deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-1632
Published: 2004-10-25
Description: Cross-site scripting (XSS) vulnerability in wiki.php in MoniWiki 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the arguments to wiki.php.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6103&w=2; http://secunia.com/advisories/12975; http://www.securityfocus.com/bid/11516
CVE: CVE-2004-1633
Published: 2004-10-25
Description: process_bug.cgi in Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS does not check edit permissions on the keywords field, which allows remote authenticated users to modify the keywords in a bug via the keywordaction parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1238&w=2; https://bugzilla.mozilla.org/show_bug.cgi?id=252638; https://exchange.xforce.ibmcloud.com/vulnerabilities/17840
CVE: CVE-2004-1634
Published: 2004-10-25
Description: show_bug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows comments and attachment summaries which are marked as private, which allows remote attackers to gain sensitive information.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1238&w=2; http://www.securityfocus.com/bid/11511; https://bugzilla.mozilla.org/show_bug.cgi?id=263780
CVE: CVE-2004-1636
Published: 2004-10-26
Description: Heap-based buffer overflow in the WvTFTPServer::new_connection function in wvtftpserver.cc for WvTftp 0.9 allows remote attackers to execute arbitrary code via a long option string in a TFTP packet.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3940&w=2; http://secunia.com/advisories/12986; http://www.securityfocus.com/bid/11525
CVE: CVE-2004-1637
Published: 2004-10-26
Description: The Hawking Technologies HAR11A modem/router allows remote attackers to obtain sensitive information by connecting to port 254, which displays a management interface and information on established connections.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7886&w=2; http://www.securityfocus.com/bid/11543; https://exchange.xforce.ibmcloud.com/vulnerabilities/17877
CVE: CVE-2004-1639
Published: 2004-10-26
Description: Mozilla Firefox before 0.10, Mozilla 5.0, and Gecko 20040913 allows remote attackers to cause a denial of service (application crash or memory consumption) via a large binary file with a .html extension.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q4/0017.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8179&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/17839
CVE: CVE-2004-1350
Published: 2004-10-30
Description: Multiple buffer overflows in Sun Java System Web Proxy Server (formerly Sun ONE Proxy Server) 3.6 through 3.6 SP4 allow remote attackers to execute arbitrary code via unknown vectors, possibly CONNECT requests.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/13036/; http://securitytracker.com/id?1012005; http://sunsolve.sun.com/search/document.do?assetkey=1-26-57606-1&searchclause=security
CVE: CVE-2004-1121
Published: 2004-11-01
Description: Apple Safari 1.0 through 1.2.3 allows remote attackers to spoof the URL displayed in the status bar via TABLE tags.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2004/Dec/msg00000.html; http://secunia.com/advisories/13047/; http://www.kb.cert.org/vuls/id/925430
CVE: CVE-2003-0718
Published: 2004-11-03
Description: The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND request with an XML message containing XML elements with a large number of attributes.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2064&w=2; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-030; https://exchange.xforce.ibmcloud.com/vulnerabilities/17645
CVE: CVE-2004-0206
Published: 2004-11-03
Description: Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0674&w=2; http://secunia.com/advisories/12803/; http://www.kb.cert.org/vuls/id/640488
CVE: CVE-2004-0207
Published: 2004-11-03
Description: "Shatter" style vulnerability in the Window Management application programming interface (API) for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to gain privileges by using certain API functions to change properties of privileged programs using the SetWindowLong and SetWIndowLongPtr API functions.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2695&w=2; http://www.kb.cert.org/vuls/id/218526; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-032
CVE: CVE-2004-0208
Published: 2004-11-03
Description: The Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4427&w=2; http://www.kb.cert.org/vuls/id/910998; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-032
CVE: CVE-2004-0209
Published: 2004-11-03
Description: Unknown vulnerability in the Graphics Rendering Engine processes of Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats that involve "an unchecked buffer."
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5779&w=2; http://www.kb.cert.org/vuls/id/806278; http://www.securityfocus.com/bid/11375
CVE: CVE-2004-0211
Published: 2004-11-03
Description: The kernel for Microsoft Windows Server 2003 does not reset certain values in CPU data structures, which allows local users to cause a denial of service (system crash) via a malicious program.
CVSS Score: 2.1 (LOW)
References: http://www.kb.cert.org/vuls/id/119262; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-032; https://exchange.xforce.ibmcloud.com/vulnerabilities/16582
CVE: CVE-2004-0214
Published: 2004-11-03
Description: Buffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba.
CVSS Score: 10.0 (HIGH)
References: http://seclists.org/lists/bugtraq/2004/Apr/0322.html; http://seclists.org/lists/fulldisclosure/2004/Apr/0933.html; http://secunia.com/advisories/11482/
CVE: CVE-2004-0216
Published: 2004-11-03
Description: Integer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2754&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2055&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]0517&w=2
CVE: CVE-2004-0552
Published: 2004-11-03
Description: Sophos Small Business Suite 1.00 on Windows does not properly handle files whose names contain reserved MS-DOS device names such as (1) LPT1, (2) COM1, (3) AUX, (4) CON, or (5) PRN, which can allow malicious code to bypass detection when it is installed, copied, or executed.
CVSS Score: 7.5 (HIGH)
References: http://www.idefense.com/application/poi/display?id=143&type=vulnerabilities; http://www.seifried.org/security/advisories/kssa-005.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/17468
CVE: CVE-2004-0569
Published: 2004-11-03
Description: The RPC Runtime Library for Microsoft Windows NT 4.0 allows remote attackers to read active memory or cause a denial of service (system crash) via a malicious message, possibly related to improper length values.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9518&w=2; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-029; https://exchange.xforce.ibmcloud.com/vulnerabilities/17646
CVE: CVE-2004-0572
Published: 2004-11-03
Description: Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-07/0290.html; http://www.kb.cert.org/vuls/id/543864; http://www.securityfocus.com/bid/10677
CVE: CVE-2004-0574
Published: 2004-11-03
Description: The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows.
CVSS Score: 10.0 (HIGH)
CWE: CWE-787
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1563&w=2; http://www.ciac.org/ciac/bulletins/p-012.shtml; http://www.coresecurity.com/common/showdoc.php?idx=420&idxseccion=10
CVE: CVE-2004-0575
Published: 2004-11-03
Description: Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]6300&w=2; http://securitytracker.com/id?1011637; http://www.ciac.org/ciac/bulletins/p-010.shtml
CVE: CVE-2004-0774
Published: 2004-11-03
Description: RealNetworks Helix Universal Server 9.0.2 for Linux and 9.0.3 for Windows allows remote attackers to cause a denial of service (CPU and memory exhaustion) via a POST request with a Content-Length header set to -1.
CVSS Score: 7.8 (HIGH)
References: http://www.idefense.com/application/poi/display?id=151&type=vulnerabilities; https://exchange.xforce.ibmcloud.com/vulnerabilities/17648; http://www.idefense.com/application/poi/display?id=151&type=vulnerabilities
CVE: CVE-2004-0804
Published: 2004-11-03
Description: Vulnerability in tif_dirread.c for libtiff allows remote attackers to cause a denial of service (application crash) via a TIFF image that causes a divide-by-zero error when the number of row bytes is zero, a different vulnerability than CVE-2005-2452.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-369
References: http://bugzilla.remotesensing.org/show_bug.cgi?id=111; http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000888; http://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1
CVE: CVE-2004-0815
Published: 2004-11-03
Description: The unix_clean_name function in Samba 2.2.x through 2.2.11, and 3.0.x before 3.0.2a, trims certain directory names down to absolute paths, which could allow remote attackers to bypass the specified share restrictions and read, write, or list arbitrary files via "/.////" style sequences in pathnames.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000873; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3457&w=2; http://sunsolve.sun.com/search/document.do?assetkey=1-26-101584-1
CVE: CVE-2004-0828
Published: 2004-11-03
Description: The ctstrtcasd program in RSCT 2.3.0.0 and earlier on IBM AIX 5.2 and 5.3 does not properly drop privileges before executing the -f option, which allows local users to modify or create arbitrary files.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/12664/; http://securitytracker.com/id?1011429; http://www.securityfocus.com/bid/11264
CVE: CVE-2004-0832
Published: 2004-11-03
Description: The (1) ntlm_fetch_string and (2) ntlm_get_string functions in Squid 2.5.6 and earlier, with NTLM authentication enabled, allow remote attackers to cause a denial of service (application crash) via an NTLMSSP packet that causes a negative value to be passed to memcpy.
CVSS Score: 5.0 (MEDIUM)
References: http://fedoranews.org/updates/FEDORA--.shtml; http://www.gentoo.org/security/en/glsa/glsa-200409-04.xml; http://www.mandriva.com/security/advisories?name=MDKSA-2004:093
CVE: CVE-2004-0835
Published: 2004-11-03
Description: MySQL 3.x before 3.23.59, 4.x before 4.0.19, 4.1.x before 4.1.2, and 5.x before 5.0.1, checks the CREATE/INSERT rights of the original table instead of the target table in an ALTER TABLE RENAME operation, which could allow attackers to conduct unauthorized activities.
CVSS Score: 7.5 (HIGH)
References: http://bugs.mysql.com/bug.php?id=3270; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000892; http://lists.mysql.com/internals/13073
CVE: CVE-2004-0836
Published: 2004-11-03
Description: Buffer overflow in the mysql_real_connect function in MySQL 4.x before 4.0.21, and 3.x before 3.23.49, allows remote DNS servers to cause a denial of service and possibly execute arbitrary code via a DNS response with a large address length (h_length).
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.mysql.com/bug.php?id=4017; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000892; http://lists.mysql.com/internals/14726
CVE: CVE-2004-0837
Published: 2004-11-03
Description: MySQL 4.x before 4.0.21, and 3.x before 3.23.49, allows attackers to cause a denial of service (crash or hang) via multiple threads that simultaneously alter MERGE table UNIONs.
CVSS Score: 2.6 (LOW)
References: http://bugs.mysql.com/2408; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000892; http://lists.mysql.com/internals/16168
CVE: CVE-2004-0840
Published: 2004-11-03
Description: The SMTP (Simple Mail Transfer Protocol) component of Microsoft Windows XP 64-bit Edition, Windows Server 2003, Windows Server 2003 64-bit Edition, and the Exchange Routing Engine component of Exchange Server 2003, allows remote attackers to execute arbitrary code via a malicious DNS response message containing length values that are not properly validated.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/394792; http://www.securityfocus.com/bid/11374; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-035
CVE: CVE-2004-0843
Published: 2004-11-03
Description: Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability."
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/625616; http://www.us-cert.gov/cas/techalerts/TA04-293A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-038
CVE: CVE-2004-0844
Published: 2004-11-03
Description: Internet Explorer 6 on Double Byte Character Set (DBCS) systems allows remote attackers to alter displayed address bars and spoof web pages via a URL containing special characters, facilitating phishing attacks, aka the "Address Bar Spoofing on Double Byte Character Set Systems Vulnerability."
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5729&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]7733&w=2; http://www.kb.cert.org/vuls/id/431576
CVE: CVE-2004-0845
Published: 2004-11-03
Description: Internet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4803&w=2; http://www.acrossecurity.com/aspr/ASPR-2004-10-13-1-PUB.txt; http://www.kb.cert.org/vuls/id/795720
CVE: CVE-2004-0846
Published: 2004-11-03
Description: Unknown vulnerability in Microsoft Excel 2000, 2002, 2001 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via a malicious file containing certain parameters that are not properly validated.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7096&w=2; http://secunia.com/advisories/12800/; http://www.ciac.org/ciac/bulletins/p-009.shtml
CVE: CVE-2004-0847
Published: 2004-11-03
Description: The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/ntbugtraq/2004-q3/0221.html; http://sourceforge.net/mailarchive/forum.php?thread_id=5671607&forum_id=24754; http://www.kb.cert.org/vuls/id/283646
CVE: CVE-2004-0885
Published: 2004-11-03
Description: The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.
CVSS Score: 7.5 (HIGH)
References: http://issues.apache.org/bugzilla/show_bug.cgi?id=31505; http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html; http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html
CVE: CVE-2004-0910
Published: 2004-11-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2004-0815.  Reason: This candidate is a reservation duplicate of CVE-2004-0815.  Notes: All CVE users should reference CVE-2004-0815 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2004-0911
Published: 2004-11-03
Description: telnetd for netkit 0.17 and earlier, and possibly other versions, on Debian GNU/Linux allows remote attackers to cause a denial of service (free of an invalid pointer), a different vulnerability than CVE-2001-0554.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=273694; http://www.debian.org/security/2004/dsa-556; http://www.securityfocus.com/archive/1/375743
CVE: CVE-2004-0920
Published: 2004-11-03
Description: Symantec Norton AntiVirus 2004, and earlier versions, allows a virus or other malicious code to avoid detection or cause a denial of service (application crash) using a filename containing an MS-DOS device name.
CVSS Score: 5.0 (MEDIUM)
References: http://www.idefense.com/application/poi/display?id=147&type=vulnerabilities; http://www.seifried.org/security/advisories/kssa-010.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/17603
CVE: CVE-2004-0938
Published: 2004-11-03
Description: FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (server crash) by sending an Ascend-Send-Secret attribute without the required leading packet.
CVSS Score: 5.0 (MEDIUM)
References: http://security.gentoo.org/glsa/glsa-200409-29.xml; http://www.kb.cert.org/vuls/id/541574; http://www.osvdb.org/10178
CVE: CVE-2004-0958
Published: 2004-11-03
Description: php_variables.c in PHP before 5.0.2 allows remote attackers to read sensitive memory contents via (1) GET, (2) POST, or (3) COOKIE GPC variables that end in an open bracket character, which causes PHP to calculate an incorrect string length.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0053.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0492&w=2; http://secunia.com/advisories/12560/
CVE: CVE-2004-0959
Published: 2004-11-03
Description: rfc1867.c in PHP before 5.0.2 allows local users to upload files to arbitrary locations via a PHP script with a certain MIME header that causes the "$_FILES" array to be modified.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0054.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0404&w=2; http://secunia.com/advisories/12560/
CVE: CVE-2004-1315
Published: 2004-11-12
Description: viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8724&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9029&w=2; http://marc.info/?t=[PII_REDACTED]0004&r=1&w=2
CVE: CVE-2004-1331
Published: 2004-11-16
Description: The execCommand method in Microsoft Internet Explorer 6.0 SP2 allows remote attackers to bypass the "File Download - Security Warning" dialog and save arbitrary files with arbitrary extensions via the SaveAs command.
CVSS Score: 2.6 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2004-11/0260.html; http://secunia.com/advisories/13203/; http://securityreason.com/securityalert/3220
CVE: CVE-2004-0079
Published: 2004-11-23
Description: The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:05.openssl.asc; ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-005.txt.asc; ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.10/SCOSA-2004.10.txt
CVE: CVE-2004-0081
Published: 2004-11-23
Description: OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.10/SCOSA-2004.10.txt; ftp://patches.sgi.com/support/free/security/advisories/20040304-01-U.asc; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000834
CVE: CVE-2004-0112
Published: 2004-11-23
Description: The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-005.txt.asc; ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.10/SCOSA-2004.10.txt; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000834
CVE: CVE-2004-0203
Published: 2004-11-23
Description: Cross-site scripting (XSS) vulnerability in Outlook Web Access for Exchange Server 5.5 Service Pack 4 allows remote attackers to insert arbitrary script and spoof content in HTML email or web caches via an HTML redirect query.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/948750; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-026; https://exchange.xforce.ibmcloud.com/vulnerabilities/16583