morpheuslord/cve-llm-training huggingface dataset:
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-1989.

assistant: Resin 2.1.1 allows remote attackers to cause a denial of service (thread and connection consumption) via multiple URL requests containing the DOS 'CON' device name and a registered file extension such as .jsp or .xtp.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-1990.

assistant: Resin 2.0.5 through 2.1.2 allows remote attackers to reveal physical path information via a URL request for the example Java class file HelloServlet.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-1991.

assistant: PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the include_file parameter to include_once.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-1992.

assistant: Buffer overflow in jrun.dll in ColdFusion MX, when used with IIS 4 or 5, allows remote attackers to cause a denial of service in IIS via (1) a long template file name or (2) a long HTTP header.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-1993.

assistant: webbbs_post.pl in WebBBS 4 and 5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the followup parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-1994.

assistant: advserver.exe in Advanced Web Server (AdvServer) Professional 1.030000 allows remote attackers to cause a denial of service via multiple HTTP requests containing a single carriage return/line feed (CRLF) sequence.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-1995.

assistant: Cross-site scripting (XSS) vulnerability in phptonuke.php for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the filnavn parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-1996.

assistant: Cross-site scripting (XSS) vulnerability in PostNuke 0.71 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) name parameter in modules.php and (2) catid parameter in index.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-1997.

assistant: ZoneAlarm Pro 3.0 MailSafe allows remote attackers to bypass filtering and possibly execute arbitrary code via email attachments containing a trailing dot after the file extension.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-1998.

assistant: Buffer overflow in rpc.cmsd in SCO UnixWare 7.1.1 and Open UNIX 8.0.0 allows remote attackers to execute arbitrary commands via a long parameter to rtable_create (procedure 21).
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2002-1999.

assistant: HP Praesidium Webproxy 1.0 running on HP-UX 11.04 VVOS could allow remote attackers to cause Webproxy to forward requests to the internal network via crafted HTTP requests.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0001.

assistant: Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0002.

assistant: Cross-site scripting vulnerability (XSS) in ManualLogin.asp script for Microsoft Content Management Server (MCMS) 2001 allows remote attackers to execute arbitrary script via the REASONTXT parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0003.

assistant: Buffer overflow in the RPC Locator service for Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute arbitrary code via an RPC call to the service containing certain parameter information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0004.

assistant: Buffer overflow in the Windows Redirector function in Microsoft Windows XP allows local users to execute arbitrary code via a long parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0007.

assistant: Microsoft Outlook 2002 does not properly handle requests to encrypt email messages with V1 Exchange Server Security certificates, which causes Outlook to send the email in plaintext, aka "Flaw in how Outlook 2002 handles V1 Exchange Server Security Certificates could lead to Information Disclosure."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0009.

assistant: Cross-site scripting (XSS) vulnerability in Help and Support Center for Microsoft Windows Me allows remote attackers to execute arbitrary script in the Local Computer security context via an hcp:// URL with the malicious script in the topic parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0010.

assistant: Integer overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0011.

assistant: Unknown vulnerability in the DNS intrusion detection application filter for Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service (blocked traffic to DNS servers) via a certain type of incoming DNS request that is not properly handled.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0012.

assistant: The data collection script for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 sets world-writable permissions for the data/mining directory when it runs, which allows local users to modify or delete the data.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0013.

assistant: The default .htaccess scripts for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 do not include filenames for backup copies of the localconfig file that are made from editors such as vi and Emacs, which could allow remote attackers to obtain a database password by directly accessing the backup file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0014.

assistant: gsinterf.c in bmv 1.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0015.

assistant: Double-free vulnerability in CVS 1.11.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed Directory request, as demonstrated by bypassing write checks to execute Update-prog and Checkin-prog commands.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0016.

assistant: Apache before 2.0.44, when running on unpatched Windows 9x and Me operating systems, allows remote attackers to cause a denial of service or execute arbitrary code via an HTTP request containing MS-DOS device names.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0017.

assistant: Apache 2.0 before 2.0.44 on Windows platforms allows remote attackers to obtain certain files via an HTTP request that ends in certain illegal characters such as ">", which causes a different filename to be processed and served.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0018.

assistant: Linux kernel 2.4.10 through 2.4.21-pre4 does not properly handle the O_DIRECT feature, which allows local attackers with write privileges to read portions of previously deleted files, or cause file system corruption.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0019.

assistant: uml_net in the kernel-utils package for Red Hat Linux 8.0 has incorrect setuid root privileges, which allows local users to modify network interfaces, e.g. by modifying ARP entries or placing interfaces into promiscuous mode.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0020.

assistant: Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0021.

assistant: The "screen dump" feature in Eterm 0.9.1 and earlier allows attackers to overwrite arbitrary files via a certain character escape sequence when it is echoed to a user's terminal, e.g. when the user views a file containing the malicious sequence.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0022.

assistant: The "screen dump" feature in rxvt 2.7.8 allows attackers to overwrite arbitrary files via a certain character escape sequence when it is echoed to a user's terminal, e.g. when the user views a file containing the malicious sequence.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0023.

assistant: The menuBar feature in rxvt 2.7.8 allows attackers to modify menu options and execute arbitrary commands via a certain character escape sequence that inserts the commands into the menu.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0024.

assistant: The menuBar feature in aterm 0.42 allows attackers to modify menu options and execute arbitrary commands via a certain character escape sequence that inserts the commands into the menu.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0025.

assistant: Multiple SQL injection vulnerabilities in IMP 2.2.8 and earlier allow remote attackers to perform unauthorized database activities and possibly gain privileges via certain database functions such as check_prefs() in db.pgsql, as demonstrated using mailbox.php3.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0026.

assistant: Multiple stack-based buffer overflows in the error handling routines of the minires library, as used in the NSUPDATE capability for ISC DHCPD 3.0 through 3.0.1RC10, allow remote attackers to execute arbitrary code via a DHCP message containing a long hostname.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0027.

assistant: Directory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0028.

assistant: Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0030.

assistant: Buffer overflows in protegrity.dll of Protegrity Secure.Data Extension Feature (SEF) before 2.2.3.9 allow attackers with SQL access to execute arbitrary code via the extended stored procedures (1) xp_pty_checkusers, (2) xp_pty_insert, or (3) xp_pty_select.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0031.

assistant: Multiple buffer overflows in libmcrypt before 2.5.5 allow attackers to cause a denial of service (crash).
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0032.

assistant: Memory leak in libmcrypt before 2.5.5 allows attackers to cause a denial of service (memory exhaustion) via a large number of requests to the application, which causes libmcrypt to dynamically load algorithms via libtool.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0033.

assistant: Buffer overflow in the RPC preprocessor for Snort 1.8 and 1.9.x before 1.9.1 allows remote attackers to execute arbitrary code via fragmented RPC packets.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0034.

assistant: Buffer overflow in the mtink status monitor, as included in the printer-drivers package in Mandrake Linux, allows local users to execute arbitrary code via a long HOME environment variable.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0035.

assistant: Buffer overflow in escputil, as included in the printer-drivers package in Mandrake Linux, allows local users to execute arbitrary code via a long printer-name command line argument.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0036.

assistant: ml85p, as included in the printer-drivers package for Mandrake Linux, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable filenames of the form "mlg85p%d".
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0037.

assistant: Buffer overflows in noffle news server 1.0.1 and earlier allow remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0038.

assistant: Cross-site scripting (XSS) vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the (1) email or (2) language parameters.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0039.

assistant: ISC dhcrelay (dhcp-relay) 3.0rc9 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (packet storm) via a certain BOOTP packet that is forwarded to a broadcast MAC address, causing an infinite loop that is not restricted by a hop count.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0040.

assistant: SQL injection vulnerability in the PostgreSQL auth module for courier 0.40 and earlier allows remote attackers to execute SQL code via the user name.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0041.

assistant: Kerberos FTP client allows remote FTP sites to execute arbitrary code via a pipe (|) character in a filename that is retrieved by the client.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0042.

assistant: Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0043.

assistant: Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0044.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0045.

assistant: Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0046.

assistant: AbsoluteTelnet SSH2 client does not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0047.

assistant: SSH2 clients for VanDyke (1) SecureCRT 4.0.2 and 3.4.7, (2) SecureFX 2.1.2 and 2.0.4, and (3) Entunnel 1.0.2 and earlier, do not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0048.

assistant: PuTTY 0.53b and earlier does not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0049.

assistant: Apple File Protocol (AFP) in Mac OS X before 10.2.4 allows administrators to log in as other users by using the administrator password.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0050.

assistant: parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via shell metacharacters.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0051.

assistant: parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to obtain the physical path of the server's installation path via a NULL file parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0052.

assistant: parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to list arbitrary directories.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0053.

assistant: Cross-site scripting (XSS) vulnerability in parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to insert arbitrary script via the filename parameter, which is inserted into an error message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0054.

assistant: Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute certain code via a request to port 7070 with the script in an argument to the rtsp DESCRIBE method, which is inserted into a log file and executed when the log is viewed using a browser.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0055.

assistant: Buffer overflow in the MP3 broadcasting module of Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via a long filename.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0056.

assistant: Buffer overflow in secure locate (slocate) before 2.7 allows local users to execute arbitrary code via a long (1) -c or (2) -r command line argument.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0057.

assistant: Multiple buffer overflows in Hypermail 2 before 2.1.6 allows remote attackers to cause a denial of service and possibly execute arbitrary code (1) via a long attachment filename that is not properly handled by the hypermail executable, or (2) by connecting to the mail CGI program from an IP address that reverse-resolves to a long hostname.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0058.

assistant: MIT Kerberos V5 Key Distribution Center (KDC) before 1.2.5 allows remote authenticated attackers to cause a denial of service (crash) on KDCs within the same realm via a certain protocol request that causes a null dereference.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0059.

assistant: Unknown vulnerability in the chk_trans.c of the libkrb5 library for MIT Kerberos V5 before 1.2.5 allows users from one realm to impersonate users in other realms that have the same inter-realm keys.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0060.

assistant: Format string vulnerabilities in the logging routines for MIT Kerberos V5 Key Distribution Center (KDC) before 1.2.5 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in Kerberos principal names.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0061.

assistant: Buffer overflow in passwd for HP UX B.10.20 allows local users to execute arbitrary commands with root privileges via a long LANG environment variable.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0062.

assistant: Buffer overflow in Eset Software NOD32 for UNIX before 1.013 allows local users to execute arbitrary code via a long path name.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0063.

assistant: The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0064.

assistant: The dtterm terminal emulator allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0065.

assistant: The uxterm terminal emulator allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0066.

assistant: The rxvt terminal emulator 2.7.8 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0067.

assistant: The aterm terminal emulator 0.42 allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0068.

assistant: The Eterm terminal emulator 0.9.1 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0069.

assistant: The PuTTY terminal emulator 0.53 allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0070.

assistant: VTE, as used by default in gnome-terminal terminal emulator 2.2 and as an option in gnome-terminal 2.0, allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0071.

assistant: The DEC UDK processing feature in the xterm terminal emulator in XFree86 4.2.99.4 and earlier allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0072.

assistant: The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes an out-of-bounds read of an array (aka "array overrun").
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0073.

assistant: Double-free vulnerability in mysqld for MySQL before 3.23.55 allows attackers with MySQL access to cause a denial of service (crash) via mysql_change_user.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0074.

assistant: Format string vulnerability in mpmain.c for plpnfsd of the plptools package allows remote attackers to execute arbitrary code via the functions (1) debuglog, (2) errorlog, and (3) infolog.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0075.

assistant: Integer signedness error in the myFseek function of samplein.c for Blade encoder (BladeEnc) 0.94.2 and earlier allows remote attackers to execute arbitrary code via a negative offset value following a "fmt" wave chunk.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0076.

assistant: Unknown vulnerability in the directory parser for Direct Connect 4 Linux (dcgui) before 0.2.2 allows remote attackers to read files outside the sharelist.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0077.

assistant: The hanterm (hanterm-xf) terminal emulator 2.0.5 and earlier, and possibly later versions, allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0078.

assistant: ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an incorrect block cipher padding is used, which causes an information leak (timing discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the "Vaudenay timing attack."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0079.

assistant: The DEC UDK processing feature in the hanterm (hanterm-xf) terminal emulator before 2.0.5 allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0080.

assistant: The iptables ruleset in Gnome-lokkit in Red Hat Linux 8.0 does not include any rules in the FORWARD chain, which could allow attackers to bypass intended access restrictions if packet forwarding is enabled.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0081.

assistant: Format string vulnerability in packet-socks.c of the SOCKS dissector for Ethereal 0.8.7 through 0.9.9 allows remote attackers to execute arbitrary code via SOCKS packets containing format string specifiers.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0082.

assistant: The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (aka "buffer underrun").
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0083.

assistant: Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerability than CVE-2003-0020.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0084.

assistant: mod_auth_any package in Red Hat Enterprise Linux 2.1 and other operating systems does not properly escape arguments when calling other programs, which allows attackers to execute arbitrary commands via shell metacharacters.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0085.

assistant: Buffer overflow in the SMB/CIFS packet fragment re-assembly code for SMB daemon (smbd) in Samba before 2.2.8, and Samba-TNG before 0.3.1, allows remote attackers to execute arbitrary code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0086.

assistant: The code for writing reg files in Samba before 2.2.8 allows local users to overwrite arbitrary files via a race condition involving chown.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0087.

assistant: Buffer overflow in libIM library (libIM.a) for National Language Support (NLS) on AIX 4.3 through 5.2 allows local users to gain privileges via several possible attack vectors, including a long -im argument to aixterm.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0088.

assistant: TruBlueEnvironment for MacOS 10.2.3 and earlier allows local users to overwrite or create arbitrary files and gain root privileges by setting a certain environment variable that is used to write debugging information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0089.

assistant: Buffer overflow in the Software Distributor utilities for HP-UX B.11.00 and B.11.11 allows local users to execute arbitrary code via a long LANG environment variable to setuid programs such as (1) swinstall and (2) swmodify.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0091.

assistant: Stack-based buffer overflow in the bsd_queue() function for lpq on Solaris 2.6 and 7 allows local users to gain root privilege.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0092.

assistant: Heap-based buffer overflow in dtsession for Solaris 2.5.1 through Solaris 9 allows local users to gain root privileges via a long HOME environment variable.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0093.

assistant: The RADIUS decoder in tcpdump 3.6.2 and earlier allows remote attackers to cause a denial of service (crash) via an invalid RADIUS packet with a header length field of 0, which causes tcpdump to generate data within an infinite loop.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0094.

assistant: A patch for mcookie in the util-linux package for Mandrake Linux 8.2 and 9.0 uses /dev/urandom instead of /dev/random, which causes mcookie to use an entropy source that is more predictable than expected, which may make it easier for certain types of attacks to succeed.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0095.

assistant: Buffer overflow in ORACLE.EXE for Oracle Database Server 9i, 8i, 8.1.7, and 8.0.6 allows remote attackers to execute arbitrary code via a long username that is provided during login, as exploitable through client applications that perform their own authentication, as demonstrated using LOADPSP.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0096.

assistant: Multiple buffer overflows in Oracle 9i Database release 2, Release 1, 8i, 8.1.7, and 8.0.6 allow remote attackers to execute arbitrary code via (1) a long conversion string argument to the TO_TIMESTAMP_TZ function, (2) a long time zone argument to the TZ_OFFSET function, or (3) a long DIRECTORY parameter to the BFILENAME function.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0097.

assistant: Unknown vulnerability in CGI module for PHP 4.3.0 allows attackers to access arbitrary files as the PHP user, and possibly execute PHP code, by bypassing the CGI force redirect settings (cgi.force_redirect or --enable-force-cgi-redirect).
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0098.

assistant: Unknown vulnerability in apcupsd before 3.8.6, and 3.10.x before 3.10.5, allows remote attackers to gain root privileges, possibly via format strings in a request to a slave server.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0099.

assistant: Multiple buffer overflows in apcupsd before 3.8.6, and 3.10.x before 3.10.5, may allow attackers to cause a denial of service or execute arbitrary code, related to usage of the vsprintf function.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0100.

assistant: Buffer overflow in Cisco IOS 11.2.x to 12.0.x allows remote attackers to cause a denial of service and possibly execute commands via a large number of OSPF neighbor announcements.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0101.

assistant: miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0102.

assistant: Buffer overflow in tryelf() in readelf.c of the file command allows attackers to execute arbitrary code as the user running file, possibly via a large entity size value in an ELF header (elfhdr.e_shentsize).
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0103.

assistant: Format string vulnerability in Nokia 6210 handset allows remote attackers to cause a denial of service (crash, lockup, or restart) via a Multi-Part vCard with fields containing a large number of format string specifiers.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0104.

assistant: Directory traversal vulnerability in PeopleTools 8.10 through 8.18, 8.40, and 8.41 allows remote attackers to overwrite arbitrary files via the SchedulerTransfer servlet.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0105.

assistant: ServerMask 2.2 and earlier does not obfuscate (1) ETag, (2) HTTP Status Message, or (3) Allow HTTP responses, which could tell remote attackers that the web server is an IIS server.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0106.

assistant: The HTTP proxy for Symantec Enterprise Firewall (SEF) 7.0 allows proxy users to bypass pattern matching for blocked URLs via requests that are URL-encoded with escapes, Unicode, or UTF-8.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0107.

assistant: Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated using vsnprintf, allows attackers to cause a denial of service or possibly execute arbitrary code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0108.

assistant: isakmp_sub_print in tcpdump 3.6 through 3.7.1 allows remote attackers to cause a denial of service (CPU consumption) via a certain malformed ISAKMP packet to UDP port 500, which causes tcpdump to enter an infinite loop.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0109.

assistant: Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute arbitrary code, as demonstrated via a WebDAV request to IIS 5.0.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0110.

assistant: The Winsock Proxy service in Microsoft Proxy Server 2.0 and the Microsoft Firewall service in Internet Security and Acceleration (ISA) Server 2000 allow remote attackers to cause a denial of service (CPU consumption or packet storm) via a spoofed, malformed packet to UDP port 1745.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0111.

assistant: The ByteCode Verifier component of Microsoft Virtual Machine (VM) build 5.0.3809 and earlier, as used in Windows and Internet Explorer, allows remote attackers to bypass security checks and execute arbitrary code via a malicious Java applet, aka "Flaw in Microsoft VM Could Enable System Compromise."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0112.

assistant: Buffer overflow in Windows Kernel allows local users to gain privileges by causing certain error messages to be passed to a debugger.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0113.

assistant: Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code via an HTTP response containing long values in (1) Content-type and (2) Content-encoding fields.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0114.

assistant: The file upload control in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to automatically upload files from the local system via a web page containing a script to upload the files.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0115.

assistant: Microsoft Internet Explorer 5.01, 5.5 and 6.0 does not properly check parameters that are passed during third party rendering, which could allow remote attackers to execute arbitrary web script, aka the "Third Party Plugin Rendering" vulnerability, a different vulnerability than CVE-2003-0233.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0116.

assistant: Microsoft Internet Explorer 5.01, 5.5 and 6.0 does not properly check the Cascading Style Sheet input parameter for Modal dialogs, which allows remote attackers to read files on the local system via a web page containing script that creates a dialog and then accesses the target files, aka "Modal Dialog script execution."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0117.

assistant: Buffer overflow in the HTTP receiver function (BizTalkHTTPReceive.dll ISAPI) of Microsoft BizTalk Server 2002 allows attackers to execute arbitrary code via a certain request to the HTTP receiver.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0118.

assistant: SQL injection vulnerability in the Document Tracking and Administration (DTA) website of Microsoft BizTalk Server 2000 and 2002 allows remote attackers to execute operating system commands via a request to (1) rawdocdata.asp or (2) RawCustomSearchField.asp containing an embedded SQL statement.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0119.

assistant: The secldapclntd daemon in AIX 4.3, 5.1 and 5.2 uses an Internet socket when communicating with the loadmodule, which allows remote attackers to directly connect to the daemon and conduct unauthorized activities.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0120.

assistant: adb2mhc in the mhc-utils package before 0.25+20010625-7.1 allows local users to overwrite arbitrary files via a symlink attack on a default temporary directory with a predictable name.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0121.

assistant: Clearswift MAILsweeper 4.x allows remote attackers to bypass attachment detection via an attachment that does not specify a MIME-Version header field, which is processed by some mail clients.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0122.

assistant: Buffer overflow in Notes server before Lotus Notes R4, R5 before 5.0.11, and early R6 allows remote attackers to execute arbitrary code via a long distinguished name (DN) during NotesRPC authentication and an outer field length that is less than that of the DN field.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0123.

assistant: Buffer overflow in Web Retriever client for Lotus Notes/Domino R4.5 through R6 allows remote malicious web servers to cause a denial of service (crash) via a long HTTP status line.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0124.

assistant: man before 1.5l allows attackers to execute arbitrary code via a malformed man file with improper quotes, which causes the my_xsprintf function to return a string with the value "unsafe," which is then executed as a program via a system call if it is in the search path of the user who runs man.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0125.

assistant: Buffer overflow in the web interface for SOHO Routefinder 550 before firmware 4.63 allows remote attackers to cause a denial of service (reboot) and execute arbitrary code via a long GET /OPTIONS value.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0126.

assistant: The web interface for SOHO Routefinder 550 firmware 4.63 and earlier, and possibly later versions, has a default "admin" account with a blank password, which could allow attackers on the LAN side to conduct unauthorized activities.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0127.

assistant: The kernel module loader in Linux kernel 2.2.x before 2.2.25, and 2.4.x before 2.4.21, allows local users to gain root privileges by using ptrace to attach to a child process that is spawned by the kernel.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0128.

assistant: The try_uudecoding function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a malicious uuencoded (UUE) header, possibly triggering a heap-based buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0129.

assistant: Ximian Evolution Mail User Agent 1.2.2 and earlier allows remote attackers to cause a denial of service (memory consumption) via a mail message that is uuencoded multiple times.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0130.

assistant: The handle_image function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier does not properly escape HTML characters, which allows remote attackers to inject arbitrary data and HTML via a MIME Content-ID header in a MIME-encoded image.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0131.

assistant: The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0132.

assistant: A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0133.

assistant: GtkHTML, as included in Evolution before 1.2.4, allows remote attackers to cause a denial of service (crash) via certain malformed messages.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0134.

assistant: Unknown vulnerability in filestat.c for Apache running on OS2, versions 2.0 through 2.0.45, allows unknown attackers to cause a denial of service via requests related to device names.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0135.

assistant: vsftpd FTP daemon in Red Hat Linux 9 is not compiled against TCP wrappers (tcp_wrappers) but is installed as a standalone service, which inadvertently prevents vsftpd from restricting access as intended.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2003-0136.

assistant: psbanner in the LPRng package allows local users to overwrite arbitrary files via a symbolic link attack on the /tmp/before file.