yahoo-inc/cve-impacts huggingface dataset:
CVE-2003-1136: Cross-site scripting (XSS) vulnerability in Chi Kien Uong Guestbook 1.51 allows remote attackers to inject arbitrary web script or HTML via (1) HTML in a posted message or (2) Javascript in an onmouseover attribute in an e-mail address or URL.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via (, cross-site scripting (xss)
CVE-2003-1137: Charles Steinkuehler sh-httpd 0.3 and 0.4 allows remote attackers to read files or execute arbitrary CGI scripts via a GET request that contains an asterisk (*) wildcard character.
Key phrases: execute arbitrary CGI scripts, read files or execute arbitrary CGI scripts via, asterisk (*) wildcard character
CVE-2003-1138: The default configuration of Apache 2.0.40, as shipped with Red Hat Linux 9.0, allows remote attackers to list directory contents, even if auto indexing is turned off and there is a default web page configured, via a GET request containing a double slash (//).
Key phrases: list directory contents, get request
CVE-2003-1139: Musicqueue 1.2.0 allows local users to overwrite arbitrary files by triggering a segmentation fault and using a symlink attack on the resulting musicqueue.crash file.
Key phrases: overwrite arbitrary files, overwrite arbitrary files by triggering a segmentation fault, symlink
CVE-2003-1140: Buffer overflow in Musicqueue 1.2.0 allows local users to execute arbitrary code via a long language variable in the configuration file.
Key phrases: execute arbitrary code, execute arbitrary code via a long language variable, buffer overflow
CVE-2003-1141: Buffer overflow in NIPrint 4.10 allows remote attackers to execute arbitrary code via a long string to TCP port 515.
Key phrases: execute arbitrary code, execute arbitrary code via a long string to, buffer overflow
CVE-2003-1142: Help in NIPrint LPD-LPR Print Server 4.10 and earlier executes Windows Explorer with SYSTEM privileges, which allows local users to gain privileges.
Key phrases: gain privileges, system privileges
CVE-2003-1143: Croteam Serious Sam demo test 2 2.1a, Serious Sam: the First Encounter 1.05, and Serious Sam: the Second Encounter 1.05 allow remote attackers to cause a denial of service (crash or freeze) via a TCP packet with an invalid first parameter.
Key phrases: denial of service (crash or freeze), cause a denial of service (crash or, tcp packet, invalid first parameter
CVE-2003-1144: Buffer overflow in the log viewing interface in Perception LiteServe 1.25 through 2.2 allows remote attackers to execute arbitrary code via a GET request with a long file name.
Key phrases: execute arbitrary code, execute arbitrary code via a GET request with, buffer overflow
CVE-2003-1145: Cross-site scripting (XSS) vulnerability in friendmail.php in OpenAutoClassifieds 1.0 allows remote attackers to inject arbitrary web script or HTML via the listing parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1146: Cross-site scripting (XSS) vulnerability in John Beatty Easy PHP Photo Album 1.0 allows remote attackers to inject arbitrary web script or HTML via the dir parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1148: Multiple PHP remote file inclusion vulnerabilities in J-Pierre DEZELUS Les Visiteurs 2.0.1, as used in phpMyConferences (phpMyConference) 8.0.2 and possibly other products, allow remote attackers to execute arbitrary PHP code via a URL in the lvc_include_dir parameter to (1) config.inc.php or (2) new-visitor.inc.php in common/visiteurs/include/.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code
CVE-2003-1149: Cross-site scripting (XSS) vulnerability in Symantec Norton Internet Security 2003 6.0.4.34 allows remote attackers to inject arbitrary web script or HTML via a URL to a blocked site, which is displayed on the blocked sites error page.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2003-1150: Buffer overflow in the portmapper service (PMAP.NLM) in Novell NetWare 6 SP3 and ZenWorks for Desktops 3.2 SP2 through 4.0.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via unknown attack vectors.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, buffer overflow, unknown attack vectors
CVE-2003-1151: Cross-site scripting (XSS) vulnerability in Fastream NETFile Server 6.0.3.588 allows remote attackers to inject arbitrary web script or HTML via the URL, which is displayed on a "404 Not Found" error page.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1152: WebTide 7.04 allows remote attackers to list arbitrary directories via an HTTP request for %3f.jsp (encoded "?").
Key phrases: list arbitrary directories, list arbitrary directories via an HTTP request for
CVE-2003-1153: byteHoard 0.7 and 0.71 allows remote attackers to list arbitrary files and directories via a direct request to files.inc.php.
Key phrases: list arbitrary files, list arbitrary files and directories via a direct, bytehoard and
CVE-2003-1154: MAILsweeper for SMTP 4.3 allows remote attackers to bypass virus protection via a mail message with a malformed zip attachment, as exploited by certain MIMAIL virus variants.
Key phrases: bypass virus protection, bypass virus protection via a mail message with, malformed zip attachment
CVE-2003-1155: X-CD-Roast 0.98 alpha10 through alpha14 allows local users to overwrite arbitrary files via a symlink attack on an unknown file.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2003-1156: Java Runtime Environment (JRE) and Software Development Kit (SDK) 1.4.2 through 1.4.2_02 allows local users to overwrite arbitrary files via a symlink attack on (1) unpack.log, as created by the unpack program, or (2) .mailcap1 and .mime.types1, as created by the RPM program.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2003-1157: Cross-site scripting (XSS) vulnerability in login.asp in Citrix MetaFrame XP Server 1.0 allows remote attackers to inject arbitrary web script or HTML via the NFuse_Message parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1158: Multiple buffer overflows in the FTP service in Plug and Play Web Server 1.0002c allow remote attackers to cause a denial of service (crash) via long (1) dir, (2) ls, (3) delete, (4) mkdir, (5) DELE, (6) RMD, or (7) MKD commands.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflows
CVE-2003-1159: Plug and Play Web Server Proxy 1.0002c allows remote attackers to cause a denial of service (server crash) via an invalid URI in an HTTP GET request to TCP port 8080.
Key phrases: denial of service (server crash), cause a denial of service (server crash, invalid uri
CVE-2003-1160: FlexWATCH Network video server 132 allows remote attackers to bypass authentication and gain administrative privileges via an HTTP request to aindex.htm that contains double leading slashes (//).
Key phrases: bypass authentication, gain administrative privileges, bypass authentication and gain administrative privileges via an
CVE-2003-1161: exit.c in Linux kernel 2.6-test9-CVS, as stored on kernel.bkbits.net, was modified to contain a backdoor, which could allow local users to elevate their privileges by passing __WCLONE|__WALL to the sys_wait4 function.
Key phrases: elevate their privileges by passing __WCLONE|__WALL, backdoor, elevate privileges
CVE-2003-1162: index.php in Tritanium Bulletin Board 1.2.3 allows remote attackers to read and reply to arbitrary messages by modifying the thread_id, forum_id, and sid parameters.
Key phrases: read and reply to arbitrary messages by modifying
CVE-2003-1163: hash.c in Ganglia gmond 2.5.3 allows remote attackers to cause a denial of service (segmentation fault) via a UDP packet that contains a single-byte name string, which is used as an out-of-bounds array index.
Key phrases: denial of service (segmentation fault), cause a denial of service (segmentation fault, out-of-bounds array index
CVE-2003-1164: Cross-site scripting (XSS) vulnerability in Mldonkey 2.5-4 allows remote attackers to inject arbitrary web script or HTML via the URI, which is injected into the HTML error page.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1165: Buffer overflow in BRS WebWeaver 1.06 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP request with a long User-Agent header.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2003-1166: Directory traversal vulnerability in (1) Openfile.aspx and (2) Html.aspx in HTTP Commander 4.0 allows remote attackers to view arbitrary files via a .. (dot dot) in the file parameter.
Key phrases: view arbitrary files, view arbitrary files via a .. (dot, directory traversal
CVE-2003-1167: misc.cpp in KPopup 0.9.1 trusts the PATH variable when executing killall, which allows local users to elevate their privileges by modifying the PATH variable to reference a malicious killall program.
Key phrases: elevate their privileges by modifying the PATH variable, elevate privileges
CVE-2003-1168: HTTP Commander 4.0 allows remote attackers to obtain sensitive information via an HTTP request that contains a . (dot) in the file parameter, which reveals the installation path in an error message.
Key phrases: obtain sensitive information, obtain sensitive information via an HTTP request that
CVE-2003-1169: DATEV Nutzungskontrolle 2.1 and 2.2 has insecure write permissions for critical registry keys, which allows local users to bypass access restrictions by importing NukoInfo values in certain DATEV keys, which disables Nutzungskontrolle.
Key phrases: bypass access restrictions, bypass access restrictions by importing NukoInfo values in, insecure write permissions, disables nutzungskontrolle
CVE-2003-1170: Format string vulnerability in main.cpp in kpopup 0.9.1 and 0.9.5pre2 allows local users to cause a denial of service (segmentation fault) and possibly execute arbitrary code via format string specifiers in command line arguments.
Key phrases: execute arbitrary code, denial of service (segmentation fault), cause a denial of service (segmentation fault, format string
CVE-2003-1171: Heap-based buffer overflow in the sec_filter_out function in mod_security 1.7RC1 through 1.7.1 in Apache 2 allows remote attackers to execute arbitrary code via a server side script that sends a large amount of data.
Key phrases: execute arbitrary code, execute arbitrary code via a server side script, heap-based buffer overflow, large amount of data, heap based buffer overflow
CVE-2003-1172: Directory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoon 2.1 and 2.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the filename parameter.
Key phrases: access arbitrary files, access arbitrary files via a .. (dot, directory traversal
CVE-2003-1173: Centrinity FirstClass 7.1 allows remote attackers to access sensitive information by appending search to the end of the URL and checking all of the search option checkboxes and leaving the text field blank, which will return all files in the searched directory.
Key phrases: access sensitive information by appending search to the
CVE-2003-1174: Buffer overflow in NullSoft Shoutcast Server 1.9.2 allows local users to cause a denial of service via (1) icy-name followed by a long server name or (2) icy-url followed by a long URL.
Key phrases: cause a denial of service via (1, buffer overflow
CVE-2003-1175: Cross-site scripting (XSS) vulnerability in index.php in Sympoll 1.5 allows remote attackers to inject arbitrary web script or HTML via the vo parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1176: post_message_form.asp in Web Wiz Forums 6.34 through 7.5, when quote mode is used, allows remote attackers to read or write to private forums by modifying the FID (forum ID) parameter.
Key phrases: read or write to private forums by modifying
CVE-2003-1177: Buffer overflow in the base64 decoder in MERCUR Mailserver 4.2 before SP3a allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long (1) AUTH command to the POP3 server or (2) AUTHENTICATE command to the IMAP server.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, buffer overflow
CVE-2003-1178: Eval injection vulnerability in comments.php in Advanced Poll 2.0.2 allows remote attackers to execute arbitrary PHP code via the (1) id, (2) template_set, or (3) action parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the (1, eval injection
CVE-2003-1179: Multiple PHP remote file inclusion vulnerabilities in Advanced Poll 2.0.2 allow remote attackers to execute arbitrary PHP code via the include_path parameter in (1) booth.php, (2) png.php, (3) poll_ssi.php, or (4) popup.php, the (5) base_path parameter to common.inc.php.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the include_path parameter, php remote file inclusion, arbitrary php code
CVE-2003-1180: Directory traversal vulnerability in Advanced Poll 2.0.2 allows remote attackers to read arbitrary files or inject arbitrary local PHP files via .. sequences in the base_path or pollvars[lang] parameters to the admin files (1) index.php, (2) admin_tpl_new.php, (3) admin_tpl_misc_new.php, (4) admin_templates_misc.php, (5) admin_templates.php, (6) admin_stats.php, (7) admin_settings.php, (8) admin_preview.php, (9) admin_password.php, (10) admin_logout.php, (11) admin_license.php, (12) admin_help.php, (13) admin_embed.php, (14) admin_edit.php, or (15) admin_comment.php.
Key phrases: read arbitrary files, read arbitrary files or inject arbitrary local PHP, directory traversal
CVE-2003-1181: Advanced Poll 2.0.2 allows remote attackers to obtain sensitive information via an HTTP request to info.php, which invokes the phpinfo() function.
Key phrases: obtain sensitive information, obtain sensitive information via an HTTP request to
CVE-2003-1182: Cross-site scripting (XSS) vulnerability in MPM Guestbook 1.2 allows remote attackers to inject arbitrary web script or HTML via the lng parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1183: The WebCache component in Oracle Files 9.0.3.1.0, 9.0.3.2.0, and 9.0.3.3.0 of Oracle Collaboration Suite Release 1 caches files despite the cacheability rules imposed by Oracle Files, which allows local users to gain access.
Key phrases: gain access, local users
CVE-2003-1184: Multiple cross-site scripting (XSS) vulnerabilities in ThWboard Beta 2.8 and 2.81 allow remote attackers to inject arbitrary web script or HTML via (1) time in board.php, (2) the profile Homepage-Feld, (3) pictures, and (4) other "Diverse XSS Bugs."
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via (, cross-site scripting (xss), diverse xss bugs
CVE-2003-1185: Multiple SQL injection vulnerabilities in ThWboard before Beta 2.8.2 allow remote attackers to inject arbitrary SQL commands via various vectors including (1) Admin-Center, (2) Announcements, (3) admin/calendar.php, and (4) showevent.php.
Key phrases: inject arbitrary SQL commands, inject arbitrary SQL commands via various vectors including, sql injection
CVE-2003-1186: Buffer overflow in TelCondex SimpleWebServer 2.12.30210 Build3285 allows remote attackers to execute arbitrary code via a long HTTP Referer header.
Key phrases: execute arbitrary code, execute arbitrary code via a long HTTP Referer, buffer overflow
CVE-2003-1187: Cross-site scripting (XSS) vulnerability in include.php in PHPKIT 1.6.02 and 1.6.03 allows remote attackers to inject arbitrary web script or HTML via the contact_email parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1188: Unichat allows remote attackers to cause a denial of service (crash) by adding extra chat characters (avatars) and logging in to a chat room, as demonstrated using duplicate ACTOR entries in u2res000.rit.
Key phrases: denial of service (crash), cause a denial of service (crash), duplicate actor entries
CVE-2003-1189: Unknown vulnerability in Nokia IPSO 3.7, configured as IP Clusters, allows remote attackers to cause a denial of service via unknown attack vectors.
Key phrases: cause a denial of service via unknown attack, ip clusters, unknown attack vectors
CVE-2003-1190: Cross-site scripting (XSS) vulnerability in PHPRecipeBook 1.24 through 2.17 allows remote attackers to inject arbitrary web script or HTML via a recipe.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2003-1191: chatbox.php in e107 0.554 and 0.603 allows remote attackers to cause a denial of service (pages fail to load) via HTML in the Name field, which prevents the main.php form from being loaded.
Key phrases: denial of service (pages fail to load), cause a denial of service (pages fail
CVE-2003-1192: Stack-based buffer overflow in IA WebMail Server 3.1.0 allows remote attackers to execute arbitrary code via a long GET request.
Key phrases: execute arbitrary code, execute arbitrary code via a long GET request, stack-based buffer overflow, stack based buffer overflow
CVE-2003-1193: Multiple SQL injection vulnerabilities in the Portal DB (1) List of Values (LOVs), (2) Forms, (3) Hierarchy, and (4) XML components packages in Oracle Oracle9i Application Server 9.0.2.00 through 3.0.9.8.5 allow remote attackers to execute arbitrary SQL commands via the URL.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the URL, sql injection
CVE-2003-1194: Cross-site scripting (XSS) vulnerability in Booby .1 through 0.2.3 allows remote attackers to inject arbitrary web script or HTML via the error message.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1195: SQL injection vulnerability in getmember.asp in VieBoard 2.6 Beta 1 allows remote attackers to execute arbitrary SQL commands via the msn variable.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the msn variable, sql injection, arbitrary sql commands
CVE-2003-1196: SQL injection vulnerability in viewtopic.asp in VieBoard 2.6 allows remote attackers to execute arbitrary SQL commands via the forumid parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the forumid parameter, sql injection, arbitrary sql commands
CVE-2003-1197: Cross-site scripting (XSS) vulnerability in index.php for Ledscripts.com LedForums Beta 1 allows remote attackers to inject arbitrary web script or HTML via the (1) top_message parameter or (2) topic field of a new thread.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1198: connection.c in Cherokee web server before 0.4.6 allows remote attackers to cause a denial of service via an HTTP POST request without a Content-Length header field.
Key phrases: cause a denial of service via an HTTP, content-length header field
CVE-2003-1199: Cross-site scripting (XSS) vulnerability in MyProxy 20030629 allows remote attackers to inject arbitrary web script or HTML via the URL.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1200: Stack-based buffer overflow in FORM2RAW.exe in Alt-N MDaemon 6.5.2 through 6.8.5 allows remote attackers to execute arbitrary code via a long From parameter to Form2Raw.cgi.
Key phrases: execute arbitrary code, execute arbitrary code via a long From parameter, stack-based buffer overflow, stack based buffer overflow
CVE-2003-1201: ldbm_back_exop_passwd in the back-ldbm backend in passwd.c for OpenLDAP 2.1.12 and earlier, when the slap_passwd_parse function does not return LDAP_SUCCESS, attempts to free an uninitialized pointer, which allows remote attackers to cause a denial of service (segmentation fault).
Key phrases: denial of service (segmentation fault), cause a denial of service (segmentation fault, uninitialized pointer
CVE-2003-1202: The checklogin function in omail.pl for omail webmail 0.98.4 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) password, (2) domainname, or (3) username.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in a
CVE-2003-1203: Cross-site scripting (XSS) vulnerability in index.php for Mambo Site Server 4.0.10 allows remote attackers to execute script on other clients via the ?option parameter.
Key phrases: execute script on other clients via the ?, cross-site scripting (xss)
CVE-2003-1204: Multiple cross-site scripting (XSS) vulnerabilities in Mambo Site Server 4.0.12 BETA and earlier allow remote attackers to execute script on other clients via (1) the link parameter in sectionswindow.php, the directory parameter in (2) gallery.php, (3) navigation.php, or (4) uploadimage.php, the path parameter in (5) view.php, (6) the choice parameter in upload.php, (7) the sitename parameter in mambosimple.php, (8) the type parameter in upload.php, or the id parameter in (9) emailarticle.php, (10) emailfaq.php, or (11) emailnews.php.
Key phrases: execute script on other clients via (1, cross-site scripting (xss)
CVE-2003-1205: Crob FTP Server 2.60.1 allows remote authenticated users to cause a denial of service (crash) by renaming a file to the "con" MS-DOS device name.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2003-1206: Format string vulnerability in Crob FTP Server 2.60.1 allows remote attackers to cause a denial of service (crash) via "%s" or "%n" sequences in (1) the username during login, or other FTP commands such as (2) dir.
Key phrases: denial of service (crash), cause a denial of service (crash), format string
CVE-2003-1207: Crob FTP Server 3.5.1 allows remote authenticated users to cause a denial of service (crash) via a dir command with a large number of "." characters followed by a "/*" string.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2003-1208: Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow local users to execute arbitrary code by (1) setting the TIME_ZONE session parameter to a long value, or providing long parameters to the (2) NUMTOYMINTERVAL, (3) NUMTODSINTERVAL or (4) FROM_TZ functions.
Key phrases: execute arbitrary code, execute arbitrary code by (1) setting, buffer overflows
CVE-2003-1209: The Post_Method function in Monkey HTTP Daemon before 0.6.2 allows remote attackers to cause a denial of service (crash) via a POST request without a Content-Type header.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2003-1210: Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 5.x through 6.5 allow remote attackers to execute arbitrary SQL commands via the (1) lid parameter to the getit function or the (2) min parameter to the search function.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the (1, sql injection, arbitrary sql commands
CVE-2003-1211: Cross-site scripting (XSS) vulnerability in search.asp for MaxWebPortal 1.30 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via the Search parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1212: MaxWebPortal 1.30 allows remote attackers to perform unauthorized actions by modifying hidden form fields, such as the (1) news, (2) lock, or (3) allmem fields in the 'start new topic' HTML page.
Key phrases: perform unauthorized actions by modifying hidden form fields
CVE-2003-1213: The default installation of MaxWebPortal 1.30 stores the portal database under the web document root with insecure access control, which allows remote attackers to obtain sensitive information via a direct request to database/db2000.mdb.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to, insecure access control
CVE-2003-1214: Unknown vulnerability in the server login for VisualShapers ezContents 2.02 and earlier allows remote attackers to bypass access restrictions and gain access to restricted functions.
Key phrases: bypass access restrictions, gain access, bypass access restrictions and gain access to restricted, unknown
CVE-2003-1215: SQL injection vulnerability in groupcp.php for phpBB 2.0.6 and earlier allows group moderators to perform unauthorized activities via the sql_in parameter.
Key phrases: perform unauthorized activities via the sql_in parameter, sql injection
CVE-2003-1216: SQL injection vulnerability in search.php for phpBB 2.0.6 and earlier allows remote attackers to execute arbitrary SQL and gain privileges via the search_id parameter.
Key phrases: execute arbitrary SQL, gain privileges, execute arbitrary SQL and gain privileges via the, sql injection
CVE-2003-1219: Cross-site scripting (XSS) vulnerability in the tep_href_link function in html_output.php for osCommerce before 2.2-MS3 allows remote attackers to inject arbitrary web script or HTML via the osCsid parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1220: BEA WebLogic Server proxy plugin for BEA Weblogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (proxy plugin crash) via a malformed URL.
Key phrases: denial of service (proxy plugin crash), cause a denial of service (proxy plugin, malformed url
CVE-2003-1221: BEA WebLogic Express and Server 7.0 through 8.1 SP 1, under certain circumstances when a request to use T3 over SSL (t3s) is made to the insecure T3 port, may use a non-SSL connection for the communication, which could allow attackers to sniff sessions.
Key phrases: sniff sessions, insecure port, non-ssl connection
CVE-2003-1222: BEA Weblogic Express and Server 8.0 through 8.1 SP 1, when using a foreign Java Message Service (JMS) provider, echoes the password for the foreign provider to the console and stores it in cleartext in config.xml, which could allow attackers to obtain the password.
Key phrases: obtain the password, cleartext
CVE-2003-1223: The Node Manager for BEA WebLogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (Node Manager crash) via malformed data to the Node Manager's port, as demonstrated by nmap.
Key phrases: denial of service (Node Manager crash), cause a denial of service (Node Manager, malformed data
CVE-2003-1224: Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read a user's password by physically observing ("shoulder surfing") the screen.
Key phrases: read a user's password by physically observing, cleartext
CVE-2003-1225: The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords.
Key phrases: extract passwords, cleartext
CVE-2003-1226: BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords.
Key phrases: learn those secrets and decrypt passwords
CVE-2003-1227: PHP remote file include vulnerability in index.php for Gallery 1.4 and 1.4-pl1, when running on Windows or in Configuration mode on Unix, allows remote attackers to inject arbitrary PHP code via a URL in the GALLERY_BASEDIR parameter, a different vulnerability than CVE-2002-1412.  NOTE: this issue might be exploitable only during installation, or if the administrator has not run a security script after installation.
Key phrases: inject arbitrary PHP code, inject arbitrary PHP code via a URL in, php remote file include, exploitable
CVE-2003-1228: Buffer overflow in the prepare_reply function in request.c for Mathopd 1.2 through 1.5b13, and possibly earlier versions, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via an HTTP request with a long path.
Key phrases: execute arbitrary code, denial of service (server crash), cause a denial of service (server crash, buffer overflow
CVE-2003-1229: X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files.
Key phrases: (1) falsely authenticate peers for SSL
CVE-2003-1230: The implementation of SYN cookies (syncookies) in FreeBSD 4.5 through 5.0-RELEASE-p3 uses only 32-bit internal keys when generating syncookies, which makes it easier for remote attackers to conduct brute force ISN guessing attacks and spoof legitimate traffic.
Key phrases: internal keys, brute force isn guessing, spoof legitimate traffic, spoofing
CVE-2003-1231: Cross-site scripting (XSS) vulnerability in index.php in ECW-Shop 5.5 allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1232: Emacs 21.2.1 does not prompt or warn the user before executing Lisp code in the local variables section of a text file, which allows user-assisted attackers to execute arbitrary commands, as demonstrated using the mode-name variable.
Key phrases: execute arbitrary commands
CVE-2003-1233: Pedestal Software Integrity Protection Driver (IPD) 1.3 and earlier allows privileged attackers, such as rootkits, to bypass file access restrictions to the Windows kernel by using the NtCreateSymbolicLinkObject function to create a symbolic link to (1) \\\\Device\\\\PhysicalMemory or (2) to a drive letter using the subst command.
Key phrases: bypass file access restrictions, bypass file access restrictions to the Windows kernel
CVE-2003-1234: Integer overflow in the f_count counter in FreeBSD before 4.2 through 5.0 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via multiple calls to (1) fpathconf and (2) lseek, which do not properly decrement f_count through a call to fdrop.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), integer overflow
CVE-2003-1235: BRW WebWeaver 1.03 allows remote attackers to obtain sensitive server environment information via a URL request for testcgi.exe, which lists the values of environment variables and the current working directory.
Key phrases: obtain sensitive server environment information, obtain sensitive server environment information via a URL
CVE-2003-1236: Multiple format string vulnerabilities in the logger function in netzio.c for Tanne 0.6.17 allows remote attackers to execute arbitrary code via format string specifiers in syslog.
Key phrases: execute arbitrary code, execute arbitrary code via format string specifiers in
CVE-2003-1237: Cross-site scripting vulnerability (XSS) in WWWBoard 2.0A2.1 and earlier allows remote attackers to inject arbitrary HTML or web script via a message post.
Key phrases: inject arbitrary HTML or web, inject arbitrary HTML or web script via a, cross-site scripting vulnerability (xss)
CVE-2003-1238: Cross-site scripting vulnerability (XSS) in Nuked-Klan 1.3 beta and earlier allows remote attackers to steal authentication information via cookies by injecting arbitrary HTML or script into op of the (1) Team, (2) News, and (3) Liens modules.
Key phrases: injecting arbitrary HTML or script, steal authentication information via cookies by injecting arbitrary, cross-site scripting vulnerability (xss), arbitrary html
CVE-2003-1239: Directory traversal vulnerability in sendphoto.php in WihPhoto 0.86 allows remote attackers to read arbitrary files via .. specifiers in the album parameter, and the target filename in the pic parameter.
Key phrases: read arbitrary files, read arbitrary files via .. specifiers in the, directory traversal
CVE-2003-1240: PHP remote file inclusion vulnerability in CuteNews 0.88 allows remote attackers to execute arbitrary PHP code via a URL in the cutepath parameter in (1) shownews.php, (2) search.php, or (3) comments.php.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code
CVE-2003-1241: Cross-site scripting vulnerability (XSS) in (1) admin_index.php, (2) admin_pass.php, (3) admin_modif.php, and (4) admin_suppr.php in MyGuestbook 3.0 allows remote attackers to execute arbitrary PHP code by modifying the location parameter to reference a URL on a remote web server that contains file.php via script injected into the pseudo, email, and message parameters.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code by modifying the location, cross-site scripting vulnerability (xss)
CVE-2003-1242: Sage 1.0 b3 allows remote attackers to obtain the root web server path via a URL request for a non-existent module, which returns the path in an error message.
Key phrases: obtain the root web server path via a URL request, non-existent module
CVE-2003-1243: Cross-site scripting vulnerability (XSS) in Sage 1.0 b3 allows remote attackers to insert arbitrary HTML or web script via the mod parameter.
Key phrases: insert arbitrary HTML or web, insert arbitrary HTML or web script via the, cross-site scripting vulnerability (xss), arbitrary html
CVE-2003-1244: SQL injection vulnerability in page_header.php in phpBB 2.0, 2.0.1 and 2.0.2 allows remote attackers to brute force user passwords and possibly gain unauthorized access to forums via the forum_id parameter to index.php.
Key phrases: gain unauthorized access, brute force user passwords and possibly gain unauthorized, sql injection
CVE-2003-1245: index2.php in Mambo 4.0.12 allows remote attackers to gain administrator access via a URL request where session_id is set to the MD5 hash of a session cookie.
Key phrases: gain administrator access, gain administrator access via a URL request where
CVE-2003-1246: NtCreateSymbolicLinkObject in ntdll.dll in Integrity Protection Driver (IPD) 1.2 and 1.3 allows local users to create and overwrite arbitrary files via a symlink attack on \\\\winnt\\\\system32\\\\drivers using the subst command.
Key phrases: overwrite arbitrary files, create and overwrite arbitrary files via a symlink
CVE-2003-1247: Multiple buffer overflows in H-Sphere WebShell 2.3 allow remote attackers to execute arbitrary code via (1) a long URL content type in CGI::readFile, (2) a long path in diskusage, and (3) a long fname in flist.
Key phrases: execute arbitrary code, execute arbitrary code via (1) a, buffer overflows
CVE-2003-1248: H-Sphere WebShell 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) mode and (2) zipfile parameters in a URL request.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-2003-1249: WebIntelligence 2.7.1 uses guessable user session cookies, which allows remote attackers to hijack sessions.
Key phrases: hijack sessions, guessable user session cookies
CVE-2003-1250: Efficient Networks 5861 DSL router, when running firmware 5.3.80 configured to block incoming TCP SYN, packets allows remote attackers to cause a denial of service (crash) via a flood of TCP SYN packets to the WAN interface using a port scanner such as nmap.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2003-1251: The (1) menu.inc.php, (2) datasets.php and (3) mass_operations.inc.php (mistakenly referred to as mass_opeations.inc.php) scripts in N/X 2002 allow remote attackers to execute arbitrary PHP code via a c_path that references a URL on a remote web server that contains the code.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a c_path that
CVE-2003-1252: register.php in S8Forum 3.0 allows remote attackers to execute arbitrary PHP commands by creating a user whose name ends in a .php extension and entering the desired commands into the E-mail field, which creates a web-accessible .php file that can be called by the attacker, as demonstrated using a "system($cmd)" E-mail address with a "any_name.php" username.
Key phrases: execute arbitrary PHP commands, execute arbitrary PHP commands by creating a user, web-accessible .php file, arbitrary php
CVE-2003-1253: PHP remote file inclusion vulnerability in Bookmark4U 1.8.3 allows remote attackers to execute arbitrary PHP code viaa URL in the prefix parameter to (1) dbase.php, (2) config.php, or (3) common.load.php.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code viaa URL in the, php remote file inclusion, arbitrary php code
CVE-2003-1254: Active PHP Bookmarks (APB) 1.1.01 allows remote attackers to execute arbitrary PHP code via (1) head.php, (2) apb_common.php, or (3) apb_view_class.php by modifying the APB_SETTINGS parameter to reference a URL on a remote web server that contains the code.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via (1)
CVE-2003-1255: add_bookmark.php in Active PHP Bookmarks (APB) 1.1.01 allows remote attackers to add arbitrary bookmarks as other users using a modified auth_user_id parameter.
Key phrases: add arbitrary bookmarks, add arbitrary bookmarks as other users using a, modified auth_user_id parameter
CVE-2003-1256: aff_liste_langue.php in E-theni allows remote attackers to execute arbitrary PHP code by modifying the rep_include parameter to reference a URL on a remote web server that contains para_langue.php.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code by modifying the rep_include
CVE-2003-1257: find_theni_home.php in E-theni allows remote attackers to obtain sensitive system information via a URL request which executes phpinfo.
Key phrases: obtain sensitive system information, obtain sensitive system information via a URL request
CVE-2003-1258: activate.php in versatileBulletinBoard (vBB) 0.9.5 and 0.9.6 allows remote attackers to gain unauthorized administrative access via a URL request with the uid parameter set to the webmaster uid.
Key phrases: gain unauthorized administrative access, gain unauthorized administrative access via a URL request
CVE-2003-1259: Buffer overflow in CuteFTP 4.2 and 5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long FTP server banner.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2003-1260: Buffer overflow in CuteFTP 5.0 allows remote attackers to execute arbitrary code via a long response to a LIST command.
Key phrases: execute arbitrary code, execute arbitrary code via a long response to, buffer overflow
CVE-2003-1261: Buffer overflow in CuteFTP 5.0 and 5.0.1 allows local users to cause a denial of service (crash) by copying a long URL into a clipboard.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2003-1262: Buffer overflow in the http_fetch function of HTTP Fetcher 1.0.0 and 1.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL request via a long (1) host, (2) referer, or (3) userAgent value.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2003-1263: ICAL.EXE in iCal 3.7 allows remote attackers to cause a denial of service (crash) via a malformed HTTP request, possibly due to an invalid method name.
Key phrases: denial of service (crash), cause a denial of service (crash), malformed http request, invalid method name
CVE-2003-1264: TFTP server in Longshine Wireless Access Point (WAP) LCS-883R-AC-B, and in D-Link DI-614+ 2.0 which is based on it, allows remote attackers to obtain the WEP secret and gain administrator privileges by downloading the configuration file (config.img) and other files without authentication.
Key phrases: obtain the WEP secret and gain administrator privileges, wep secret
CVE-2003-1265: Netscape 7.0 and Mozilla 5.0 do not immediately delete messages in the trash folder when users select the 'Empty Trash' option, which could allow local users to access deleted messages.
Key phrases: access deleted messages
CVE-2003-1266: The (1) FTP, (2) POP3, (3) SMTP, and (4) NNTP servers in EServer 2.92 through 2.97, and possibly 2.98, allow remote attackers to cause a denial of service (crash) via a large amount of data.
Key phrases: denial of service (crash), cause a denial of service (crash), large amount of data
CVE-2003-1267: GuildFTPd 0.999 allows remote attackers to cause a denial of service (crash) via a GET request for MS-DOS device names such as lpt1.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2003-1268: Multiple SQL injection vulnerabilities in (1) addcustomer.asp, (2) addprod.asp, and (3) process.asp in a.shopKart 2.0.3 allow remote attackers to execute arbitrary SQL and obtain sensitive information via the zip, state, country, phone, and fax parameters.
Key phrases: execute arbitrary SQL, obtain sensitive information, execute arbitrary SQL and obtain sensitive information via, sql injection
CVE-2003-1269: AN HTTP 1.41e allows remote attackers to obtain the root web server path via an HTTP request with a long argument to a script, which leaks the path in an error message.
Key phrases: obtain the root web server path via an HTTP request, leaks
CVE-2003-1270: AN HTTP 1.41e allows remote attackers to cause a denial of service (borken pipe) via an HTTP request to aux.cgi with a long argument, possibly triggering a buffer overflow or MS-DOS device vulnerability.
Key phrases: denial of service (borken pipe), cause a denial of service (borken pipe, buffer overflow, ms-dos device
CVE-2003-1271: Cross-site scripting vulnerability (XSS) in AN HTTP 1.41e allows remote attackers to execute arbitrary web script or HTML as other users via a URL containing the script.
Key phrases: execute arbitrary web script or HTML, execute arbitrary web script or HTML as other, cross-site scripting vulnerability (xss)
CVE-2003-1272: Multiple buffer overflows in Winamp 3.0 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a .b4s file containing (1) a long playlist name or (2) a long path in a file: argument to the Playstring parameter.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflows
CVE-2003-1273: Winamp 3.0 allows remote attackers to cause a denial of service (crash) via a .b4s file with a playlist name that contains some non-English characters, e.g. Cyrillic characters.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2003-1274: Winamp 3.0 allows remote attackers to cause a denial of service (crash) via .b4s file with a file: argument to the Playstring parameter that contains MS-DOS device names such as aux.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2003-1275: Pocket Internet Explorer (PIE) 3.0 allows remote attackers to cause a denial of service (crash) via a Javascript function that uses the object.innerHTML function to recursively call that function.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2003-1276: Netfone.exe of NetTelephone 3.5.6 uses weak encryption for user PIN's and stores user account numbers in plaintext in the HKEY_CURRENT_USER\\\\Software\\\\MediaRing.com\\\\SDK\\\\NetTelephone\\\\settings registry key, which could allow local users to gain unauthorized access to NetTelephone accounts.
Key phrases: gain unauthorized access, gain unauthorized access to NetTelephone accounts, weak encryption
CVE-2003-1277: Cross-site scripting (XSS) vulnerabilities in Yet Another Bulletin Board (YaBB) 1.5.0 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via cookies by injecting arbitrary HTML or script into (1) news_icon of news_template.php, and (2) threadid and subject of index.html
Key phrases: injecting arbitrary HTML or script, execute arbitrary script as other users and possibly, cross-site scripting (xss), arbitrary html
CVE-2003-1278: Cross-site scripting vulnerability (XSS) in OpenTopic 2.3.1 allows remote attackers to execute arbitrary script as other users and possibly steal authentication information via cookies by injecting arbitrary HTML or script into IMG tags.
Key phrases: injecting arbitrary HTML or script, execute arbitrary script as other users and possibly, cross-site scripting vulnerability (xss), arbitrary html
CVE-2003-1279: S-PLUS 6.0 allows local users to overwrite arbitrary files and possibly elevate privileges via a symlink attack on (1) /tmp/__F8499 by Sqpe, (2) /tmp/PRINT.$$.out by PRINT, (3) /tmp/SUBST$PID.TXT and /tmp/ed.cmds$PID by mustfix.hlinks, (4) /tmp/file.1 and /tmp/file.2 by sas_get, (5) /tmp/file.1 by sas_vars, and (6) /tmp/sgml2html$$tmp /tmp/sgml2html$$tmp1 /tmp/sgml2html$$tmp2 by sglm2html.
Key phrases: overwrite arbitrary files, overwrite arbitrary files and possibly elevate privileges via, symlink, hlinks
CVE-2003-1280: Directory traversal vulnerability in cgihtml 1.69 allows remote attackers to overwrite and create arbitrary files via a .. (dot dot) in multipart/form-data uploads.
Key phrases: create arbitrary files, overwrite and create arbitrary files via a .., directory traversal
CVE-2003-1281: cgihtml 1.69 allows local users to overwrite arbitrary files via a symlink attack on certain temporary files.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2003-1282: IBM Net.Data allows remote attackers to obtain sensitive information such as path names, server names and possibly user names and passwords by causing the (1) $(DTW_CURRENT_FILENAME), (2) $(DATABASE), (3) $(LOGIN), (4) $(PASSWORD), and possibly other predefined variables that can be echoed back to the user via a web form.
Key phrases: obtain sensitive information, obtain sensitive information such as path names
CVE-2003-1283: KaZaA Media Desktop (KMD) 2.0 launches advertisements in the Internet Explorer (IE) local security zone, which could allow remote attackers to view local files and possibly execute arbitrary code.
Key phrases: execute arbitrary code, view local files and possibly execute arbitrary code, local security zone
CVE-2003-1284: Sambar Server before 6.0 beta 6 allows remote attackers to obtain sensitive information via direct requests to the default scripts (1) environ.pl and (2) testcgi.exe.
Key phrases: obtain sensitive information, obtain sensitive information via direct requests to the
CVE-2003-1285: Multiple cross-site scripting (XSS) vulnerabilities in Sambar Server before 6.0 beta 6 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) isapi/testisa.dll, (2) testcgi.exe, (3) environ.pl, (4) the query parameter to samples/search.dll, (5) the price parameter to mortgage.pl, (6) the query string in dumpenv.pl, (7) the query string to dumpenv.pl, and (8) the E-Mail field of the guestbook script (book.pl).
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)