yahoo-inc/cve-impacts huggingface dataset:
CVE-2003-1286: HTTP Proxy in Sambar Server before 6.0 beta 6, when security.ini lacks a 127.0.0.1 proxydeny entry, allows remote attackers to send proxy HTTP requests to the Sambar Server's administrative interface and external web servers, by making a "Connection: keep-alive" request before the proxy requests.
Key phrases: send proxy HTTP requests to the Sambar Server
CVE-2003-1287: Sambar Server before 6.0 beta 3 allows attackers with physical access to execute arbitrary code via a request with an MS-DOS device name such as com1.pl, con.pl, or aux.pl, which causes Perl to read the code from the associated device.
Key phrases: execute arbitrary code, execute arbitrary code via a request with an, physical access
CVE-2003-1288: Multiple race conditions in Linux-VServer 1.22 with Linux kernel 2.4.23 and SMP allow local users to cause a denial of service (kernel oops) via unknown attack vectors related to the (1) s_info and (2) ip_info data structures and the (a) forget_original_parent, (b) goodness, (c) schedule, (d) update_process_times, and (e) vc_new_s_context functions.
Key phrases: denial of service (kernel oops), cause a denial of service (kernel oops, multiple race conditions, unknown attack vectors
CVE-2003-1289: The iBCS2 system call translator for statfs in NetBSD 1.5 through 1.5.3 and FreeBSD 4 up to 4.8-RELEASE-p2 and 5 up to 5.1-RELEASE-p1 allows local users to read portions of kernel memory (memory disclosure) via a large length parameter, which copies additional kernel memory into userland memory.
Key phrases: read portions of kernel memory (memory disclosure
CVE-2003-1290: BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, with RMI and anonymous admin lookup enabled, allows remote attackers to obtain configuration information by accessing MBeanHome via the Java Naming and Directory Interface (JNDI).
Key phrases: obtain configuration information, obtain configuration information by accessing MBeanHome via the, anonymous admin lookup
CVE-2003-1291: VMware ESX Server 1.5.2 before Patch 4 allows local users to execute arbitrary programs as root via certain modified VMware ESX Server environment variables.
Key phrases: execute arbitrary programs, execute arbitrary programs as root via certain modified
CVE-2003-1292: PHP remote file include vulnerability in Derek Ashauer ashNews 0.83 allows remote attackers to include and execute arbitrary remote files via a URL in the pathtoashnews parameter to (1) ashnews.php and (2) ashheadlines.php.
Key phrases: include and execute arbitrary remote files via a, php remote file include
CVE-2003-1293: Multiple cross-site scripting (XSS) vulnerabilities in NukedWeb GuestBookHost allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) Email and (3) Message fields when signing the guestbook.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1294: Xscreensaver before 4.15 creates temporary files insecurely in (1) driver/passwd-kerberos.c, (2) driver/xscreensaver-getimage-video, (3) driver/xscreensaver.kss.in, and the (4) vidwhacker and (5) webcollage screensavers, which allows local users to overwrite arbitrary files via a symlink attack.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack
CVE-2003-1295: Unspecified vulnerability in xscreensaver 4.12, and possibly other versions, allows attackers to cause xscreensaver to crash via unspecified vectors "while verifying the user-password."
Key phrases: cause xscreensaver to crash via unspecified vectors ", unspecified vulnerability
CVE-2003-1296: Easy File Sharing (EFS) Web Server 1.2 allows remote authenticated users to cause a denial of service via (1) an "empty symbol" in the Title field or (2) certain data in the Your Message field, possibly a long argument.
Key phrases: cause a denial of service via (1, long argument
CVE-2003-1297: Easy File Sharing (EFS) Web Server 1.2 stores the (1) option.ini (aka options.ini) file and (2) log directory under the web root with insufficient access control, which allows remote attackers to obtain sensitive information including an SMTP account username and password hash, the server configuration, and server log files.
Key phrases: obtain sensitive information, obtain sensitive information including an SMTP account username, insufficient access control
CVE-2003-1298: Multiple directory traversal vulnerabilities in siteman.php3 in AnyPortal(php) 12 MAY 00 allow remote attackers to (1) create, (2) delete, (3) save, and (4) upload files by navigating to the root directory and entering a filename beginning with "./.." (dot slash dot dot).
Key phrases: (1) create, directory traversal
CVE-2003-1299: Directory traversal vulnerability in Baby FTP Server 1.2, and possibly other versions before May 31, 2003 allows remote authenticated users to list arbitrary directories and possibly read files via "..." (triple dot) manipulations to the CWD command.
Key phrases: list arbitrary directories, list arbitrary directories and possibly read files via, directory traversal
CVE-2003-1300: Baby FTP Server (BabyFTP) 1.2, and possibly other versions before May 31, 2003, allows remote attackers to cause a denial of service via a large number of connections from the same IP address, which triggers an access violation.
Key phrases: cause a denial of service via a large, access violation
CVE-2003-1301: Sun Java Runtime Environment (JRE) 1.x before 1.4.2_11 and 1.5.x before 1.5.0_06, and as used in multiple web browsers, allows remote attackers to cause a denial of service (application crash) via deeply nested object arrays, which are not properly handled by the garbage collector and trigger invalid memory accesses.
Key phrases: denial of service (application crash), cause a denial of service (application crash, invalid memory accesses
CVE-2003-1302: The IMAP functionality in PHP before 4.3.1 allows remote attackers to cause a denial of service via an e-mail message with a (1) To or (2) From header with an address that contains a large number of "\\\\" (backslash) characters.
Key phrases: cause a denial of service via an e
CVE-2003-1303: Buffer overflow in the imap_fetch_overview function in the IMAP functionality (php_imap.c) in PHP before 4.3.3 allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long e-mail address in a (1) To or (2) From header.
Key phrases: execute arbitrary code, denial of service (segmentation fault), cause a denial of service (segmentation fault, buffer overflow
CVE-2003-1304: EarlyImpact ProductCart 1.0 through 2.0 stores database/EIPC.mdb under the web root with insufficient access control, which allows remote attackers to obtain sensitive database information via a direct request.
Key phrases: obtain sensitive database, obtain sensitive database information via a direct request, earlyimpact, insufficient access control
CVE-2003-1305: Microsoft Internet Explorer allows remote attackers to cause a denial of service (resource consumption) via a Javascript src attribute that recursively loads the current web page.
Key phrases: denial of service (resource consumption), cause a denial of service (resource consumption, javascript src attribute
CVE-2003-1306: Microsoft URLScan 2.5, with the RemoveServerHeader option enabled, allows remote attackers to obtain sensitive information (server name and version) via an HTTP request that generates certain errors such as 400 "Bad Request," which leak the Server header in the response.
Key phrases: obtain sensitive information, obtain sensitive information (server name and version
CVE-2003-1307: The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port.  NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP.
Key phrases: PHP scripts to send signals to the server
CVE-2003-1308: CRLF injection vulnerability in fvwm-menu-directory for fvwm 2.5.x before 2.5.10 and 2.4.x before 2.4.18 allows local users to execute arbitrary commands via carriage returns in a filename.
Key phrases: execute arbitrary commands, execute arbitrary commands via carriage returns in a, crlf injection
CVE-2003-1309: The DeviceIoControl function in the TrueVector Device Driver (VSDATANT) in ZoneAlarm before 3.7.211, Pro before 4.0.146.029, and Plus before 4.0.146.029 allows local users to gain privileges via certain signals (aka "Device Driver Attack").
Key phrases: gain privileges, gain privileges via certain signals (aka ", device driver
CVE-2003-1310: The DeviceIoControl function in the Norton Device Driver (NAVAP.sys) in Symantec Norton AntiVirus 2002 allows local users to gain privileges by overwriting memory locations via certain control codes (aka "Device Driver Attack").
Key phrases: gain privileges, gain privileges by overwriting memory locations via certain, device driver
CVE-2003-1311: siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder does not ensure that the TARGET parameter names a valid redirection resource, which allows remote attackers to construct a URL that might trick users into visiting an arbitrary web site referenced by this parameter.
Key phrases: construct a URL that might trick users into
CVE-2003-1312: siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder places a session ID string in the value of the SMSESSION parameter in a URL, which might allow remote attackers to obtain the ID by sniffing, reading Referer logs, or other methods.
Key phrases: obtain the ID by sniffing, reading Referer logs
CVE-2003-1313: Multiple PHP remote file inclusion vulnerabilities in EternalMart Mailing List Manager (EMLM) 1.32 allow remote attackers to execute arbitrary PHP code via a URL in (1) the emml_admin_path parameter to admin/auth.php or (2) the emml_path parameter to emml_email_func.php.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code
CVE-2003-1314: PHP remote file inclusion vulnerability in admin/auth.php in EternalMart Guestbook (EMGB) 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the emgb_admin_path parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code
CVE-2003-1315: SQL injection vulnerability in auth.php in Land Down Under (LDU) v601 and earlier allows remote attackers to execute arbitrary SQL commands.
Key phrases: execute arbitrary SQL commands, sql injection, arbitrary sql commands
CVE-2003-1316: mod.php in eNdonesia 8.2 allows remote attackers to obtain sensitive information via a ' (quote) value in the lng parameter, which reveals the path in an error message.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Key phrases: obtain sensitive information, obtain sensitive information via a ' (quote
CVE-2003-1317: Cross-site scripting (XSS) vulnerability in mod.php in eNdonesia 8.2 allows remote attackers to inject arbitrary web script or HTML via the mod parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1318: Twilight Webserver 1.3.3.0 allows remote attackers to cause a denial of service (application crash) via a GET request for a long URI, a different vulnerability than CVE-2004-2376.
Key phrases: denial of service (application crash), cause a denial of service (application crash
CVE-2003-1319: Multiple buffer overflows in SmartFTP 1.0.973, and other versions before 1.0.976, allow remote attackers to execute arbitrary code via (1) a long response to a PWD command, which triggers a stack-based overflow, and (2) a long line in a response to a file LIST command, which triggers a heap-based overflow.
Key phrases: execute arbitrary code, execute arbitrary code via (1) a, buffer overflows, stack-based overflow, heap-based overflow, stack based overflow, heap based overflow
CVE-2003-1320: SonicWALL firmware before 6.4.0.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted Internet Key Exchange (IKE) response packets, possibly including (1) a large Security Parameter Index (SPI) field, (2) a large number of payloads, or (3) a long payload.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, payloads, long payload
CVE-2003-1321: Buffer overflow in Avant Browser 8.02 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long URL in an HTTP request.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2003-1322: Multiple stack-based buffer overflows in Atrium MERCUR IMAPD in MERCUR Mailserver before 4.2.15.0 allow remote attackers to execute arbitrary code via a long (1) EXAMINE, (2) DELETE, (3) SUBSCRIBE, (4) RENAME, (5) UNSUBSCRIBE, (6) LIST, (7) LSUB, (8) STATUS, (9) LOGIN, (10) CREATE, or (11) SELECT command.
Key phrases: execute arbitrary code, execute arbitrary code via a long (1, stack-based buffer overflows, stack based buffer overflow
CVE-2003-1323: Elm ME+ 2.4 before PL109S, when installed setgid mail and the operating system lacks POSIX saved ID support, allows local users to read and modify certain files with the privileges of the mail group via unspecified vectors.
Key phrases: read and modify certain files with the privileges, unspecified vectors
CVE-2003-1324: Race condition in the can_open function in Elm ME+ 2.4, when installed setgid mail and the operating system lacks POSIX saved ID support, allows local users to read and modify certain files with the privileges of the mail group.
Key phrases: read and modify certain files with the privileges, race condition
CVE-2003-1325: The SV_CheckForDuplicateNames function in Valve Software Half-Life CSTRIKE Dedicated Server 1.1.1.0 and earlier allows remote authenticated users to cause a denial of service (infinite loop and daemon hang) via a certain connection string to UDP port 27015 that represents "absence of player informations," a related issue to CVE-2006-0734.
Key phrases: denial of service (infinite loop and daemon hang), cause a denial of service (infinite loop
CVE-2003-1326: Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model to run malicious script or arbitrary programs via dialog boxes, aka "Improper Cross Domain Security Validation with dialog box."
Key phrases: bypass the cross-domain security model to run malicious script, improper cross domain security validation with dialog box
CVE-2003-1327: Buffer overflow in the SockPrintf function in wu-ftpd 2.6.2 and earlier, when compiled with MAIL_ADMIN option enabled on a system that supports very long pathnames, might allow remote anonymous users to execute arbitrary code by uploading a file with a long pathname, which triggers the overflow when wu-ftpd constructs a notification message to the administrator.
Key phrases: execute arbitrary code, execute arbitrary code by uploading a file with, buffer overflow
CVE-2003-1328: The showHelp() function in Microsoft Internet Explorer 5.01, 5.5, and 6.0 supports certain types of pluggable protocols that allow remote attackers to bypass the cross-domain security model and execute arbitrary code, aka "Improper Cross Domain Security Validation with ShowHelp functionality."
Key phrases: execute arbitrary code, bypass the cross-domain security model and execute arbitrary code, improper cross domain security validation
CVE-2003-1329: ftpd.c in wu-ftpd 2.6.2, when running on "operating systems that only allow one non-connected socket bound to the same local address," does not close failed connections, which allows remote attackers to cause a denial of service.
Key phrases: the same local address, cause a denial of service, non-connected socket
CVE-2003-1330: Clearswift MAILsweeper for SMTP 4.3.6 SP1 does not execute custom "on strip unsuccessful" hooks, which allows remote attackers to bypass e-mail attachment filtering policies via an attachment that MAILsweeper can detect but not remove.
Key phrases: bypass e-mail attachment filtering, bypass e-mail attachment filtering policies via
CVE-2003-1331: Stack-based buffer overflow in the mysql_real_connect function in the MySql client library (libmysqlclient) 4.0.13 and earlier allows local users to execute arbitrary code via a long socket name, a different vulnerability than CVE-2001-1453.
Key phrases: execute arbitrary code, execute arbitrary code via a long socket name, stack-based buffer overflow, stack based buffer overflow
CVE-2003-1332: Stack-based buffer overflow in the reply_nttrans function in Samba 2.2.7a and earlier allows remote attackers to execute arbitrary code via a crafted request, a different vulnerability than CVE-2003-0201.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted request, stack-based buffer overflow, stack based buffer overflow
CVE-2003-1333: Unspecified vulnerability in the Cache' Server Page (CSP) implementation in InterSystems Cache' 4.0.3 through 5.0.5 allows remote attackers to "gain complete control" of a server.
Key phrases: gain complete control, "gain complete control" of a server, unspecified, unspecified vulnerability
CVE-2003-1334: Cross-site scripting (XSS) vulnerability in Kai Blankenhorn Bitfolge simple and nice index file (aka snif) before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2003-1335: Directory traversal vulnerability in Kai Blankenhorn Bitfolge simple and nice index file (aka snif) before 1.2.5 allows remote attackers to download files from locations above the snif directory.
Key phrases: download files from locations above the snif directory, directory traversal
CVE-2003-1336: Buffer overflow in mIRC before 6.11 allows remote attackers to execute arbitrary code via a long irc:// URL.
Key phrases: execute arbitrary code, execute arbitrary code via a long irc:// URL, buffer overflow
CVE-2003-1337: Heap-based buffer overflow in Aprelium Abyss Web Server 1.1.2 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.
Key phrases: execute arbitrary code, execute arbitrary code via a long HTTP GET, heap-based buffer overflow, heap based buffer overflow
CVE-2003-1338: CRLF injection vulnerability in Aprelium Abyss Web Server 1.1.2 and earlier allows remote attackers to inject arbitrary HTTP headers and possibly conduct HTTP Response Splitting attacks via CRLF sequences in the Location header.
Key phrases: inject arbitrary HTTP headers, inject arbitrary HTTP headers and possibly conduct HTTP, crlf injection, http response splitting
CVE-2003-1339: Stack-based buffer overflow in eZnet.exe, as used in eZ (a) eZphotoshare, (b) eZmeeting, (c) eZnetwork, and (d) eZshare allows remote attackers to cause a denial of service (crash) or execute arbitrary code, as demonstrated via (1) a long GET request and (2) a long operation or autologin parameter to SwEzModule.dll.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), stack-based buffer overflow, stack based buffer overflow
CVE-2003-1340: Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 5.6 and 6.5 allow remote authenticated users to execute arbitrary SQL commands via (1) a uid (user) cookie to modules.php; and allow remote attackers to execute arbitrary SQL commands via an aid (admin) cookie to the Web_Links module in a (2) viewlink, (3) MostPopular, or (4) NewLinksDate action, different vectors than CVE-2003-0279.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via (1), execute arbitrary SQL commands via an aid (, sql injection
CVE-2003-1341: The default installation of Trend Micro OfficeScan 3.0 through 3.54 and 5.x allows remote attackers to bypass authentication from cgiChkMasterPasswd.exe and gain access to the web management console via a direct request to cgiMasterPwd.exe.
Key phrases: bypass authentication, gain access, bypass authentication from cgiChkMasterPasswd.exe and gain access to, direct request
CVE-2003-1342: Trend Micro Virus Control System (TVCS) 1.8 running with IIS allows remote attackers to cause a denial of service (memory consumption) in IIS via multiple URL requests for ActiveSupport.exe.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption
CVE-2003-1343: Trend Micro ScanMail for Exchange (SMEX) before 3.81 and before 6.1 might install a back door account in smg_Smxcfg30.exe, which allows remote attackers to gain access to the web management interface via the vcc parameter, possibly "3560121183d3".
Key phrases: gain access, gain access to the web management interface via, back door account
CVE-2003-1344: Trend Micro Virus Control System (TVCS) Log Collector allows remote attackers to obtain usernames, encrypted passwords, and other sensitive information via a URL request for getservers.exe with the action parameter set to "selects1", which returns log files.
Key phrases: obtain usernames, encrypted passwords, sensitive information
CVE-2003-1345: Directory traversal vulnerability in s.dll in WebCollection Plus 5.00 allows remote attackers to view arbitrary files in c:\\\\ via a full pathname in the d parameter.
Key phrases: view arbitrary files, view arbitrary files in c:\\\\ via a full, directory traversal
CVE-2003-1346: D-Link wireless access point DWL-900AP+ 2.2, 2.3 and possibly 2.5 allows remote attackers to set factory default settings by upgrading the firmware using AirPlus Access Point Manager.
Key phrases: set factory default settings by upgrading the firmware
CVE-2003-1347: Multiple cross-site scripting (XSS) vulnerabilities in Geeklog 1.3.7 allow remote attackers to inject arbitrary web script or HTML via the (1) cid parameter to comment.php, (2) uid parameter to profiles.php, (3) uid to users.php, and (4) homepage field.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1348: Cross-site scripting (XSS) vulnerability in guestbook.cgi in ftls.org Guestbook 1.1 allows remote attackers to inject arbitrary web script or HTML via the (1) comment, (2) name, or (3) title field.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1349: Directory traversal vulnerability in NITE ftp-server (NiteServer) 1.83 allows remote attackers to list arbitrary directories via a "\\\\.." (backslash dot dot) in the CD (CWD) command.
Key phrases: list arbitrary directories, list arbitrary directories via a "\\\\.., directory traversal
CVE-2003-1350: List Site Pro 2.0 allows remote attackers to hijack user accounts by inserting a "|" (pipe), which is used as a field delimiter, into the bannerurl field.
Key phrases: hijack user accounts by inserting a "|
CVE-2003-1351: Directory traversal vulnerability in edittag.cgi in EditTag 1.1 allows remote attackers to read arbitrary files via a "%2F.." (encoded slash dot dot) in the file parameter.
Key phrases: read arbitrary files, read arbitrary files via a "%2F, directory traversal
CVE-2003-1352: Gabber 0.8.7 sends an email to a specific address during user login and logout, which allows remote attackers to obtain user session activity and Gabber version number by sniffing.
Key phrases: obtain user session activity and Gabber version number, sniffing
CVE-2003-1353: Multiple cross-site scripting (XSS) vulnerabilities in Outreach Project Tool (OPT) 0.946b allow remote attackers to inject arbitrary web script or HTML, as demonstrated using the news field.
Key phrases: inject arbitrary web script or HTML, cross-site scripting (xss)
CVE-2003-1354: Multiple GameSpy 3D 2.62 compatible gaming servers generate very large UDP responses to small requests, which allows remote attackers to use the servers as an amplifier in DDoS attacks with spoofed UDP query packets, as demonstrated using Battlefield 1942.
Key phrases: use the servers as an amplifier in DDoS, spoofing
CVE-2003-1355: Buffer overflow in the remote console (rcon) in Battlefield 1942 1.2 and 1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long user name and password.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2003-1356: The "file handling" in sort in HP-UX 10.01 through 10.20, and 11.00 through 11.11 is "incorrect," which allows attackers to gain access or cause a denial of service via unknown vectors.
Key phrases: gain access, gain access or cause a denial of service, file handling, unknown vectors
CVE-2003-1357: ProxyView has a default administrator password of Administrator for Embedded Windows NT, which allows remote attackers to gain access.
Key phrases: gain access, default administrator password
CVE-2003-1358: rs.F300 for HP-UX 10.0 through 11.22 uses the PATH environment variable to find and execute programs such as rm while operating at raised privileges, which allows local users to gain privileges by modifying the path to point to a malicious rm program.
Key phrases: gain privileges, gain privileges by modifying the path to point
CVE-2003-1359: Buffer overflow in stmkfont utility of HP-UX 10.0 through 11.22 allows local users to gain privileges via a long command line argument.
Key phrases: gain privileges, gain privileges via a long command line argument, buffer overflow
CVE-2003-1360: Buffer overflow in the setupterm function of (1) lanadmin and (2) landiag programs of HP-UX 10.0 through 10.34 allows local users to execute arbitrary code via a long TERM environment variable.
Key phrases: execute arbitrary code, execute arbitrary code via a long TERM environment, buffer overflow
CVE-2003-1361: Unknown vulnerability in VERITAS Bare Metal Restore (BMR) of Tivoli Storage Manager (TSM) 3.1.0 through 3.2.1 allows remote attackers to gain root privileges on the BMR Main Server.
Key phrases: gain root privileges, gain root privileges on the BMR Main Server, unknown
CVE-2003-1362: Bastille B.02.00.00 of HP-UX 11.00 and 11.11 does not properly configure the (1) NOVRFY and (2) NOEXPN options in the sendmail.cf file, which could allow remote attackers to verify the existence of system users and expand defined sendmail aliases.
Key phrases: verify the existence of system users and expand
CVE-2003-1363: The remote web management interface of Aprelium Technologies Abyss Web Server 1.1.2 and earlier does not log connection attempts to the web management port (9999), which allows remote attackers to mount brute force attacks on the administration console without detection.
Key phrases: mount brute force attacks on the administration console, connection attempts
CVE-2003-1364: Aprelium Technologies Abyss Web Server 1.1.2, and possibly other versions before 1.1.4, allows remote attackers to cause a denial of service (crash) via an HTTP GET message with empty (1) Connection or (2) Range fields.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2003-1365: The escape_dangerous_chars function in CGI::Lite 2.0 and earlier does not correctly remove special characters including (1) "\\\\" (backslash), (2) "?", (3) "~" (tilde), (4) "^" (carat), (5) newline, or (6) carriage return, which could allow remote attackers to read or write arbitrary files, or execute arbitrary commands, in shell scripts that rely on CGI::Lite to filter such dangerous inputs.
Key phrases: write arbitrary files, read or write arbitrary files, arbitrary commands, dangerous inputs, execute arbitrary
CVE-2003-1366: chpass in OpenBSD 2.0 through 3.2 allows local users to read portions of arbitrary files via a hard link attack on a temporary file used to store user database information.
Key phrases: read portions of arbitrary files via a hard, chpass, hard link
CVE-2003-1367: The which_access variable for Majordomo 2.0 through 1.94.4, and possibly earlier versions, is set to "open" by default, which allows remote attackers to identify the email addresses of members of mailing lists via a "which" command.
Key phrases: identify the email addresses of members of mailing
CVE-2003-1368: Buffer overflow in the 32bit FTP client 9.49.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long FTP server banner.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2003-1369: Buffer overflow in ByteCatcher FTP client 1.04b allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long FTP server banner.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2003-1370: Multiple cross-site scripting (XSS) vulnerabilities in Nuked-Klan 1.2b allow remote attackers to inject arbitrary HTML or web script via (1) the Author field in the Guestbook module, (2) the Titre or Pseudo fields in the Forum module, or (3) "La Tribune Libre" in the Shoutbox module.
Key phrases: inject arbitrary HTML or web, inject arbitrary HTML or web script via (, cross-site scripting (xss)
CVE-2003-1371: Nuked-Klan 1.3b, and possibly earlier versions, allows remote attackers to obtain sensitive server information via an op parameter set to phpinfo for the (1) Team, (2) News, or (3) Liens modules.
Key phrases: obtain sensitive server information, obtain sensitive server information via an op parameter, nuked-klan
CVE-2003-1372: Cross-site scripting (XSS) vulnerability in links.php script in myPHPNuke 1.8.8, and possibly earlier versions, allows remote attackers to inject arbitrary HTML and web script via the (1) ratenum or (2) query parameters.
Key phrases: inject arbitrary HTML, inject arbitrary HTML and web script via the, cross-site scripting (xss)
CVE-2003-1373: Directory traversal vulnerability in auth.php for PhpBB 1.4.0 through 1.4.4 allows remote attackers to read and include arbitrary files via .. (dot dot) sequences followed by NULL (%00) characters in CGI parameters, as demonstrated using the lang parameter in prefs.php.
Key phrases: include arbitrary files, read and include arbitrary files via .. (, directory traversal
CVE-2003-1374: Buffer overflow in disable of HP-UX 11.0 may allow local users to execute arbitrary code via a long argument to the (1) -r or (2)-c options.
Key phrases: execute arbitrary code, execute arbitrary code via a long argument to, buffer overflow
CVE-2003-1375: Buffer overflow in wall for HP-UX 10.20 through 11.11 may allow local users to execute arbitrary code by calling wall with a large file as an argument.
Key phrases: execute arbitrary code, execute arbitrary code by calling wall with a, buffer overflow
CVE-2003-1376: WinZip 8.0 uses weak random number generation for password protected ZIP files, which allows local users to brute force the encryption keys and extract the data from the zip file by guessing the state of the stream coder.
Key phrases: brute force the encryption keys and extract the, weak random number generation
CVE-2003-1377: Buffer overflow in the reverse DNS lookup of Smart IRC Daemon (SIRCD) 0.4.0 and 0.4.4 allows remote attackers to execute arbitrary code via a client with a long hostname.
Key phrases: execute arbitrary code, execute arbitrary code via a client with a, buffer overflow
CVE-2003-1378: Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary programs via an HTML email with the CODEBASE parameter set to the program, a vulnerability similar to CAN-2002-0077.
Key phrases: execute arbitrary programs, execute arbitrary programs via an HTML email with
CVE-2003-1379: clarkconnectd in ClarkConnect Linux 1.2 allows remote attackers to obtain sensitive information about the server via the characters (1) A, which reveals the date and time, (2) F, (3) M, which reveals 'ifconfig' information, (4) P, which lists the processes, (5) Y, which reveals the snort log files, or (6) b, which reveals /var/log/messages.
Key phrases: obtain sensitive information, obtain sensitive information about the server via the
CVE-2003-1380: Directory traversal vulnerability in BisonFTP Server 4 release 2 allows remote attackers to (1) list directories above the root via an 'ls @../' command, or (2) list files above the root via a "mget @../FILE" command.
Key phrases: (1) list directories above the root, directory traversal
CVE-2003-1381: Format string vulnerability in AMX 0.9.2 and earlier, a plugin for Valve Software's Half-Life Server, allows remote attackers to execute arbitrary commands via format string specifiers in the amx_say command.
Key phrases: execute arbitrary commands, execute arbitrary commands via format string specifiers in
CVE-2003-1382: Buffer overflow in ISMail 1.4.3 and earlier allow remote attackers to execute arbitrary code via long domain names in (1) MAIL FROM or (2) RCPT TO fields.
Key phrases: execute arbitrary code, execute arbitrary code via long domain names in, buffer overflow
CVE-2003-1383: WEB-ERP 0.1.4 and earlier allows remote attackers to obtain sensitive information via an HTTP request for the logicworks.ini file, which contains the MySQL database username and password.
Key phrases: obtain sensitive information, obtain sensitive information via an HTTP request for
CVE-2003-1384: Cross-site scripting (XSS) vulnerability in index.php in PY-Livredor 1.0 allows remote attackers to insert arbitrary web script or HTML via the (1) titre, (2) Votre pseudo, (3) Votre e-mail, or (4) Votre message fields.
Key phrases: insert arbitrary web script or HTML, insert arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1385: ipchat.php in Invision Power Board 1.1.1 allows remote attackers to execute arbitrary PHP code, if register_globals is enabled, by modifying the root_path parameter to reference a URL on a remote web server that contains the code.
Key phrases: execute arbitrary PHP code, register_globals
CVE-2003-1386: AXIS 2400 Video Server 2.00 through 2.33 allows remote attackers to obtain sensitive information via an HTTP request to /support/messages, which displays the server's /var/log/messages file.
Key phrases: obtain sensitive information, obtain sensitive information via an HTTP request to
CVE-2003-1387: Buffer overflow in Opera 6.05 and 6.06, and possibly other versions, allows remote attackers to execute arbitrary code via a URL with a long username.
Key phrases: execute arbitrary code, execute arbitrary code via a URL with a, buffer overflow
CVE-2003-1388: Buffer overflow in Opera 7.02 Build 2668 allows remote attackers to crash Opera via a long HTTP request ending in a .ZIP extension.
Key phrases: crash Opera via a long HTTP request ending, buffer overflow
CVE-2003-1389: RTS CryptoBuddy 1.2 and earlier truncates long passphrases without warning the user, which may make it easier to conduct certain brute force guessing attacks.
Key phrases: brute force guessing
CVE-2003-1390: RTS CryptoBuddy 1.2 and earlier stores bytes 53 through 55 of a 55-byte passphrase in plaintext, which makes it easier for local users to guess the passphrase.
Key phrases: plaintext
CVE-2003-1391: RTS CryptoBuddy 1.0 and 1.2 uses a weak encryption algorithm for the passphrase and generates predictable keys, which makes it easier for attackers to guess the passphrase.
Key phrases: predictable keys, weak encryption
CVE-2003-1392: CryptoBuddy 1.0 and 1.2 does not use the user-supplied passphrase to encrypt data, which could allow local users to use their own passphrase to decrypt the data.
Key phrases: use their own passphrase to decrypt the data, local users
CVE-2003-1393: Buffer overflow in Gupta SQLBase 8.1.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long EXECUTE command.
Key phrases: execute arbitrary code, cause a denial of service and possibly execute, buffer overflow, execute commands
CVE-2003-1394: CoffeeCup Software Password Wizard 4.0 stores sensitive information such as usernames and passwords in a .apw file under the web document root with insufficient access control, which allows remote attackers to obtain that information via a direct request for the file.
Key phrases: obtain that information, obtain that information via a direct request for, insufficient access control, sensitive information
CVE-2003-1395: Buffer overflow in KaZaA Media Desktop 2.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a response to the ad server.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2003-1396: Heap-based buffer overflow in Opera 6.05 through 7.10 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a filename with a long extension.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), heap-based buffer overflow, heap based buffer overflow
CVE-2003-1397: The PluginContext object of Opera 6.05 and 7.0 allows remote attackers to cause a denial of service (crash) via an HTTP request containing a long string that gets passed to the ShowDocument method.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2003-1398: Cisco IOS 12.0 through 12.2, when IP routing is disabled, accepts false ICMP redirect messages, which allows remote attackers to cause a denial of service (network routing modification).
Key phrases: denial of service (network routing modification), cause a denial of service (network routing, false icmp redirect messages
CVE-2003-1399: eject 2.0.10, when installed setuid on systems such as SuSE Linux 7.3, generates different error messages depending on whether a specified file exists or not, which allows local users to obtain sensitive information.
Key phrases: obtain sensitive information, setuid
CVE-2003-1400: Cross-site scripting (XSS) vulnerability in the Your_Account module for PHP-Nuke 5.0 through 6.0 allows remote attackers to inject arbitrary web script or HTML via the user_avatar parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1401: login.php in php-Board 1.0 stores plaintext passwords in $username.txt with insufficient access control under the web document root, which allows remote attackers to obtain sensitive information via a direct request.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request, insufficient access control
CVE-2003-1402: PHP remote file inclusion vulnerability in hit.php for Kietu 2.0 and 2.3 allows remote attackers to execute arbitrary PHP code via the url_hit parameter, a different vulnerability than CVE-2006-5015.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the url_hit parameter, php remote file inclusion
CVE-2003-1403: foo.php3 in DotBr 0.1 allows remote attackers to obtain sensitive information via a direct request, which calls the phpinfo function.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request
CVE-2003-1404: DotBr 0.1 stores config.inc with insufficient access control under the web document root, which allows remote attackers to obtain sensitive information such as SQL usernames and passwords.
Key phrases: obtain sensitive information, obtain sensitive information such as SQL usernames and, insufficient access control
CVE-2003-1405: DotBr 0.1 allows remote attackers to execute arbitrary shell commands via the cmd parameter to (1) exec.php3 or (2) system.php3.
Key phrases: execute arbitrary shell commands, execute arbitrary shell commands via the cmd parameter
CVE-2003-1406: PHP remote file inclusion vulnerability in D-Forum 1.00 through 1.11 allows remote attackers to execute arbitrary PHP code via a URL in the (1) my_header parameter to header.php3 or (2) my_footer parameter to footer.php3.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via a URL in, php remote file inclusion, arbitrary php code
CVE-2003-1407: Buffer overflow in cmd.exe in Windows NT 4.0 may allow local users to execute arbitrary code via a long pathname argument to the cd command.
Key phrases: execute arbitrary code, execute arbitrary code via a long pathname argument, buffer overflow
CVE-2003-1408: Lotus Domino Server 5.0 and 6.0 allows remote attackers to read the source code for files via an HTTP request with a filename with a trailing dot.
Key phrases: read the source code for files via an
CVE-2003-1409: TOPo 1.43 allows remote attackers to obtain sensitive information by sending an HTTP request with an invalid parameter to (1) in.php or (2) out.php, which reveals the path to the TOPo directory in the error message.
Key phrases: obtain sensitive information, obtain sensitive information by sending an HTTP request, invalid parameter
CVE-2003-1410: PHP remote file inclusion vulnerability in email.php (aka email.php3) in Cedric Email Reader 0.2 and 0.3 allows remote attackers to execute arbitrary PHP code via the cer_skin parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the cer_skin parameter, php remote file inclusion, arbitrary php code
CVE-2003-1411: PHP remote file inclusion vulnerability in emailreader_execute_on_each_page.inc.php in Cedric Email Reader 0.4 allows remote attackers to execute arbitrary PHP code via the emailreader_ini parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the emailreader_ini parameter, php remote file inclusion, arbitrary php code
CVE-2003-1412: PHP remote file inclusion vulnerability in index.php for GONiCUS System Administrator (GOsa) 1.0 allows remote attackers to execute arbitrary PHP code via the plugin parameter to (1) 3fax/1blocklists/index.php; (2) 6departamentadmin/index.php, (3) 5terminals/index.php, (4) 4mailinglists/index.php, (5) 3departaments/index.php, and (6) 2groupd/index.php in 2administration/; or (7) the base parameter to include/help.php.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the plugin parameter, php remote file inclusion
CVE-2003-1413: parse_xml.cgi in Apple Darwin Streaming Server 4.1.1 allows remote attackers to determine the existence of arbitrary files by using ".." sequences in the filename parameter and comparing the resulting error messages.
Key phrases: determine the existence of arbitrary files by using
CVE-2003-1414: Directory traversal vulnerability in parse_xml.cg Apple Darwin Streaming Server 4.1.2 and Apple Quicktime Streaming Server 4.1.1 allows remote attackers to read arbitrary files via a ... (triple dot) in the filename parameter.
Key phrases: read arbitrary files, read arbitrary files via a ... (triple, directory traversal
CVE-2003-1415: NetCharts XBRL Server 4.0.0 allows remote attackers to obtain sensitive information via an HTTP request with an invalid chunked transfer encoding specification.
Key phrases: obtain sensitive information, obtain sensitive information via an HTTP request with, invalid chunked transfer encoding specification
CVE-2003-1416: BisonFTP Server 4 release 2 allows remote attackers to cause a denial of service (CPU consumption) via a long (1) ls or (2) cwd command.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, cpu consumption
CVE-2003-1417: nCipher Support Software 6.00, when using generatekey KeySafe to import keys, does not delete the temporary copies of the key, which may allow local users to gain access to the key by reading the (1) key.pem or (2) key.der files.
Key phrases: gain access, gain access to the key by reading the, temporary copies
CVE-2003-1418: Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child process IDs (PID).
Key phrases: obtain sensitive information, obtain sensitive information via (1) the, etag header, multipart mime boundary
CVE-2003-1419: Netscape 7.0 allows remote attackers to cause a denial of service (crash) via a web page with an invalid regular expression argument to the JavaScript reformatDate function.
Key phrases: denial of service (crash), cause a denial of service (crash), invalid regular expression argument
CVE-2003-1420: Cross-site scripting (XSS) vulnerability in Opera 6.0 through 7.0 with automatic redirection disabled allows remote attackers to inject arbitrary web script or HTML via the HTTP Location header.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2003-1421: Unspecified vulnerability in mod_mysql_logger shared object in SuckBot 0.006 allows remote attackers to cause a denial of service (seg fault) via unknown attack vectors.
Key phrases: denial of service (seg fault), cause a denial of service (seg fault, unspecified, unknown attack vectors, unspecified vulnerability
CVE-2003-1422: Multiple unspecified vulnerabilities in the installer for SYSLINUX 2.01, when running setuid root, allow local users to gain privileges via unknown vectors.
Key phrases: gain privileges, gain privileges via unknown vectors, multiple unspecified, unspecified vulnerability
CVE-2003-1423: Petitforum stores the liste.txt data file under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as e-mail addresses and encrypted passwords.
Key phrases: obtain sensitive information, obtain sensitive information such as e-mail, insufficient access control
CVE-2003-1424: message.php in Petitforum does not properly authenticate users, which allows remote attackers to impersonate forum users via a modified connect cookie.
Key phrases: impersonate forum users via a modified connect cookie
CVE-2003-1425: guestbook.cgi in cPanel 5.0 allows remote attackers to execute arbitrary commands via the template parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the template parameter
CVE-2003-1426: Openwebmail in cPanel 5.0, when run using suid Perl, adds the directory in the SCRIPT_FILENAME environment variable to Perl's @INC include array, which allows local users to execute arbitrary code by modifying SCRIPT_FILENAME to reference a directory containing a malicious openwebmail-shared.pl executable.
Key phrases: execute arbitrary code, execute arbitrary code by modifying SCRIPT_FILENAME to reference
CVE-2003-1427: Directory traversal vulnerability in the web configuration interface in Netgear FM114P 1.4 allows remote attackers to read arbitrary files, such as the netgear.cfg configuration file, via a hex-encoded (%2e%2e%2f) ../ (dot dot slash) in the port parameter.
Key phrases: read arbitrary files, directory traversal
CVE-2003-1428: Gallery 1.3.3 creates directories with insecure permissions, which allows local users to read, modify, or delete photos.
Key phrases: read, insecure permissions
CVE-2003-1429: Buffer overflow in Proxomitron Naoko 4.4 allows remote attackers to execute arbitrary code via a long request.
Key phrases: execute arbitrary code, execute arbitrary code via a long request, buffer overflow
CVE-2003-1430: Directory traversal vulnerability in Unreal Tournament Server 436 and earlier allows remote attackers to access known files via a ".." (dot dot) in an unreal:// URL.
Key phrases: access known files via a "..", directory traversal
CVE-2003-1431: Buffer overflow in Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of service (crash) via a long host string in the Unreal URL.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow