Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: November 2003

26 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2003-0542
    37Monitor

    Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration

    HighCVSS 7.2No exploitEPSS 30%

    apache · http serverNov 3, 2003

  • CVE-2003-0789
    44Plan

    mod_cgid in Apache before 2.0.48, when using a threaded MPM, does not properly handle CGI redirect paths, which could cause Apache to send t

    CriticalCVSS 10.0No exploitEPSS 12%

    apache · http serverNov 3, 2003

  • CVE-2003-0899
    46Plan

    Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contai

    CriticalCVSS 9.8Proof of conceptEPSS 22%

    acme · thttpdNov 3, 2003

  • CVE-2003-1192
    61This week

    Stack-based buffer overflow in IA WebMail Server 3.1.0 allows remote attackers to execute arbitrary code via a long GET request.

    CriticalCVSS 10.0WeaponizedEPSS 69%

    truenorth software · ia webmail serverNov 3, 2003

  • CVE-2003-1141
    50Plan

    Buffer overflow in NIPrint 4.10 allows remote attackers to execute arbitrary code via a long string to TCP port 515.

    HighCVSS 7.5WeaponizedEPSS 68%

    network instruments · niprint lpd-lpr print serverNov 4, 2003

  • CVE-2003-0543
    28Monitor

    Integer overflow in OpenSSL 0.9.6 and 0.9.7 allows remote attackers to cause a denial of service (crash) via an SSL client certificate with

    MediumCVSS 5.0Proof of conceptEPSS 27%

    openssl · opensslNov 17, 2003

  • CVE-2003-0545
    65This week

    Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code

    CriticalCVSS 9.8No exploitEPSS 87%

    openssl · opensslNov 17, 2003

  • CVE-2003-0659
    41Plan

    Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long (1) LB_D

    HighCVSS 7.2Proof of conceptEPSS 43%

    microsoft · windows 2000Nov 17, 2003

  • CVE-2003-0660
    37Monitor

    The Authenticode capability in Microsoft Windows NT through Server 2003 does not prompt the user to download and install ActiveX controls wh

    HighCVSS 7.5No exploitEPSS 24%

    microsoft · windows 2000Nov 17, 2003

  • CVE-2003-0662
    48Plan

    Buffer overflow in Troubleshooter ActiveX Control (Tshoot.ocx) in Microsoft Windows 2000 SP4 and earlier allows remote attackers to execute

    CriticalCVSS 9.3No exploitEPSS 38%

    microsoft · windows 2000Nov 17, 2003

  • CVE-2003-0711
    41Plan

    Stack-based buffer overflow in the PCHealth system in the Help and Support Center function in Windows XP and Windows Server 2003 allows remo

    HighCVSS 7.5No exploitEPSS 37%

    microsoft · windows 2000Nov 17, 2003

  • CVE-2003-0712
    23Monitor

    Cross-site scripting (XSS) vulnerability in the HTML encoding for the Compose New Message form in Microsoft Exchange Server 5.5 Outlook Web

    MediumCVSS 4.3No exploitEPSS 19%

    microsoft · exchange serverNov 17, 2003

  • CVE-2003-0714
    53Plan

    The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory exhaustion)

    HighCVSS 7.5WeaponizedEPSS 77%

    microsoft · exchange serverNov 17, 2003

  • CVE-2003-0717
    48Plan

    The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers t

    HighCVSS 7.5Proof of conceptEPSS 60%

    microsoft · windows 2000Nov 17, 2003

  • CVE-2003-0809
    38Monitor

    Internet Explorer 5.01 through 6.0 does not properly handle object tags returned from a Web server during XML data binding, which allows rem

    HighCVSS 7.5Proof of conceptEPSS 27%

    microsoft · ieNov 17, 2003

  • CVE-2003-0813
    25Monitor

    A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a d

    MediumCVSS 5.1No exploitEPSS 16%

    microsoft · windows 2000Nov 17, 2003

  • CVE-2003-0831
    54Plan

    ProFTPD 1.2.7 through 1.2.9rc2 does not properly translate newline characters when transferring files in ASCII mode, which allows remote att

    CriticalCVSS 9.0Proof of conceptEPSS 58%

    proftpd project · proftpdNov 17, 2003

  • CVE-2003-0838
    41Plan

    Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window an

    HighCVSS 7.5Proof of conceptEPSS 37%

    microsoft · ieNov 17, 2003

  • CVE-2003-0839
    24Monitor

    Directory traversal vulnerability in the "Shell Folders" capability in Microsoft Windows Server 2003 allows remote attackers to read arbitra

    MediumCVSS 5.0No exploitEPSS 13%

    microsoft · windows 2003 serverNov 17, 2003

  • CVE-2003-0845
    35Monitor

    Unknown vulnerability in the HSQLDB component in JBoss 3.2.1 and 3.0.8 on Java 1.4.x platforms, when running in the default configuration, a

    HighCVSS 7.5Proof of conceptEPSS 15%

    jboss · jbossNov 17, 2003

  • CVE-2003-0849
    33Monitor

    Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified l

    HighCVSS 7.5Proof of conceptEPSS 10%

    gnu · cfengineNov 17, 2003

  • CVE-2003-0853
    23Monitor

    An integer overflow in ls in the fileutils or coreutils packages may allow local users to cause a denial of service or execute arbitrary cod

    MediumCVSS 5.0Proof of conceptEPSS 11%

    gnu · fileutilsNov 17, 2003

  • CVE-2003-0865
    34Monitor

    Heap-based buffer overflow in readstring of httpget.c for mpg123 0.59r and 0.59s allows remote attackers to execute arbitrary code via a lon

    HighCVSS 7.5Proof of conceptEPSS 14%

    mpg123 · mpg123Nov 17, 2003

  • CVE-2003-0866
    30Monitor

    The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via

    MediumCVSS 5.0Proof of conceptEPSS 34%

    apache · tomcatNov 17, 2003

  • CVE-2003-0870
    35Monitor

    Heap-based buffer overflow in Opera 7.11 and 7.20 allows remote attackers to execute arbitrary code via an HREF with a large number of escap

    HighCVSS 7.5Proof of conceptEPSS 15%

    opera · opera browserNov 17, 2003

  • CVE-2003-0896
    34Monitor

    The loadClass method of the sun.applet.AppletClassLoader class in the Java Virtual Machine (JVM) in Sun SDK and JRE 1.4.1_03 and earlier all

    HighCVSS 7.5Proof of conceptEPSS 14%

    sun · jreNov 17, 2003