2004 CVEs (page 19)
Page 19 of 27 — CVEs published in 2004, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2004-1617 | | 2004-10-18 | Lynx, lynx-ssl, and lynx-cur before 2.8.6dev.8 allow remote attackers to cause a denial of service (infinite loop) via a web page or HTML email that contains i… | |
CVE-2004-1616 | | 2004-10-18 | Links allows remote attackers to cause a denial of service (memory consumption) via a web page or HTML email that contains a table with a td element and a larg… | |
CVE-2004-1615 | | 2004-10-18 | Opera allows remote attackers to cause a denial of service (invalid memory reference and application crash) via a web page or HTML email that contains a TBODY… | |
CVE-2004-1614 | | 2004-10-18 | Mozilla allows remote attackers to cause a denial of service (application crash from invalid memory access) via an "unusual combination of visual elements," in… | |
CVE-2004-1613 | | 2004-10-18 | Mozilla allows remote attackers to cause a denial of service (application crash from null dereference or infinite loop) via a web page that contains a (1) TEXT… | |
CVE-2004-1612 | | 2004-10-18 | Directory traversal vulnerability in SalesLogix 6.1 allows remote attackers to upload arbitrary files via a .. (dot dot) in a ProcessQueueFile request. | |
CVE-2004-1611 | | 2004-10-18 | SalesLogix 6.1 does not verify if a user is authenticated before performing sensitive operations, which could allow remote attackers to (1) execute arbitrary S… | |
CVE-2004-1610 | | 2004-10-18 | SalesLogix 6.1 uses client-specified pathnames for writing certain files, which might allow remote authenticated users to create arbitrary files and execute co… | |
CVE-2004-1609 | | 2004-10-18 | SalesLogix 6.1 includes usernames, passwords, and other sensitive information in the headers of an HTTP response, which could allow remote attackers to gain ac… | |
CVE-2004-1608 | | 2004-10-18 | SQL injection vulnerability in SalesLogix 6.1 allows remote attackers to execute arbitrary SQL statements via the id parameter in a view operation. | |
CVE-2004-1607 | | 2004-10-18 | slxweb.dll in SalesLogix 6.1 allows remote attackers to obtain sensitive information via a (1) Library or (2) Attachment request with an invalid file parameter… | |
CVE-2004-1606 | | 2004-10-18 | slxweb.dll in SalesLogix 6.1 allows remote attackers to cause a denial service (application crash) via an invalid HTTP request, which might also leak sensitive… | |
CVE-2004-1603 | Medium | 5.5 | 2004-10-18 | cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .h… |
CVE-2004-1638 | | 2004-10-16 | Buffer overflow in MailCarrier 2.51 allows remote attackers to execute arbitrary code via a long (1) EHLO and possibly (2) HELO command. | |
CVE-2004-1601 | | 2004-10-16 | Directory traversal vulnerability in index.php in CoolPHP 1.0-stable allows remote attackers to access arbitrary files and execute local PHP scripts via a .. (… | |
CVE-2004-1600 | | 2004-10-16 | index.php in CoolPHP 1.0-stable allows remote attackers to gain sensitive information via an invalid op parameter, which reveals the path in an error message. | |
CVE-2004-1599 | | 2004-10-16 | Cross-site scripting (XSS) vulnerability in index.php in CoolPHP 1.0-stable allows remote attackers to execute arbitrary web script or HTML via the (1) query o… | |
CVE-2004-1602 | | 2004-10-15 | ProFTPD 1.2.x, including 1.2.8 and 1.2.10, responds in a different amount of time when a given username exists, which allows remote attackers to identify valid… | |
CVE-2004-1700 | | 2004-10-14 | Cross-site scripting (XSS) vulnerability in SettingsBase.php in Pinnacle ShowCenter 1.51 build 121 allows remote attackers to inject arbitrary HTML or web scri… | |
CVE-2004-1605 | | 2004-10-14 | SalesLogix 6.1 allows remote attackers to bypass authentication by modifying the slxweb cookie to set user=Admin, teams=ADMIN!, and usertype=Administrator. | |
CVE-2004-1597 | | 2004-10-13 | RIM Blackberry 7230 running RIM Blackberry OS 3.7 SP1 allows remote attackers to cause a denial of service (device reboot and possibly data corruption) via a c… | |
CVE-2004-1596 | | 2004-10-13 | The 3COM Wireless router 3CRADSL72 running Boot Code 1.3d allows remote attackers to gain sensitive information such as passwords and router settings via a dir… | |
CVE-2004-1595 | | 2004-10-13 | Buffer overflow in ShixxNote 6.net build 117 allows remote attackers to execute arbitrary code via a long font field. | |
CVE-2004-1594 | | 2004-10-13 | Cross-site scripting (XSS) vulnerability in FuseTalk 4.0 allows remote attackers to execute arbitrary web script via an img src tag. | |
CVE-2004-1674 | | 2004-10-12 | viewaction.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to (1) delete arbitrary files via th… | |
CVE-2004-1673 | | 2004-10-12 | accountsettings_add.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allow remote attackers to create text files with ar… | |
CVE-2004-1672 | | 2004-10-12 | attachment.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to view other users' attachments by… | |
CVE-2004-1671 | | 2004-10-12 | Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to gain sensitive information via a direct request to (… | |
CVE-2004-1598 | | 2004-10-12 | Adobe Acrobat and Acrobat Reader 6.0 allow remote attackers to read arbitrary files via a PDF file that contains an embedded Shockwave (swf) file that referenc… | |
CVE-2004-0928 | | 2004-10-05 | The Microsoft IIS Connector in JRun 4.0 and Macromedia ColdFusion MX 6.0, 6.1, and 6.1 J2EE allows remote attackers to bypass authentication and view source fi… | |
CVE-2004-1349 | | 2004-10-04 | gzip before 1.3 in Solaris 8, when called with the -f or -force flags, will change the permissions of files that are hard linked to the target files, which all… | |
CVE-2004-1604 | | 2004-09-30 | cPanel 9.9.1-RELEASE-3 allows remote authenticated users to chmod arbitrary files via a symlink attack on the _private directory, which is created when Front P… | |
CVE-2004-0745 | | 2004-09-28 | LHA 1.14 and earlier allows attackers to execute arbitrary commands via a directory with shell metacharacters in its name. | |
CVE-2004-0699 | | 2004-09-28 | Heap-based buffer overflow in ASN.1 decoding library in Check Point VPN-1 products, when Aggressive Mode IKE is implemented, allows remote attackers to execute… | |
CVE-2004-0693 | | 2004-09-28 | The GIF parser in the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (application crash) via a malformed image file that tr… | |
CVE-2004-0692 | | 2004-09-28 | The XPM parser in the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (application crash) via a malformed image file that tr… | |
CVE-2004-0691 | | 2004-09-28 | Heap-based buffer overflow in the BMP image format parser for the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (applicati… | |
CVE-2004-0690 | | 2004-09-28 | The DCOPServer in KDE 3.2.3 and earlier allows local users to gain unauthorized access via a symlink attack on DCOP files in the /tmp directory. | |
CVE-2004-0689 | High | 7.1 | 2004-09-28 | KDE before 3.3.0 does not properly handle when certain symbolic links point to "stale" locations, which could allow local users to create or truncate arbitrary… |
CVE-2004-0644 | | 2004-09-28 | The asn1buf_skiptail function in the ASN.1 decoder library for MIT Kerberos 5 (krb5) 1.2.2 through 1.3.4 allows remote attackers to cause a denial of service (… | |
CVE-2004-0643 | | 2004-09-28 | Double free vulnerability in the krb5_rd_cred function for MIT Kerberos 5 (krb5) 1.3.1 and earlier may allow local users to execute arbitrary code. | |
CVE-2004-0642 | | 2004-09-28 | Double free vulnerabilities in the error handling code for ASN.1 decoders in the (1) Key Distribution Center (KDC) library and (2) client library for MIT Kerbe… | |
CVE-2004-0629 | | 2004-09-28 | Buffer overflow in the ActiveX component (pdf.ocx) for Adobe Acrobat 5.0.5 and Acrobat Reader, and possibly other versions, allows remote attackers to execute… | |
CVE-2004-0593 | | 2004-09-28 | Sygate Enforcer 3.5MR1 and earlier passes broadcast traffic before authentication, which could allow remote attackers to bypass filtering rules. | |
CVE-2004-0573 | | 2004-09-28 | Buffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attacke… | |
CVE-2004-0558 | | 2004-09-28 | The Internet Printing Protocol (IPP) implementation in CUPS before 1.1.21 allows remote attackers to cause a denial of service (service hang) via a certain UDP… | |
CVE-2004-0500 | | 2004-09-28 | Buffer overflow in the MSN protocol plugins (1) object.c and (2) slp.c for Gaim before 0.82 allows remote attackers to cause a denial of service and possibly e… | |
CVE-2004-0458 | High | 7.5 | 2004-09-28 | mah-jong before 1.6.2 allows remote attackers to cause a denial of service (server crash) via a missing argument, which triggers a null pointer dereference. |
CVE-2004-0457 | | 2004-09-28 | The mysqlhotcopy script in mysql 4.0.20 and earlier, when using the scp method from the mysql-server package, allows local users to overwrite arbitrary files v… | |
CVE-2004-0408 | | 2004-09-28 | Buffer overflow in the child_service function in the ident2 ident daemon allows remote attackers to execute arbitrary code. | |
CVE-2004-0200 | | 2004-09-28 | Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execu… | |
CVE-2004-0163 | | 2004-09-28 | Sygate Secure Enterprise (SSE) 3.5MR3 and earlier does not change the key used to encrypt data, which allows remote attackers to cause a denial of service (res… | |
CVE-2004-1698 | | 2004-09-24 | The Base64 function in PopMessenger 1.60 (before 20 Sep 2004) and earlier allows remote attackers to cause a denial of service (application crash) via invalid… | |
CVE-2004-1699 | | 2004-09-21 | SettingsBase.php in Pinnacle ShowCenter 1.51 allows remote attackers to cause a denial of service (web interface errors) via an invalid Skin parameter. | |
CVE-2004-1697 | | 2004-09-21 | The "Forgot your Password" link in Computer Associates (CA) Unicenter Management Portal 2.0 and 3.1 displays different error messages for users that exist and… | |
CVE-2004-1696 | | 2004-09-21 | EmuLive Server4 Commerce Edition Build 7560 allows remote attackers to cause a denial of service (application crash) via a sequence of carriage returns sent to… | |
CVE-2004-1694 | | 2004-09-21 | Symantec ON Command CCM 5.4.x and iCommand 3.0.x has four default usernames and passwords, one of which is hardcoded, which allows remote attackers to gain una… | |
CVE-2004-1378 | | 2004-09-21 | The expat XML parser code, as used in the open source Jabber (jabberd) 1.4.3 and earlier, jadc2s 0.9.0 and earlier, and possibly other packages, allows remote… | |
CVE-2004-1695 | | 2004-09-20 | EmuLive Server4 Commerce Edition Build 7560 allows remote attackers to bypass authentication for the remote administration feature via a URL that contains an e… | |
CVE-2004-1693 | | 2004-09-18 | PHP remote file inclusion vulnerability in Function.php in Mambo 4.5 (1.0.9) allows remote attackers to execute arbitrary PHP code by modifying the mosConfig_a… | |
CVE-2004-1692 | | 2004-09-18 | Cross-site scripting (XSS) vulnerability in index.php in Mambo 4.5 (1.0.9) allows remote attackers to inject arbitrary web script or HTML via the (1) Itemid, (… | |
CVE-2004-1691 | | 2004-09-18 | The Web Server in DNS4Me 3.0.0.4 allows remote attackers to cause a denial of service (CPU consumption and crash) via a large amount of data. | |
CVE-2004-1690 | | 2004-09-18 | Cross-site scripting (XSS) vulnerability in the Web Server in DNS4Me 3.0.0.4 allows remote attackers to execute arbitrary web script or HTML via the URL. | |
CVE-2004-0534 | | 2004-09-17 | Cross-site scripting (XSS) vulnerability in Business Objects InfoView 5.1.4 through 5.1.8 for WebIntelligence 2.7.0 through 2.7.4 allows remote attackers to in… | |
CVE-2004-1689 | | 2004-09-16 | sudoedit (aka sudo -e) in sudo 1.6.8 opens a temporary file with root privileges, which allows local users to read arbitrary files via a symlink attack on the… | |
CVE-2004-1688 | | 2004-09-16 | Pigeon Server 3.02.0143 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a long login name sent to port… | |
CVE-2004-1687 | | 2004-09-16 | CRLF injection vulnerability in down.asp for Snitz Forums 2000 3.4.04 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTM… | |
CVE-2004-1379 | | 2004-09-16 | Heap-based buffer overflow in the DVD subpicture decoder in xine xine-lib 1-rc5 and earlier allows remote attackers to execute arbitrary code via a (1) DVD or… | |
CVE-2004-0872 | | 2004-09-16 | Opera does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which c… | |
CVE-2004-0871 | | 2004-09-16 | Mozilla does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which… | |
CVE-2004-0870 | | 2004-09-16 | KDE Konqueror does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain… | |
CVE-2004-0869 | | 2004-09-16 | Internet Explorer does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same dom… | |
CVE-2004-0866 | | 2004-09-16 | Internet Explorer 6.0 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk, and .sch.uk, which could allow remote a… | |
CVE-2004-0827 | | 2004-09-16 | Multiple buffer overflows in the ImageMagick graphics library 5.x before 5.4.4, and 6.x before 6.0.6.2, allow remote attackers to cause a denial of service (ap… | |
CVE-2004-0809 | | 2004-09-16 | The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK reque… | |
CVE-2004-0801 | | 2004-09-16 | Unknown vulnerability in foomatic-rip in Foomatic before 3.0.2 allows local users or remote attackers with access to CUPS to execute arbitrary commands. | |
CVE-2004-1686 | | 2004-09-15 | Internet Explorer 6.0 in Windows XP SP2 allows remote attackers to bypass the Information Bar prompt for ActiveX and Javascript via an XHTML page that contains… | |
CVE-2004-1685 | | 2004-09-15 | SMC routers SMC7004VWBR running firmware 1.00.014 and SMC7008ABR EU running firmware 1.42.003 allow remote attackers to bypass authentication by connecting to… | |
CVE-2004-0905 | | 2004-09-14 | Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to perform cross-domain scripting and poss… | |
CVE-2004-0831 | | 2004-09-14 | McAfee VirusScan 4.5.1 does not drop SYSTEM privileges before allowing users to browse for files via the "System Scan" properties of the System Tray applet, wh… | |
CVE-2004-1684 | | 2004-09-13 | Zyxel P681 running ZyNOS Vt020225a contains portions of memory in an ARP request, which allows remote attackers to obtain sensitive information by sniffing the… | |
CVE-2004-1683 | | 2004-09-13 | A race condition in crrtrap for QNX RTP 6.1 allows local users to gain privileges by modifying the PATH environment variable to reference a malicious io-graphi… | |
CVE-2004-1680 | | 2004-09-13 | application.cgi in the Pingtel Xpressa handset running firmware 2.1.11.24 allows remote authenticated users to cause a denial of service (VxWorks OS crash) via… | |
CVE-2004-1678 | | 2004-09-13 | Directory traversal vulnerability in pdesk.cgi in PerlDesk allows remote attackers to read portions of arbitrary files and possibly execute arbitrary Perl modu… | |
CVE-2004-0838 | | 2004-09-13 | Lexar Safe Guard for JumpDrive Secure 1.0 stores the password insecurely in memory using XOR encryption, which allows local users to read the password directly… | |
CVE-2004-0807 | | 2004-09-13 | Samba 3.0.6 and earlier allows remote attackers to cause a denial of service (infinite loop and memory exhaustion) via certain malformed requests that cause ne… | |
CVE-2004-1677 | | 2004-09-12 | pdesk.cgi in PerlDesk allows remote attackers to gain sensitive information via an invalid lang parameter, which includes pathname information in an error mess… | |
CVE-2004-1676 | | 2004-09-12 | Heap-based buffer overflow in the image sending feature in Gadu-Gadu 6.0 build 149 allows remote attackers to execute arbitrary code via a crafted GG_MSG_IMAGE… | |
CVE-2004-1675 | | 2004-09-11 | Serv-U FTP server 4.x and 5.x allows remote attackers to cause a denial of service (application crash) via a STORE UNIQUE (STOU) command with an MS-DOS device… | |
CVE-2004-1670 | | 2004-09-10 | Multiple directory traversal vulnerabilities Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7, and possibly other versions, allow remote attackers to (1) cr… | |
CVE-2004-1669 | | 2004-09-10 | Cross-site scripting (XSS) vulnerability in MERAK Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to execute… | |
CVE-2004-1668 | | 2004-09-10 | Multiple SQL injection vulnerabilities in index.php in Subjects 2.0 Postnuke module allow remote attackers to execute arbitrary SQL commands via the (1) pageid… | |
CVE-2004-1667 | | 2004-09-09 | Off-by-one error in Halo Combat Evolved 1.04 and earlier allows remote attackers to cause a denial of service (server crash) via a long client response. | |
CVE-2004-0830 | | 2004-09-09 | The Content Scanner Server in F-Secure Anti-Virus for Microsoft Exchange 6.21 and earlier, F-Secure Anti-Virus for Microsoft Exchange 6.01 and earlier, and F-S… | |
CVE-2004-0851 | | 2004-09-08 | The (1) write_list and (2) dump_curr_list functions in Net-Acct before 0.71 allows local users to overwrite arbitrary files via a symlink attack on temporary f… | |
CVE-2004-0823 | | 2004-09-07 | OpenLDAP 1.0 through 2.1.19, as used in Apple Mac OS 10.3.4 and 10.3.5 and possibly other operating systems, may allow certain authentication schemes to use ha… | |
CVE-2004-0822 | | 2004-09-07 | Buffer overflow in The Core Foundation framework (CoreFoundation.framework) in Mac OS X 10.2.8, 10.3.4, and 10.3.5 allows local users to execute arbitrary code… | |
CVE-2004-1348 | | 2004-09-06 | Unknown vulnerability in in.named on Solaris 8 allows remote attackers to cause a denial of service (process crash). | |
CVE-2004-1665 | | 2004-09-05 | Cross-site scripting (XSS) vulnerability in index.php in PsNews 1.1 allows remote attackers to inject arbitrary web script or HTML via the no parameter. | |
CVE-2004-1664 | | 2004-09-05 | Call of Duty 1.4 and earlier allows remote attackers to cause a denial of service (game end) via a large (1) query or (2) reply packet, which is not properly h… |