2004 CVEs (page 16)
Page 16 of 27 — CVEs published in 2004, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2004-1333 | | 2004-12-15 | Integer overflow in the vc_resize function in the Linux kernel 2.4 and 2.6 before 2.6.10 allows local users to cause a denial of service (kernel crash) via a s… | |
CVE-2004-1322 | | 2004-12-15 | Cisco Unity 2.x, 3.x, and 4.x, when integrated with Microsoft Exchange, has several hard coded usernames and passwords, which allows remote attackers to gain u… | |
CVE-2004-1321 | | 2004-12-15 | The configuration backup in Asante FM2008 running firmware 1.06 stores the username and password in cleartext, which could allow remote attackers to gain unaut… | |
CVE-2004-1320 | | 2004-12-15 | Asante FM2008 running firmware 1.06 is shipped with a default username and password, which could allow remote attackers to gain unauthorized access. | |
CVE-2004-1319 | | 2004-12-15 | The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child… | |
CVE-2004-1145 | | 2004-12-15 | Multiple vulnerabilities in Konqueror in KDE 3.3.1 and earlier (1) allow access to restricted Java classes via JavaScript and (2) do not properly restrict acce… | |
CVE-2004-1142 | | 2004-12-15 | Ethereal 0.9.0 through 0.10.7 allows remote attackers to cause a denial of service (CPU consumption) via a certain malformed SMB packet. | |
CVE-2004-1139 | | 2004-12-15 | Unknown vulnerability in the DICOM dissector in Ethereal 0.10.4 through 0.10.7 allows remote attackers to cause a denial of service (application crash). | |
CVE-2004-1059 | | 2004-12-10 | Multiple cross-site scripting (XSS) vulnerabilities in mnoGoSearch 3.2.26 and earlier allow remote attackers to inject arbitrary HTML and web script via the (1… | |
CVE-2004-1351 | | 2004-12-07 | Unknown vulnerability in the rwho daemon (in.rwhod) for Solaris 7 through 9 allows remote attackers to execute arbitrary code. | |
CVE-2004-0635 | | 2004-12-06 | The SNMP dissector in Ethereal 0.8.15 through 0.10.4 allows remote attackers to cause a denial of service (process crash) via a (1) malformed or (2) missing co… | |
CVE-2004-0634 | | 2004-12-06 | The SMB SID snooping capability in Ethereal 0.9.15 to 0.10.4 allows remote attackers to cause a denial of service (process crash) via a handle without a policy… | |
CVE-2004-0633 | | 2004-12-06 | The iSNS dissector for Ethereal 0.10.3 through 0.10.4 allows remote attackers to cause a denial of service (process abort) via an integer overflow. | |
CVE-2004-0628 | | 2004-12-06 | Stack-based buffer overflow in MySQL 4.1.x before 4.1.3, and 5.0, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary c… | |
CVE-2004-0627 | | 2004-12-06 | The check_scramble_323 function in MySQL 4.1.x before 4.1.3, and 5.0, allows remote attackers to bypass authentication via a zero-length scrambled string. | |
CVE-2004-0626 | | 2004-12-06 | The tcp_find_option function of the netfilter subsystem in Linux kernel 2.6, when using iptables and TCP options rules, allows remote attackers to cause a deni… | |
CVE-2004-0625 | | 2004-12-06 | SQL injection vulnerability in Infinity WEB 1.0 allows remote attackers to bypass authentication and gain privileges via the login page. | |
CVE-2004-0624 | | 2004-12-06 | PHP remote file inclusion vulnerability in index.php for Artmedic links 5.0 (artmedic_links5) allows remote attackers to execute arbitrary PHP code by modifyin… | |
CVE-2004-0623 | | 2004-12-06 | Format string vulnerability in misc.c in GNU GNATS 4.00 may allow remote attackers to execute arbitrary code via format string specifiers in a string that gets… | |
CVE-2004-0622 | | 2004-12-06 | Apple Mac OS X 10.3.4, 10.4, 10.5, and possibly other versions does not properly clear memory for login (aka Loginwindow.app), Keychain, or FileVault passwords… | |
CVE-2004-0621 | | 2004-12-06 | admin.php in Newsletter ZWS allows remote attackers to gain administrative privileges via a list_user operation with the ulevel parameter set to 1 (administrat… | |
CVE-2004-0620 | | 2004-12-06 | Cross-site scripting (XSS) vulnerability in (1) newreply.php or (2) newthread.php in vBulletin 3.0.1 allows remote attackers to inject arbitrary HTML or script… | |
CVE-2004-0619 | | 2004-12-06 | Integer overflow in the ubsec_keysetup function for Linux Broadcom 5820 cryptonet driver allows local users to cause a denial of service (crash) and possibly e… | |
CVE-2004-0618 | | 2004-12-06 | FreeBSD 5.1 for the Alpha processor allows local users to cause a denial of service (crash) via an execve system call with an unaligned memory address as an ar… | |
CVE-2004-0617 | | 2004-12-06 | Cross-site scripting (XSS) vulnerability in ArbitroWeb 0.6 allows remote attackers to inject arbitrary script or HTML via the rawURL parameter. | |
CVE-2004-0616 | | 2004-12-06 | The BT Voyager 2000 Wireless ADSL Router has a default public SNMP community name, which allows remote attackers to obtain sensitive information such as the pa… | |
CVE-2004-0615 | | 2004-12-06 | Cross-site scripting (XSS) vulnerability in D-Link DI-614+ SOHO router running firmware 2.30, and DI-704 SOHO router running firmware 2.60B2, and DI-624, allow… | |
CVE-2004-0614 | | 2004-12-06 | osTicket trusts a hidden form field in the submit form to limit the upload size of a document, which could allow remote attackers to upload a file of any size. | |
CVE-2004-0613 | | 2004-12-06 | osTicket allows remote attackers to view sensitive uploaded files and possibly execute arbitrary code via an HTTP request that uploads a PHP file to the ticket… | |
CVE-2004-0612 | | 2004-12-06 | The Mobile Code filter in ZoneAlarm Pro 5.0.590.015 does not filter mobile code within an SSL encrypted session, which could allow remote attackers to bypass t… | |
CVE-2004-0611 | | 2004-12-06 | Web-Based Administration in Netgear FVS318 VPN Router allows remote attackers to cause a denial of service (no new connections) via a large number of open HTTP… | |
CVE-2004-0610 | | 2004-12-06 | The Web administration interface in Microsoft MN-500 Wireless Router allows remote attackers to cause a denial of service (connection refusal) via a large numb… | |
CVE-2004-0609 | | 2004-12-06 | rssh 2.0 through 2.1.x expands command line arguments before entering a chroot jail, which allows remote authenticated users to determine the existence of file… | |
CVE-2004-0608 | | 2004-12-06 | The Unreal Engine, as used in DeusEx 1.112fm and earlier, Devastation 390 and earlier, Mobile Forces 20000 and earlier, Nerf Arena Blast 1.2 and earlier, Posta… | |
CVE-2004-0607 | | 2004-12-06 | The eay_check_x509cert function in KAME Racoon successfully verifies certificates even when OpenSSL validation fails, which could allow remote attackers to byp… | |
CVE-2004-0606 | | 2004-12-06 | Cross-site scripting (XSS) vulnerability in Infoblox DNS One running firmware 2.4.0-8 and earlier allows remote attackers to execute arbitrary scripts as other… | |
CVE-2004-0605 | | 2004-12-06 | Non-registered IRC users using (1) ircd-hybrid 7.0.1 and earlier, (2) ircd-ratbox 1.5.1 and earlier, or (3) ircd-ratbox 2.0rc6 and earlier do not have a rate-l… | |
CVE-2004-0604 | | 2004-12-06 | The HTTP client and server in giFT-FastTrack 0.8.6 and earlier allows remote attackers to cause a denial of service (crash), possibly via an empty search query… | |
CVE-2004-0603 | | 2004-12-06 | gzexe in gzip 1.3.3 and earlier will execute an argument when the creation of a temp file fails instead of exiting the program, which could allow remote attack… | |
CVE-2004-0602 | | 2004-12-06 | The binary compatibility mode for FreeBSD 4.x and 5.x does not properly handle certain Linux system calls, which could allow local users to access kernel memor… | |
CVE-2004-0590 | | 2004-12-06 | FreeS/WAN 1.x and 2.x, and other related products including superfreeswan 1.x, openswan 1.x before 1.0.6, openswan 2.x before 2.1.4, and strongSwan before 2.1… | |
CVE-2004-0578 | | 2004-12-06 | WinGate 5.2.3 build 901 and 6.0 beta 2 build 942, and other versions such as 5.0.5, allows remote attackers to read arbitrary files via leading slash (//) char… | |
CVE-2004-0577 | | 2004-12-06 | WinGate 5.2.3 build 901 and 6.0 beta 2 build 942, and other versions such as 5.0.5, allows remote attackers to read arbitrary files from the root directory via… | |
CVE-2004-0576 | | 2004-12-06 | The radius daemon (radiusd) for GNU Radius 1.1, when compiled with the -enable-snmp option, allows remote attackers to cause a denial of service (server crash)… | |
CVE-2004-0565 | | 2004-12-06 | Floating point information leak in the context switch code for Linux 2.4.x only checks the MFH bit but does not verify the FPH owner, which allows local users… | |
CVE-2004-0497 | | 2004-12-06 | Unknown vulnerability in Linux kernel 2.x may allow local users to modify the group ID of files, such as NFS exported files in kernel 2.4. | |
CVE-2004-0496 | | 2004-12-06 | Multiple unknown vulnerabilities in Linux kernel 2.6 allow local users to gain privileges or access kernel memory, a different set of vulnerabilities than thos… | |
CVE-2004-0480 | | 2004-12-06 | Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via a notes: URI that uses a UNC network sh… | |
CVE-2004-0477 | | 2004-12-06 | Unknown vulnerability in 3Com OfficeConnect Remote 812 ADSL Router allows remote attackers to bypass authentication via repeated attempts using any username an… | |
CVE-2004-0468 | | 2004-12-06 | Memory leak in Juniper JUNOS Packet Forwarding Engine (PFE) allows remote attackers to cause a denial of service (memory exhaustion and device reboot) via cert… | |
CVE-2004-0456 | | 2004-12-06 | Stack-based buffer overflow in pavuk 0.9pl28, 0.9pl27, and possibly other versions allows remote web sites to execute arbitrary code via a long HTTP Location h… | |
CVE-2004-0455 | | 2004-12-06 | Buffer overflow in cgi.c in www-sql before 0.5.7 allows local users to execute arbitrary code via a web page that is processed by www-sql. | |
CVE-2004-0454 | | 2004-12-06 | Buffer overflow in the msg function for rlpr daemon (rlprd) 2.04 allows local users to execute arbitrary code. | |
CVE-2004-0451 | | 2004-12-06 | Multiple format string vulnerabilities in the (1) logquit, (2) logerr, or (3) loginfo functions in Software Upgrade Protocol (SUP) allows remote attackers to e… | |
CVE-2004-0448 | | 2004-12-06 | Format string vulnerability in the log function for jftpgw 0.13.4 and earlier allows remote authenticated users to execute arbitrary code via format string spe… | |
CVE-2004-0395 | | 2004-12-06 | The xatitv program in the gatos package does not properly drop root privileges when the configuration file does not exist, which allows local users to execute… | |
CVE-2004-0393 | | 2004-12-06 | Format string vulnerability in the msg function for rlpr daemon (rlprd) 2.0.4 allows remote attackers to execute arbitrary code via format string specifiers in… | |
CVE-2004-1083 | High | 7.5 | 2004-12-03 | Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insens… |
CVE-2004-1089 | | 2004-12-02 | Unknown vulnerability in Apple Mac OS X 10.3.6 server, when using Kerberos authentication and Cyrus IMAP allows local users to access mailboxes of other users. | |
CVE-2004-1088 | | 2004-12-02 | Postfix server for Apple Mac OS X 10.3.6, when using CRAM-MD5, allows remote attackers to send mail without authentication by replaying authentication informat… | |
CVE-2004-1087 | | 2004-12-02 | Terminal for Apple Mac OS X 10.3.6 may indicate that "Secure Keyboard Entry" is enabled even when it is not, which could result in a false sense of security fo… | |
CVE-2004-1086 | | 2004-12-02 | Buffer overflow in PSNormalizer for Apple Mac OS X 10.3.6 allows remote attackers to execute arbitrary code via a crafted PostScript input file. | |
CVE-2004-1085 | | 2004-12-02 | Human Interface Toolbox (HIToolBox) for Apple Mac 0S X 10.3.6 allows local users to exit applications via the force-quit key combination, even when the system… | |
CVE-2004-1084 | | 2004-12-02 | Apache for Apple Mac OS X 10.2.8 and 10.3.6 allows remote attackers to read files and resource fork content via HTTP requests to certain special file names rel… | |
CVE-2004-1081 | | 2004-12-02 | The Application Framework (AppKit) for Apple Mac OS X 10.2.8 and 10.3.6 does not properly restrict access to a secure text input field, which allows local user… | |
CVE-2004-1352 | | 2004-12-01 | Buffer overflow in the ping daemon of Sun Solaris 7 through 9 may allow local users to execute arbitrary code. | |
CVE-2004-1771 | | 2004-11-30 | Scalable OGo (SOGo) 1.0 allows remote authenticated users to bypass intended permissions and view private appointments of other users. | |
CVE-2004-0308 | | 2004-11-24 | Unknown vulnerability in Cisco ONS 15327 before 4.1(3), ONS 15454 before 4.6(1), ONS 15454 SD before 4.1(3), and Cisco ONS15600 before 1.3(0) allows a superuse… | |
CVE-2004-0771 | | 2004-11-23 | Buffer overflow in the extract_one function from lhext.c in LHA may allow attackers to execute arbitrary code via a long w (working directory) command line opt… | |
CVE-2004-0744 | | 2004-11-23 | The TCP/IP Networking component in Mac OS X before 10.3.5 allows remote attackers to cause a denial of service (memory and resource consumption) via a "Rose At… | |
CVE-2004-0743 | | 2004-11-23 | Safari in Mac OS X before 10.3.5, after sending form data using the POST method, may re-send the data to a GET method URL if that URL is redirected after the P… | |
CVE-2004-0636 | | 2004-11-23 | Buffer overflow in the goaway function in the aim:goaway URI handler for AOL Instant Messenger (AIM) 5.5, including 5.5.3595, allows remote attackers to execut… | |
CVE-2004-0599 | | 2004-11-23 | Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capabil… | |
CVE-2004-0598 | | 2004-11-23 | The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that… | |
CVE-2004-0597 | | 2004-11-23 | Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images… | |
CVE-2004-0494 | | 2004-11-23 | Multiple extfs backend scripts for GNOME virtual file system (VFS) before 1.0.1 may allow remote attackers to perform certain unauthorized actions via a gnome-… | |
CVE-2004-0415 | | 2004-11-23 | Linux kernel does not properly convert 64-bit file offset pointers to 32 bits, which allows local users to access portions of kernel memory. | |
CVE-2004-0361 | | 2004-11-23 | The Javascript engine in Safari 1.2 and earlier allows remote attackers to cause a denial of service (segmentation fault) by creating a new Array object with a… | |
CVE-2004-0360 | | 2004-11-23 | Unknown vulnerability in passwd(1) in Solaris 8.0 and 9.0 allows local users to gain privileges via unknown attack vectors. | |
CVE-2004-0359 | | 2004-11-23 | Cross-site scripting (XSS) vulnerability in index.php for Invision Power Board 1.3 final allows remote attackers to execute arbitrary script as other users via… | |
CVE-2004-0358 | | 2004-11-23 | Cross-site scripting (XSS) vulnerability in VirtuaNews Admin Panel Pro 1.0.3 allows remote attackers to execute arbitrary script as other users via (1) the mai… | |
CVE-2004-0357 | | 2004-11-23 | Stack-based buffer overflows in SL Mail Pro 2.0.9 allow remote attackers to execute arbitrary code via (1) user.dll, (2) loadpageadmin.dll or (3) loadpageuser… | |
CVE-2004-0356 | | 2004-11-23 | Stack-based buffer overflow in Supervisor Report Center in SL Mail Pro 2.0.9 and earlier allows remote attackers to execute arbitrary code via an HTTP request… | |
CVE-2004-0355 | | 2004-11-23 | Invision Power Board 1.3 Final allows remote attackers to gain sensitive information by selecting a file for "Personal Photo" that is not an image file, which… | |
CVE-2004-0354 | | 2004-11-23 | Multiple format string vulnerabilities in GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to execute arbitrary code via format string… | |
CVE-2004-0353 | | 2004-11-23 | Multiple buffer overflows in auth_ident() function in auth.c for GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to gain privileges vi… | |
CVE-2004-0352 | | 2004-11-23 | Cisco 11000 Series Content Services Switches (CSS) running WebNS 5.0(x) before 05.0(04.07)S, and 6.10(x) before 06.10(02.05)S allow remote attackers to cause a… | |
CVE-2004-0351 | | 2004-11-23 | Spider Sales shopping cart stores the private key in the same database and table as the public key, which allows local users with access to the database to dec… | |
CVE-2004-0350 | | 2004-11-23 | SpiderSales shopping cart does not enforce a minimum length for the private key, which can make it easier for local users to obtain the private key by factorin… | |
CVE-2004-0349 | | 2004-11-23 | Directory traversal vulnerability in GWeb HTTP Server 0.6 allows remote attackers to view arbitrary files via a .. (dot dot) in the URL. | |
CVE-2004-0348 | | 2004-11-23 | SQL injection vulnerability in viewCart.asp in SpiderSales shopping cart software allows remote attackers to execute arbitrary SQL via the userId parameter. | |
CVE-2004-0347 | | 2004-11-23 | Cross-site scripting (XSS) vulnerability in delhomepage.cgi in NetScreen-SA 5000 Series running firmware 3.3 Patch 1 (build 4797) allows remote authenticated u… | |
CVE-2004-0346 | High | 7.8 | 2004-11-23 | Off-by-one buffer overflow in _xlate_ascii_write() in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command. |
CVE-2004-0345 | | 2004-11-23 | Buffer overflow in Red Faction client 1.20 and earlier allows remote servers to execute arbitrary code via a long server name. | |
CVE-2004-0344 | | 2004-11-23 | Directory traversal vulnerability in ModifyMessage.php in YaBB SE 1.5.4 through 1.5.5b allows remote attackers to delete arbitrary files via a .. (dot dot) in… | |
CVE-2004-0343 | | 2004-11-23 | Multiple SQL injection vulnerabilities in YaBB SE 1.5.4 through 1.5.5b allow remote attackers to execute arbitrary SQL via (1) the msg parameter in ModifyMessa… | |
CVE-2004-0342 | Medium | 5.5 | 2004-11-23 | WFTPD Pro Server 3.21 Release 1, with the XeroxDocutech option enabled, allows local users to cause a denial of service (crash) via a (1) MKD or (2) XMKD comma… |
CVE-2004-0341 | | 2004-11-23 | WFTPD Pro Server 3.21 Release 1 allocates memory for a command until a 0Ah byte (newline) is sent, which allows local users to cause a denial of service (CPU c… | |
CVE-2004-0340 | | 2004-11-23 | Stack-based buffer overflow in WFTPD Pro Server 3.21 Release 1, Pro Server 3.20 Release 2, Server 3.21 Release 1, and Server 3.10 allows local users to execute… | |
CVE-2004-0339 | | 2004-11-23 | Cross-site scripting (XSS) vulnerability in ViewTopic.php in phpBB, possibly 2.0.6c and earlier, allows remote attackers to execute arbitrary script or HTML as… |