# CVEs published 2003-03-18

96 CVEs were published on March 18, 2003: 0 critical, 0 high. Days are UTC.

- [CVE-2002-0690](https://cve.now/CVE-2002-0690.md): Format string vulnerability in McAfee Security ePolicy Orchestrator (ePO) 2.5.1 allows remote attackers to execute arbitrary code via an HTT (no CVSS)
- [CVE-2002-1406](https://cve.now/CVE-2002-1406.md): Unknown vulnerability in passwd for VVOS HP-UX 11.04, with unknown impact, related to "Unexpected behavior." (no CVSS)
- [CVE-2002-1408](https://cve.now/CVE-2002-1408.md): Unknown vulnerability or vulnerabilities in HP OpenView EMANATE 14.2 snmpModules allow the SNMP read-write community name to be exposed, rel (no CVSS)
- [CVE-2002-1409](https://cve.now/CVE-2002-1409.md): ptrace on HP-UX 11.00 through 11.11 allows local users to cause a denial of service (data page fault panic) via "an incorrect reference to t (no CVSS)
- [CVE-2002-1410](https://cve.now/CVE-2002-1410.md): Easy Guestbook CGI programs do not authenticate the administrator, which allows remote attackers to (1) delete entries via direct access of (no CVSS)
- [CVE-2002-1411](https://cve.now/CVE-2002-1411.md): Directory traversal vulnerability in update.dpgs in Duma Photo Gallery System (DPGS) 0.99.4 allows remote attackers to read arbitrary files (no CVSS)
- [CVE-2002-1415](https://cve.now/CVE-2002-1415.md): Format string vulnerability in SMTP service for WebEasyMail 3.4.2.2 and earlier allows remote attackers to cause a denial of service (crash) (no CVSS)
- [CVE-2002-1416](https://cve.now/CVE-2002-1416.md): The POP3 service for WebEasyMail 3.4.2.2 and earlier generates diffferent error messages for valid and invalid usernames during authenticati (no CVSS)
- [CVE-2002-1421](https://cve.now/CVE-2002-1421.md): SQL injection vulnerabilities in FUDforum before 2.2.0 allow remote attackers to perform unauthorized database operations via (1) report.php (no CVSS)
- [CVE-2002-1422](https://cve.now/CVE-2002-1422.md): admbrowse.php in FUDforum before 2.2.0 allows remote attackers to create or delete files via URL-encoded pathnames in the cur and dest param (no CVSS)
- [CVE-2002-1423](https://cve.now/CVE-2002-1423.md): tmp\_view.php in FUDforum before 2.2.0 allows remote attackers to read arbitrary files via an absolute pathname in the file parameter. (no CVSS)
- [CVE-2002-1426](https://cve.now/CVE-2002-1426.md): HP ProCurve Switch 4000M C.07.23 allows remote attackers to cause a denial of service (crash) via an SNMP write request containing 85 charac (no CVSS)
- [CVE-2002-1427](https://cve.now/CVE-2002-1427.md): The print\_html\_to\_file function in edit.cgi for Easy Homepage Creator 1.0 does not check user credentials, which allows remote attackers to (no CVSS)
- [CVE-2002-1428](https://cve.now/CVE-2002-1428.md): index.php in dotProject 0.2.1.5 allows remote attackers to bypass authentication via a cookie or URL with the user\_cookie parameter set to 1 (no CVSS)
- [CVE-2002-1429](https://cve.now/CVE-2002-1429.md): Cross-site scripting vulnerability in board.php of endity.com ShoutBOX allows remote attackers to inject arbitrary HTML into the shoutbox pa (no CVSS)
- [CVE-2002-1431](https://cve.now/CVE-2002-1431.md): Belkin F5D5230-4 4-Port Cable/DSL Gateway Router 1.20.000 modifies the source IP address of internal packets to that of the router's externa (no CVSS)
- [CVE-2002-1432](https://cve.now/CVE-2002-1432.md): MidiCart stores the midicart.mdb database file under the Web document root, which allows remote attackers to steal sensitive information by (no CVSS)
- [CVE-2002-1433](https://cve.now/CVE-2002-1433.md): Kerio MailServer 5.0 allows remote attackers to cause a denial of service (hang) via SYN packets to the supported network services. (no CVSS)
- [CVE-2002-1434](https://cve.now/CVE-2002-1434.md): Multiple cross-site scripting (XSS) vulnerabilities in the Web mail module of Kerio MailServer 5.0 allow remote attackers to execute HTML sc (no CVSS)
- [CVE-2002-1439](https://cve.now/CVE-2002-1439.md): Unknown vulnerability related to stack corruption in the TGA daemon for HP-UX 11.04 (VVOS) Virtualvault 4.0, 4.5, and 4.6 may allow attacker (no CVSS)
- [CVE-2002-1440](https://cve.now/CVE-2002-1440.md): The Gateway GS-400 server has a default root password of "0001n" that can not be changed via the administrative interface, which can allow a (no CVSS)
- [CVE-2002-1441](https://cve.now/CVE-2002-1441.md): Multiple buffer overflows in Tomahawk SteelArrow before 4.5 allow remote attackers to execute arbitrary code via (1) the Steelarrow Service (no CVSS)
- [CVE-2002-1442](https://cve.now/CVE-2002-1442.md): The Google toolbar 1.1.58 and earlier allows remote web sites to perform unauthorized toolbar operations including script execution and file (no CVSS)
- [CVE-2002-1444](https://cve.now/CVE-2002-1444.md): The Google toolbar 1.1.60, when running on Internet Explorer 5.5 and 6.0, allows remote attackers to cause a denial of service (crash with a (no CVSS)
- [CVE-2002-1445](https://cve.now/CVE-2002-1445.md): Cross-site scripting (XSS) vulnerability in CERN Proxy Server allows remote attackers to execute script as other users via a link to a non-e (no CVSS)
- [CVE-2002-1449](https://cve.now/CVE-2002-1449.md): eUpload 1.0 stores the password.txt password file in plaintext under the web document root, which allows remote attackers to overwrite arbit (no CVSS)
- [CVE-2002-1450](https://cve.now/CVE-2002-1450.md): IBM UniVerse with UV/ODBC allows attackers to cause a denial of service (client crash or server CPU consumption) via a query with an invalid (no CVSS)
- [CVE-2002-1451](https://cve.now/CVE-2002-1451.md): Blazix before 1.2.2 allows remote attackers to read source code of JSP scripts or list restricted web directories via an HTTP request that e (no CVSS)
- [CVE-2002-1452](https://cve.now/CVE-2002-1452.md): Buffer overflow in the search capability for MyWebServer 1.0.2 allows remote attackers to execute arbitrary code via a long searchTarget par (no CVSS)
- [CVE-2002-1453](https://cve.now/CVE-2002-1453.md): Cross-site scripting (XSS) vulnerability in MyWebServer 1.0.2 allows remote attackers to insert script and HTML via a long request followed (no CVSS)
- [CVE-2002-1454](https://cve.now/CVE-2002-1454.md): MyWebServer 1.0.2 allows remote attackers to determine the absolute path of the web document root via a request for a directory that does no (no CVSS)
- [CVE-2002-1455](https://cve.now/CVE-2002-1455.md): Multiple cross-site scripting (XSS) vulnerabilities in OmniHTTPd allow remote attackers to insert script or HTML into web pages via (1) test (no CVSS)
- [CVE-2002-1456](https://cve.now/CVE-2002-1456.md): Buffer overflow in mIRC 6.0.2 and earlier allows remote attackers to execute arbitrary code via a long $asctime value. (no CVSS)
- [CVE-2002-1457](https://cve.now/CVE-2002-1457.md): SQL injection vulnerability in search.php for L-Forum 2.40 allows remote attackers to execute arbitrary SQL statements via the search parame (no CVSS)
- [CVE-2002-1458](https://cve.now/CVE-2002-1458.md): Cross-site scripting vulnerability in L-Forum 2.40 and earlier, when the "Enable HTML in messages" option is on, allows remote attackers to (no CVSS)
- [CVE-2002-1459](https://cve.now/CVE-2002-1459.md): Cross-site scripting vulnerability in L-Forum 2.40 and earlier, when the "Enable HTML in messages" option is off, allows remote attackers to (no CVSS)
- [CVE-2002-1460](https://cve.now/CVE-2002-1460.md): L-Forum 2.40 and earlier does not properly verify whether a file was uploaded or if the associated variables were set by POST (attachment, a (no CVSS)
- [CVE-2002-1461](https://cve.now/CVE-2002-1461.md): Web Shop Manager 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search box. (no CVSS)
- [CVE-2002-1462](https://cve.now/CVE-2002-1462.md): details2.php in OrganicPHP PHP-affiliate 1.0, and possibly later versions, allows remote attackers to modify information of other users by m (no CVSS)
- [CVE-2002-1464](https://cve.now/CVE-2002-1464.md): Cross-site scripting (XSS) vulnerability in CafeLog b2 Weblog Tool allows remote attackers to insert arbitrary HTML or script via the GPC va (no CVSS)
- [CVE-2002-1465](https://cve.now/CVE-2002-1465.md): SQL injection vulnerability in CafeLog b2 Weblog Tool allows remote attackers to execute arbitrary SQL code via the tablehosts variable. (no CVSS)
- [CVE-2002-1466](https://cve.now/CVE-2002-1466.md): CafeLog b2 Weblog Tool 2.06pre4, with allow\_fopen\_url enabled, allows remote attackers to execute arbitrary PHP code via the b2inc variable. (no CVSS)
- [CVE-2002-1467](https://cve.now/CVE-2002-1467.md): Macromedia Flash Plugin before 6,0,47,0 allows remote attackers to bypass the same-domain restriction and read arbitrary files via (1) an HT (no CVSS)
- [CVE-2002-1470](https://cve.now/CVE-2002-1470.md): SHOUTcast 1.8.9 and earlier allows local users to obtain the cleartext administrative password via a GET request to port 8001, which causes (no CVSS)
- [CVE-2002-1473](https://cve.now/CVE-2002-1473.md): Multiple buffer overflows in lp subsystem for HP-UX 10.20 through 11.11 (11i) allow local users to cause a denial of service and possibly ex (no CVSS)
- [CVE-2002-1474](https://cve.now/CVE-2002-1474.md): Unknown vulnerability or vulnerabilities in TCP/IP component for HP Tru64 UNIX 4.0f, 4.0g, and 5.0a allows remote attackers to cause a denia (no CVSS)
- [CVE-2002-1475](https://cve.now/CVE-2002-1475.md): Unknown vulnerability in the ARP component for HP Tru64 UNIX 4.0f, 4.0g, and 5.0a allows remote attackers to "take over packets destined for (no CVSS)
- [CVE-2002-1480](https://cve.now/CVE-2002-1480.md): Cross-site scripting (XSS) vulnerability in phpGB before 1.20 allows remote attackers to inject arbitrary HTML or script into guestbook page (no CVSS)
- [CVE-2002-1481](https://cve.now/CVE-2002-1481.md): savesettings.php in phpGB 1.20 and earlier does not require authentication, which allows remote attackers to cause a denial of service or ex (no CVSS)
- [CVE-2002-1482](https://cve.now/CVE-2002-1482.md): SQL injection vulnerability in login.php for phpGB 1.20 and earlier, when magic\_quotes\_gpc is not enabled, allows remote attackers to gain a (no CVSS)
- [CVE-2002-1483](https://cve.now/CVE-2002-1483.md): db4web\_c and db4web\_c.exe programs in DB4Web 3.4 and 3.6 allow remote attackers to read arbitrary files via an HTTP request whose argument i (no CVSS)
- [CVE-2002-1484](https://cve.now/CVE-2002-1484.md): DB4Web server, when configured to use verbose debug messages, allows remote attackers to use DB4Web as a proxy and attempt TCP connections t (no CVSS)
- [CVE-2002-1485](https://cve.now/CVE-2002-1485.md): The AIM component of Trillian 0.73 and 0.74 allows remote attackers to cause a denial of service (crash) via certain strings such as "P \> O (no CVSS)
- [CVE-2002-1486](https://cve.now/CVE-2002-1486.md): Multiple buffer overflows in the IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service an (no CVSS)
- [CVE-2002-1487](https://cve.now/CVE-2002-1487.md): The IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service (crash) by sending the raw mess (no CVSS)
- [CVE-2002-1488](https://cve.now/CVE-2002-1488.md): The IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service (crash) via a PART message with (no CVSS)
- [CVE-2002-1489](https://cve.now/CVE-2002-1489.md): Buffer overflow in PlanetDNS PlanetWeb 1.14 and earlier allows remote attackers to execute arbitrary code via (1) an HTTP GET request with a (no CVSS)
- [CVE-2002-1492](https://cve.now/CVE-2002-1492.md): Buffer overflows in the Cisco VPN 5000 Client before 5.2.7 for Linux, and VPN 5000 Client before 5.2.8 for Solaris, allow local users to gai (no CVSS)
- [CVE-2002-1495](https://cve.now/CVE-2002-1495.md): Cross-site scripting (XSS) vulnerability in JAWmail 1.0-rc1 allows remote attackers to insert arbitrary script or HTML via (1) attached file (no CVSS)
- [CVE-2002-1498](https://cve.now/CVE-2002-1498.md): Directory traversal vulnerability in SWServer 2.2 and earlier allows remote attackers to read arbitrary files via a URL containing .. (no CVSS)
- [CVE-2002-1499](https://cve.now/CVE-2002-1499.md): Multiple SQL injection vulnerabilities in FactoSystem CMS allows remote attackers to perform unauthorized database actions via (1) the autho (no CVSS)
- [CVE-2002-1500](https://cve.now/CVE-2002-1500.md): Buffer overflow in (1) mrinfo, (2) mtrace, and (3) pppd in NetBSD 1.4.x through 1.6 allows local users to gain privileges by executing the p (no CVSS)
- [CVE-2002-1503](https://cve.now/CVE-2002-1503.md): Buffer overflow in Automatic File Distributor (AFD) 1.2.14 and earlier allows local users to gain privileges via a long MON\_WORK\_DIR environ (no CVSS)
- [CVE-2002-1504](https://cve.now/CVE-2002-1504.md): Directory traversal vulnerability in WebServer 4 Everyone 1.22 allows remote attackers to read arbitrary files via "..\\" (dot-dot backslash) (no CVSS)
- [CVE-2002-1506](https://cve.now/CVE-2002-1506.md): Buffer overflow in Linuxconf before 1.28r4 allows local users to execute arbitrary code via a long LINUXCONF\_LANG environment variable, whic (no CVSS)
- [CVE-2002-1507](https://cve.now/CVE-2002-1507.md): Unreal Tournament 2003 (ut2003) clients and servers allow remote attackers to cause a denial of service via malformed messages containing a (no CVSS)
- [CVE-2002-1512](https://cve.now/CVE-2002-1512.md): xbru in BRU Workstation 17.0 allows local users to overwrite arbitrary files and gain root privileges via a symlink attack on the xbru\_dsche (no CVSS)
- [CVE-2002-1515](https://cve.now/CVE-2002-1515.md): Directory traversal vulnerability in avatar.php in CoolForum 0.5 beta allows remote attackers to read arbitrary files via .. (no CVSS)
- [CVE-2002-1522](https://cve.now/CVE-2002-1522.md): Buffer overflow in PowerFTP FTP server 2.24, and possibly other versions, allows remote attackers to cause a denial of service and possibly (no CVSS)
- [CVE-2002-1523](https://cve.now/CVE-2002-1523.md): Directory traversal vulnerability in Daniel Arenz Mini Server 2.1.6 allows remote attackers to read arbitrary files via (1) ../ (dot-dot sla (no CVSS)
- [CVE-2002-1525](https://cve.now/CVE-2002-1525.md): Directory traversal vulnerability in ASTAware SearchDisk engine for Sun ONE Starter Kit 2.0 allows remote attackers to read arbitrary files (no CVSS)
- [CVE-2002-1526](https://cve.now/CVE-2002-1526.md): Cross-site scripting (XSS) vulnerability in emumail.cgi for EMU Webmail 5.0 allows remote attackers to inject arbitrary HTML or script via t (no CVSS)
- [CVE-2002-1527](https://cve.now/CVE-2002-1527.md): emumail.cgi in EMU Webmail 5.0 allows remote attackers to determine the full pathname for emumail.cgi via a malformed string containing scri (no CVSS)
- [CVE-2002-1533](https://cve.now/CVE-2002-1533.md): Cross-site scripting (XSS) vulnerability in Jetty JSP servlet engine allows remote attackers to insert arbitrary HTML or script via an HTTP (no CVSS, org.mortbay.jetty:jetty)
- [CVE-2002-1535](https://cve.now/CVE-2002-1535.md): Secure Webserver 1.1 in Raptor 6.5 and Symantec Enterprise Firewall 6.5.2 allows remote attackers to identify IP addresses of hosts on the i (no CVSS)
- [CVE-2002-1536](https://cve.now/CVE-2002-1536.md): Molly IRC bot 0.5 allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the $host variable for nslookup.pl, (no CVSS)
- [CVE-2002-1539](https://cve.now/CVE-2002-1539.md): Buffer overflow in MDaemon POP server 6.0.7 and earlier allows remote authenticated users to cause a denial of service via long (1) DELE or (no CVSS)
- [CVE-2002-1542](https://cve.now/CVE-2002-1542.md): SolarWinds TFTP server 5.0.55 and earlier allows remote attackers to cause a denial of service (crash) via a large UDP datagram, possibly tr (no CVSS)
- [CVE-2002-1544](https://cve.now/CVE-2002-1544.md): Directory traversal vulnerability in CooolSoft Personal FTP Server 2.24 allows remote attackers to read or modify arbitrary files via .. (no CVSS)
- [CVE-2002-1545](https://cve.now/CVE-2002-1545.md): CooolSoft Personal FTP Server 2.24 allows remote attackers to obtain the absolute pathname of the FTP root via a PWD command, which includes (no CVSS)
- [CVE-2002-1546](https://cve.now/CVE-2002-1546.md): BRS WebWeaver Web Server 1.01 allows remote attackers to bypass password protections for files and directories via an HTTP request containin (no CVSS)
- [CVE-2002-1551](https://cve.now/CVE-2002-1551.md): Buffer overflow in nslookup in IBM AIX may allow attackers to cause a denial of service or execute arbitrary code. (no CVSS)
- [CVE-2002-1553](https://cve.now/CVE-2002-1553.md): Cisco ONS15454 and ONS15327 running ONS before 3.4 allows remote attackers to modify the system configuration and delete files by establishi (no CVSS)
- [CVE-2002-1554](https://cve.now/CVE-2002-1554.md): Cisco ONS15454 and ONS15327 running ONS before 3.4 stores usernames and passwords in cleartext in the image database for the TCC, TCC+ or XT (no CVSS)
- [CVE-2002-1555](https://cve.now/CVE-2002-1555.md): Cisco ONS15454 and ONS15327 running ONS before 3.4 uses a "public" SNMP community string that cannot be changed, which allows remote attacke (no CVSS)
- [CVE-2002-1556](https://cve.now/CVE-2002-1556.md): Cisco ONS15454 and ONS15327 running ONS before 3.4 allows attackers to cause a denial of service (reset) via an HTTP request to the TCC, TCC (no CVSS)
- [CVE-2002-1557](https://cve.now/CVE-2002-1557.md): Cisco ONS15454 and ONS15327 running ONS before 3.4 allows attackers to cause a denial of service (reset to TCC, TCC+, TCCi or XTC) via a mal (no CVSS)
- [CVE-2002-1558](https://cve.now/CVE-2002-1558.md): Cisco ONS15454 and ONS15327 running ONS before 3.4 have an account for the VxWorks Operating System in the TCC, TCC+ and XTC that cannot be (no CVSS)
- [CVE-2002-1559](https://cve.now/CVE-2002-1559.md): Directory traversal vulnerability in ion-p.exe (aka ion-p) allows remote attackers to read arbitrary files via (1) C: (drive letter) or (2) (no CVSS)
- [CVE-2003-0080](https://cve.now/CVE-2003-0080.md): The iptables ruleset in Gnome-lokkit in Red Hat Linux 8.0 does not include any rules in the FORWARD chain, which could allow attackers to by (no CVSS)
- [CVE-2003-0085](https://cve.now/CVE-2003-0085.md): Buffer overflow in the SMB/CIFS packet fragment re-assembly code for SMB daemon (smbd) in Samba before 2.2.8, and Samba-TNG before 0.3.1, al (no CVSS)
- [CVE-2003-0086](https://cve.now/CVE-2003-0086.md): The code for writing reg files in Samba before 2.2.8 allows local users to overwrite arbitrary files via a race condition involving chown. (no CVSS)
- [CVE-2003-0109](https://cve.now/CVE-2003-0109.md): Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote (no CVSS)
- [CVE-2003-0127](https://cve.now/CVE-2003-0127.md): The kernel module loader in Linux kernel 2.2.x before 2.2.25, and 2.4.x before 2.4.21, allows local users to gain root privileges by using p (no CVSS)
- [CVE-2003-0146](https://cve.now/CVE-2003-0146.md): Multiple vulnerabilities in NetPBM 9.20 and earlier, and possibly other versions, may allow remote attackers to cause a denial of service or (no CVSS)
- [CVE-2003-0147](https://cve.now/CVE-2003-0147.md): OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining fact (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2003-03-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.