVE-2002-1437
Published: 2003-04-11
Description: Directory traversal vulnerability in the web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to read arbitrary files via an HTTP request containing "..%5c" (URL-encoded dot-dot backslash) sequences.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0202.html; http://support.novell.com/servlet/tidfinder/2963307; http://www.iss.net/security_center/static/9915.php
CVE: CVE-2002-1438
Published: 2003-04-11
Description: The web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to obtain Perl version information via the -v option.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0202.html; http://support.novell.com/servlet/tidfinder/2963307; http://www.iss.net/security_center/static/9917.php
CVE: CVE-2002-1439
Published: 2003-04-11
Description: Unknown vulnerability related to stack corruption in the TGA daemon for HP-UX 11.04 (VVOS) Virtualvault 4.0, 4.5, and 4.6 may allow attackers to obtain access to system files.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/hp/2002-q3/0050.html; http://www.iss.net/security_center/static/9846.php; http://www.securityfocus.com/bid/5459
CVE: CVE-2002-1440
Published: 2003-04-11
Description: The Gateway GS-400 server has a default root password of "0001n" that can not be changed via the administrative interface, which can allow attackers to gain root privileges.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0126.html; http://www.iss.net/security_center/static/9864.php; http://www.securityfocus.com/bid/5472
CVE: CVE-2002-1441
Published: 2003-04-11
Description: Multiple buffer overflows in Tomahawk SteelArrow before 4.5 allow remote attackers to execute arbitrary code via (1) the Steelarrow Service (Steelarrow.exe) using a long UserIdent Cookie header, (2) DLLHOST.EXE (Steelarrow.dll) via a request for a long .aro file, or (3) DLLHOST.EXE via a Chunked Transfer-Encoding request.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0085.html; http://online.securityfocus.com/archive/1/288013; http://www.iss.net/security_center/static/9888.php
CVE: CVE-2002-1442
Published: 2003-04-11
Description: The Google toolbar 1.1.58 and earlier allows remote web sites to perform unauthorized toolbar operations including script execution and file reading in other zones such as "My Computer" by opening a window to tools.google.com or the res: protocol, then using script to modify the window's location to the toolbar's configuration URL, which bypasses the origin verification check.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/ntbugtraq/2002-q3/0066.html; http://online.securityfocus.com/archive/1/286527; http://sec.greymagic.com/adv/gm001-mc/
CVE: CVE-2002-1443
Published: 2003-04-11
Description: The Google toolbar 1.1.58 and earlier allows remote web sites to monitor a user's input into the toolbar via an "onkeydown" event handler.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/ntbugtraq/2002-q3/0066.html; http://online.securityfocus.com/archive/1/286527; http://sec.greymagic.com/adv/gm001-mc/
CVE: CVE-2003-0132
Published: 2003-04-11
Description: A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-772
References: http://lists.apple.com/mhonarc/security-announce/msg00028.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6484&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1731&w=2
CVE: CVE-2003-0134
Published: 2003-04-11
Description: Unknown vulnerability in filestat.c for Apache running on OS2, versions 2.0 through 2.0.45, allows unknown attackers to cause a denial of service via requests related to device names.
CVSS Score: 5.0 (MEDIUM)
References: http://cvs.apache.org/viewcvs/apr/file_io/os2/filestat.c.diff?r1=1.34&r2=1.35; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6484&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2559&w=2
CVE: CVE-2003-0135
Published: 2003-04-11
Description: vsftpd FTP daemon in Red Hat Linux 9 is not compiled against TCP wrappers (tcp_wrappers) but is installed as a standalone service, which inadvertently prevents vsftpd from restricting access as intended.
CVSS Score: 7.5 (HIGH)
References: http://www.redhat.com/support/errata/RHSA-2003-084.html; http://www.securityfocus.com/bid/7253; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A634
CVE: CVE-2003-0169
Published: 2003-04-11
Description: hpnst.exe in the GoAhead-Webs webserver for HP Instant TopTools before 5.55 allows remote attackers to cause a denial of service (CPU consumption) via a request to hpnst.exe that calls itself, which causes an infinite loop.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0164.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5949&w=2; http://www.securityfocus.com/bid/7246
CVE: CVE-2003-0197
Published: 2003-04-11
Description: Buffer overflow gds_lock_mgr of Interbase Database 6.x allows local users to gain privileges via a long ISC_LOCK_ENV environment variable (INTERBASE_LOCK).
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q2/0003.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9887&w=2; http://www.secnetops.com/research/advisories/SRT2003-04-03-1300.txt
CVE: CVE-2003-0203
Published: 2003-04-11
Description: Buffer overflow in moxftp 2.2 and earlier allows remote malicious FTP servers to execute arbitrary code via a long FTP banner.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6860&w=2; http://secunia.com/advisories/8136; http://www.debian.org/security/2003/dsa-281
CVE: CVE-2003-1054
Published: 2003-04-16
Description: mod_access_referer 1.0.2 allows remote attackers to cause a denial of service (crash) via a malformed Referer header that is missing a hostname, as parsed by the ap_parse_uri_components function in Apache, which triggers a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004555.html; http://secunia.com/advisories/8612; http://sourceforge.net/project/shownotes.php?release_id=151905
CVE: CVE-2002-1464
Published: 2003-04-22
Description: Cross-site scripting (XSS) vulnerability in CafeLog b2 Weblog Tool allows remote attackers to insert arbitrary HTML or script via the GPC variable.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0071.html; http://online.securityfocus.com/archive/1/287228; http://www.iss.net/security_center/static/9835.php
CVE: CVE-2002-1465
Published: 2003-04-22
Description: SQL injection vulnerability in CafeLog b2 Weblog Tool allows remote attackers to execute arbitrary SQL code via the tablehosts variable.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0071.html; http://online.securityfocus.com/archive/1/287228; http://www.iss.net/security_center/static/9836.php
CVE: CVE-2002-1466
Published: 2003-04-22
Description: CafeLog b2 Weblog Tool 2.06pre4, with allow_fopen_url enabled, allows remote attackers to execute arbitrary PHP code via the b2inc variable.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0071.html; http://online.securityfocus.com/archive/1/287228; http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0071.html
CVE: CVE-2002-1467
Published: 2003-04-22
Description: Macromedia Flash Plugin before 6,0,47,0 allows remote attackers to bypass the same-domain restriction and read arbitrary files via (1) an HTTP redirect, (2) a "file://" base in a web document, or (3) a relative URL from a web archive (mht file).
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/286625; http://www.iss.net/security_center/static/9797.php; http://www.macromedia.com/v1/handlers/index.cfm?ID=23294
CVE: CVE-2002-1468
Published: 2003-04-22
Description: Buffer overflow in errpt in AIX 4.3.3 allows local users to execute arbitrary code as root.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/aix/2002-q3/0007.html; http://www.securityfocus.com/bid/5885; http://archives.neohapsis.com/archives/aix/2002-q3/0007.html
CVE: CVE-2002-1469
Published: 2003-04-22
Description: scponly does not properly verify the path when finding the (1) scp or (2) sftp-server programs, which could allow remote authenticated users to bypass access controls by uploading malicious programs and modifying the PATH variable in $HOME/.ssh/environment to locate those programs.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/288245; http://www.iss.net/security_center/static/9913.php; http://www.securityfocus.com/bid/5526
CVE: CVE-2002-1470
Published: 2003-04-22
Description: SHOUTcast 1.8.9 and earlier allows local users to obtain the cleartext administrative password via a GET request to port 8001, which causes the password to be logged in the world-readable sc_serv.log file.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2002-08/0017.html; http://www.iss.net/security_center/static/9775.php; http://www.securityfocus.com/bid/5414
CVE: CVE-2002-1471
Published: 2003-04-22
Description: The camel component for Ximian Evolution 1.0.x and earlier does not verify certificates when it establishes a new SSL connection after previously verifying a certificate, which could allow remote attackers to monitor or modify sessions via a man-in-the-middle attack.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-10/0045.html; http://www.iss.net/security_center/static/10292.php; http://www.securityfocus.com/bid/5875
CVE: CVE-2002-1473
Published: 2003-04-22
Description: Multiple buffer overflows in lp subsystem for HP-UX 10.20 through 11.11 (11i) allow local users to cause a denial of service and possibly execute arbitrary code.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/hp/2002-q3/0064.html; http://www.iss.net/security_center/static/9992.php; http://archives.neohapsis.com/archives/hp/2002-q3/0064.html
CVE: CVE-2002-1474
Published: 2003-04-22
Description: Unknown vulnerability or vulnerabilities in TCP/IP component for HP Tru64 UNIX 4.0f, 4.0g, and 5.0a allows remote attackers to cause a denial of service.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/tru64/2002-q3/0017.html; http://archives.neohapsis.com/archives/tru64/2002-q3/0017.html
CVE: CVE-2002-1475
Published: 2003-04-22
Description: Unknown vulnerability in the ARP component for HP Tru64 UNIX 4.0f, 4.0g, and 5.0a allows remote attackers to "take over packets destined for another host" and cause a denial of service.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/tru64/2002-q3/0017.html; http://archives.neohapsis.com/archives/tru64/2002-q3/0017.html
CVE: CVE-2002-1476
Published: 2003-04-22
Description: Buffer overflow in setlocale in libc on NetBSD 1.4.x through 1.6, and possibly other operating systems, when called with the LC_ALL category, allows local attackers to execute arbitrary code via a user-controlled locale string that has more than 6 elements, which exceeds the boundaries of the new_categories category array, as exploitable through programs such as xterm and zsh.
CVSS Score: 4.6 (MEDIUM)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-012.txt.asc; http://www.iss.net/security_center/static/10159.php; http://www.osvdb.org/7565
CVE: CVE-2002-1477
Published: 2003-04-22
Description: graphs.php in Cacti before 0.6.8 allows remote authenticated Cacti administrators to execute arbitrary commands via shell metacharacters in the title during edit mode.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0028.html; http://www.debian.org/security/2002/dsa-164; http://www.iss.net/security_center/static/10048.php
CVE: CVE-2002-1478
Published: 2003-04-22
Description: Cacti before 0.6.8 allows attackers to execute arbitrary commands via the "Data Input" option in console mode.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0028.html; http://www.debian.org/security/2002/dsa-164; http://www.iss.net/security_center/static/10050.php
CVE: CVE-2002-1479
Published: 2003-04-22
Description: Cacti before 0.6.8 stores a MySQL username and password in plaintext in config.php, which has world-readable permissions, which allows local users to modify databases as the Cacti user and possibly gain privileges.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0028.html; http://www.iss.net/security_center/static/10049.php; http://www.knights-of-the-routing-table.org/advisories/krt_001_20020903_cacti.txt
CVE: CVE-2002-1480
Published: 2003-04-22
Description: Cross-site scripting (XSS) vulnerability in phpGB before 1.20 allows remote attackers to inject arbitrary HTML or script into guestbook pages, which is executed when the administrator deletes the entry.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0069.html; http://www.iss.net/security_center/static/10060.php; http://www.securityfocus.com/bid/5676
CVE: CVE-2002-1481
Published: 2003-04-22
Description: savesettings.php in phpGB 1.20 and earlier does not require authentication, which allows remote attackers to cause a denial of service or execute arbitrary PHP code by using savesettings.php to modify config.php.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0076.html; http://www.iss.net/security_center/static/10065.php; http://www.securityfocus.com/bid/5679
CVE: CVE-2002-1482
Published: 2003-04-22
Description: SQL injection vulnerability in login.php for phpGB 1.20 and earlier, when magic_quotes_gpc is not enabled, allows remote attackers to gain administrative privileges via SQL code in the password entry.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0076.html; http://www.iss.net/security_center/static/10068.php; http://www.securityfocus.com/bid/5673
CVE: CVE-2002-1483
Published: 2003-04-22
Description: db4web_c and db4web_c.exe programs in DB4Web 3.4 and 3.6 allow remote attackers to read arbitrary files via an HTTP request whose argument is a filename of the form (1) C: (drive letter), (2) //absolute/path (double-slash), or (3) .. (dot-dot).
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0197.html; http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0124.html; http://www.db4web.de/download/homepage/hotfix/readme_en.txt
CVE: CVE-2002-1484
Published: 2003-04-22
Description: DB4Web server, when configured to use verbose debug messages, allows remote attackers to use DB4Web as a proxy and attempt TCP connections to other systems (port scan) via a request for a URL that specifies the target IP address and port, which produces a connection status in the resulting error message.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: http://archives.neohapsis.com/archives/bugtraq/2002-09/0201.html; http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0125.html; http://www.iss.net/security_center/static/10136.php
CVE: CVE-2003-1070
Published: 2003-04-28
Description: Unknown vulnerability in rpcbind for Solaris 2.6 through 9 allows remote attackers to cause a denial of service (rpcbind crash).
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/8685/; http://sunsolve.sun.com/search/document.do?assetkey=1-26-50922-1; http://www.securityfocus.com/bid/7455
CVE: CVE-2003-1072
Published: 2003-04-28
Description: Memory leak in lofiadm in Solaris 8 allows local users to cause a denial of service (kernel memory consumption).
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/8686/; http://sunsolve.sun.com/search/document.do?assetkey=1-26-54100-1; http://www.securityfocus.com/bid/7454