CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In November 2003

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2001-1411 +Priv 2003-11-17 2016-10-18
7.2
 None Local Low Not required Complete Complete Complete
Format string vulnerability in gm4 (aka m4) on Mac OS X may allow local users to gain privileges if gm4 is called by setuid programs.
2 CVE-2001-1412 2003-11-17 2016-10-18
2.1
 None Local Low Not required Partial None None
nidump on MacOS X before 10.3 allows local users to read the encrypted passwords from the password file by specifying passwd as a command line argument.
3 CVE-2002-1568 DoS Overflow 2003-11-17 2016-10-18
5.0
 None Remote Low Not required None None Partial
OpenSSL 0.9.6e uses assertions when detecting buffer overflow attacks instead of less severe mechanisms, which allows remote attackers to cause a denial of service (crash) via certain messages that cause OpenSSL to abort from a failed assertion, as demonstrated using SSLv2 CLIENT_MASTER_KEY messages, which are not properly handled in s2_srvr.c.
4 CVE-2002-1569 Exec Code 2003-11-17 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
gv 3.5.8, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the filename for (1) a PDF file or (2) a gzip file.
5 CVE-2002-1570 Exec Code Overflow 2003-11-03 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in snmpnetstat for ucd-snmp 4.2.3 and earlier, and net-snmp, allows remote attackers to execute arbitrary code via multiple getnextrequest PDU messages with conflicting ifindex variables, which cause snmpnetstat to write variable data past the end of an array.
6 CVE-2003-0542 119 DoS Exec Code Overflow 2003-11-03 2021-06-06
7.2
 None Local Low Not required Complete Complete Complete
Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures.
7 CVE-2003-0543 DoS Overflow 2003-11-17 2018-05-03
5.0
 None Remote Low Not required None None Partial
Integer overflow in OpenSSL 0.9.6 and 0.9.7 allows remote attackers to cause a denial of service (crash) via an SSL client certificate with certain ASN.1 tag values.
8 CVE-2003-0544 DoS 2003-11-17 2018-05-03
5.0
 None Remote Low Not required None None Partial
OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to cause a denial of service (crash) via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used.
9 CVE-2003-0545 119 DoS Exec Code Overflow 2003-11-17 2018-05-03
10.0
 None Remote Low Not required Complete Complete Complete
Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding.
10 CVE-2003-0626 2003-11-13 2017-07-11
5.0
 None Remote Low Not required Partial None None
psdoccgi.exe in PeopleSoft PeopleTools 8.4 through 8.43 allows remote attackers to read arbitrary files via the (1) headername or (2) footername arguments.
11 CVE-2003-0659 Exec Code Overflow 2003-11-17 2019-04-30
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long (1) LB_DIR messages to ListBox or (2) CB_DIR messages to ComboBox controls in a privileged application.
12 CVE-2003-0660 Exec Code 2003-11-17 2019-04-30
7.5
 None Remote Low Not required Partial Partial Partial
The Authenticode capability in Microsoft Windows NT through Server 2003 does not prompt the user to download and install ActiveX controls when the system is low on memory, which could allow remote attackers to execute arbitrary code without user approval.
13 CVE-2003-0662 119 Exec Code Overflow 2003-11-17 2019-04-30
9.3
 None Remote Medium Not required Complete Complete Complete
Buffer overflow in Troubleshooter ActiveX Control (Tshoot.ocx) in Microsoft Windows 2000 SP4 and earlier allows remote attackers to execute arbitrary code via an HTML document with a long argument to the RunQuery2 method.
14 CVE-2003-0683 Bypass 2003-11-03 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
NFS in SGI 6.5.21m and 6.5.21f does not perform access checks in certain configurations when an /etc/exports entry uses wildcards without any hostnames or groups, which could allow attackers to bypass intended restrictions.
15 CVE-2003-0711 Exec Code Overflow 2003-11-17 2019-04-30
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code via a long query in an HCP URL.
16 CVE-2003-0712 79 XSS 2003-11-17 2020-04-09
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the HTML encoding for the Compose New Message form in Microsoft Exchange Server 5.5 Outlook Web Access (OWA) allows remote attackers to execute arbitrary web script.
17 CVE-2003-0714 400 DoS Overflow 2003-11-17 2020-04-09
7.5
 None Remote Low Not required Partial Partial Partial
The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory exhaustion) by directly connecting to the SMTP service and sending a certain extended verb request, possibly triggering a buffer overflow in Exchange 2000.
18 CVE-2003-0717 Exec Code Overflow 2003-11-17 2019-04-30
7.5
 None Remote Low Not required Partial Partial Partial
The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute arbitrary code via a buffer overflow attack.
19 CVE-2003-0786 +Priv 2003-11-17 2008-09-10
10.0
 None Remote Low Not required Complete Complete Complete
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.
20 CVE-2003-0787 +Priv 2003-11-17 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
The PAM conversation function in OpenSSH 3.7.1 and 3.7.1p1 interprets an array of structures as an array of pointers, which allows attackers to modify the stack and possibly gain privileges.
21 CVE-2003-0789 2003-11-03 2021-06-06
10.0
 None Remote Low Not required Complete Complete Complete
mod_cgid in Apache before 2.0.48, when using a threaded MPM, does not properly handle CGI redirect paths, which could cause Apache to send the output of a CGI program to the wrong client.
22 CVE-2003-0792 399 DoS 2003-11-17 2017-07-11
5.0
 None Remote Low Not required None None Partial
Fetchmail 6.2.4 and earlier does not properly allocate memory for long lines, which allows remote attackers to cause a denial of service (crash) via a certain email.
23 CVE-2003-0793 DoS 2003-11-17 2017-07-11
2.1
 None Local Low Not required None None Partial
GDM 2.4.4.x before 2.4.4.4, and 2.4.1.x before 2.4.1.7, does not restrict the size of input, which allows attackers to cause a denial of service (memory consumption).
24 CVE-2003-0794 DoS 2003-11-17 2017-07-11
2.1
 None Local Low Not required None None Partial
GDM 2.4.4.x before 2.4.4.4, and 2.4.1.x before 2.4.1.7, does not limit the number or duration of commands and uses a blocking socket connection, which allows attackers to cause a denial of service (resource exhaustion) by sending commands and not reading the results.
25 CVE-2003-0804 DoS 2003-11-17 2008-09-10
5.0
 None Remote Low Not required None None Partial
The arplookup function in FreeBSD 5.1 and earlier, Mac OS X before 10.2.8, and possibly other BSD-based systems, allows remote attackers on a local subnet to cause a denial of service (resource starvation and panic) via a flood of spoofed ARP requests.
26 CVE-2003-0809 Exec Code 2003-11-17 2021-07-23
7.5
 None Remote Low Not required Partial Partial Partial
Internet Explorer 5.01 through 6.0 does not properly handle object tags returned from a Web server during XML data binding, which allows remote attackers to execute arbitrary code via an HTML e-mail message or web page.
27 CVE-2003-0813 DoS 2003-11-17 2019-04-30
5.1
 None Remote High Not required Partial Partial Partial
A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by causing two threads to process the same RPC request, which causes one thread to use memory after it has been freed, a different vulnerability than CVE-2003-0352 (Blaster/Nachi), CVE-2003-0715, and CVE-2003-0528, and as demonstrated by certain exploits against those vulnerabilities.
28 CVE-2003-0830 Overflow +Priv 2003-11-17 2008-09-10
4.6
 None Local Low Not required Partial Partial Partial
Buffer overflow in marbles 1.0.2 and earlier allows local users to gain privileges via a long HOME environment variable.
29 CVE-2003-0831 119 Exec Code Overflow 2003-11-17 2017-10-05
9.0
 None Remote Low ??? Complete Complete Complete
ProFTPD 1.2.7 through 1.2.9rc2 does not properly translate newline characters when transferring files in ASCII mode, which allows remote attackers to execute arbitrary code via a buffer overflow using certain files.
30 CVE-2003-0832 Dir. Trav. 2003-11-17 2008-09-10
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in webfs before 1.20 allows remote attackers to read arbitrary files via .. (dot dot) sequences in a Hostname header.
31 CVE-2003-0833 Exec Code Overflow 2003-11-17 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in webfs before 1.20 allows attackers to execute arbitrary code by creating directories that result in a long pathname.
32 CVE-2003-0835 Exec Code Overflow 2003-11-17 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in asf_http_request of MPlayer before 0.92 allows remote attackers to execute arbitrary code via an ASX header with a long hostname.
33 CVE-2003-0836 Exec Code Overflow 2003-11-17 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in IBM DB2 Universal Data Base 7.2 before Fixpak 10 and 10a, and 8.1 before Fixpak 2, allows attackers with "Connect" privileges to execute arbitrary code via a LOAD command.
34 CVE-2003-0837 Exec Code Overflow 2003-11-17 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in IBM DB2 Universal Data Base 7.2 for Windows, before Fixpak 10a, allows attackers with "Connect" privileges to execute arbitrary code via the INVOKE command.
35 CVE-2003-0838 Exec Code Bypass 2003-11-17 2021-07-23
7.5
 None Remote Low Not required Partial Partial Partial
Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a "data" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but later executes as an HTA application, a different vulnerability than CVE-2003-0532, and as exploited using the QHosts Trojan horse (aka Trojan.Qhosts, QHosts-1, VBS.QHOSTS, or aolfix.exe).
36 CVE-2003-0839 Dir. Trav. 2003-11-17 2016-10-18
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in the "Shell Folders" capability in Microsoft Windows Server 2003 allows remote attackers to read arbitrary files via .. (dot dot) sequences in a "shell:" link.
37 CVE-2003-0840 Overflow +Priv 2003-11-17 2016-10-18
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in dtprintinfo on HP-UX 11.00, and possibly other operating systems, allows local users to gain root privileges via a long DISPLAY environment variable.
38 CVE-2003-0841 2003-11-17 2019-08-19
5.0
 None Remote Low Not required Partial None None
The grid option in PeopleSoft 8.42 stores temporary .xls files in guessable directories under the web document root, which allows remote attackers to steal search results by directly accessing the files via a URL request.
39 CVE-2003-0842 Exec Code Overflow 2003-11-17 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode, allows remote attackers to execute arbitrary code via a long filename in a GET request with an "Accept-Encoding: gzip" header.
40 CVE-2003-0843 Exec Code 2003-11-17 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Format string vulnerability in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode and using the Apache log, allows remote attackers to execute arbitrary code via format string characters in an HTTP GET request with an "Accept-Encoding: gzip" header.
41 CVE-2003-0844 2003-11-17 2016-10-18
2.1
 None Local Low Not required None Partial None
mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode without the Apache log, allows local users to overwrite arbitrary files via (1) a symlink attack on predictable temporary filenames on Unix systems, or (2) an NTFS hard link on Windows systems when the "Strengthen default permissions of internal system objects" policy is not enabled.
42 CVE-2003-0845 89 Exec Code Sql 2003-11-17 2020-03-24
7.5
 None Remote Low Not required Partial Partial Partial
Unknown vulnerability in the HSQLDB component in JBoss 3.2.1 and 3.0.8 on Java 1.4.x platforms, when running in the default configuration, allows remote attackers to conduct unauthorized activities and possibly execute arbitrary code via certain SQL statements to (1) TCP port 1701 in JBoss 3.2.1, and (2) port 1476 in JBoss 3.0.8.
43 CVE-2003-0846 2003-11-17 2016-10-18
4.6
 None Local Low Not required Partial Partial Partial
SuSEconfig.javarunt in the javarunt package on SuSE Linux 7.3Pro allows local users to overwrite arbitrary files via a symlink attack on the .java_wrapper temporary file.
44 CVE-2003-0847 2003-11-17 2016-10-18
4.6
 None Local Low Not required Partial Partial Partial
SuSEconfig.susewm in the susewm package on SuSE Linux 8.2Pro allows local users to overwrite arbitrary files via a symlink attack on the susewm.$$ temporary file.
45 CVE-2003-0848 Overflow +Priv 2003-11-17 2017-10-11
4.6
 None Local Low Not required Partial Partial Partial
Heap-based buffer overflow in main.c of slocate 2.6, and possibly other versions, may allow local users to gain privileges via a modified slocate database that causes a negative "pathlen" value to be used.
46 CVE-2003-0849 Exec Code Overflow 2003-11-17 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length values, which is trusted by the ReceiveTransaction function when using a buffer provided by the BusyWithConnection function.
47 CVE-2003-0850 Exec Code Mem. Corr. 2003-11-17 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
The TCP reassembly functionality in libnids before 1.18 allows remote attackers to cause "memory corruption" and possibly execute arbitrary code via "overlarge TCP packets."
48 CVE-2003-0852 DoS 2003-11-17 2017-07-11
5.0
 None Remote Low Not required None None Partial
Format string vulnerability in send_message.c for Sylpheed-claws 0.9.4 through 0.9.6 allows remote SMTP servers to cause a denial of service (crash) in sylpheed via format strings in an error message.
49 CVE-2003-0853 DoS Exec Code Overflow 2003-11-17 2008-09-10
5.0
 None Remote Low Not required None None Partial
An integer overflow in ls in the fileutils or coreutils packages may allow local users to cause a denial of service or execute arbitrary code via a large -w value, which could be remotely exploited via applications that use ls, such as wu-ftpd.
50 CVE-2003-0854 2003-11-17 2017-10-11
2.1
 None Local Low Not required None None Partial
ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via applications that use ls, such as wu-ftpd.
Total number of vulnerabilities : 93   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.