Vulnerabilities > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2003-12-31 | CVE-2003-1541 | Permissions, Privileges, and Access Controls vulnerability in Planetmoon Guestbook Tr3.A.1 PlanetMoon Guestbook tr3.a stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the admin script password, and other passwords, via a direct request to files/passwd.txt. | 5.0 |
| 2003-12-31 | CVE-2003-1540 | Information Exposure vulnerability in Wfchat 1.0 WF-Chat 1.0 Beta stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain authentication information via a direct request to (1) !pwds.txt and (2) !nicks.txt. | 5.0 |
| 2003-12-31 | CVE-2003-1539 | Cross-Site Scripting vulnerability in Onedotoh Simple File Manager Cross-site scripting (XSS) vulnerability in ONEdotOH Simple File Manager (SFM) before 0.21 allows remote attackers to inject arbitrary web script or HTML via (1) file names and (2) directory names. | 4.3 |
| 2003-12-31 | CVE-2003-1538 | Improper Input Validation vulnerability in Suse products susehelp in SuSE Linux 8.1, Enterprise Server 8, Office Server, and Openexchange Server 4 does not properly filter shell metacharacters, which allows remote attackers to execute arbitrary commands via CGI queries. | 6.4 |
| 2003-12-31 | CVE-2003-1537 | Path Traversal vulnerability in Postnuke Software Foundation Postnuke Directory traversal vulnerability in PostNuke 0.723 and earlier allows remote attackers to include arbitrary files named theme.php via the theme parameter to index.php. | 5.0 |
| 2003-12-31 | CVE-2003-1536 | Cross-Site Scripting vulnerability in Dcp-Portal 5.3.1 Multiple cross-site scripting (XSS) vulnerabilities in Codeworx Technologies DCP-Portal 5.3.1 allow remote attackers to inject arbitrary web script or HTML via (1) the q parameter to search.php and (2) the year parameter to calendar.php. | 4.3 |
| 2003-12-31 | CVE-2003-1535 | Information Exposure vulnerability in Justice Media Guestbook 1.3 Justice Guestbook 1.3 allows remote attackers to obtain the full installation path via a direct request to cfooter.php3, which leaks the path in an error message. | 5.0 |
| 2003-12-31 | CVE-2003-1534 | Cross-Site Scripting vulnerability in Justice Media Guestbook Cross-site scripting (XSS) vulnerability in jgb.php3 in Justice Guestbook 1.3 allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) homepage, (3) aim, (4) yim, (5) location, and (6) comment variables. | 4.3 |
| 2003-12-31 | CVE-2003-1531 | Cross-Site Scripting vulnerability in Lilikoi Ceilidh Cross-site scripting (XSS) vulnerability in testcgi.exe in Lilikoi Software Ceilidh 2.70 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string. | 4.3 |
| 2003-12-31 | CVE-2003-1529 | Path Traversal vulnerability in Seagull Software Systems J Walk Application Server 3.2C9 Directory traversal vulnerability in Seagull Software Systems J Walk application server 3.2C9, and other versions before 3.3c4, allows remote attackers to read arbitrary files via a ".%252e" (encoded dot dot) in the URL. | 5.0 |