DuyTa/cve-kgrag-db huggingface dataset:
CVE-2004-1757
BEA WebLogic Server and Express 8.1, SP1 and earlier, stores the administrator password in cleartext in config.xml, which allows local users to gain privileges.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: weblogic_server
References: http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_50.00.jsp, http://secunia.com/advisories/10728, http://www.kb.cert.org/vuls/id/350350
CVE-2004-0699
Heap-based buffer overflow in ASN.1 decoding library in Check Point VPN-1 products, when Aggressive Mode IKE is implemented, allows remote attackers to execute arbitrary code by initiating an IKE negotiation and then sending an IKE packet with malformed ASN.1 data.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: vpn-1, firewall-1
References: http://secunia.com/advisories/12177/, http://securitytracker.com/alerts/2004/Jul/1010799.html, http://www.checkpoint.com/techsupport/alerts/asn1.html
CVE-2004-2545
Secure Computing Corporation Sidewinder G2 6.1.0.01 allows remote attackers to cause a denial of service (SMTP proxy failure) via unknown attack vendors involving an "extremely busy network."  NOTE: this might not be a vulnerability because the embedded monitoring sub-system automatically restarts after the failure.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: sidewinder_g2
References: http://secunia.com/advisories/11632, http://www.osvdb.org/6236, http://www.securecomputing.com/pdf/SW61002Rel_Notes_0512.pdf
CVE-2004-0186
smbmnt in Samba 2.x and 3.x on Linux 2.6, when installed setuid, allows local users to gain root privileges by mounting a Samba share that contains a setuid root program, whose setuid attributes are not cleared when the share is mounted.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: linux_kernel, samba
References: http://marc.info/?l=bugtraq&m=107636290906296&w=2, http://marc.info/?l=bugtraq&m=107657505718743&w=2, http://www.debian.org/security/2004/dsa-463
CVE-2004-0719
Internet Explorer for Mac 5.2.3, Internet Explorer 6 on Windows XP, and possibly other versions, does not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ie, internet_explorer
References: http://secunia.com/advisories/11966, http://secunia.com/advisories/11978, http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/
CVE-2004-0394
A "potential" buffer overflow exists in the panic() function in Linux 2.4.x, although it may not be exploitable due to the functionality of panic.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: linux_kernel
References: ftp://patches.sgi.com/support/free/security/advisories/20040504-01-U.asc, ftp://patches.sgi.com/support/free/security/advisories/20040505-01-U.asc, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000846
CVE-2004-0740
The HTTP server in Lexmark T522 and possibly other models allows remote attackers to cause a denial of service (server crash, reload, or hang) via an HTTP header with a long Host field, possibly triggering a buffer overflow.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: t522_network_printer
References: http://marc.info/?l=bugtraq&m=109035701329111&w=2, https://exchange.xforce.ibmcloud.com/vulnerabilities/16752, http://marc.info/?l=bugtraq&m=109035701329111&w=2
CVE-2004-0961
Memory leak in FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (memory exhaustion) via a series of Access-Request packets with (1) Ascend-Send-Secret, (2) Ascend-Recv-Secret, or (3) Tunnel-Password attributes.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: enterprise_linux, freeradius, fedora_core
References: http://security.gentoo.org/glsa/glsa-200409-29.xml, http://www.kb.cert.org/vuls/id/541574, http://www.securityfocus.com/bid/11222
CVE-2004-1694
Symantec ON Command CCM 5.4.x and iCommand 3.0.x has four default usernames and passwords, one of which is hardcoded, which allows remote attackers to gain unauthorized access.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: on_command_ccm, on_icommand
References: http://marc.info/?l=bugtraq&m=109571689621784&w=2, http://secunia.com/advisories/12604, http://www.sarc.com/avcenter/security/Content/2004.09.29.html
CVE-2004-0769
Buffer overflow in LHA allows remote attackers to execute arbitrary code via long pathnames in LHarc format 2 headers for a .LHZ archive, as originally demonstrated using the "x" option but also exploitable through "l" and "v", and fixed in header.c, a different issue than CVE-2004-0771.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: bugzilla
References: http://bugs.gentoo.org/show_bug.cgi?id=51285, http://lw.ftw.zamosc.pl/lha-exploit.txt, http://marc.info/?l=bugtraq&m=108745217504379&w=2
CVE-2004-1684
Zyxel P681 running ZyNOS Vt020225a contains portions of memory in an ARP request, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: zynos, prestige
References: http://marc.info/?l=bugtraq&m=109510732611448&w=2, http://www.osvdb.org/9962, http://www.securityfocus.com/bid/11167
CVE-2004-0580
DHCP on Linksys BEFSR11, BEFSR41, BEFSR81, and BEFSRU31 Cable/DSL Routers, firmware version 1.45.7, does not properly clear previously used buffer contents in a BOOTP reply packet, which allows remote attackers to obtain sensitive information.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: wrt54g, befsr41, wap55ag, befcmu10, befsr81
References: http://linksys.custhelp.com/cgi-bin/linksys.cfg/php/enduser/std_adp.php?p_faqid=832&p_%20%5Ccreated=1086294093&p_sid=pU1X1idh&p_lva=&p_sp=cF9zcmNoPSZwX3NvcnRfYnk9JnBfZ3JpZHNvcnQ9%20%5CJnBfcm93X2NudD02NTQmcF9wYWdlPTE%2A&p_li=, http://marc.info/?l=bugtraq&m=108662876129301&w=2, http://secunia.com/advisories/11606
CVE-2004-2082
The samiftp.dll library in Sami FTP Server 1.1.3 allows remote authenticated users to cause a denial of service (pmsystem.exe crash) via a GET request wit a large number of leading "/" (slash) characters.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: sami_ftp_server
References: http://www.karja.com/samiftp/news.html, http://www.securityfocus.com/archive/1/353753, http://www.securityfocus.com/bid/9657
CVE-2004-1706
The U.S. Robotics USR808054 wireless access point allows remote attackers to cause a denial of service (device crash) and possibly execute arbitrary code via an HTTP GET request with a long version string.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: usr808054
References: http://marc.info/?l=bugtraq&m=109146350605751&w=2, http://secunia.com/advisories/12207, http://www.securityfocus.com/bid/10840
CVE-2004-0959
rfc1867.c in PHP before 5.0.2 allows local users to upload files to arbitrary locations via a PHP script with a certain MIME header that causes the "$_FILES" array to be modified.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: php
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0054.html, http://marc.info/?l=bugtraq&m=109534848430404&w=2, http://secunia.com/advisories/12560/
CVE-2004-1053
Integer overflow in fetch on FreeBSD 4.1 through 5.3 allows remote malicious servers to execute arbitrary code via certain HTTP headers in an HTTP response, which lead to a buffer overflow.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: fetch
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:16.fetch.asc, http://www.securityfocus.com/bid/11702, https://exchange.xforce.ibmcloud.com/vulnerabilities/18160
CVE-2004-0426
rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, which allows remote attackers to write files outside of the module's path.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: rsync
References: http://marc.info/?l=bugtraq&m=108515912212018&w=2, http://rsync.samba.org/, http://secunia.com/advisories/11514
CVE-2004-0815
The unix_clean_name function in Samba 2.2.x through 2.2.11, and 3.0.x before 3.0.2a, trims certain directory names down to absolute paths, which could allow remote attackers to bypass the specified share restrictions and read, write, or list arbitrary files via "/.////" style sequences in pathnames.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: samba
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000873, http://marc.info/?l=bugtraq&m=109655827913457&w=2, http://sunsolve.sun.com/search/document.do?assetkey=1-26-101584-1
CVE-2004-1198
Microsoft Internet Explorer allows remote attackers to cause a denial of service (application crash from memory consumption), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: ie, internet_explorer
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-11/1221.html, http://www.securityfocus.com/archive/1/382257, http://www.securityfocus.com/bid/11751
CVE-2004-1858
HP Web Jetadmin 7.5.2546 allows remote attackers to cause a denial of service (crash) via a malformed request, possibly due to a stricmp() error from an invalid use of the "$" character.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: web_jetadmin
References: http://marc.info/?l=bugtraq&m=108016019623003&w=2, http://www.securityfocus.com/advisories/6492, http://marc.info/?l=bugtraq&m=108016019623003&w=2
CVE-2004-0901
Microsoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_2000, windows_nt, windows_me, windows_98se, windows_98
References: http://www.ciac.org/ciac/bulletins/p-055.shtml, http://www.idefense.com/application/poi/display?id=162&type=vulnerabilities&flashstatus=true, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-041
CVE-2004-2367
The Control Panel applet in WFTPD and WFTPD Pro 3.21 R1 and R2 allows remote authenticated users to cause a denial of service (crash) via a long FTP command.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: wftpd, wftpd_pro
References: http://secunia.com/advisories/11160/, http://www.securiteam.com/windowsntfocus/5JP0B20CAY.html, http://www.securityfocus.com/bid/9908
CVE-2004-1005
Multiple buffer overflows in Midnight Commander (mc) 4.5.55 and earlier allow remote attackers to have an unknown impact.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: enterprise_linux, midnight_commander, debian_linux, suse_linux, linux
References: http://secunia.com/advisories/13863/, http://www.debian.org/security/2005/dsa-639, http://www.gentoo.org/security/en/glsa/glsa-200502-24.xml
CVE-2004-1304
Stack-based buffer overflow in the ELF header parsing code in file before 4.12 allows attackers to execute arbitrary code via a crafted ELF file.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: file, secure_linux, linux
References: http://securitytracker.com/id?1012433, http://www.gentoo.org/security/en/glsa/glsa-200412-07.xml, http://www.securityfocus.com/bid/11771
CVE-2004-1562
SQL injection vulnerability in redir_url.php in w-Agora 4.1.6a allows remote attackers to execute arbitrary SQL commands via the key parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: w-agora
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/027040.html, http://marc.info/?l=bugtraq&m=109655691512298&w=2, http://secunia.com/advisories/12695
CVE-2004-1462
Unknown vulnerability in MoinMoin 1.2.2 and earlier allows remote attackers to gain unauthorized access to administrator functions such as (1) revert and (2) delete.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: moinmoin
References: http://www.gentoo.org/security/en/glsa/glsa-200408-25.xml, http://www.osvdb.org/displayvuln.php?osvdb_id=8194, http://www.securityfocus.com/bid/10805
CVE-2004-2237
Unknown vulnerability in Moodle before 1.3.4 has unknown impact and attack vectors, related to "strings in Moodle texts."
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: moodle
References: http://moodle.org/doc/?file=releaseold.html, http://secunia.com/advisories/12262, http://www.osvdb.org/8522
CVE-2004-0190
Symantec FireWall/VPN Appliance model 200 records a cleartext password for the password administration page, which may be cached on the administrator's local system or in a proxy, which allows attackers to steal the password and gain privileges.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: firewall_vpn_appliance_200, firewall_vpn_appliance_100, firewall_vpn_appliance_200r
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-February/017414.html, http://marc.info/?l=bugtraq&m=107694794031839&w=2, http://www.osvdb.org/4117
CVE-2004-2378
@Mail 3.64 for Windows allows remote attackers to cause a denial of service ("unusable" server) via a large number of POP3 connections to the server.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: at_mail_webmail_system
References: http://members.lycos.co.uk/r34ct/main/%40mail_3.64/%40mail_3.64.txt, http://secunia.com/advisories/10978, http://www.osvdb.org/4068
CVE-2004-0235
Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with (1) .. sequences or (2) absolute pathnames with double leading slashes ("//absolute/path").
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: f-secure_personal_express, f-secure_for_firewalls, f-secure_internet_security, mailsweeper, f-secure_anti-virus
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000840, http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/020776.html, http://marc.info/?l=bugtraq&m=108422737918885&w=2
CVE-2004-1118
Buffer overflow in the WodFtpDLX.ocx (WeOnlyDo!) ActiveX component before 2.3.2.97, as used by CoffeeCup Direct FTP 6.2.0.62 and CoffeeCup Free FTP 3.0.0.10, and possibly other applications, allows remote attackers to execute arbitrary code via a long filename.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: wodftpdlx_activex_component
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/029243.html, http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/029244.html, http://marc.info/?l=bugtraq&m=110114233323417&w=2
CVE-2004-2095
Honeyd before 0.8 replies to TCP packets with the SYN and RST flags set, which allows remote attackers to identify IP addresses that are being simulated by Honeyd.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: honeyd
References: http://marc.info/?l=bugtraq&m=107471181426047&w=2, http://marc.info/?l=bugtraq&m=107473095118505&w=2, http://secunia.com/advisories/10694
CVE-2004-2245
Cross-site scripting (XSS) vulnerability in Goollery 0.03 allows remote attackers to inject arbitrary HTML or web script via the (1) page parameter to viewalbum.php or (2) btopage parameter to viewpic.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: goollery
References: http://securitytracker.com/id?1012062, http://www.osvdb.org/11318, http://www.osvdb.org/11319
CVE-2004-0110
Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: propack, libxml2, libxml
References: http://marc.info/?l=bugtraq&m=107851606605420&w=2, http://marc.info/?l=bugtraq&m=107860178228804&w=2, http://rhn.redhat.com/errata/RHSA-2004-090.html
CVE-2004-1829
Multiple cross-site scripting (XSS) vulnerabilities in error.php in Gijza.net Error Manager 2.1 for PHP-Nuke 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) pagetitle or (2) error parameters, or (3) certain parameters in the error log.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: php-nuke_module
References: http://marc.info/?l=bugtraq&m=107963064317560&w=2, http://secunia.com/advisories/11164, http://www.osvdb.org/4384