Format string vulnerability in gm4 (aka m4) on Mac OS X may allow local users to gain privileges if gm4 is called by setuid programs.
Max CVSS
7.2
EPSS Score
0.04%
Published
2003-11-17
Updated
2016-10-18
nidump on MacOS X before 10.3 allows local users to read the encrypted passwords from the password file by specifying passwd as a command line argument.
Max CVSS
2.1
EPSS Score
0.04%
Published
2003-11-17
Updated
2016-10-18
Apple File Protocol (AFP) in Mac OS X before 10.2.4 allows administrators to log in as other users by using the administrator password.
Max CVSS
7.5
EPSS Score
0.48%
Published
2003-03-03
Updated
2008-09-11

CVE-2003-0050

Public exploit
parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via shell metacharacters.
Max CVSS
7.5
EPSS Score
65.93%
Published
2003-03-07
Updated
2016-10-18
parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to obtain the physical path of the server's installation path via a NULL file parameter.
Max CVSS
5.0
EPSS Score
0.57%
Published
2003-03-07
Updated
2016-10-18
parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to list arbitrary directories.
Max CVSS
5.0
EPSS Score
0.57%
Published
2003-03-07
Updated
2016-10-18
Cross-site scripting (XSS) vulnerability in parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to insert arbitrary script via the filename parameter, which is inserted into an error message.
Max CVSS
4.3
EPSS Score
0.29%
Published
2003-03-07
Updated
2016-10-18
Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute certain code via a request to port 7070 with the script in an argument to the rtsp DESCRIBE method, which is inserted into a log file and executed when the log is viewed using a browser.
Max CVSS
7.5
EPSS Score
1.02%
Published
2003-03-07
Updated
2016-10-18
Buffer overflow in the MP3 broadcasting module of Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via a long filename.
Max CVSS
7.5
EPSS Score
3.99%
Published
2003-03-07
Updated
2016-10-18
TruBlueEnvironment for MacOS 10.2.3 and earlier allows local users to overwrite or create arbitrary files and gain root privileges by setting a certain environment variable that is used to write debugging information.
Max CVSS
7.2
EPSS Score
0.04%
Published
2003-03-03
Updated
2008-09-11
Buffer overflow in Apple QuickTime Player 5.x and 6.0 for Windows allows remote attackers to execute arbitrary code via a long QuickTime URL.
Max CVSS
7.5
EPSS Score
13.75%
Published
2003-04-02
Updated
2018-10-19
DirectoryServices in MacOS X trusts the PATH environment variable to locate and execute the touch command, which allows local users to execute arbitrary commands by modifying the PATH to point to a directory containing a malicious touch program.
Max CVSS
7.2
EPSS Score
0.04%
Published
2003-05-05
Updated
2008-09-10
Mac OS X before 10.2.5 allows guest users to modify the permissions of the DropBox folder and read unauthorized files.
Max CVSS
6.4
EPSS Score
0.25%
Published
2003-05-05
Updated
2008-09-10

CVE-2003-0201

Public exploit
Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code.
Max CVSS
10.0
EPSS Score
97.04%
Published
2003-05-05
Updated
2018-10-30
IPSec in Mac OS X before 10.2.6 does not properly handle certain incoming security policies that match by port, which could allow traffic that is not explicitly allowed by the policies.
Max CVSS
7.5
EPSS Score
1.13%
Published
2003-06-09
Updated
2020-12-09

CVE-2003-0270

Public exploit
The administration capability for Apple AirPort 802.11 wireless access point devices uses weak encryption (XOR with a fixed key) for protecting authentication credentials, which could allow remote attackers to obtain administrative access via sniffing when the capability is available via Ethernet or non-WEP connections.
Max CVSS
7.6
EPSS Score
2.85%
Published
2003-06-16
Updated
2017-07-11
Safari 1.0 Beta 2 (v73) and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates.
Max CVSS
5.0
EPSS Score
0.17%
Published
2003-06-09
Updated
2008-09-05
Konqueror Embedded and KDE 2.2.2 and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates via a man-in-the-middle attack.
Max CVSS
7.5
EPSS Score
0.66%
Published
2003-06-16
Updated
2008-09-10
The Kerberos login authentication feature in Mac OS X, when used with an LDAPv3 server and LDAP bind authentication, may send cleartext passwords to the LDAP server when the AuthenticationAuthority attribute is not set.
Max CVSS
7.5
EPSS Score
0.14%
Published
2003-06-16
Updated
2008-09-05
Unknown vulnerability in Apple File Service (AFP Server) for Mac OS X Server, when sharing files on a UFS or re-shared NFS volume, allows remote attackers to overwrite arbitrary files.
Max CVSS
5.0
EPSS Score
0.15%
Published
2003-07-24
Updated
2011-03-08
Information leak in dsimportexport for Apple Macintosh OS X Server 10.2.6 allows local users to obtain the username and password of the account running the tool.
Max CVSS
4.6
EPSS Score
0.04%
Published
2003-06-13
Updated
2017-07-11
Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to cause a denial of service (crash) via an MS-DOS device name (e.g. AUX) in a request to HTTP port 1220, a different vulnerability than CVE-2003-0502.
Max CVSS
10.0
EPSS Score
0.83%
Published
2003-08-27
Updated
2008-09-05
Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to cause a denial of service (crash) via a request to view_broadcast.cgi that does not contain the required parameters.
Max CVSS
5.0
EPSS Score
0.29%
Published
2003-08-27
Updated
2008-09-10
parse_xml.cgi in Apple QuickTime / Darwin Streaming Server before 4.1.3g allows remote attackers to obtain the source code for parseable files via the filename parameter.
Max CVSS
5.0
EPSS Score
0.73%
Published
2003-08-27
Updated
2008-09-10
Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to obtain the source code for scripts by appending encoded space (%20) or . (%2e) characters to an HTTP request for the script, e.g. view_broadcast.cgi.
Max CVSS
5.0
EPSS Score
0.73%
Published
2003-08-27
Updated
2008-09-10
47 vulnerabilities found
1 2
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!