rainbutterfly/cve_corpus huggingface dataset:
CVE-2003-1174 
Buffer overflow in NullSoft Shoutcast Server 1.9.2 allows local users to cause a denial of service via (1) icy-name followed by a long server name or (2) icy-url followed by a long URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1175 
Cross-site scripting (XSS) vulnerability in index.php in Sympoll 1.5 allows remote attackers to inject arbitrary web script or HTML via the vo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1176 
post_message_form.asp in Web Wiz Forums 6.34 through 7.5, when quote mode is used, allows remote attackers to read or write to private forums by modifying the FID (forum ID) parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1177 
Buffer overflow in the base64 decoder in MERCUR Mailserver 4.2 before SP3a allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long (1) AUTH command to the POP3 server or (2) AUTHENTICATE command to the IMAP server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1178 
Eval injection vulnerability in comments.php in Advanced Poll 2.0.2 allows remote attackers to execute arbitrary PHP code via the (1) id, (2) template_set, or (3) action parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1179 
Multiple PHP remote file inclusion vulnerabilities in Advanced Poll 2.0.2 allow remote attackers to execute arbitrary PHP code via the include_path parameter in (1) booth.php, (2) png.php, (3) poll_ssi.php, or (4) popup.php, the (5) base_path parameter to common.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1180 
Directory traversal vulnerability in Advanced Poll 2.0.2 allows remote attackers to read arbitrary files or inject arbitrary local PHP files via .. sequences in the base_path or pollvars[lang] parameters to the admin files (1) index.php, (2) admin_tpl_new.php, (3) admin_tpl_misc_new.php, (4) admin_templates_misc.php, (5) admin_templates.php, (6) admin_stats.php, (7) admin_settings.php, (8) admin_preview.php, (9) admin_password.php, (10) admin_logout.php, (11) admin_license.php, (12) admin_help.php, (13) admin_embed.php, (14) admin_edit.php, or (15) admin_comment.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1181 
Advanced Poll 2.0.2 allows remote attackers to obtain sensitive information via an HTTP request to info.php, which invokes the phpinfo() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1182 
Cross-site scripting (XSS) vulnerability in MPM Guestbook 1.2 allows remote attackers to inject arbitrary web script or HTML via the lng parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1183 
The WebCache component in Oracle Files 9.0.3.1.0, 9.0.3.2.0, and 9.0.3.3.0 of Oracle Collaboration Suite Release 1 caches files despite the cacheability rules imposed by Oracle Files, which allows local users to gain access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1184 
Multiple cross-site scripting (XSS) vulnerabilities in ThWboard Beta 2.8 and 2.81 allow remote attackers to inject arbitrary web script or HTML via (1) time in board.php, (2) the profile Homepage-Feld, (3) pictures, and (4) other "Diverse XSS Bugs."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1185 
Multiple SQL injection vulnerabilities in ThWboard before Beta 2.8.2 allow remote attackers to inject arbitrary SQL commands via various vectors including (1) Admin-Center, (2) Announcements, (3) admin/calendar.php, and (4) showevent.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1186 
Buffer overflow in TelCondex SimpleWebServer 2.12.30210 Build3285 allows remote attackers to execute arbitrary code via a long HTTP Referer header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1187 
Cross-site scripting (XSS) vulnerability in include.php in PHPKIT 1.6.02 and 1.6.03 allows remote attackers to inject arbitrary web script or HTML via the contact_email parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1188 
Unichat allows remote attackers to cause a denial of service (crash) by adding extra chat characters (avatars) and logging in to a chat room, as demonstrated using duplicate ACTOR entries in u2res000.rit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1189 
Unknown vulnerability in Nokia IPSO 3.7, configured as IP Clusters, allows remote attackers to cause a denial of service via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1190 
Cross-site scripting (XSS) vulnerability in PHPRecipeBook 1.24 through 2.17 allows remote attackers to inject arbitrary web script or HTML via a recipe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1191 
chatbox.php in e107 0.554 and 0.603 allows remote attackers to cause a denial of service (pages fail to load) via HTML in the Name field, which prevents the main.php form from being loaded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1192 
Stack-based buffer overflow in IA WebMail Server 3.1.0 allows remote attackers to execute arbitrary code via a long GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1193 
Multiple SQL injection vulnerabilities in the Portal DB (1) List of Values (LOVs), (2) Forms, (3) Hierarchy, and (4) XML components packages in Oracle Oracle9i Application Server 9.0.2.00 through 3.0.9.8.5 allow remote attackers to execute arbitrary SQL commands via the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1194 
Cross-site scripting (XSS) vulnerability in Booby .1 through 0.2.3 allows remote attackers to inject arbitrary web script or HTML via the error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1195 
SQL injection vulnerability in getmember.asp in VieBoard 2.6 Beta 1 allows remote attackers to execute arbitrary SQL commands via the msn variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1196 
SQL injection vulnerability in viewtopic.asp in VieBoard 2.6 allows remote attackers to execute arbitrary SQL commands via the forumid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1197 
Cross-site scripting (XSS) vulnerability in index.php for Ledscripts.com LedForums Beta 1 allows remote attackers to inject arbitrary web script or HTML via the (1) top_message parameter or (2) topic field of a new thread.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1198 
connection.c in Cherokee web server before 0.4.6 allows remote attackers to cause a denial of service via an HTTP POST request without a Content-Length header field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1199 
Cross-site scripting (XSS) vulnerability in MyProxy 20030629 allows remote attackers to inject arbitrary web script or HTML via the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1200 
Stack-based buffer overflow in FORM2RAW.exe in Alt-N MDaemon 6.5.2 through 6.8.5 allows remote attackers to execute arbitrary code via a long From parameter to Form2Raw.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1201 
ldbm_back_exop_passwd in the back-ldbm backend in passwd.c for OpenLDAP 2.1.12 and earlier, when the slap_passwd_parse function does not return LDAP_SUCCESS, attempts to free an uninitialized pointer, which allows remote attackers to cause a denial of service (segmentation fault).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1202 
The checklogin function in omail.pl for omail webmail 0.98.4 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) password, (2) domainname, or (3) username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2003-1203 
Cross-site scripting (XSS) vulnerability in index.php for Mambo Site Server 4.0.10 allows remote attackers to execute script on other clients via the ?option parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-19T04:00:00.000Z
CVE-2003-1204 
Multiple cross-site scripting (XSS) vulnerabilities in Mambo Site Server 4.0.12 BETA and earlier allow remote attackers to execute script on other clients via (1) the link parameter in sectionswindow.php, the directory parameter in (2) gallery.php, (3) navigation.php, or (4) uploadimage.php, the path parameter in (5) view.php, (6) the choice parameter in upload.php, (7) the sitename parameter in mambosimple.php, (8) the type parameter in upload.php, or the id parameter in (9) emailarticle.php, (10) emailfaq.php, or (11) emailnews.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-19T04:00:00.000Z
CVE-2003-1205 
Crob FTP Server 2.60.1 allows remote authenticated users to cause a denial of service (crash) by renaming a file to the "con" MS-DOS device name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-19T04:00:00.000Z
CVE-2003-1206 
Format string vulnerability in Crob FTP Server 2.60.1 allows remote attackers to cause a denial of service (crash) via "%s" or "%n" sequences in (1) the username during login, or other FTP commands such as (2) dir.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-19T04:00:00.000Z
CVE-2003-1207 
Crob FTP Server 3.5.1 allows remote authenticated users to cause a denial of service (crash) via a dir command with a large number of "." characters followed by a "/*" string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-19T04:00:00.000Z
CVE-2003-1208 
Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow local users to execute arbitrary code by (1) setting the TIME_ZONE session parameter to a long value, or providing long parameters to the (2) NUMTOYMINTERVAL, (3) NUMTODSINTERVAL or (4) FROM_TZ functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-19T04:00:00.000Z
CVE-2003-1209 
The Post_Method function in Monkey HTTP Daemon before 0.6.2 allows remote attackers to cause a denial of service (crash) via a POST request without a Content-Type header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-19T04:00:00.000Z
CVE-2003-1210 
Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 5.x through 6.5 allow remote attackers to execute arbitrary SQL commands via the (1) lid parameter to the getit function or the (2) min parameter to the search function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-19T04:00:00.000Z
CVE-2003-1211 
Cross-site scripting (XSS) vulnerability in search.asp for MaxWebPortal 1.30 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via the Search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-19T04:00:00.000Z
CVE-2003-1212 
MaxWebPortal 1.30 allows remote attackers to perform unauthorized actions by modifying hidden form fields, such as the (1) news, (2) lock, or (3) allmem fields in the 'start new topic' HTML page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-19T04:00:00.000Z
CVE-2003-1213 
The default installation of MaxWebPortal 1.30 stores the portal database under the web document root with insecure access control, which allows remote attackers to obtain sensitive information via a direct request to database/db2000.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-19T04:00:00.000Z
CVE-2003-1214 
Unknown vulnerability in the server login for VisualShapers ezContents 2.02 and earlier allows remote attackers to bypass access restrictions and gain access to restricted functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-19T04:00:00.000Z
CVE-2003-1215 
SQL injection vulnerability in groupcp.php for phpBB 2.0.6 and earlier allows group moderators to perform unauthorized activities via the sql_in parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-27T04:00:00.000Z
CVE-2003-1216 
SQL injection vulnerability in search.php for phpBB 2.0.6 and earlier allows remote attackers to execute arbitrary SQL and gain privileges via the search_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-27T04:00:00.000Z
CVE-2003-1219 
Cross-site scripting (XSS) vulnerability in the tep_href_link function in html_output.php for osCommerce before 2.2-MS3 allows remote attackers to inject arbitrary web script or HTML via the osCsid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-04T04:00:00.000Z
CVE-2003-1220 
BEA WebLogic Server proxy plugin for BEA Weblogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (proxy plugin crash) via a malformed URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2003-1221 
BEA WebLogic Express and Server 7.0 through 8.1 SP 1, under certain circumstances when a request to use T3 over SSL (t3s) is made to the insecure T3 port, may use a non-SSL connection for the communication, which could allow attackers to sniff sessions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2003-1222 
BEA Weblogic Express and Server 8.0 through 8.1 SP 1, when using a foreign Java Message Service (JMS) provider, echoes the password for the foreign provider to the console and stores it in cleartext in config.xml, which could allow attackers to obtain the password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2003-1223 
The Node Manager for BEA WebLogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (Node Manager crash) via malformed data to the Node Manager's port, as demonstrated by nmap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2003-1224 
Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read a user's password by physically observing ("shoulder surfing") the screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2003-1225 
The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2003-1226 
BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2003-1227 
PHP remote file include vulnerability in index.php for Gallery 1.4 and 1.4-pl1, when running on Windows or in Configuration mode on Unix, allows remote attackers to inject arbitrary PHP code via a URL in the GALLERY_BASEDIR parameter, a different vulnerability than CVE-2002-1412.  NOTE: this issue might be exploitable only during installation, or if the administrator has not run a security script after installation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2003-1228 
Buffer overflow in the prepare_reply function in request.c for Mathopd 1.2 through 1.5b13, and possibly earlier versions, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via an HTTP request with a long path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2003-1229 
X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-17T04:00:00.000Z
CVE-2003-1230 
The implementation of SYN cookies (syncookies) in FreeBSD 4.5 through 5.0-RELEASE-p3 uses only 32-bit internal keys when generating syncookies, which makes it easier for remote attackers to conduct brute force ISN guessing attacks and spoof legitimate traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-17T04:00:00.000Z
CVE-2003-1231 
Cross-site scripting (XSS) vulnerability in index.php in ECW-Shop 5.5 allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2003-1232 
Emacs 21.2.1 does not prompt or warn the user before executing Lisp code in the local variables section of a text file, which allows user-assisted attackers to execute arbitrary commands, as demonstrated using the mode-name variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-26T04:00:00.000Z
CVE-2003-1233 
Pedestal Software Integrity Protection Driver (IPD) 1.3 and earlier allows privileged attackers, such as rootkits, to bypass file access restrictions to the Windows kernel by using the NtCreateSymbolicLinkObject function to create a symbolic link to (1) \Device\PhysicalMemory or (2) to a drive letter using the subst command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-28T04:00:00.000Z
CVE-2003-1234 
Integer overflow in the f_count counter in FreeBSD before 4.2 through 5.0 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via multiple calls to (1) fpathconf and (2) lseek, which do not properly decrement f_count through a call to fdrop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-16T07:37:00.000Z
CVE-2003-1235 
BRW WebWeaver 1.03 allows remote attackers to obtain sensitive server environment information via a URL request for testcgi.exe, which lists the values of environment variables and the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-16T07:37:00.000Z
CVE-2003-1236 
Multiple format string vulnerabilities in the logger function in netzio.c for Tanne 0.6.17 allows remote attackers to execute arbitrary code via format string specifiers in syslog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-16T07:37:00.000Z
CVE-2003-1237 
Cross-site scripting vulnerability (XSS) in WWWBoard 2.0A2.1 and earlier allows remote attackers to inject arbitrary HTML or web script via a message post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-16T07:37:00.000Z
CVE-2003-1238 
Cross-site scripting vulnerability (XSS) in Nuked-Klan 1.3 beta and earlier allows remote attackers to steal authentication information via cookies by injecting arbitrary HTML or script into op of the (1) Team, (2) News, and (3) Liens modules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-16T07:37:00.000Z
CVE-2003-1239 
Directory traversal vulnerability in sendphoto.php in WihPhoto 0.86 allows remote attackers to read arbitrary files via .. specifiers in the album parameter, and the target filename in the pic parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-16T07:37:00.000Z
CVE-2003-1240 
PHP remote file inclusion vulnerability in CuteNews 0.88 allows remote attackers to execute arbitrary PHP code via a URL in the cutepath parameter in (1) shownews.php, (2) search.php, or (3) comments.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-16T07:37:00.000Z
CVE-2003-1241 
Cross-site scripting vulnerability (XSS) in (1) admin_index.php, (2) admin_pass.php, (3) admin_modif.php, and (4) admin_suppr.php in MyGuestbook 3.0 allows remote attackers to execute arbitrary PHP code by modifying the location parameter to reference a URL on a remote web server that contains file.php via script injected into the pseudo, email, and message parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-16T07:37:00.000Z
CVE-2003-1242 
Sage 1.0 b3 allows remote attackers to obtain the root web server path via a URL request for a non-existent module, which returns the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-16T07:37:00.000Z
CVE-2003-1243 
Cross-site scripting vulnerability (XSS) in Sage 1.0 b3 allows remote attackers to insert arbitrary HTML or web script via the mod parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-16T07:37:00.000Z
CVE-2003-1244 
SQL injection vulnerability in page_header.php in phpBB 2.0, 2.0.1 and 2.0.2 allows remote attackers to brute force user passwords and possibly gain unauthorized access to forums via the forum_id parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-16T07:37:00.000Z
CVE-2003-1245 
index2.php in Mambo 4.0.12 allows remote attackers to gain administrator access via a URL request where session_id is set to the MD5 hash of a session cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-16T07:37:00.000Z