2004 CVEs (page 27)
Page 27 of 27 — CVEs published in 2004, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2004-2073 | | 2004-02-06 | Linux-VServer 1.24 allows local users with root privileges on a virtual server to gain access to the filesystem outside the virtual server via a modified chroo… | |
CVE-2004-2085 | | 2004-02-04 | Multiple cross-site scripting (XSS) vulnerabilities in Brad Fears phpCodeCabinet 0.4 and earlier allow remote attackers to inject arbitrary web script or HTML… | |
CVE-2004-1082 | | 2004-02-03 | mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to repl… | |
CVE-2004-0046 | | 2004-02-03 | Cross-site scripting (XSS) vulnerability in SnapStream PVS LITE allows remote attackers to inject arbitrary web script or HTML via a GET request containing a t… | |
CVE-2004-0045 | | 2004-02-03 | Buffer overflow in the ARTpost function in art.c in the control message handling code for INN 2.4.0 may allow remote attackers to execute arbitrary code. | |
CVE-2004-0044 | | 2004-02-03 | Cisco Personal Assistant 1.4(1) and 1.4(2) disables password authentication when "Allow Only Cisco CallManager Users" is enabled and the Corporate Directory se… | |
CVE-2004-0043 | | 2004-02-03 | Buffer overflow in Yahoo Instant Messenger 5.6.0.1351 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary c… | |
CVE-2004-0042 | | 2004-02-03 | vsftpd 1.1.3 generates different error messages depending on whether or not a valid username exists, which allows remote attackers to identify valid usernames. | |
CVE-2004-0041 | | 2004-02-03 | The mod_auth_shadow module 1.4 and earlier does not properly enforce the expiration of a user account and password, which could allow remote authenticated user… | |
CVE-2004-0028 | | 2004-02-03 | jitterbug 1.6.2 does not properly sanitize inputs, which allows remote authenticated users to execute arbitrary commands. | |
CVE-2004-0017 | | 2004-02-03 | Multiple SQL injection vulnerabilities in the (1) calendar and (2) infolog modules for phpgroupware 0.9.14 allow remote attackers to perform unauthorized datab… | |
CVE-2004-0016 | | 2004-02-03 | The calendar module for phpgroupware 0.9.14 does not enforce the "save extension" feature for holiday files, which allows remote attackers to create and execut… | |
CVE-2004-0015 | | 2004-02-03 | vbox3 0.1.8 and earlier does not properly drop privileges before executing a user-provided TCL script, which allows local users to gain privileges. | |
CVE-2004-0013 | | 2004-02-03 | jabber 1.4.2, 1.4.2a, and possibly earlier versions, does not properly handle SSL connections, which allows remote attackers to cause a denial of service (cras… | |
CVE-2004-2133 | | 2004-01-29 | Certain third-party packages for CVSup 16.1h, such as SuSE Linux, contain untrusted paths in the ELF RPATH fields of certain executables, which could allow loc… | |
CVE-2004-2132 | | 2004-01-29 | Directory traversal vulnerability in PJreview_Neo.cgi in PJ CGI Neo review allows remote attackers to read arbitrary files via a .. (dot dot) in the p paramet… | |
CVE-2004-2034 | | 2004-01-29 | Buffer overflow in the (1) WTHoster and (2) WebDriver modules in WildTangent Web Driver 4.0 allows remote attackers to execute arbitrary code via a long filena… | |
CVE-2004-2134 | | 2004-01-28 | Oracle toplink mapping workBench uses a weak encryption algorithm for passwords, which allows local users to decrypt the passwords. | |
CVE-2004-2131 | | 2004-01-27 | Stack-based buffer overflow in ontape for IBM Informix Dynamic Server (IDS) 9.40.xC3 and earlier allows local users, with DSA privileges, to execute arbitrary… | |
CVE-2004-2122 | | 2004-01-24 | Cross-site scripting (XSS) vulnerability in intraforum_db.cgi in Intra Forum allows remote attackers to inject arbitrary web script or HTML via the (1) use_las… | |
CVE-2004-2117 | | 2004-01-24 | Tiny Server 1.1 allows remote attackers to cause a denial of service (crash) via malformed HTTP requests such as (1) a GET request without the HTTP version (HT… | |
CVE-2004-2120 | | 2004-01-23 | Reptile Web Server allows remote attackers to cause a denial of service (CPU consumption) via multiple incomplete GET requests without the HTTP version. | |
CVE-2004-1760 | | 2004-01-21 | The default installation of Cisco voice products, when running the IBM Director Agent on IBM servers before OS 2000.2.6, does not require authentication, which… | |
CVE-2004-1759 | | 2004-01-21 | Cisco voice products, when running the IBM Director Agent on IBM servers before OS 2000.2.6, allows remote attackers to cause a denial of service (CPU consumpt… | |
CVE-2004-2127 | | 2004-01-20 | Directory traversal vulnerability in Web Blog 1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file variable. | |
CVE-2004-1766 | | 2004-01-20 | The default installation of NetScreen-Security Manager before Feature Pack 1 does not enable encryption for communication with devices running ScreenOS 5.0, wh… | |
CVE-2004-0037 | | 2004-01-20 | FirstClass Desktop Client 7.1 allows remote attackers to execute arbitrary commands via hyperlinks in FirstClass RTF messages. | |
CVE-2004-0036 | | 2004-01-20 | SQL injection vulnerability in calendar.php for vBulletin Forum 2.3.x before 2.3.4 allows remote attackers to steal sensitive information via the eventid param… | |
CVE-2004-0035 | | 2004-01-20 | SQL injection vulnerability in register.php for Phorum 3.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the hide_email parameter. | |
CVE-2004-0034 | | 2004-01-20 | Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.4.5 and earlier allow remote attackers to inject arbitrary HTML or web script via (1) the phoru… | |
CVE-2004-0033 | | 2004-01-20 | admin.php in PHPGEDVIEW 2.61 allows remote attackers to obtain sensitive information via an action parameter with a phpinfo command. | |
CVE-2004-0032 | | 2004-01-20 | Cross-site scripting (XSS) vulnerability in search.php in PHPGEDVIEW 2.61 allows remote attackers to inject arbitrary HTML and web script via the firstname par… | |
CVE-2004-0031 | | 2004-01-20 | PHPGEDVIEW 2.61 allows remote attackers to reinstall the software and change the administrator password via a direct HTTP request to editconfig.php. | |
CVE-2004-0030 | Critical | 9.8 | 2004-01-20 | PHP remote file inclusion vulnerability in (1) functions.php, (2) authentication_index.php, and (3) config_gedcom.php for PHPGEDVIEW 2.61 allows remote attacke… |
CVE-2004-0029 | | 2004-01-20 | Lotus Notes Domino 6.0.2 on Linux installs the notes.ini configuration file with world-writable permissions, which allows local users to modify the Notes confi… | |
CVE-2004-0014 | | 2004-01-20 | Multiple buffer overflows in the nd WebDAV interface 0.8.2 and earlier allows remote web servers to execute arbitrary code via certain long strings. | |
CVE-2004-0011 | | 2004-01-20 | Buffer overflow in fsp before 2.81.b18 allows remote users to execute arbitrary code. | |
CVE-2004-1764 | | 2004-01-14 | Buffer overflow in CDE libDtSvc on HP-UX B.11.00, B.11.04, B.11.11, and B.11.22 allows local users to gain root privileges via unknown vectors. | |
CVE-2004-1124 | | 2004-01-14 | Unknown vulnerability in chroot on SCO UnixWare 7.1.1 through 7.1.4 allows local users to escape the chroot jail and conduct unauthorized activities. | |
CVE-2004-1000 | | 2004-01-10 | lintian 1.23 and earlier removes the working directory even if it was not created by lintian, which may allow local users to delete arbitrary files or director… | |
CVE-2004-1786 | | 2004-01-04 | PortalApp places user credentials under the web root with insufficient access control, which allows remote attackers to gain access to sensitive information vi… | |
CVE-2004-1785 | | 2004-01-03 | SQL injection vulnerability in calendar.php for Invision Power Board 1.3 allows remote attackers to execute arbitrary SQL commands via the m parameter, which s… | |
CVE-2004-1784 | | 2004-01-03 | Buffer overflow in the web server of Webcam Watchdog 3.63 allows remote attackers to execute arbitrary code via a long HTTP GET request. | |
CVE-2004-1776 | | 2001-02-28 | Cisco IOS 12.1(3) and 12.1(3)T allows remote attackers to read and modify device configuration data via the cable-docsis read-write community string used by th… |