CVE-2003-0907

MediumCVSS 5.1/10Last modified Jun 16, 2026

Description

Help and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code via quotation marks in an hcp:// URL, which are not quoted when constructing the argument list to HelpCtr.exe.

Metrics

CVSS 2.0 5.1/10AV:N/AC:H/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-88

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jun 1, 2004
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2003

CVE-2003-09087.2The Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges, which allows local users to execute arbitrary coCVE-2003-09097.2Windows XP allows local users to execute arbitrary programs by creating a task at an elevated privilege level through the eventtriggers.exe CVE-2003-09107.2The NtSetLdtEntries function in the programming interface for the Local Descriptor Table (LDT) in Windows NT 4.0 and Windows 2000 allows locCVE-2003-09134.6Unknown vulnerability in the Terminal application for Mac OS X 10.3 (Client and Server) may allow "unauthorized access."CVE-2003-09144.3ISC BIND 8.3.x before 8.3.7, and 8.4.x before 8.4.3, allows remote attackers to poison the cache via a malicious name server that returns neCVE-2003-09243.7netpbm 9.25 and earlier does not properly create temporary files, which allows local users to overwrite arbitrary files.CVE-2003-09257.5Buffer overflow in Ethereal 0.9.15 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via CVE-2003-09265.0Ethereal 0.9.15 and earlier, and Tethereal, allows remote attackers to cause a denial of service (crash) via certain malformed (1) ISAKMP orCVE-2003-09277.5Heap-based buffer overflow in Ethereal 0.9.15 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute CVE-2003-09287.5Clearswift MAILsweeper before 4.3.15 does not properly detect and filter RAR 3.20 encoded files, which allows remote attackers to bypass intCVE-2003-09297.5Clearswift MAILsweeper before 4.3.15 does not properly detect and filter ZIP 6.0 encoded files, which allows remote attackers to bypass inteCVE-2003-09307.5Clearswift MAILsweeper before 4.3.15 does not properly detect filenames in BinHex (HQX) encoded files, which allows remote attackers to bypa
CVE-2003-0907: Medium severity, CVSS 5.1 | Vulnix