CVE-2003-0154

Cross-site scripting vulnerabilities (XSS) in bonsai Mozilla CVS query tool allow remote attackers to execute arbitrary web script via (1) the file, root, or rev parameters to cvslog.cgi, (2) the file or root parameters to cvsblame.cgi, (3) various parameters to cvsquery.cgi, (4) the person parameter to showcheckins.cgi, (5) the module parameter to cvsqueryform.cgi, and (6) possibly other attack vectors as identified by Mozilla bug #146244.

• http://bugzilla.mozilla.org/attachment.cgi?id=95950&action=view
• http://bugzilla.mozilla.org/attachment.cgi?id=95985&action=view
• http://bugzilla.mozilla.org/show_bug.cgi?id=146244
• http://bugzilla.mozilla.org/show_bug.cgi?id=163573
• http://marc.info/?l=bugtraq&m=102980129101054&w=2
• http://www.debian.org/security/2003/dsa-265Patch, Vendor Advisory
• http://www.iss.net/security_center/static/9920.php
• http://www.securityfocus.com/bid/5516Exploit, Patch, Vendor Advisory
• http://bugzilla.mozilla.org/attachment.cgi?id=95950&action=view
• http://bugzilla.mozilla.org/attachment.cgi?id=95985&action=view
• http://bugzilla.mozilla.org/show_bug.cgi?id=146244
• http://bugzilla.mozilla.org/show_bug.cgi?id=163573
• http://marc.info/?l=bugtraq&m=102980129101054&w=2
• http://www.debian.org/security/2003/dsa-265Patch, Vendor Advisory
• http://www.iss.net/security_center/static/9920.php
• http://www.securityfocus.com/bid/5516Exploit, Patch, Vendor Advisory

Published

Apr 2, 2003

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2003-0148The default installation of MSDE via McAfee ePolicy Orchestr…
• CVE-2003-0149Heap-based buffer overflow in ePO agent for McAfee ePolicy O…
• CVE-2003-0150MySQL 3.23.55 and earlier creates world-writeable files and …
• CVE-2003-0151BEA WebLogic Server and Express 6.0 through 7.0 does not pro…
• CVE-2003-0152Unknown vulnerability in bonsai Mozilla CVS query tool allow…
• CVE-2003-0153bonsai Mozilla CVS query tool leaks the absolute pathname of…
• CVE-2003-0155bonsai Mozilla CVS query tool allows remote attackers to gai…
• CVE-2003-0156Directory traversal vulnerability in Cross-Referencing Linux…
• CVE-2003-0157Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2003-0158Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2003-0159Heap-based buffer overflow in the NTLMSSP code for Ethereal …
• CVE-2003-0160Multiple cross-site scripting (XSS) vulnerabilities in Squir…