[CLOSE] OSVDB ID : 4622 - Disclosed: 2003-05-31

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 4654 - Disclosed: 2003-05-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 4651 - Disclosed: 2003-05-30

Description:

Yahoo! Audio Conferencing contains a flaw that may allow a remote attacker to execute arbitrary code. The issue is due to an unchecked buffer in the Audio Conferencing ActiveX Control. If an attacker sends a specially crafted request, they may be able to overflow the buffer and execute arbitrary code.

[CLOSE] OSVDB ID : 4467 - Disclosed: 2003-05-30

Description:

Windows servers with WebDAV enabled contain a flaw that may allow a remote attacker to execute arbitrary code. The issue is due to the ntdll.dll component of the WebDAV not properly sanitizing input to a path conversion function. If an attacker sends a specially crafted request to this function, they may be able to execute arbitrary code with SYSTEM privileges.

[CLOSE] OSVDB ID : 4652 - Disclosed: 2003-05-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 4765 - Disclosed: 2003-05-30

Description:

Zeus Web Server contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'server' variable upon submission to the /apps/web/vs_diag.cgi script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 4655 - Disclosed: 2003-05-30

Description:

A local overflow exists in the Microsoft IIS web server. The service fails to validate the length of the parameter passed to the SSI include() function, resulting in a stack overflow. With a specially crafted SHTML page, an attacker can execute arbitrary code on this system, resulting in a loss of confidentiality, integrity, and/or availability.

[CLOSE] OSVDB ID : 4656 - Disclosed: 2003-05-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 39362 - Disclosed: 2003-05-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 24539 - Disclosed: 2003-05-30

Description:

(Description Provided by CVE) : Baby FTP Server (BabyFTP) 1.2, and possibly other versions before May 31, 2003, allows remote attackers to cause a denial of service via a large number of connections from the same IP address, which triggers an access violation.

[CLOSE] OSVDB ID : 24538 - Disclosed: 2003-05-30

Description:

(Description Provided by CVE) : Directory traversal vulnerability in Baby FTP Server 1.2, and possibly other versions before May 31, 2003 allows remote authenticated users to list arbitrary directories and possibly read files via "..." (triple dot) manipulations to the CWD command.

[CLOSE] OSVDB ID : 60383 - Disclosed: 2003-05-30

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 5.6 and 6.5 allow remote authenticated users to execute arbitrary SQL commands via (1) a uid (user) cookie to modules.php; and allow remote attackers to execute arbitrary SQL commands via an aid (admin) cookie to the Web_Links module in a (2) viewlink, (3) MostPopular, or (4) NewLinksDate action, different vectors than CVE-2003-0279.

[CLOSE] OSVDB ID : 60384 - Disclosed: 2003-05-30

Description:

(Description Provided by CVE) : Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 5.6 and 6.5 allow remote authenticated users to execute arbitrary SQL commands via (1) a uid (user) cookie to modules.php; and allow remote attackers to execute arbitrary SQL commands via an aid (admin) cookie to the Web_Links module in a (2) viewlink, (3) MostPopular, or (4) NewLinksDate action, different vectors than CVE-2003-0279.

[CLOSE] OSVDB ID : 60550 - Disclosed: 2003-05-30

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 62124 - Disclosed: 2003-05-30

Description:

(Description Provided by CVE) : Buffer overflow in pamverifier in Change Manager (CM) 1.0 for Sun Management Center (SunMC) 3.0 on Solaris 8 and 9 on the sparc platform allows remote attackers to execute arbitrary code via unspecified vectors.

[CLOSE] OSVDB ID : 35133 - Disclosed: 2003-05-29

Description:

(Description Provided by CVE) : siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder places a session ID string in the value of the SMSESSION parameter in a URL, which might allow remote attackers to obtain the ID by sniffing, reading Referer logs, or other methods.

[CLOSE] OSVDB ID : 50531 - Disclosed: 2003-05-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 50532 - Disclosed: 2003-05-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 30741 - Disclosed: 2003-05-29

Description:

Netegrity SiteMinder contains a flaw that may allow a remote attacker to conduct user-complicit attacks that would redirect a person to an arbitrary web site. The issue is due to the SmMakeCookie.ccc script not properly sanitizing input to the TARGET variable. By providing an arbitrary web site to this variable, a URL can be crafted that would appear to be a legitimate site link. When clicked, the SiteMinder script would then redirect the person to the arbitrary site.

[CLOSE] OSVDB ID : 4781 - Disclosed: 2003-05-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 4782 - Disclosed: 2003-05-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 4764 - Disclosed: 2003-05-29

Description:

Activity Monitor 2002 contains a flaw that may allow a remote denial of service. By connecting to TCP port 15163 and sending an overly long string, a remote attacker could consume all available CPU resources and cause the application to crash resulting in loss of availability for the application.

[CLOSE] OSVDB ID : 4499 - Disclosed: 2003-05-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 4780 - Disclosed: 2003-05-29

Description:

(Description Provided by CVE) : CUPS before 1.1.19 allows remote attackers to cause a denial of service via a partial printing request to the IPP port (631), which does not time out.

[CLOSE] OSVDB ID : 52991 - Disclosed: 2003-05-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 51702 - Disclosed: 2003-05-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 4769 - Disclosed: 2003-05-29

Description:

Philboard contains a flaw that may allow a malicious user to gain admin privileges without authentication. The issue is triggered when an attacker creates cookies which the program uses for admin authorization. It is possible that the flaw may allow unauthorized administrative access resulting in a loss of confidentiality, integrity, and/or availability.

[CLOSE] OSVDB ID : 52979 - Disclosed: 2003-05-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 52980 - Disclosed: 2003-05-29

Description:

Unknown / Incomplete

[CLOSE] OSVDB ID : 4919 - Disclosed: 2003-05-29

Description:

P-Sync Password Management contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker requests the nph-psa.exe script with a malformed lang parameter, which will disclose the software's installation path resulting in a loss of confidentiality. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.

[CLOSE] OSVDB ID : 4920 - Disclosed: 2003-05-29

Description:

M-Tech's P-Synch password management product contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'css' variable upon submission to the nph-psf.exe script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 52977 - Disclosed: 2003-05-29

Description:

P-Sync Password Management contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker requests the nph-psf.exe script with a malformed lang parameter, which will disclose the software's installation path resulting in a loss of confidentiality. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.

[CLOSE] OSVDB ID : 52978 - Disclosed: 2003-05-29

Description:

M-Tech's P-Synch password management product contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'css' variable upon submission to the nph-psa.exe script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

[CLOSE] OSVDB ID : 4811 - Disclosed: 2003-05-29

Description:

Geeklog contains a flaw that may allow a malicious user to gain administrative access. The issue is triggered when a connection is made with a cookie of a non-existent user. It is possible that the flaw may allow a full administrative session resulting in a loss of confidentiality, integrity, and availability.

[CLOSE] OSVDB ID : 4812 - Disclosed: 2003-05-29

Description:

Geeklog contains a flaw that may allow a malicious user to gain access and execute arbitrary code. The issue is triggered when an image file upload occurs. It is possible that the flaw may allow arbitrary script code execution resulting in a loss of confidentiality, integrity, and availability.

[CLOSE] OSVDB ID : 4662 - Disclosed: 2003-05-29

Description:

Son hServer contains a flaw that allows a remote attacker to access arbitrary files and directories outside of the web path. The issue is due to the server not properly sanitizing user input, specifically traversal style attacks (../../) supplied via URI.

[CLOSE] OSVDB ID : 4813 - Disclosed: 2003-05-29

Description:

Geeklog contains a flaw that may allow a remote attacker to gain access to unauthorized privileges. By issuing a floating-point number for the 'userid' variable, a remote attacker could gain administrative access, resulting in a loss of integrity.

[CLOSE] OSVDB ID : 9396 - Disclosed: 2003-05-29

Description:

Titan FTP contains a flaw that allows a remote attacker to return a directory listing outside of the ftp root path. The issue is due to the STAT command not properly sanitizing user input, specifically traversal style attacks (../../) supplied via the stat variable.

[CLOSE] OSVDB ID : 9547 - Disclosed: 2003-05-29

Description:

Mirabilis ICQLite contains a flaw that may allow a malicious local user to overwrite or delete files in the ICQLite folder. The issue exists because ICQLite adds the Interactive Users group with Full Control to the ACL of the ICQLite program folder. It is possible that the flaw may result in a loss of integrity.

[CLOSE] OSVDB ID : 58685 - Disclosed: 2003-05-29

Description:

Velocity contains a flaw that may allow a malicious user to execute privileged code. The issue is triggered when a malicious user uses the template designer to instantiate an arbitrary class and call arbitrary methods. It is possible that the flaw may allow privileged code execution resulting in a loss of integrity.