CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2003

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
101 CVE-2003-0532 Exec Code 2003-08-27 2021-07-23
7.5
 None Remote Low Not required Partial Partial Partial
Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type, aka the "Object Type" vulnerability.
102 CVE-2003-0531 2003-08-27 2021-07-23
7.5
 None Remote Low Not required Partial Partial Partial
Internet Explorer 5.01 SP3 through 6.0 SP1 allows remote attackers to access and execute script in the My Computer domain using the browser cache via crafted Content-Type and Content-Disposition headers, aka the "Browser Cache Script Execution in My Computer Zone" vulnerability.
103 CVE-2003-0530 Exec Code Overflow 2003-08-27 2021-07-23
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the BR549.DLL ActiveX control for Internet Explorer 5.01 SP3 through 6.0 SP1 allows remote attackers to execute arbitrary code.
104 CVE-2003-0526 XSS 2003-08-18 2018-10-12
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to inject arbitrary web script via a URL containing the script in the domain name portion, which is not properly cleansed in the default error pages (1) 500.htm for "500 Internal Server error" or (2) 404.htm for "404 Not Found."
105 CVE-2003-0525 DoS Mem. Corr. 2003-08-27 2018-10-12
5.0
 None Remote Low Not required None None Partial
The getCanonicalPath function in Windows NT 4.0 may free memory that it does not own and cause heap corruption, which allows attackers to cause a denial of service (crash) via requests that cause a long file name to be passed to getCanonicalPath, as demonstrated on the IBM JVM using a long string to the java.io.getCanonicalPath Java method.
106 CVE-2003-0524 2003-08-18 2016-10-18
6.2
 None Local High Not required Complete Complete Complete
Qt in Knoppix 3.1 Live CD allows local users to overwrite arbitrary files via a symlink attack on the qt_plugins_3.0rc temporary file in the .qt directory.
107 CVE-2003-0523 XSS 2003-08-18 2016-10-18
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in msg.asp for certain versions of ProductCart allow remote attackers to execute arbitrary web script via the message parameter.
108 CVE-2003-0522 +Priv Sql 2003-08-18 2016-10-18
10.0
 None Remote Low Not required Complete Complete Complete
Multiple SQL injection vulnerabilities in ProductCart 1.5 through 2 allow remote attackers to (1) gain access to the admin control panel via the idadmin parameter to login.asp or (2) gain other privileges via the Email parameter to Custva.asp.
109 CVE-2003-0521 +Priv XSS 2003-08-18 2016-10-18
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in cPanel 6.4.2 allows remote attackers to insert arbitrary HTML and possibly gain cPanel administrator privileges via script in a URL that is logged but not properly quoted when displayed via the (1) Error Log or (2) Latest Visitors screens.
110 CVE-2003-0520 DoS 2003-08-18 2016-10-18
5.0
 None Remote Low Not required None None Partial
Trillian 1.0 Pro and 0.74 Freeware allows remote attackers to cause a denial of service (crash) via a TypingUser message in which the "TypingUser" string has been modified.
111 CVE-2003-0519 DoS 2003-08-18 2021-07-23
5.0
 None Remote Low Not required None None Partial
Certain versions of Internet Explorer 5 and 6, in certain Windows environments, allow remote attackers to cause a denial of service (freeze) via a URL to C:\aux (MS-DOS device name) and possibly other devices.
112 CVE-2003-0518 Overflow 2003-08-18 2008-09-10
4.6
 None Local Low Not required Partial Partial Partial
The screen saver in MacOS X allows users with physical access to cause the screen saver to crash and gain access to the underlying session via a large number of characters in the password field, possibly triggering a buffer overflow.
113 CVE-2003-0517 2003-08-18 2008-09-05
2.1
 None Local Low Not required None Partial None
faxrunqd.in in mgetty 1.1.28 and earlier allows local users to overwrite files via a symlink attack on JOB files.
114 CVE-2003-0516 Exec Code 2003-08-18 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
cnd.c in mgetty 1.1.28 and earlier does not properly filter non-printable characters and quotes, which may allow remote attackers to execute arbitrary commands via shell metacharacters in (1) caller ID or (2) caller name strings.
115 CVE-2003-0515 +Priv Sql 2003-08-18 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerabilities in the (1) PostgreSQL or (2) MySQL authentication modules for teapop 0.3.5 and earlier allow attackers to execute arbitrary SQL and possibly gain privileges.
116 CVE-2003-0512 310 2003-08-27 2017-10-11
5.0
 None Remote Low Not required Partial None None
Cisco IOS 12.2 and earlier generates a "% Login invalid" message instead of prompting for a password when an invalid username is provided, which allows remote attackers to identify valid usernames on the system and conduct brute force password guessing, as reported for the Aironet Bridge.
117 CVE-2003-0511 DoS 2003-08-27 2017-10-11
5.0
 None Remote Low Not required None None Partial
The web server for Cisco Aironet AP1x00 Series Wireless devices running certain versions of IOS 12.2 allow remote attackers to cause a denial of service (reload) via a malformed URL.
118 CVE-2003-0510 Exec Code 2003-08-07 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Format string vulnerability in ezbounce 1.0 through 1.50 allows remote attackers to execute arbitrary code via the "sessions" command.
119 CVE-2003-0509 +Priv Sql 2003-08-07 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
SQL injection vulnerability in Cyberstrong eShop 4.2 and earlier allows remote attackers to steal authentication information and gain privileges via the ProductCode parameter in (1) 10expand.asp, (2) 10browse.asp, and (3) 20review.asp.
120 CVE-2003-0508 Exec Code Overflow 2003-08-07 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the WWWLaunchNetscape function of Adobe Acrobat Reader (acroread) 5.0.7 and earlier allows remote attackers to execute arbitrary code via a .pdf file with a long mailto link.
121 CVE-2003-0507 DoS Exec Code Overflow 2003-08-07 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in Active Directory in Windows 2000 before SP4 allows remote attackers to cause a denial of service (reboot) and possibly execute arbitrary code via an LDAP version 3 search request with a large number of (1) "AND," (2) "OR," and possibly other statements, which causes LSASS.EXE to crash.
122 CVE-2003-0506 DoS 2003-08-07 2016-10-18
5.0
 None Remote Low Not required None None Partial
Microsoft NetMeeting 3.01 2000 before SP4 allows remote attackers to cause a denial of service (shutdown of NetMeeting conference) via malformed packets, as demonstrated via the chat conversation.
123 CVE-2003-0505 Dir. Trav. 2003-08-07 2016-10-18
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in Microsoft NetMeeting 3.01 2000 before SP4 allows remote attackers to read arbitrary files via "..\.." (dot dot) sequences in a file transfer request.
124 CVE-2003-0504 XSS 2003-08-07 2016-10-18
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Phpgroupware 0.9.14.003 (aka webdistro) allow remote attackers to insert arbitrary HTML or web script, as demonstrated with a request to index.php in the addressbook module.
125 CVE-2003-0503 DoS Exec Code Overflow 2003-08-07 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the ShellExecute API function of SHELL32.DLL in Windows 2000 before SP4 may allow attackers to cause a denial of service or execute arbitrary code via a long third argument.
126 CVE-2003-0502 DoS 2003-08-27 2011-03-08
10.0
 None Remote Low Not required Complete Complete Complete
Apple QuickTime / Darwin Streaming Server before 4.1.3g allows remote attackers to cause a denial of service (crash) via a .. (dot dot) sequence followed by an MS-DOS device name (e.g. AUX) in a request to HTTP port 1220, a different vulnerability than CVE-2003-0421.
127 CVE-2003-0501 +Info 2003-08-07 2018-05-03
2.1
 None Local Low Not required Partial None None
The /proc filesystem in Linux allows local users to obtain sensitive information by opening various entries in /proc/self before executing a setuid program, which causes the program to fail to change the ownership and permissions of those entries.
128 CVE-2003-0500 +Priv Sql Bypass 2003-08-07 2008-09-05
10.0
 None Remote Low Not required Complete Complete Complete
SQL injection vulnerability in the PostgreSQL authentication module (mod_sql_postgres) for ProFTPD before 1.2.9rc1 allows remote attackers to execute arbitrary SQL and gain privileges by bypassing authentication or stealing passwords via the USER name.
129 CVE-2003-0499 2003-08-07 2016-12-08
3.6
 None Local Low Not required Partial Partial None
Mantis 0.17.5 and earlier stores its database password in cleartext in a world-readable configuration file, which allows local users to perform unauthorized database operations.
130 CVE-2003-0498 94 Exec Code 2003-08-07 2020-02-10
7.2
 None Local Low Not required Complete Complete Complete
Caché Database 5.x installs the /cachesys/csp directory with insecure permissions, which allows local users to execute arbitrary code by adding server-side scripts that are executed with root privileges.
131 CVE-2003-0497 264 +Priv 2003-08-07 2020-02-10
7.2
 None Local Low Not required Complete Complete Complete
Caché Database 5.x installs /cachesys/bin/cache with world-writable permissions, which allows local users to gain privileges by modifying cache and executing it via cuxs.
132 CVE-2003-0496 +Priv 2003-08-18 2019-04-30
7.2
 None Local Low Not required Complete Complete Complete
Microsoft SQL Server before Windows 2000 SP4 allows local users to gain privileges as the SQL Server user by calling the xp_fileexist extended stored procedure with a named pipe as an argument instead of a normal file.
133 CVE-2003-0495 XSS 2003-08-07 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in LedNews 0.7 allows remote attackers to insert arbitrary web script via a news item.
134 CVE-2003-0494 +Priv 2003-08-07 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
password.asp in Snitz Forums 3.4.03 and earlier allows remote attackers to reset passwords and gain privileges as other users by via a direct request to password.asp with a modified member id.
135 CVE-2003-0493 +Priv 2003-08-07 2016-10-18
10.0
 None Remote Low Not required Complete Complete Complete
Snitz Forums 3.4.03 and earlier allows attackers to gain privileges as other users by stealing and replaying the encrypted password after obtaining a valid session ID.
136 CVE-2003-0492 XSS 2003-08-07 2017-07-11
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in search.asp for Snitz Forums 3.4.03 and earlier allows remote attackers to execute arbitrary web script via the Search parameter.
137 CVE-2003-0491 Exec Code 2003-08-07 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
The Tutorials 2.0 module in XOOPS and E-XOOPS allows remote attackers to execute arbitrary code by uploading a PHP file without a MIME image type, then directly accessing the uploaded file.
138 CVE-2003-0490 +Priv 2003-08-07 2016-10-18
7.2
 None Local Low Not required Complete Complete Complete
The installation of Dantz Retrospect Client 5.0.540 on MacOS X 10.2.6, and possibly other versions, creates critical directories and files with world-writable permissions, which allows local users to gain privileges as other users by replacing programs with malicious code.
139 CVE-2003-0489 +Priv 2003-08-07 2008-09-05
7.2
 None Local Low Not required Complete Complete Complete
tcptraceroute 1.4 and earlier does not fully drop privileges after obtaining a file descriptor for capturing packets, which may allow local users to gain access to the descriptor via a separate vulnerability in tcptraceroute.
140 CVE-2003-0488 XSS 2003-08-07 2017-07-11
5.1
 None Remote High Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in Kerio MailServer 5.6.3 allow remote attackers to insert arbitrary web script via (1) the add_name parameter in the add_acl module, or (2) the alias parameter in the do_map module.
141 CVE-2003-0487 DoS Exec Code Overflow 2003-08-07 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in Kerio MailServer 5.6.3 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code via (1) a long showuser parameter in the do_subscribe module, (2) a long folder parameter in the add_acl module, (3) a long folder parameter in the list module, and (4) a long user parameter in the do_map module.
142 CVE-2003-0486 Sql 2003-08-07 2017-07-11
5.0
 None Remote Low Not required Partial None None
SQL injection vulnerability in viewtopic.php for phpBB 2.0.5 and earlier allows remote attackers to steal password hashes via the topic_id parameter.
143 CVE-2003-0485 Exec Code Overflow 2003-08-07 2016-10-18
4.6
 None Local Low Not required Partial Partial Partial
Buffer overflow in Progress 4GL Compiler 9.1D06 and earlier allows attackers to execute arbitrary code via source code containing a long, invalid data type.
144 CVE-2003-0484 XSS 2003-08-07 2016-10-18
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in viewtopic.php for phpBB allows remote attackers to insert arbitrary web script via the topic_id parameter.
145 CVE-2003-0483 XSS 2003-08-07 2021-04-29
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerabilities in XMB Forum 1.8 Partagium allow remote attackers to insert arbitrary script via (1) the member parameter to member.php or (2) the action parameter to buddy.php.
146 CVE-2003-0482 Exec Code 2003-08-07 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
TUTOS 1.1 allows remote attackers to execute arbitrary code by uploading the code using file_new.php, then directly accessing the uploaded code via a request to the repository containing the code.
147 CVE-2003-0481 XSS 2003-08-07 2016-10-18
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in TUTOS 1.1 allow remote attackers to insert arbitrary web script, as demonstrated using the msg parameter to file_select.php.
148 CVE-2003-0480 +Priv 2003-08-07 2016-10-18
3.7
 None Local High Not required Partial Partial Partial
VMware Workstation 4.0 for Linux allows local users to overwrite arbitrary files and gain privileges via "symlink manipulation."
149 CVE-2003-0479 XSS 2003-08-07 2016-10-18
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the guestbook for WebBBS allows remote attackers to insert arbitrary web script via the (1) Name, (2) Email, or (3) Message fields.
150 CVE-2003-0478 DoS Exec Code 2003-08-07 2016-10-18
10.0
 None Remote Low Not required Complete Complete Complete
Format string vulnerability in (1) Bahamut IRCd 1.4.35 and earlier, and other IRC daemons based on Bahamut including (2) digatech 1.2.1, (3) methane 0.1.1, (4) AndromedeIRCd 1.2.3-Release, and (5) ircd-RU, when running in debug mode, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a request containing format strings.
Total number of vulnerabilities : 205   Page : 1 2 3 (This Page)4 5
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.