rainbutterfly/cve_corpus huggingface dataset:
CVE-2003-1534 
Cross-site scripting (XSS) vulnerability in jgb.php3 in Justice Guestbook 1.3 allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) homepage, (3) aim, (4) yim, (5) location, and (6) comment variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-08T20:00:00.000Z
CVE-2003-1535 
Justice Guestbook 1.3 allows remote attackers to obtain the full installation path via a direct request to cfooter.php3, which leaks the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-08T20:00:00.000Z
CVE-2003-1536 
Multiple cross-site scripting (XSS) vulnerabilities in Codeworx Technologies DCP-Portal 5.3.1 allow remote attackers to inject arbitrary web script or HTML via (1) the q parameter to search.php and (2) the year parameter to calendar.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-08T20:00:00.000Z
CVE-2003-1537 
Directory traversal vulnerability in PostNuke 0.723 and earlier allows remote attackers to include arbitrary files named theme.php via the theme parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-14T02:00:00.000Z
CVE-2003-1538 
susehelp in SuSE Linux 8.1, Enterprise Server 8, Office Server, and Openexchange Server 4 does not properly filter shell metacharacters, which allows remote attackers to execute arbitrary commands via CGI queries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-20T21:00:00.000Z
CVE-2003-1539 
Cross-site scripting (XSS) vulnerability in ONEdotOH Simple File Manager (SFM) before 0.21 allows remote attackers to inject arbitrary web script or HTML via (1) file names and (2) directory names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T01:00:00.000Z
CVE-2003-1540 
WF-Chat 1.0 Beta stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain authentication information via a direct request to (1) !pwds.txt and (2) !nicks.txt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-13T01:00:00.000Z
CVE-2003-1541 
PlanetMoon Guestbook tr3.a stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the admin script password, and other passwords, via a direct request to files/passwd.txt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-13T23:00:00.000Z
CVE-2003-1542 
Directory traversal vulnerability in plugins/file.php in phpWebFileManager before 0.4.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the fm_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-13T23:00:00.000Z
CVE-2003-1543 
Cross-site scripting (XSS) vulnerability in Bajie Http Web Server 0.95zxe, 0.95zxc, and possibly others, allows remote attackers to inject arbitrary web script or HTML via the query string, which is reflected in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-13T23:00:00.000Z
CVE-2003-1544 
Unrestricted critical resource lock in Terminal Services for Windows 2000 before SP4 and Windows XP allows remote authenticated users to cause a denial of service (reboot) by obtaining a read lock on msgina.dll, which prevents msgina.dll from being loaded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-13T23:00:00.000Z
CVE-2003-1545 
Absolute path traversal vulnerability in nukestyles.com viewpage.php addon for PHP-Nuke allows remote attackers to read arbitrary files via a full pathname in the file parameter.  NOTE: This was originally reported as an issue in PHP-Nuke 6.5, but this is an independent addon.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-28T20:00:00.000Z
CVE-2003-1546 
Cross-site scripting (XSS) vulnerability in gbook.php in Filebased guestbook 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the comment section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-06T01:00:00.000Z
CVE-2003-1547 
Cross-site scripting (XSS) vulnerability in block-Forums.php in the Splatt Forum module for PHP-Nuke 6.x allows remote attackers to inject arbitrary web script or HTML via the subject parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-06T01:00:00.000Z
CVE-2003-1548 
MyABraCaDaWeb 1.0.2 and earlier allows remote attackers to obtain sensitive information via an invalid IDAdmin or other parameter, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-06T01:00:00.000Z
CVE-2003-1549 
Cross-site scripting (XSS) vulnerability in header.php in MyABraCaDaWeb 1.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the ma_kw parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-06T01:00:00.000Z
CVE-2003-1550 
XOOPS 2.0, and possibly earlier versions, allows remote attackers to obtain sensitive information via an invalid xoopsOption parameter, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-06T01:00:00.000Z
CVE-2003-1551 
Unspecified vulnerability in Novell GroupWise 6 SP3 WebAccess before Revision F has unknown impact and attack vectors related to "malicious script."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-08T00:00:00.000Z
CVE-2003-1552 
Unrestricted file upload vulnerability in uploader.php in Uploader 1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-08T00:00:00.000Z
CVE-2003-1553 
Haakon Nilsen Simple Internet Publishing System (SIPS) 0.2.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain password and other user information via a direct request to a user-specific configuration directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-26T17:00:00.000Z
CVE-2003-1554 
Cross-site scripting (XSS) vulnerability in scozbook/add.php in ScozNet ScozBook 1.1 BETA allows remote attackers to inject arbitrary web script or HTML via the (1) username, (2) useremail, (3) aim, (4) msn, (5) sitename and (6) siteaddy variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-26T17:00:00.000Z
CVE-2003-1555 
ScozNet ScozBook 1.1 BETA allows remote attackers to obtain sensitive information via an invalid PG parameter in view.php, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-26T17:00:00.000Z
CVE-2003-1556 
Cross-site scripting (XSS) vulnerability in cc_guestbook.pl in CGI City CC GuestBook allows remote attackers to inject arbitrary web script or HTML via the (1) name and (2) homepage_title (webpage title) parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-04T01:00:00.000Z
CVE-2003-1557 
Off-by-one buffer overflow in spamc of SpamAssassin 2.40 through 2.43, when using BSMTP mode ("-B"), allows remote attackers to execute arbitrary code via email containing headers with leading "." characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-04T01:00:00.000Z
CVE-2003-1558 
Buffer overflow in httpd.c of fnord 1.6 allows remote attackers to create a denial of service (crash) and possibly execute arbitrary code via a long CGI request passed to the do_cgi function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-09T20:00:00.000Z
CVE-2003-1559 
Microsoft Internet Explorer 5.22, and other 5 through 6 SP1 versions, sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-14T23:00:00.000Z
CVE-2003-1560 
Netscape 4 sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-14T23:00:00.000Z
CVE-2003-1561 
Opera, probably before 7.50, sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-14T23:00:00.000Z
CVE-2003-1562 
sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T10:00:00.000Z
CVE-2003-1563 
Sun Cluster 2.2 through 3.2 for Oracle Parallel Server / Real Application Clusters (OPS/RAC) allows local users to cause a denial of service (cluster node panic or abort) by launching a daemon listening on a TCP port that would otherwise be used by the Distributed Lock Manager (DLM), possibly involving this daemon responding in a manner that spoofs a cluster reconfiguration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-18T19:00:00.000Z
CVE-2003-1564 
libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-02T14:00:00.000Z
CVE-2003-1566 
Microsoft Internet Information Services (IIS) 5.0 does not log requests that use the TRACK method, which allows remote attackers to obtain sensitive information without detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-15T00:00:00.000Z
CVE-2003-1567 
The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the content of the original request in the body of the response, which makes it easier for remote attackers to steal cookies and authentication credentials, or bypass the HttpOnly protection mechanism, by using TRACK to read the contents of the HTTP headers that are returned in the response, a technique that is similar to cross-site tracing (XST) using HTTP TRACE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-15T00:00:00.000Z
CVE-2003-1568 
GoAhead WebServer before 2.1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an invalid URL, related to the websSafeUrl function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-06T19:00:00.000Z
CVE-2003-1569 
GoAhead WebServer before 2.1.5 on Windows 95, 98, and ME allows remote attackers to cause a denial of service (daemon crash) via an HTTP request with a (1) con, (2) nul, (3) clock$, or (4) config$ device name in a path component, different vectors than CVE-2001-0385.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-06T19:00:00.000Z
CVE-2003-1570 
The server in IBM Tivoli Storage Manager (TSM) 5.1.x, 5.2.x before 5.2.1.2, and 6.x before 6.1 does not require credentials to observe the server console in some circumstances, which allows remote authenticated administrators to monitor server operations by establishing a console mode session, related to "session exposure."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T18:00:00.000Z
CVE-2003-1571 
Web Wiz Guestbook 6.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database and obtain sensitive information via a direct request for database/WWGguestbook.mdb.  NOTE: it was later reported that 8.21 is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-02T15:00:00.000Z
CVE-2003-1572 
Sun Java Media Framework (JMF) 2.1.1 through 2.1.1c allows unsigned applets to cause a denial of service (JVM crash) and read or write unauthorized memory locations via the ReadEnv class, as demonstrated by reading environment variables using modified .data and .size fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-01T22:00:00.000Z
CVE-2003-1573 
The PointBase 4.6 database component in the J2EE 1.4 reference implementation (J2EE/RI) allows remote attackers to execute arbitrary programs, conduct a denial of service, and obtain sensitive information via a crafted SQL statement, related to "inadequate security settings and library bugs in sun.* and org.apache.* packages."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-01T22:00:00.000Z
CVE-2003-1574 
TikiWiki 1.6.1 allows remote attackers to bypass authentication by entering a valid username with an arbitrary password, possibly related to the Internet Explorer "Remember Me" feature.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2003-1575 
VERITAS File System (VxFS) 3.3.3, 3.4, and 3.5 before MP1 Rolling Patch 02 for Sun Solaris 2.5.1 through 9 does not properly implement inheritance of default ACLs in certain circumstances related to the characteristics of a directory inode, which allows local users to bypass intended file permissions by accessing a file on a VxFS filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-28T20:00:00.000Z
CVE-2003-1576 
Buffer overflow in pamverifier in Change Manager (CM) 1.0 for Sun Management Center (SunMC) 3.0 on Solaris 8 and 9 on the sparc platform allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-28T20:00:00.000Z
CVE-2003-1577 
Sun ONE (aka iPlanet) Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files, and conduct cross-site scripting (XSS) attacks involving the iPlanet Log Analyzer, via an HTTP request in conjunction with a crafted DNS response, related to an "Inverse Lookup Log Corruption (ILLC)" issue, a different vulnerability than CVE-2002-1315 and CVE-2002-1316.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-05T22:13:00.000Z
CVE-2003-1578 
Sun ONE (aka iPlanet) Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to hide HTTP requests from the log-preview functionality by accompanying the requests with crafted DNS responses specifying a domain name beginning with a "format=" substring, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-05T22:13:00.000Z
CVE-2003-1579 
Sun ONE (aka iPlanet) Web Server 6 on Windows, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which allows remote attackers to spoof IP addresses via crafted DNS responses containing numerical top-level domains, as demonstrated by a forged 123.123.123.123 domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-05T22:13:00.000Z
CVE-2003-1580 
The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which allows remote attackers to spoof IP addresses via crafted DNS responses containing numerical top-level domains, as demonstrated by a forged 123.123.123.123 domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-05T22:13:00.000Z
CVE-2003-1581 
The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-05T22:13:00.000Z
CVE-2003-1582 
Microsoft Internet Information Services (IIS) 6.0, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-05T22:13:00.000Z
CVE-2003-1583 
Cross-site scripting (XSS) vulnerability in WebTrends allows remote attackers to inject arbitrary web script or HTML via a crafted client domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-05T22:13:00.000Z
CVE-2003-1584 
Cross-site scripting (XSS) vulnerability in SurfStats allows remote attackers to inject arbitrary web script or HTML via a crafted client domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-05T22:13:00.000Z
CVE-2003-1585 
Cross-site scripting (XSS) vulnerability in WebLogExpert allows remote attackers to inject arbitrary web script or HTML via a crafted client domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-05T22:13:00.000Z
CVE-2003-1586 
Cross-site scripting (XSS) vulnerability in WebExpert allows remote attackers to inject arbitrary web script or HTML via a crafted User-Agent HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-05T22:13:00.000Z
CVE-2003-1587 
Cross-site scripting (XSS) vulnerability in LoganPro allows remote attackers to inject arbitrary web script or HTML via a crafted User-Agent HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-05T22:13:00.000Z
CVE-2003-1588 
Sun Cluster 2.2, when HA-Oracle or HA-Sybase DBMS services are used, stores database credentials in cleartext in a cluster configuration file, which allows local users to obtain sensitive information by reading this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-08T20:00:00.000Z
CVE-2003-1589 
Unspecified vulnerability in Sun ONE (aka iPlanet) Web Server 4.1 before SP13 and 6.0 before SP6 on Windows allows attackers to cause a denial of service (daemon crash) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-25T19:00:00.000Z
CVE-2003-1590 
Unspecified vulnerability in Sun ONE (aka iPlanet) Web Server 6.0 SP3 through SP5 on Windows allows remote attackers to cause a denial of service (daemon crash) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-25T19:00:00.000Z
CVE-2003-1591 
NWFTPD.nlm in the FTP server in Novell NetWare 6.0 before SP4 and 6.5 before SP1 allows user-assisted remote attackers to cause a denial of service (console hang) via a large number of FTP sessions, which are not properly handled during an NLM unload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-05T15:15:00.000Z
CVE-2003-1592 
Multiple buffer overflows in NWFTPD.nlm in the FTP server in Novell NetWare 6.0 before SP4 and 6.5 before SP1 allow remote attackers to cause a denial of service (abend) via a long (1) username or (2) password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-05T15:15:00.000Z
CVE-2003-1593 
NWFTPD.nlm in the FTP server in Novell NetWare 6.0 before SP4 and 6.5 before SP1 does not enforce domain-name login restrictions, which allows remote attackers to bypass intended access control via an FTP connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-05T15:15:00.000Z
CVE-2003-1594 
NWFTPD.nlm before 5.04.05 in the FTP server in Novell NetWare 6.5 does not properly enforce FTPREST.TXT settings, which allows remote attackers to bypass intended access restrictions via an FTP session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-05T15:15:00.000Z
CVE-2003-1595 
NWFTPD.nlm before 5.04.05 in the FTP server in Novell NetWare 6.5 does not properly perform "intruder detection," which has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-05T15:15:00.000Z
CVE-2003-1596 
NWFTPD.nlm before 5.03.12 in the FTP server in Novell NetWare does not properly restrict filesystem use by anonymous users with NFS Gateway home directories, which allows remote attackers to bypass intended access restrictions via an FTP session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-05T15:15:00.000Z
CVE-2003-1598 
SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-01T14:00:00.000Z
CVE-2003-1599 
PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the $abspath variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-27T20:00:00.000Z
CVE-2003-1603 
GE Healthcare Discovery VH has a default password of (1) interfile for the ftpclient user of the Interfile server or (2) "2" for the LOCAL user of the FTP server for the Codonics printer, which has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-04T10:00:00.000Z