yahoo-inc/cve-impacts huggingface dataset:
CVE-2003-0979: FreeScripts VisitorBook LE (visitorbook.pl) does not properly escape line breaks in input, which allows remote attackers to (1) use VisitorBook as an open mail relay, when $mailuser is 1, via extra headers in the email field, or (2) cause the guestbook database to be deleted via a large number of line breaks that exceeds the $max_posts variable.
Key phrases: (1) use VisitorBook as an open, open mail relay, deleted
CVE-2003-0980: Cross-site scripting (XSS) vulnerability in FreeScripts VisitorBook LE (visitorbook.pl) allows remote attackers to inject arbitrary HTML or web script via (1) the "do" parameter, (2) via the "user" parameter from a host with a malicious reverse DNS name, (3) via quote marks or ampersands in other parameters.
Key phrases: inject arbitrary HTML or web, inject arbitrary HTML or web script via (, cross-site scripting (xss)
CVE-2003-0981: FreeScripts VisitorBook LE (visitorbook.pl) logs the reverse DNS name of a visiting host, which allows remote attackers to spoof the origin of their incoming requests and facilitate cross-site scripting (XSS) attacks.
Key phrases: spoof the origin of their incoming requests and, cross-site scripting (xss), spoofing
CVE-2003-0982: Buffer overflow in the authentication module for Cisco ACNS 4.x before 4.2.11, and 5.x before 5.0.5, allows remote attackers to execute arbitrary code via a long password.
Key phrases: execute arbitrary code, execute arbitrary code via a long password, buffer overflow
CVE-2003-0983: Cisco Unity on IBM servers is shipped with default settings that should have been disabled by the manufacturer, which allows local or remote attackers to conduct unauthorized activities via (1) a "bubba" local user account, (2) an open TCP port 34571, or (3) when a local DHCP server is unavailable, a DHCP server on the manufacturer's test network.
Key phrases: conduct unauthorized activities via (1) a, bubba local user account, open tcp port
CVE-2003-0984: Real time clock (RTC) routines in Linux kernel 2.4.23 and earlier do not properly initialize their structures, which could leak kernel data to user space.
Key phrases: leak kernel data
CVE-2003-0985: The mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21, and possibly other versions before 2.4.24, does not properly perform bounds checks, which allows local users to cause a denial of service and possibly gain privileges by causing a remapping of a virtual memory area (VMA) to create a zero length VMA, a different vulnerability than CAN-2004-0077.
Key phrases: gain privileges, cause a denial of service and possibly gain, zero length vma
CVE-2003-0986: Various routines for the ppc64 architecture on Linux kernel 2.6 prior to 2.6.2 and 2.4 prior to 2.4.24 do not use the copy_from_user function when copying data from userspace to kernelspace, which crosses security boundaries and allows local users to cause a denial of service.
Key phrases: cause a denial of service, security boundaries
CVE-2003-0987: mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret.
CVE-2003-0988: Buffer overflow in the VCF file information reader for KDE Personal Information Management (kdepim) suite in KDE 3.1.0 through 3.1.4 allows attackers to execute arbitrary code via a VCF file.
Key phrases: execute arbitrary code, execute arbitrary code via a VCF file, buffer overflow
CVE-2003-0989: tcpdump before 3.8.1 allows remote attackers to cause a denial of service (infinite loop) via certain ISAKMP packets, a different vulnerability than CVE-2004-0057.
Key phrases: denial of service (infinite loop), cause a denial of service (infinite loop
CVE-2003-0990: The parseAddress code in (1) SquirrelMail 1.4.0 and (2) GPG Plugin 1.1 allows remote attackers to execute commands via shell metacharacters in the "To:" field.
Key phrases: execute commands via shell metacharacters in the "
CVE-2003-0991: Unknown vulnerability in the mail command handler in Mailman before 2.0.14 allows remote attackers to cause a denial of service (crash) via malformed e-mail commands.
Key phrases: denial of service (crash), cause a denial of service (crash), unknown, malformed e-mail commands
CVE-2003-0992: Cross-site scripting (XSS) vulnerability in the create CGI script for Mailman before 2.1.3 allows remote attackers to steal cookies of other users.
Key phrases: steal cookies of other users, cross-site scripting (xss)
CVE-2003-0993: mod_access in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions.
Key phrases: bypass intended access restrictions
CVE-2003-0994: The GUI functionality for an interactive session in Symantec LiveUpdate 1.70.x through 1.90.x, as used in Norton Internet Security 2001 through 2004, SystemWorks 2001 through 2004, and AntiVirus and Norton AntiVirus Pro 2001 through 2004, AntiVirus for Handhelds v3.0, allows local users to gain SYSTEM privileges.
Key phrases: gain SYSTEM privileges, system privileges
CVE-2003-0995: Buffer overflow in the Microsoft Message Queue Manager (MSQM) allows remote attackers to cause a denial of service (RPC service crash) via a queue registration request.
Key phrases: denial of service (RPC service crash), cause a denial of service (RPC service, buffer overflow
CVE-2003-0996: Unknown "System Security Vulnerability" in Computer Associates (CA) Unicenter Remote Control (URC) 6.0 allows attackers to gain privileges via the help interface.
Key phrases: gain privileges, gain privileges via the help interface, system security
CVE-2003-0997: Unknown "Denial of Service Attack" vulnerability in Computer Associates (CA) Unicenter Remote Control (URC) 6.0 allows attackers to cause a denial of service (CPU consumption in URC host service).
Key phrases: denial of service (CPU consumption in URC host service), cause a denial of service (CPU consumption, cpu consumption
CVE-2003-0998: Unknown "potential system security vulnerability" in Computer Associates (CA) Unicenter Remote Control 5.0 through 5.2, and ControlIT 5.0 and 5.1, may allow attackers to gain privileges to the local system account.
Key phrases: gain privileges, gain privileges to the local system account
CVE-2003-0999: Unknown multiple vulnerabilities in (1) lpstat and (2) the libprint library in Solaris 2.6 through 9 may allow attackers to execute arbitrary code or read or write arbitrary files.
Key phrases: execute arbitrary code, execute arbitrary code or read or write arbitrary, unknown multiple, read or write arbitrary files
CVE-2003-1000: xchat 2.0.6 allows remote attackers to cause a denial of service (crash) via a passive DCC request with an invalid ID number, which causes a null dereference.
Key phrases: denial of service (crash), cause a denial of service (crash), passive dcc request, invalid id number, null dereference
CVE-2003-1001: Buffer overflow in the Cisco Firewall Services Module (FWSM) in Cisco Catalyst 6500 and 7600 series devices allows remote attackers to cause a denial of service (crash and reload) via HTTP auth requests for (1) TACACS+ or (2) RADIUS authentication.
Key phrases: denial of service (crash and reload), cause a denial of service (crash and, buffer overflow
CVE-2003-1002: Cisco Firewall Services Module (FWSM) in Cisco Catalyst 6500 and 7600 series devices allows remote attackers to cause a denial of service (crash and reload) via an SNMPv3 message when snmp-server is set.
Key phrases: denial of service (crash and reload), cause a denial of service (crash and
CVE-2003-1003: Cisco PIX firewall 5.x.x, and 6.3.1 and earlier, allows remote attackers to cause a denial of service (crash and reload) via an SNMPv3 message when snmp-server is set.
Key phrases: denial of service (crash and reload), cause a denial of service (crash and
CVE-2003-1004: Cisco PIX firewall 6.2.x through 6.2.3, when configured as a VPN Client, allows remote attackers to cause a denial of service (dropped IPSec tunnel connection) via an IKE Phase I negotiation request to the outside interface of the firewall.
Key phrases: denial of service (dropped IPSec tunnel connection), cause a denial of service (dropped IPSec
CVE-2003-1005: The PKI functionality in Mac OS X 10.2.8 and 10.3.2 allows remote attackers to cause a denial of service (service crash) via malformed ASN.1 sequences.
Key phrases: denial of service (service crash), cause a denial of service (service crash, malformed sequences
CVE-2003-1006: Buffer overflow in cd9660.util in Apple Mac OS X 10.0 through 10.3.2 and Apple Mac OS X Server 10.0 through 10.3.2 may allow local users to execute arbitrary code via a long command line parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a long command line, buffer overflow
CVE-2003-1007: AppleFileServer (AFS) in Apple Mac OS X 10.2.8 and 10.3.2 does not properly handle certain malformed requests, with unknown impact.
Key phrases: malformed requests, unknown impact
CVE-2003-1008: Unknown vulnerability in Mac OS X 10.2.8 and 10.3.2 allows local users to bypass the screen saver login window and write a text clipping to the desktop or another application.
Key phrases: bypass the screen, bypass the screen saver login window and write, unknown
CVE-2003-1009: Directory Services in Apple Mac OS X 10.0.2, 10.0.3, 10.2.8, 10.3.2 and Apple Mac OS X Server 10.2 through 10.3.2 accepts authentication server information from unknown LDAP or NetInfo sources as provided by a malicious DHCP server, which allows remote attackers to gain privileges.
Key phrases: gain privileges
CVE-2003-1010: Unknown vulnerability in fs_usage in Mac OS X 10.2.8 and 10.3.2 and Mac OS X Server 10.2.8 and 10.3.2 allows local users to gain privileges via unknown attack vectors.
Key phrases: gain privileges, gain privileges via unknown attack vectors, unknown vulnerability in fs_usage
CVE-2003-1011: Apple Mac OS X 10.0 through 10.2.8 allows local users with a USB keyboard to gain unauthorized access by holding down the CTRL and C keys when the system is booting, which crashes the init process and leaves the user in a root shell.
Key phrases: gain unauthorized access, gain unauthorized access by holding down the CTRL, crash
CVE-2003-1012: The SMB dissector in Ethereal before 0.10.0 allows remote attackers to cause a denial of service via a malformed SMB packet that triggers a segmentation fault during processing of Selected packets.
Key phrases: cause a denial of service via a malformed, malformed smb packet, segmentation fault
CVE-2003-1013: The Q.931 dissector in Ethereal before 0.10.0, and Tethereal, allows remote attackers to cause a denial of service (crash) via a malformed Q.931, which triggers a null dereference.
Key phrases: denial of service (crash), cause a denial of service (crash), malformed, null dereference
CVE-2003-1014: Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use multiple MIME fields with the same name, which may be interpreted differently by mail clients.
Key phrases: bypass content restrictions, bypass content restrictions via MIME messages that use
CVE-2003-1015: Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use whitespace in an unusual fashion, which may be interpreted differently by mail clients.
Key phrases: bypass content restrictions, bypass content restrictions via MIME messages that use
CVE-2003-1016: Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use malformed quoting in MIME headers, parameters, and values, including (1) fields that should not be quoted, (2) duplicate quotes, or (3) missing leading or trailing quote characters, which may be interpreted differently by mail clients.
Key phrases: bypass content restrictions, bypass content restrictions via MIME messages that use, malformed quoting, duplicate quotes, missing leading or trailing quote characters
CVE-2003-1017: Macromedia Flash Player before 7,0,19,0 stores a Flash data file in a predictable location that is accessible to web browsers such as Internet Explorer and Opera, which allows remote attackers to read restricted files via vulnerabilities in web browsers whose exploits rely on predictable names.
Key phrases: read restricted files via vulnerabilities in web browsers
CVE-2003-1018: Format string vulnerability in enq command in AIX 4.3, 5.1, and 5.2 allows local users with rintq group privileges to gain privileges via unknown attack vectors.
Key phrases: gain privileges, gain privileges via unknown attack vectors, format string
CVE-2003-1020: The format_send_to_gui function in formats.c for irssi before 0.8.9 allows remote IRC users to cause a denial of service (crash).
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2003-1021: The scosession program in OpenServer 5.0.6 and 5.0.7 allows local users to gain privileges via crafted strings on the commandline.
Key phrases: gain privileges, gain privileges via crafted strings on the commandline
CVE-2003-1022: Directory traversal vulnerability in fsp before 2.81.b18 allows remote users to access files outside the FSP root directory.
Key phrases: access files outside the FSP root directory, directory traversal
CVE-2003-1023: Stack-based buffer overflow in vfs_s_resolve_symlink of vfs/direntry.c for Midnight Commander (mc) 4.6.0 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code during symlink conversion.
Key phrases: execute arbitrary code, execute arbitrary code during symlink conversion, stack-based buffer overflow, stack based buffer overflow
CVE-2003-1024: Unknown vulnerability in the ls-F builtin function in tcsh on Solaris 8 allows local users to create or delete files as other users, and gain privileges.
Key phrases: gain privileges, create or delete files as other users, unknown
CVE-2003-1025: Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability."
Key phrases: spoof the domain of a URL via a, improper url canonicalization, spoofing
CVE-2003-1026: Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability."
Key phrases: bypass zone restrictions, bypass zone restrictions via a javascript protocol URL, backtoframedjpu, travel log cross domain
CVE-2003-1027: Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability."
Key phrases: direct drag and drop behaviors and other mouse, function pointer drag and drop
CVE-2003-1028: The download function of Internet Explorer 6 SP1 allows remote attackers to obtain the cache directory name via an HTTP response with an invalid ContentType and a .htm file, which could allow remote attackers to bypass security mechanisms that rely on random names, as demonstrated by threadid10008.
Key phrases: bypass security mechanisms that rely on random names, obtain the cache directory name via an HTTP response, invalid contenttype
CVE-2003-1029: The L2TP protocol parser in tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (infinite loop and memory consumption) via a packet with invalid data to UDP port 1701, which causes l2tp_avp_print to use a bad length value when calling print_octets.
Key phrases: denial of service (infinite loop and memory consumption), cause a denial of service (infinite loop
CVE-2003-1030: Buffer overflow in DameWare Mini Remote Control before 3.73 allows remote attackers to execute arbitrary code via a long pre-authentication request to TCP port 6129.
Key phrases: execute arbitrary code, execute arbitrary code via a long pre-, buffer overflow
CVE-2003-1031: Cross-site scripting (XSS) vulnerability in register.php for vBulletin 3.0 Beta 2 allows remote attackers to inject arbitrary HTML or web script via optional fields such as (1) "Interests-Hobbies", (2) "Biography", or (3) "Occupation."
Key phrases: inject arbitrary HTML or web, inject arbitrary HTML or web script via optional, cross-site scripting (xss)
CVE-2003-1032: Pi3Web web server 2.0.2 Beta 1, when the Directory Index is configured to use the "Name" column and sort using the column title as a hyperlink, allows remote attackers to cause a denial of service (crash) via a malformed URL to the web server, possibly involving a buffer overflow.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2003-1033: The (1) instdbmsrv and (2) instlserver programs in SAP DB Development Tools 7.x trust the user-provided INSTROOT environment variable as a path when assigning setuid permissions to the lserver program, which allows local users to gain root privileges via a modified INSTROOT that points to a malicious dbmsrv or lserver program.
Key phrases: gain root privileges, gain root privileges via a modified INSTROOT that, modified instroot
CVE-2003-1034: The RPM installation of SAP DB 7.x creates the (1) dbmsrv or (2) lserver programs with world-writable permissions, which allows local users to gain privileges by modifying those programs.
Key phrases: gain privileges, gain privileges by modifying those programs, world-writable permissions
CVE-2003-1035: The default installation of SAP R/3 46C/D allows remote attackers to bypass account locking by using the RFC API instead of the SAPGUI to conduct a brute force password guessing attack, which does not lock out the account like the SAPGUI does.
Key phrases: bypass account locking by using the RFC API instead, brute force password guessing
CVE-2003-1036: Multiple buffer overflows in the AGate component for SAP Internet Transaction Server (ITS) allow remote attackers to execute arbitrary code via long (1) ~command, (2) ~runtimemode, or (3) ~session parameters, or (4) a long HTTP Content-Type header.
Key phrases: execute arbitrary code, execute arbitrary code via long (1), buffer overflows
CVE-2003-1037: Format string vulnerability in the WGate component for SAP Internet Transaction Server (ITS) allows remote attackers to execute arbitrary code via a high "trace level."
Key phrases: execute arbitrary code, execute arbitrary code via a high "trace, format string
CVE-2003-1038: The AGate component for SAP Internet Transaction Server (ITS) allows remote attackers to obtain sensitive information via a ~command parameter with an AgateInstallCheck value, which provides a list of installed DLLs and full pathnames.
Key phrases: obtain sensitive information, obtain sensitive information via a ~command parameter with
CVE-2003-1039: Multiple buffer overflows in the mySAP.com architecture for SAP allow remote attackers to execute arbitrary code via a long HTTP Host header to (1) Message Server, (2) Web Dispatcher, or (3) Application Server.
Key phrases: execute arbitrary code, execute arbitrary code via a long HTTP Host, buffer overflows
CVE-2003-1040: kmod in the Linux kernel does not set its uid, suid, gid, or sgid to 0, which allows local users to cause a denial of service (crash) by sending certain signals to kmod.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2003-1041: Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot dot) sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension.  NOTE: this bug may overlap CVE-2004-0475.
Key phrases: execute arbitrary programs, execute arbitrary programs via a modified directory traversal
CVE-2003-1042: SQL injection vulnerability in collectstats.pl for Bugzilla 2.16.3 and earlier allows remote authenticated users with editproducts privileges to execute arbitrary SQL via the product name.
Key phrases: execute arbitrary SQL, execute arbitrary SQL via the product name, sql injection
CVE-2003-1043: SQL injection vulnerability in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote authenticated users with editkeywords privileges to execute arbitrary SQL via the id parameter to editkeywords.cgi.
Key phrases: execute arbitrary SQL, execute arbitrary SQL via the id parameter, sql injection
CVE-2003-1044: editproducts.cgi in Bugzilla 2.16.3 and earlier, when usebuggroups is enabled, does not properly remove group add privileges from a group that is being deleted, which allows users with those privileges to perform unauthorized additions to the next group that is assigned with the original group ID.
Key phrases: perform unauthorized additions to the next group that
CVE-2003-1045: votes.cgi in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote attackers to read a user's voting page when that user has voted on a restricted bug, which allows remote attackers to read potentially sensitive voting information by modifying the who parameter.
Key phrases: read a user's voting page when that, read potentially sensitive voting information by modifying the, restricted bug, who parameter
CVE-2003-1046: describecomponents.cgi in Bugzilla 2.17.3 and 2.17.4 does not properly verify group membership when bug entry groups are used, which allows remote attackers to list component descriptions for otherwise restricted products.
Key phrases: list component descriptions for otherwise restricted products
CVE-2003-1048: Double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image.
Key phrases: denial of service (application crash), cause a denial of service (application crash, double free
CVE-2003-1049: IBM DB2 Universal Database 7 before FixPak 12 creates certain DMS directories with insecure permissions (777), which allows local users to modify or delete certain DB2 files.
Key phrases: modify or delete certain DB2 files, insecure permissions
CVE-2003-1050: Multiple buffer overflows in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via long command line arguments to (1) db2start, (2) db2stop, or (3) db2govd.
Key phrases: execute arbitrary code, execute arbitrary code via long command line arguments, buffer overflows
CVE-2003-1051: Multiple format string vulnerabilities in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via certain command line arguments to (1) db2start, (2) db2stop, or (3) db2govd.
Key phrases: execute arbitrary code, execute arbitrary code via certain command line arguments, multiple format string
CVE-2003-1052: IBM DB2 7.1 and 8.1 allow the bin user to gain root privileges by modifying the shared libraries that are used in setuid root programs.
Key phrases: gain root privileges, gain root privileges by modifying the shared libraries
CVE-2003-1053: Multiple buffer overflows in XShisen allow attackers to execute arbitrary code via a long (1) -KCONV command line option or (2) XSHISENLIB environment variable.
Key phrases: execute arbitrary code, execute arbitrary code via a long (1, buffer overflows
CVE-2003-1054: mod_access_referer 1.0.2 allows remote attackers to cause a denial of service (crash) via a malformed Referer header that is missing a hostname, as parsed by the ap_parse_uri_components function in Apache, which triggers a null dereference.
Key phrases: denial of service (crash), cause a denial of service (crash), malformed referer header, null dereference
CVE-2003-1055: Buffer overflow in the nss_ldap.so.1 library for Sun Solaris 8 and 9 may allow local users to gain root access via a long hostname in an LDAP lookup.
Key phrases: gain root access, gain root access via a long hostname in, buffer overflow
CVE-2003-1056: The ed editor for Sun Solaris 2.6, 7, and 8 allows local users to create or overwrite arbitrary files via a symlink attack on temporary files.
Key phrases: overwrite arbitrary files, create or overwrite arbitrary files via a symlink
CVE-2003-1057: Unknown vulnerability in CDE Print Viewer (dtprintinfo) for Sun Solaris 2.6 through 9 may allow local users to execute arbitrary code.
Key phrases: execute arbitrary code, unknown
CVE-2003-1058: The Xsun server for Sun Solaris 2.6 through 9, when running in Direct Graphics Access (DGA) mode, allows local users to cause a denial of service (Xsun crash) or to create or overwrite arbitrary files on the system, probably via a symlink attack on temporary server files.
Key phrases: overwrite arbitrary files, denial of service (Xsun crash), cause a denial of service (Xsun crash, symlink
CVE-2003-1059: Unknown vulnerability in the libraries for the PGX32 frame buffer in Solaris 2.5.1 and 2.6 through 9 allows local users to gain root access.
Key phrases: gain root access, unknown
CVE-2003-1060: The NFS Server for Solaris 7, 8, and 9 allows remote attackers to cause a denial of service (UFS panic) via certain invalid UFS requests, which triggers a null dereference.
Key phrases: denial of service (UFS panic), cause a denial of service (UFS panic, invalid ufs requests, null dereference
CVE-2003-1061: Race condition in Solaris 2.6 through 9 allows local users to cause a denial of service (kernel panic), as demonstrated via the namefs function, pipe, and certain STREAMS routines.
Key phrases: denial of service (kernel panic), cause a denial of service (kernel panic, race condition
CVE-2003-1062: Unknown vulnerability in the sysinfo system call for Solaris for SPARC 2.6 through 9, and Solaris for x86 2.6, 7, and 8, allows local users to read kernel memory.
Key phrases: read kernel memory, unknown
CVE-2003-1063: The patches (1) 105693-13, (2) 108800-02, (3) 105694-13, and (4) 108801-02 for cachefs on Solaris 2.6 and 7 overwrite the inetd.conf file, which may silently reenable services and allow remote attackers to bypass the intended security policy.
Key phrases: bypass the intended security policy, cachefs
CVE-2003-1064: Solaris 8 with IPv6 enabled allows remote attackers to cause a denial of service (kernel panic) via a crafted IPv6 packet.
Key phrases: denial of service (kernel panic), cause a denial of service (kernel panic
CVE-2003-1065: Unknown vulnerability in patches 108993-14 through 108993-19 and 108994-14 through 108994-19 for Solaris 8 may allow local users to cause a denial of service (automountd crash).
Key phrases: denial of service (automountd crash), cause a denial of service (automountd crash, unknown
CVE-2003-1066: Buffer overflow in the syslog daemon for Solaris 2.6 through 9 allows remote attackers to cause a denial of service (syslogd crash) and possibly execute arbitrary code via long syslog UDP packets.
Key phrases: execute arbitrary code, denial of service (syslogd crash), cause a denial of service (syslogd crash, buffer overflow
CVE-2003-1067: Multiple buffer overflows in the (1) dbm_open function, as used in ndbm and dbm, and the (2) dbminit function in Solaris 2.6 through 9 allow local users to gain root privileges via long arguments to Xsun or other programs that use these functions.
Key phrases: gain root privileges, gain root privileges via long arguments to Xsun, buffer overflows
CVE-2003-1068: Buffer overflow in utmp_update for Solaris 2.6 through 9 allows local users to gain root privileges, as identified by Sun BugID 4659277, a different vulnerability than CVE-2003-1082.
Key phrases: gain root privileges, buffer overflow, sun bugid
CVE-2003-1069: The Telnet daemon (in.telnetd) for Solaris 2.6 through 9 allows remote attackers to cause a denial of service (CPU consumption by infinite loop).
Key phrases: denial of service (CPU consumption by infinite loop), cause a denial of service (CPU consumption
CVE-2003-1070: Unknown vulnerability in rpcbind for Solaris 2.6 through 9 allows remote attackers to cause a denial of service (rpcbind crash).
Key phrases: denial of service (rpcbind crash), cause a denial of service (rpcbind crash, unknown
CVE-2003-1071: rpc.walld (wall daemon) for Solaris 2.6 through 9 allows local users to send messages to logged on users that appear to come from arbitrary user IDs by closing stderr before executing wall, then supplying a spoofed from header.
Key phrases: send messages to logged on users that appear, spoofing
CVE-2003-1072: Memory leak in lofiadm in Solaris 8 allows local users to cause a denial of service (kernel memory consumption).
Key phrases: denial of service (kernel memory consumption), cause a denial of service (kernel memory, memory leak
CVE-2003-1073: A race condition in the at command for Solaris 2.6 through 9 allows local users to delete arbitrary files via the -r argument with .. (dot dot) sequences in the job name, then modifying the directory structure after at checks permissions to delete the file and before the deletion actually takes place.
Key phrases: delete arbitrary files, delete arbitrary files via the -r argument with, race condition
CVE-2003-1074: Unknown vulnerability in newtask for Solaris 9 allows local users to gain root privileges.
Key phrases: gain root privileges, unknown
CVE-2003-1075: Unknown vulnerability in the FTP server (in.ftpd) for Solaris 2.6 through 9 allows remote attackers to cause a denial of service (temporary FTP server hang), which affects other active mode FTP clients.
Key phrases: denial of service (temporary FTP server hang), cause a denial of service (temporary FTP, unknown
CVE-2003-1076: Unknown vulnerability in sendmail for Solaris 7, 8, and 9 allows local users to cause a denial of service (unknown impact) and possibly gain privileges via certain constructs in a .forward file.
Key phrases: denial of service (unknown impact), gain privileges, cause a denial of service (unknown impact
CVE-2003-1077: Unknown vulnerability in UFS for Solaris 9 for SPARC, with logging enabled, allows local users to cause a denial of service (UFS file system hang).
Key phrases: denial of service (UFS file system hang), cause a denial of service (UFS file, unknown
CVE-2003-1078: The FTP client for Solaris 2.6, 7, and 8 with the debug (-d) flag enabled displays the user password on the screen during login.
CVE-2003-1079: Unknown vulnerability in UDP RPC for Solaris 2.5.1 through 9 for SPARC, and 2.5.1 through 8 for x86, allows remote attackers to cause a denial of service (memory consumption) via certain arguments in RPC calls that cause large amounts of memory to be allocated.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption, unknown, large amounts of memory
CVE-2003-1080: Unknown vulnerability in mail for Solaris 2.6 through 9 allows local users to read the email of other users.
Key phrases: read the email of other users, unknown
CVE-2003-1081: Aspppls for Solaris 8 allows local users to overwrite arbitrary files via a symlink attack on the .asppp.fifo temporary file.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2003-1082: Buffer overflow in utmp_update for Solaris 2.6 through 9 allows local users to gain root privileges, as identified by Sun BugID 4705891, a different vulnerability than CVE-2003-1068.
Key phrases: gain root privileges, buffer overflow, sun bugid
CVE-2003-1083: Stack-based buffer overflow in Monit 1.4 to 4.1 allows remote attackers to execute arbitrary code via a long HTTP request.
Key phrases: execute arbitrary code, execute arbitrary code via a long HTTP request, stack-based buffer overflow, stack based buffer overflow
CVE-2003-1084: Monit 1.4 to 4.1 allows remote attackers to cause a denial of service (daemon crash) via an HTTP POST request with a negative Content-Length field.
Key phrases: denial of service (daemon crash), cause a denial of service (daemon crash, negative content-length field
CVE-2003-1085: The HTTP server in the Thomson TWC305, TWC315, and TCW690 cable modem ST42.03.0a allows remote attackers to cause a denial of service (unstable service) via a long GET request, possibly caused by a buffer overflow.
Key phrases: denial of service (unstable service), cause a denial of service (unstable service, buffer overflow
CVE-2003-1086: PHP remote file inclusion vulnerability in pm/lib.inc.php in pMachine Free and pMachine Pro 2.2 and 2.2.1 allows remote attackers to execute arbitrary PHP code by modifying the pm_path parameter to reference a URL on a remote web server that contains the code.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code by modifying the pm_path, php remote file inclusion
CVE-2003-1087: Unknown vulnerability in diagmond and possibly other applications in HP9000 Series 700/800 running HP-UX B.11.00, B.11.04, B.11.11, and B.11.22 allows remote attackers to cause a denial of service (program failure) via certain network traffic.
Key phrases: denial of service (program failure), cause a denial of service (program failure, unknown
CVE-2003-1088: Cross-site scripting (XSS) vulnerability in index.php for Zorum 3.4 and 3.5 allows remote attackers to inject arbitrary web script or HTML via the method parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1089: index.php for Zorum 3.4 allows remote attackers to determine the full path of the web root via invalid parameter names, which reveals the path in a PHP error message.
Key phrases: determine the full path of the web root, invalid parameter names
CVE-2003-1090: Buffer overflow in AbsoluteTelnet before 2.12 RC10 allows remote attackers to execute arbitrary code via a long window title.
Key phrases: execute arbitrary code, execute arbitrary code via a long window title, buffer overflow
CVE-2003-1091: Integer overflow in MP3Broadcaster for Apple QuickTime/Darwin Streaming Server 4.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed ID3 tags in MP3 files.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), integer overflow
CVE-2003-1092: Unknown vulnerability in the "Automatic File Content Type Recognition (AFCTR) Tool version of the file package before 3.41, related to "a memory allocation problem," has unknown impact.
Key phrases: unknown, memory allocation problem, unknown impact
CVE-2003-1093: BEA WebLogic Server 6.1, 7.0 and 7.0.0.1, when routing messages to a JMS target domain that is inaccessible, may leak the user's password when it throws a ResourceAllocationException.
Key phrases: inaccessible
CVE-2003-1094: BEA WebLogic Server and Express version 7.0 SP3 may follow certain code execution paths that result in an incorrect current user, such as in the frequent use of JNDI initial contexts, which could allow remote authenticated users to gain privileges.
Key phrases: gain privileges, code execution paths, incorrect current user, jndi initial contexts
CVE-2003-1095: BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate.
Key phrases: gain access, gain access without having to re-authenticate
CVE-2003-1096: The Cisco LEAP challenge/response authentication mechanism uses passwords in a way that is susceptible to dictionary attacks, which makes it easier for remote attackers to gain privileges via brute force password guessing attacks.
Key phrases: gain privileges, dictionary, brute force password guessing
CVE-2003-1097: Buffer overflow in rexec on HP-UX B.10.20, B.11.00, and B.11.04, when setuid root, may allow local users to gain privileges via a long -l option.
Key phrases: gain privileges, gain privileges via a long -l option, buffer overflow
CVE-2003-1098: The Xserver for HP-UX 11.22 was not properly built, which introduced a vulnerability that allows local users to gain privileges.
Key phrases: gain privileges
CVE-2003-1099: shar on HP-UX B.11.00, B.11.04, and B.11.11 creates temporary files with predictable names in /tmp, which allows local users to cause a denial of service and possibly execute arbitrary code via a symlink attack.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, predictable names, symlink
CVE-2003-1100: Multiple cross-site scripting (XSS) vulnerabilities in Hummingbird CyberDOCS 3.5.1, 3.9, and 4.0 allow remote attackers to inject arbitrary web script or HTML via certain vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via certain, cross-site scripting (xss), certain vectors
CVE-2003-1101: Hummingbird CyberDOCS 3.5.1, 3.9, and 4.0 allows remote attackers to obtain the full path of the DM Web Server via invalid login credentials, which reveals the path in an error message.
Key phrases: obtain the full path of the DM Web Server, invalid login credentials
CVE-2003-1102: Hummingbird CyberDOCS 3.5, 3.9, and 4.0, when running on IIS, uses insecure permissions for script source code files, which allows remote attackers to read the source code.
Key phrases: read the source code, insecure permissions
CVE-2003-1103: SQL injection vulnerability in loginact.asp for Hummingbird CyberDOCS before 3.9 allows remote attackers to execute arbitrary SQL commands.
Key phrases: execute arbitrary SQL commands, sql injection
CVE-2003-1104: Buffer overflow in IBM Tivoli Firewall Toolbox (TFST) 1.2 allows remote attackers to execute arbitrary code via unknown vectors.
Key phrases: execute arbitrary code, execute arbitrary code via unknown vectors, buffer overflow
CVE-2003-1105: Unknown vulnerability in Internet Explorer 5.01 SP3 through 6.0 SP1 allows remote attackers to cause a denial of service (browser or Outlook Express crash) via HTML with certain input tags that are not properly rendered.
Key phrases: denial of service (browser or Outlook Express crash), cause a denial of service (browser or, unknown
CVE-2003-1106: The SMTP service in Microsoft Windows 2000 before SP4 allows remote attackers to cause a denial of service (crash or hang) via an e-mail message with a malformed time stamp in the FILETIME attribute.
Key phrases: denial of service (crash or hang), cause a denial of service (crash or, malformed time stamp
CVE-2003-1107: The DHTML capability in Microsoft Windows Media Player (WMP) 6.4, 7.0, 7.1, and 9 may run certain URL commands from a security zone that is less trusted than the current zone, which allows attackers to bypass intended access restrictions.
Key phrases: bypass intended access restrictions, url commands, security zone
CVE-2003-1108: The Session Initiation Protocol (SIP) implementation in Alcatel OmniPCX Enterprise 5.0 Lx allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute
CVE-2003-1109: The Session Initiation Protocol (SIP) implementation in multiple Cisco products including IP Phone models 7940 and 7960, IOS versions in the 12.2 train, and Secure PIX 5.2.9 to 6.2.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute
CVE-2003-1110: The Session Initiation Protocol (SIP) implementation in Columbia SIP User Agent (sipc) 1.74 and other versions before sipc 2.0 build 2003-02-21 allows remote attackers to cause a denial of service or execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.
Key phrases: execute arbitrary code, cause a denial of service or execute arbitrary
CVE-2003-1111: The Session Initiation Protocol (SIP) implementation in multiple dynamicsoft products including y and certain demo products for AppEngine allows remote attackers to cause a denial of service or execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.
Key phrases: execute arbitrary code, cause a denial of service or execute arbitrary
CVE-2003-1112: The Session Initiation Protocol (SIP) implementation in Ingate Firewall and Ingate SIParator before 3.1.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute
CVE-2003-1113: The Session Initiation Protocol (SIP) implementation in IPTel SIP Express Router 0.8.9 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute
CVE-2003-1114: The Session Initiation Protocol (SIP) implementation in Mediatrix Telecom VoIP Access Devices and Gateways running SIPv2.4 and SIPv4.3 firmware allows remote attackers to cause a denial of service or execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.
Key phrases: execute arbitrary code, cause a denial of service or execute arbitrary
CVE-2003-1115: The Session Initiation Protocol (SIP) implementation in Nortel Networks Succession Communication Server 2000, when using SIP-T, allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute
CVE-2003-1116: The communications protocol for the Report Review Agent (RRA), aka FND File Server (FNDFS) program, in Oracle E-Business Suite 10.7, 11.0, and 11.5.1 to 11.5.8 allows remote attackers to bypass authentication and obtain sensitive information from the Oracle Applications Concurrent Manager by spoofing requests to the TNS Listener.
Key phrases: bypass authentication, obtain sensitive information, bypass authentication and obtain sensitive information from the, spoofing requests
CVE-2003-1117: Buffer overflow in RealSystem Server 6.x, 7.x and 8.x, and RealSystem Proxy 8.x, related to URL error handling, allows remote attackers to cause a denial of service and possibly execute arbitrary code.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, buffer overflow
CVE-2003-1118: Buffer overflow in the SETI@home client 3.03 and other versions allows remote attackers to cause a denial of service (client crash) and execute arbitrary code via a spoofed server response containing a long string followed by a \\\\n (newline) character.
Key phrases: execute arbitrary code, denial of service (client crash), cause a denial of service (client crash, buffer overflow, spoofing
CVE-2003-1119: SSH Secure Shell before 3.2.9 allows remote attackers to cause a denial of service via malformed BER/DER packets.
Key phrases: cause a denial of service via malformed BER, malformed ber der packets
CVE-2003-1120: Race condition in SSH Tectia Server 4.0.3 and 4.0.4 for Unix, when the password change plugin (ssh-passwd-plugin) is enabled, allows local users to obtain the server's private key.
Key phrases: obtain the server's private key., race condition
CVE-2003-1121: Services in ScriptLogic 4.01, and possibly other versions before 4.14, process client requests at raised privileges, which allows remote attackers to (1) modify arbitrary registry entries via the ScriptLogic RPC service (SLRPC) or (2) modify arbitrary configuration via the RunAdmin services (SLRAserver.exe and SLRAclient.exe).
Key phrases: modify arbitrary registry entries, (1) modify arbitrary registry entries via, raised privileges
CVE-2003-1122: ScriptLogic 4.01, and possibly other versions before 4.14, uses insecure permissions for the LOGS$ share, which allows users to modify log records and possibly execute arbitrary code.
Key phrases: execute arbitrary code, modify log records and possibly execute arbitrary code, insecure permissions
CVE-2003-1123: Sun Java Runtime Environment (JRE) and SDK 1.4.0_01 and earlier allows untrusted applets to access certain information within trusted applets, which allows attackers to bypass the restrictions of the Java security model.
Key phrases: bypass the restrictions, access certain information within trusted applets, bypass the restrictions of the Java security model, untrusted applets
CVE-2003-1124: Unknown vulnerability in Sun Management Center (SunMC) 2.1.1, 3.0, and 3.0 Revenue Release (RR), when installed and run by root, allows local users to create or modify arbitrary files.
Key phrases: modify arbitrary files, create or modify arbitrary files, unknown
CVE-2003-1125: Unknown vulnerability in ns-ldapd for Sun ONE Directory Server 4.16, 5.0, and 5.1 allows LDAP clients to cause a denial of service (service halt).
Key phrases: denial of service (service halt), cause a denial of service (service halt
CVE-2003-1126: Unknown vulnerability in SunOne/iPlanet Web Server SP3 through SP5 on Windows platforms allows remote attackers to cause a denial of service.
Key phrases: cause a denial of service, unknown
CVE-2003-1127: Whale Communications e-Gap 2.5 on Windows 2000 allows remote attackers to obtain the source code for the login page via the HTTP TRACE method, which bypasses the preprocessor.
Key phrases: obtain the source code for the login page, http trace method
CVE-2003-1128: XMMS.pm in X2 XMMS Remote, as obtained from the vendor server between 4 AM 11 AM PST on May 7, 2003, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to TCP port 8086.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in a
CVE-2003-1129: Buffer overflow in the Yahoo! Audio Conferencing (aka Voice Chat) ActiveX control before 1,0,0,45 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a URL with a long hostname to Yahoo! Messenger or Yahoo! Chat.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, buffer overflow
CVE-2003-1131: PHP remote file inclusion vulnerability in index.php in KnowledgeBuilder, referred to as KnowledgeBase, allows remote attackers to execute arbitrary PHP code by modifying the page parameter to reference a URL on a remote web server that contains the code.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code by modifying the page, php remote file inclusion
CVE-2003-1132: The DNS server for Cisco Content Service Switch (CSS) 11000 and 11500, when prompted for a nonexistent AAAA record, responds with response code 3 (NXDOMAIN or "Name Error") instead of response code 0 ("No Error"), which allows remote attackers to cause a denial of service (inaccessible domain) by forcing other DNS servers to send and cache a request for a AAAA record to the vulnerable server.
Key phrases: denial of service (inaccessible domain), cause a denial of service (inaccessible domain
CVE-2003-1133: Rit Research Labs The Bat! 1.0.11 through 2.0 creates new accounts with insecure ACLs, which allows local users to read other users' email messages.
Key phrases: read other users' email messages, insecure acls
CVE-2003-1134: Sun Java 1.3.1, 1.4.1, and 1.4.2 allows local users to cause a denial of service (JVM crash), possibly by calling the ClassDepth function with a null parameter, which causes a crash instead of generating a null pointer exception.
Key phrases: denial of service (JVM crash), cause a denial of service (JVM crash, null parameter, null pointer
CVE-2003-1135: Buffer overflow in Yahoo! Messenger 5.6 allows remote attackers to cause a denial of service (crash) via a file send request (sendfile) with a large number of "%" (percent) characters after the Yahoo ID.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow