CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 5 and 5.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
18951 CVE-2003-1269 2003-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
AN HTTP 1.41e allows remote attackers to obtain the root web server path via an HTTP request with a long argument to a script, which leaks the path in an error message.
18952 CVE-2003-1267 DoS 2003-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
GuildFTPd 0.999 allows remote attackers to cause a denial of service (crash) via a GET request for MS-DOS device names such as lpt1.
18953 CVE-2003-1266 DoS 2003-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
The (1) FTP, (2) POP3, (3) SMTP, and (4) NNTP servers in EServer 2.92 through 2.97, and possibly 2.98, allow remote attackers to cause a denial of service (crash) via a large amount of data.
18954 CVE-2003-1264 +Priv 2003-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
TFTP server in Longshine Wireless Access Point (WAP) LCS-883R-AC-B, and in D-Link DI-614+ 2.0 which is based on it, allows remote attackers to obtain the WEP secret and gain administrator privileges by downloading the configuration file (config.img) and other files without authentication.
18955 CVE-2003-1263 DoS 2003-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
ICAL.EXE in iCal 3.7 allows remote attackers to cause a denial of service (crash) via a malformed HTTP request, possibly due to an invalid method name.
18956 CVE-2003-1257 +Info 2003-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
find_theni_home.php in E-theni allows remote attackers to obtain sensitive system information via a URL request which executes phpinfo.
18957 CVE-2003-1254 Exec Code 2003-12-31 2008-09-05
5.0
 None Remote Low Not required None Partial None
Active PHP Bookmarks (APB) 1.1.01 allows remote attackers to execute arbitrary PHP code via (1) head.php, (2) apb_common.php, or (3) apb_view_class.php by modifying the APB_SETTINGS parameter to reference a URL on a remote web server that contains the code.
18958 CVE-2003-1250 DoS 2003-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
Efficient Networks 5861 DSL router, when running firmware 5.3.80 configured to block incoming TCP SYN, packets allows remote attackers to cause a denial of service (crash) via a flood of TCP SYN packets to the WAN interface using a port scanner such as nmap.
18959 CVE-2003-1242 2003-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Sage 1.0 b3 allows remote attackers to obtain the root web server path via a URL request for a non-existent module, which returns the path in an error message.
18960 CVE-2003-1239 Dir. Trav. 2003-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in sendphoto.php in WihPhoto 0.86 allows remote attackers to read arbitrary files via .. specifiers in the album parameter, and the target filename in the pic parameter.
18961 CVE-2003-1238 XSS 2003-12-31 2008-09-05
5.8
 None Remote Medium Not required Partial Partial None
Cross-site scripting vulnerability (XSS) in Nuked-Klan 1.3 beta and earlier allows remote attackers to steal authentication information via cookies by injecting arbitrary HTML or script into op of the (1) Team, (2) News, and (3) Liens modules.
18962 CVE-2003-1235 +Info 2003-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
BRW WebWeaver 1.03 allows remote attackers to obtain sensitive server environment information via a URL request for testcgi.exe, which lists the values of environment variables and the current working directory.
18963 CVE-2003-1232 Exec Code 2003-12-31 2010-04-02
5.1
 User Remote High Not required Partial Partial Partial
Emacs 21.2.1 does not prompt or warn the user before executing Lisp code in the local variables section of a text file, which allows user-assisted attackers to execute arbitrary commands, as demonstrated using the mode-name variable.
18964 CVE-2003-1223 DoS 2003-12-31 2008-09-10
5.0
 None Remote Low Not required None None Partial
The Node Manager for BEA WebLogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (Node Manager crash) via malformed data to the Node Manager's port, as demonstrated by nmap.
18965 CVE-2003-1222 2003-12-31 2008-09-10
5.0
 None Remote Low Not required Partial None None
BEA Weblogic Express and Server 8.0 through 8.1 SP 1, when using a foreign Java Message Service (JMS) provider, echoes the password for the foreign provider to the console and stores it in cleartext in config.xml, which could allow attackers to obtain the password.
18966 CVE-2003-1221 2003-12-31 2008-09-10
5.0
 None Remote Low Not required None Partial None
BEA WebLogic Express and Server 7.0 through 8.1 SP 1, under certain circumstances when a request to use T3 over SSL (t3s) is made to the insecure T3 port, may use a non-SSL connection for the communication, which could allow attackers to sniff sessions.
18967 CVE-2003-1220 DoS 2003-12-31 2008-09-10
5.0
 None Remote Low Not required None None Partial
BEA WebLogic Server proxy plugin for BEA Weblogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (proxy plugin crash) via a malformed URL.
18968 CVE-2003-1209 20 DoS 2003-12-31 2017-07-10
5.0
 None Remote Low Not required None None Partial
The Post_Method function in Monkey HTTP Daemon before 0.6.2 allows remote attackers to cause a denial of service (crash) via a POST request without a Content-Type header.
18969 CVE-2003-1207 DoS 2004-02-01 2017-07-10
5.0
 None Remote Low Not required None None Partial
Crob FTP Server 3.5.1 allows remote authenticated users to cause a denial of service (crash) via a dir command with a large number of "." characters followed by a "/*" string.
18970 CVE-2003-1206 DoS 2003-06-03 2017-07-10
5.0
 None Remote Low Not required None None Partial
Format string vulnerability in Crob FTP Server 2.60.1 allows remote attackers to cause a denial of service (crash) via "%s" or "%n" sequences in (1) the username during login, or other FTP commands such as (2) dir.
18971 CVE-2003-1205 DoS 2003-08-06 2017-07-10
5.0
 None Remote Low Not required None None Partial
Crob FTP Server 2.60.1 allows remote authenticated users to cause a denial of service (crash) by renaming a file to the "con" MS-DOS device name.
18972 CVE-2003-1201 DoS 2003-03-20 2017-07-10
5.0
 None Remote Low Not required None None Partial
ldbm_back_exop_passwd in the back-ldbm backend in passwd.c for OpenLDAP 2.1.12 and earlier, when the slap_passwd_parse function does not return LDAP_SUCCESS, attempts to free an uninitialized pointer, which allows remote attackers to cause a denial of service (segmentation fault).
18973 CVE-2003-1198 DoS 2003-12-26 2017-07-10
5.0
 None Remote Low Not required None None Partial
connection.c in Cherokee web server before 0.4.6 allows remote attackers to cause a denial of service via an HTTP POST request without a Content-Length header field.
18974 CVE-2003-1191 DoS 2003-10-29 2017-07-10
5.0
 None Remote Low Not required None None Partial
chatbox.php in e107 0.554 and 0.603 allows remote attackers to cause a denial of service (pages fail to load) via HTML in the Name field, which prevents the main.php form from being loaded.
18975 CVE-2003-1189 DoS 2003-10-29 2017-07-10
5.0
 None Remote Low Not required None None Partial
Unknown vulnerability in Nokia IPSO 3.7, configured as IP Clusters, allows remote attackers to cause a denial of service via unknown attack vectors.
18976 CVE-2003-1188 DoS 2003-11-02 2017-07-10
5.0
 None Remote Low Not required None None Partial
Unichat allows remote attackers to cause a denial of service (crash) by adding extra chat characters (avatars) and logging in to a chat room, as demonstrated using duplicate ACTOR entries in u2res000.rit.
18977 CVE-2003-1181 +Info 2003-10-25 2017-07-10
5.0
 None Remote Low Not required Partial None None
Advanced Poll 2.0.2 allows remote attackers to obtain sensitive information via an HTTP request to info.php, which invokes the phpinfo() function.
18978 CVE-2003-1173 2003-12-31 2017-07-10
5.0
 None Remote Low Not required Partial None None
Centrinity FirstClass 7.1 allows remote attackers to access sensitive information by appending search to the end of the URL and checking all of the search option checkboxes and leaving the text field blank, which will return all files in the searched directory.
18979 CVE-2003-1172 Dir. Trav. 2003-12-31 2017-07-10
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoon 2.1 and 2.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the filename parameter.
18980 CVE-2003-1168 +Info 2003-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
HTTP Commander 4.0 allows remote attackers to obtain sensitive information via an HTTP request that contains a . (dot) in the file parameter, which reveals the installation path in an error message.
18981 CVE-2003-1166 Dir. Trav. 2003-12-31 2017-07-10
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in (1) Openfile.aspx and (2) Html.aspx in HTTP Commander 4.0 allows remote attackers to view arbitrary files via a .. (dot dot) in the file parameter.
18982 CVE-2003-1165 DoS Exec Code Overflow 2003-12-31 2017-07-10
5.0
 None Remote Low Not required None None Partial
Buffer overflow in BRS WebWeaver 1.06 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP request with a long User-Agent header.
18983 CVE-2003-1163 DoS 2003-12-31 2017-07-10
5.0
 None Remote Low Not required None None Partial
hash.c in Ganglia gmond 2.5.3 allows remote attackers to cause a denial of service (segmentation fault) via a UDP packet that contains a single-byte name string, which is used as an out-of-bounds array index.
18984 CVE-2003-1162 2003-12-31 2017-07-10
5.0
 None Remote Low Not required Partial None None
index.php in Tritanium Bulletin Board 1.2.3 allows remote attackers to read and reply to arbitrary messages by modifying the thread_id, forum_id, and sid parameters.
18985 CVE-2003-1159 DoS 2003-10-31 2017-07-10
5.0
 None Remote Low Not required None None Partial
Plug and Play Web Server Proxy 1.0002c allows remote attackers to cause a denial of service (server crash) via an invalid URI in an HTTP GET request to TCP port 8080.
18986 CVE-2003-1158 DoS Overflow 2003-12-31 2017-07-10
5.0
 None Remote Low Not required None None Partial
Multiple buffer overflows in the FTP service in Plug and Play Web Server 1.0002c allow remote attackers to cause a denial of service (crash) via long (1) dir, (2) ls, (3) delete, (4) mkdir, (5) DELE, (6) RMD, or (7) MKD commands.
18987 CVE-2003-1153 2003-12-31 2017-07-10
5.0
 None Remote Low Not required Partial None None
byteHoard 0.7 and 0.71 allows remote attackers to list arbitrary files and directories via a direct request to files.inc.php.
18988 CVE-2003-1152 2003-12-31 2017-07-10
5.0
 None Remote Low Not required Partial None None
WebTide 7.04 allows remote attackers to list arbitrary directories via an HTTP request for %3f.jsp (encoded "?").
18989 CVE-2003-1139 2003-10-27 2017-07-10
5.0
 None Remote Low Not required None Partial None
Musicqueue 1.2.0 allows local users to overwrite arbitrary files by triggering a segmentation fault and using a symlink attack on the resulting musicqueue.crash file.
18990 CVE-2003-1138 2003-10-27 2008-09-05
5.0
 None Remote Low Not required Partial None None
The default configuration of Apache 2.0.40, as shipped with Red Hat Linux 9.0, allows remote attackers to list directory contents, even if auto indexing is turned off and there is a default web page configured, via a GET request containing a double slash (//).
18991 CVE-2003-1137 2003-10-27 2017-07-10
5.0
 None Remote Low Not required Partial None None
Charles Steinkuehler sh-httpd 0.3 and 0.4 allows remote attackers to read files or execute arbitrary CGI scripts via a GET request that contains an asterisk (*) wildcard character.
18992 CVE-2003-1132 DoS 2003-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
The DNS server for Cisco Content Service Switch (CSS) 11000 and 11500, when prompted for a nonexistent AAAA record, responds with response code 3 (NXDOMAIN or "Name Error") instead of response code 0 ("No Error"), which allows remote attackers to cause a denial of service (inaccessible domain) by forcing other DNS servers to send and cache a request for a AAAA record to the vulnerable server.
18993 CVE-2003-1127 Bypass 2003-12-31 2017-07-10
5.0
 None Remote Low Not required Partial None None
Whale Communications e-Gap 2.5 on Windows 2000 allows remote attackers to obtain the source code for the login page via the HTTP TRACE method, which bypasses the preprocessor.
18994 CVE-2003-1126 DoS 2003-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
Unknown vulnerability in SunOne/iPlanet Web Server SP3 through SP5 on Windows platforms allows remote attackers to cause a denial of service.
18995 CVE-2003-1125 DoS 2003-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
Unknown vulnerability in ns-ldapd for Sun ONE Directory Server 4.16, 5.0, and 5.1 allows LDAP clients to cause a denial of service (service halt).
18996 CVE-2003-1119 DoS 2003-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
SSH Secure Shell before 3.2.9 allows remote attackers to cause a denial of service via malformed BER/DER packets.
18997 CVE-2003-1116 Bypass +Info 2003-12-31 2017-07-10
5.0
 None Remote Low Not required Partial None None
The communications protocol for the Report Review Agent (RRA), aka FND File Server (FNDFS) program, in Oracle E-Business Suite 10.7, 11.0, and 11.5.1 to 11.5.8 allows remote attackers to bypass authentication and obtain sensitive information from the Oracle Applications Concurrent Manager by spoofing requests to the TNS Listener.
18998 CVE-2003-1108 DoS Exec Code 2003-12-31 2017-10-10
5.0
 None Remote Low Not required None None Partial
The Session Initiation Protocol (SIP) implementation in Alcatel OmniPCX Enterprise 5.0 Lx allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite.
18999 CVE-2003-1107 Bypass 2003-12-31 2017-07-10
5.1
 None Remote High Not required Partial Partial Partial
The DHTML capability in Microsoft Windows Media Player (WMP) 6.4, 7.0, 7.1, and 9 may run certain URL commands from a security zone that is less trusted than the current zone, which allows attackers to bypass intended access restrictions.
19000 CVE-2003-1106 DoS 2003-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
The SMTP service in Microsoft Windows 2000 before SP4 allows remote attackers to cause a denial of service (crash or hang) via an e-mail message with a malformed time stamp in the FILETIME attribute.
Total number of vulnerabilities : 21278   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 (This Page)381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.