CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 2 and 2.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
3851 CVE-2003-1233 Bypass 2003-12-31 2017-07-10
2.1
None Local Low Not required None Partial None
Pedestal Software Integrity Protection Driver (IPD) 1.3 and earlier allows privileged attackers, such as rootkits, to bypass file access restrictions to the Windows kernel by using the NtCreateSymbolicLinkObject function to create a symbolic link to (1) \Device\PhysicalMemory or (2) to a drive letter using the subst command.
3852 CVE-2003-1226 2003-12-31 2008-09-10
2.1
None Local Low Not required Partial None None
BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords.
3853 CVE-2003-1225 2003-12-31 2008-09-10
2.1
None Local Low Not required Partial None None
The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords.
3854 CVE-2003-1224 2003-12-31 2008-09-10
2.1
None Local Low Not required Partial None None
Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read a user's password by physically observing ("shoulder surfing") the screen.
3855 CVE-2003-1174 DoS Overflow 2003-12-31 2017-07-10
2.1
None Local Low Not required None None Partial
Buffer overflow in NullSoft Shoutcast Server 1.9.2 allows local users to cause a denial of service via (1) icy-name followed by a long server name or (2) icy-url followed by a long URL.
3856 CVE-2003-1135 DoS Overflow 2003-12-31 2008-09-05
2.6
None Remote High Not required None None Partial
Buffer overflow in Yahoo! Messenger 5.6 allows remote attackers to cause a denial of service (crash) via a file send request (sendfile) with a large number of "%" (percent) characters after the Yahoo ID.
3857 CVE-2003-1134 DoS 2003-12-31 2008-09-05
2.1
None Local Low Not required None None Partial
Sun Java 1.3.1, 1.4.1, and 1.4.2 allows local users to cause a denial of service (JVM crash), possibly by calling the ClassDepth function with a null parameter, which causes a crash instead of generating a null pointer exception.
3858 CVE-2003-1133 2003-12-31 2017-07-10
2.1
None Local Low Not required Partial None None
Rit Research Labs The Bat! 1.0.11 through 2.0 creates new accounts with insecure ACLs, which allows local users to read other users' email messages.
3859 CVE-2003-1129 DoS Exec Code Overflow 2003-12-31 2017-07-10
2.6
None Remote High Not required None None Partial
Buffer overflow in the Yahoo! Audio Conferencing (aka Voice Chat) ActiveX control before 1,0,0,45 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a URL with a long hostname to Yahoo! Messenger or Yahoo! Chat.
3860 CVE-2003-1122 Exec Code 2003-12-31 2017-07-10
2.1
None Local Low Not required None Partial None
ScriptLogic 4.01, and possibly other versions before 4.14, uses insecure permissions for the LOGS$ share, which allows users to modify log records and possibly execute arbitrary code.
3861 CVE-2003-1105 DoS 2003-12-31 2018-10-12
2.6
None Remote High Not required None None Partial
Unknown vulnerability in Internet Explorer 5.01 SP3 through 6.0 SP1 allows remote attackers to cause a denial of service (browser or Outlook Express crash) via HTML with certain input tags that are not properly rendered.
3862 CVE-2003-1099 DoS Exec Code 2003-12-31 2017-10-10
2.1
None Local Low Not required None None Partial
shar on HP-UX B.11.00, B.11.04, and B.11.11 creates temporary files with predictable names in /tmp, which allows local users to cause a denial of service and possibly execute arbitrary code via a symlink attack.
3863 CVE-2003-1077 DoS 2003-03-05 2017-07-10
2.1
None Local Low Not required None None Partial
Unknown vulnerability in UFS for Solaris 9 for SPARC, with logging enabled, allows local users to cause a denial of service (UFS file system hang).
3864 CVE-2003-1072 DoS 2003-04-28 2018-10-30
2.1
None Local Low Not required None None Partial
Memory leak in lofiadm in Solaris 8 allows local users to cause a denial of service (kernel memory consumption).
3865 CVE-2003-1071 2003-01-03 2018-10-30
2.1
None Local Low Not required None Partial None
rpc.walld (wall daemon) for Solaris 2.6 through 9 allows local users to send messages to logged on users that appear to come from arbitrary user IDs by closing stderr before executing wall, then supplying a spoofed from header.
3866 CVE-2003-1065 DoS 2003-07-23 2018-10-30
2.1
None Local Low Not required None None Partial
Unknown vulnerability in patches 108993-14 through 108993-19 and 108994-14 through 108994-19 for Solaris 8 may allow local users to cause a denial of service (automountd crash).
3867 CVE-2003-1040 DoS 2004-04-15 2018-08-13
2.1
None Local Low Not required None None Partial
kmod in the Linux kernel does not set its uid, suid, gid, or sgid to 0, which allows local users to cause a denial of service (crash) by sending certain signals to kmod.
3868 CVE-2003-0956 2003-12-31 2017-07-10
2.6
None Local High Not required Partial Partial None
Multiple race conditions in the handling of O_DIRECT in Linux kernel prior to version 2.4.22 could cause stale data to be returned from the disk when handling sparse files, or cause incorrect data to be returned when a file is truncated as it is being read, which might allow local users to obtain sensitive data that was originally owned by other users, a different vulnerability than CVE-2003-0018.
3869 CVE-2003-0887 2003-12-31 2008-09-05
2.1
None Local Low Not required None Partial None
ez-ipupdate 3.0.11b7 and earlier creates insecure temporary cache files, which allows local users to conduct unauthorized operations via a symlink attack on the ez-ipupdate.cache file.
3870 CVE-2003-0878 2003-11-03 2008-09-05
2.1
None Local Low Not required None Partial None
slpd daemon in Mac OS X before 10.3 allows local users to overwrite arbitrary files via a symlink attack on a temporary file, a different vulnerability than CVE-2003-0875.
3871 CVE-2003-0876 2003-11-03 2017-07-10
2.1
None Local Low Not required None Partial None
Finder in Mac OS X 10.2.8 and earlier sets global read/write/execute permissions on directories when they are dragged (copied) from a mounted volume such as a disk image (DMG), which could cause the directories to have less restrictive permissions than intended.
3872 CVE-2003-0875 2003-11-17 2016-10-17
2.1
None Local Low Not required None Partial None
Symbolic link vulnerability in the slpd script slpd.all_init for OpenSLP before 1.0.11 allows local users to overwrite arbitrary files via the route.check temporary file.
3873 CVE-2003-0872 2003-11-17 2008-09-05
2.1
None Local Low Not required None Partial None
Certain scripts in OpenServer before 5.0.6 allow local users to overwrite files and conduct other unauthorized activities via a symlink attack on temporary files.
3874 CVE-2003-0858 399 DoS 2003-12-15 2017-10-10
2.1
None Local Low Not required None None Partial
Zebra 0.93b and earlier, and quagga before 0.95, allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.
3875 CVE-2003-0854 2003-11-17 2017-10-10
2.1
None Local Low Not required None None Partial
ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via applications that use ls, such as wu-ftpd.
3876 CVE-2003-0844 2003-11-17 2016-10-17
2.1
None Local Low Not required None Partial None
mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode without the Apache log, allows local users to overwrite arbitrary files via (1) a symlink attack on predictable temporary filenames on Unix systems, or (2) an NTFS hard link on Windows systems when the "Strengthen default permissions of internal system objects" policy is not enabled.
3877 CVE-2003-0794 DoS 2003-11-17 2017-07-10
2.1
None Local Low Not required None None Partial
GDM 2.4.4.x before 2.4.4.4, and 2.4.1.x before 2.4.1.7, does not limit the number or duration of commands and uses a blocking socket connection, which allows attackers to cause a denial of service (resource exhaustion) by sending commands and not reading the results.
3878 CVE-2003-0793 DoS 2003-11-17 2017-07-10
2.1
None Local Low Not required None None Partial
GDM 2.4.4.x before 2.4.4.4, and 2.4.1.x before 2.4.1.7, does not restrict the size of input, which allows attackers to cause a denial of service (memory consumption).
3879 CVE-2003-0727 DoS Overflow 2003-10-20 2017-09-27
2.1
None Local Low Not required None None Partial
Multiple buffer overflows in the XML Database (XDB) functionality for Oracle 9i Database Release 2 allow local users to cause a denial of service or hijack user sessions.
3880 CVE-2003-0679 2003-08-27 2008-09-10
2.1
None Local Low Not required None Partial None
Unknown vulnerability in the libcpr library for the Checkpoint/Restart (cpr) system on SGI IRIX 6.5.21f and earlier allows local users to truncate or overwrite certain files.
3881 CVE-2003-0670 2003-08-27 2008-09-10
2.1
None Local Low Not required Partial None None
Sustworks IPNetSentryX and IPNetMonitorX allow local users to sniff network packets via the setuid helper applications (1) RunTCPDump, which calls tcpdump, and (2) RunTCPFlow, which calls tcpflow.
3882 CVE-2003-0656 2003-08-27 2016-10-17
2.1
None Local Low Not required None Partial None
eroaster before 2.2.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary file that is used as a lockfile.
3883 CVE-2003-0643 DoS 2003-07-25 2008-09-10
2.1
None Local Low Not required None None Partial
Integer signedness error in the Linux Socket Filter implementation (filter.c) in Linux 2.4.3-pre3 to 2.4.22-pre10 allows attackers to cause a denial of service (crash).
3884 CVE-2003-0642 2003-08-27 2017-07-10
2.1
None Local Low Not required Partial None None
WatchGuard ServerLock for Windows 2000 before SL 2.0.4 allows local users to access kernel memory via a symlink attack on \Device\PhysicalMemory.
3885 CVE-2003-0618 +Info 2004-05-04 2017-07-10
2.1
None Local Low Not required Partial None None
Multiple vulnerabilities in suidperl 5.6.1 and earlier allow a local user to obtain sensitive information about files for which the user does not have appropriate permissions.
3886 CVE-2003-0603 2003-08-27 2008-09-05
2.1
None Local Low Not required None Partial None
Bugzilla 2.16.x before 2.16.3, 2.17.x before 2.17.4, and earlier versions allows local users to overwrite arbitrary files via a symlink attack on temporary files that are created in directories with group-writable or world-writable permissions.
3887 CVE-2003-0547 2003-08-27 2017-10-10
2.1
None Local Low Not required Partial None None
GDM before 2.4.1.6, when using the "examine session errors" feature, allows local users to read arbitrary files via a symlink attack on the ~/.xsession-errors file.
3888 CVE-2003-0517 2003-08-18 2008-09-05
2.1
None Local Low Not required None Partial None
faxrunqd.in in mgetty 1.1.28 and earlier allows local users to overwrite files via a symlink attack on JOB files.
3889 CVE-2003-0501 +Info 2003-08-07 2018-05-02
2.1
None Local Low Not required Partial None None
The /proc filesystem in Linux allows local users to obtain sensitive information by opening various entries in /proc/self before executing a setuid program, which causes the program to fail to change the ownership and permissions of those entries.
3890 CVE-2003-0476 2003-08-07 2018-05-02
2.1
None Local Low Not required Partial None None
The execve system call in Linux 2.4.x records the file descriptor of the executable process in the file table of the calling process, which allows local users to gain read access to restricted file descriptors.
3891 CVE-2003-0461 +Info 2003-08-27 2017-10-10
2.1
None Local Low Not required Partial None None
/proc/tty/driver/serial in Linux 2.4.x reveals the exact number of characters used in serial links, which could allow local users to obtain potentially sensitive information such as the length of passwords.
3892 CVE-2003-0381 2003-07-24 2008-09-05
2.1
None Local Low Not required None Partial None
Multiple vulnerabilities in noweb 2.9 and earlier creates temporary files insecurely, which allows local users to overwrite arbitrary files via multiple vectors including the noroff script.
3893 CVE-2003-0367 2003-07-02 2008-09-10
2.1
None Local Low Not required None Partial None
znew in the gzip package allows local users to overwrite arbitrary files via a symlink attack on temporary files.
3894 CVE-2003-0334 DoS 2003-05-10 2017-07-10
2.1
None Local Low Not required None None Partial
BitchX IRC client 1.0c20cvs and earlier allows attackers to cause a denial of service (core dump) via certain channel mode changes that are not properly handled in names.c.
3895 CVE-2003-0282 Dir. Trav. 2003-06-16 2017-10-10
2.6
None Remote High Not required None Partial None
Directory traversal vulnerability in UnZip 5.50 allows attackers to overwrite arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence.
3896 CVE-2003-0279 Sql 2003-06-16 2017-07-10
2.6
None Remote High Not required Partial None None
Multiple SQL injection vulnerabilities in the Web_Links module for PHP-Nuke 5.x through 6.5 allows remote attackers to steal sensitive information via numeric fields, as demonstrated using (1) the viewlink function and cid parameter, or (2) index.php.
3897 CVE-2003-0207 2003-05-05 2008-09-10
2.1
None Local Low Not required None Partial None
ps2epsi creates insecure temporary files when calling ghostscript, which allows local attackers to overwrite arbitrary files.
3898 CVE-2003-0193 2004-08-18 2017-07-10
2.1
None Local Low Not required None Partial None
msxlsview.sh in xlsview for catdoc 0.91 and earlier allows local users to overwrite arbitrary files via a symlink attack on predictable temporary file names ("word$$.html").
3899 CVE-2003-0175 DoS 2004-02-03 2017-07-10
2.1
None Local Low Not required None None Partial
SGI IRIX before 6.5.21 allows local users to cause a denial of service (kernel panic) via a certain call to the PIOCSWATCH ioctl.
3900 CVE-2003-0136 2003-05-05 2017-10-10
2.1
None Local Low Not required None Partial None
psbanner in the LPRng package allows local users to overwrite arbitrary files via a symbolic link attack on the /tmp/before file.
Total number of vulnerabilities : 4392   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 (This Page)79 80 81 82 83 84 85 86 87 88
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.