deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-2570
Published: 2004-12-31
Description: Opera before 7.54 allows remote attackers to modify properties and methods of the location object and execute Javascript to read arbitrary files from the client's local filesystem or display a false URL to the user.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-74
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0131.html; http://osvdb.org/8331; http://secunia.com/advisories/12233
CVE: CVE-2004-2571
Published: 2004-12-31
Description: Multiple buffer overflows in EnderUNIX isoqlog 2.1.1 allow remote attackers to execute arbitrary code via the (1) parseQmailFromBytesLine, (2) parseQmailToRemoteLine, (3) parseQmailToLocalLine, (4) parseSendmailFromBytesLine, (5) parseSendmailToLine, (6) parseEximFromBytesLine, and (7) parseEximToLine functions in Parser.c; allow local users to execute arbitrary code via the (8) lowercase and (9) check_syslog_date functions in Parser.c, and (10) unspecified functions in Dir.c; and allow unspecified attackers to execute arbitrary code via the (11) loadconfig and (12) removespaces functions in loadconfig.c, the (13) loadLang function in LangCfg.c, and (14) unspecified functions in Html.c.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2004-05/0298.html; http://secunia.com/advisories/11741/; http://securitytracker.com/id?1010292
CVE: CVE-2004-2572
Published: 2004-12-31
Description: AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering (1) invalid characters such as "()" or (2) a large number of characters in the Lookup field on the netaddressbook.php web form, which reveals the path in an ldaplib.php error message when the ldap_search function fails, due to improper processing of the $keyword variable.
CVSS Score: 5.0 (MEDIUM)
References: http://members.lycos.co.uk/r34ct/main/ldaplib/ldaplib.php%20reveal%20local%20path%20of%20Winmail%203.6%20webmail%20directory.txt; http://secunia.com/advisories/11015; http://www.magicwinmail.net/download/english-help.chm
CVE: CVE-2004-2573
Published: 2004-12-31
Description: PHP remote file inclusion vulnerability in tables_update.inc.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to execute arbitrary PHP code via an external URL in the appdir parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/7599; http://www.securityfocus.com/bid/12074; https://savannah.gnu.org/bugs/?func=detailitem&item_id=7478
CVE: CVE-2004-2574
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in index.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to inject arbitrary web script or HTML via the date parameter in a calendar.uicalendar.planner menuaction.
CVSS Score: 4.3 (MEDIUM)
References: http://www.osvdb.org/7600; http://www.securityfocus.com/bid/12082; https://savannah.gnu.org/bugs/?func=detailitem&item_id=7478
CVE: CVE-2004-2575
Published: 2004-12-31
Description: phpGroupWare 0.9.14.005 and earlier allow remote attackers to obtain sensitive information via a direct request to (1) hook_admin.inc.php, (2) hook_home.inc.php, (3) class.holidaycalc.inc.php, and (4) setup.inc.php.sample, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://www.osvdb.org/7601; http://www.osvdb.org/7602; http://www.osvdb.org/7603
CVE: CVE-2004-2576
Published: 2004-12-31
Description: class.vfs_dav.inc.php in phpGroupWare 0.9.16.000 does not create .htaccess files to enable authorization checks for access to users' home-directory files, which allows remote attackers to obtain sensitive information from these files.
CVSS Score: 5.0 (MEDIUM)
References: http://www.osvdb.org/7617; https://exchange.xforce.ibmcloud.com/vulnerabilities/19195; https://savannah.gnu.org/bugs/?func=detailitem&item_id=8359
CVE: CVE-2004-2577
Published: 2004-12-31
Description: The acl_check function in phpGroupWare 0.9.16RC2 always returns True, even when mkdir does not behave as expected, which could allow remote attackers to obtain sensitive information via WebDAV from users' home directories that lack .htaccess files, and possibly has other unknown impacts.
CVSS Score: 5.0 (MEDIUM)
References: http://www.osvdb.org/7618; http://www.securityfocus.com/bid/12237; https://savannah.gnu.org/bugs/?func=detailitem&item_id=7227
CVE: CVE-2004-2578
Published: 2004-12-31
Description: phpGroupWare before 0.9.16.002 transmits the (1) header admin and (2) setup passwords in plaintext via cookies, which allows remote attackers to sniff passwords.
CVSS Score: 5.0 (MEDIUM)
References: http://web.archive.org/web/[PII_REDACTED]4328/http://www.phpgroupware.org/; http://www.osvdb.org/8354; http://www.securityfocus.com/bid/10895
CVE: CVE-2004-2579
Published: 2004-12-31
Description: ACLCHECK module in Novell iChain 2.3 allows attackers to bypass access control rules of an unspecified component via an unspecified attack vector involving a string that contains escape sequences represented with "overlong UTF-8 encoding."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/12366; http://securitytracker.com/id?1011074; http://support.novell.com/cgi-bin/search/searchtid.cgi?2972080.htm
CVE: CVE-2004-2580
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in Novell iChain 2.3 allows remote attackers to obtain login credentials via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/12366; http://securitytracker.com/id?1011074; http://www.osvdb.org/9267
CVE: CVE-2004-2581
Published: 2004-12-31
Description: Novell iChain 2.3 allows attackers to cause a denial of service via a URL with a "specific string."
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/12366; http://securitytracker.com/id?1011074; http://support.novell.com/cgi-bin/search/searchtid.cgi?2972080.htm
CVE: CVE-2004-2582
Published: 2004-12-31
Description: Novell iChain 2.3 includes the build number in the VIA line of the proxy server's HTTP headers, which allows remote attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/12366; http://securitytracker.com/id?1011074; http://support.novell.com/cgi-bin/search/searchtid.cgi?2972080.htm
CVE: CVE-2004-2583
Published: 2004-12-31
Description: SMTP service in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous open connections to TCP port 25.
CVSS Score: 7.8 (HIGH)
References: http://members.lycos.co.uk/r34ct/main/smarter_mail%203.1/smarter_mail.txt; http://secunia.com/advisories/11042; http://www.zone-h.org/advisories/read/id=4098
CVE: CVE-2004-2584
Published: 2004-12-31
Description: frmAddfolder.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote authenticated users to create a folder that SmarterMail cannot delete or rename via a folder name with a null byte ("%00"). NOTE: it is not clear whether this issue poses a vulnerability.
CVSS Score: 4.0 (MEDIUM)
References: http://members.lycos.co.uk/r34ct/main/smarter_mail%203.1/smarter_mail.txt; http://www.zone-h.org/advisories/read/id=4098; https://exchange.xforce.ibmcloud.com/vulnerabilities/15392
CVE: CVE-2004-2585
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in frmCompose.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to inject arbitrary web script or HTML via Javascript to the "check spelling" feature in the compose area.
CVSS Score: 4.3 (MEDIUM)
References: http://members.lycos.co.uk/r34ct/main/smarter_mail%203.1/smarter_mail.txt; http://secunia.com/advisories/11042; http://securitytracker.com/id?1009307
CVE: CVE-2004-2586
Published: 2004-12-31
Description: Directory traversal vulnerability in frmGetAttachment.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to read arbitrary files via the filename parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://members.lycos.co.uk/r34ct/main/smarter_mail%203.1/smarter_mail.txt; http://secunia.com/advisories/11042; http://securitytracker.com/id?1009307
CVE: CVE-2004-2587
Published: 2004-12-31
Description: login.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service via a long txtusername parameter, possibly due to a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://members.lycos.co.uk/r34ct/main/smarter_mail%203.1/smarter_mail.txt; http://secunia.com/advisories/11042; http://www.zone-h.org/advisories/read/id=4098
CVE: CVE-2004-2588
Published: 2004-12-31
Description: Intentional information leak in phpinfo.php in XMB (aka extreme message board) 1.9 beta (aka Nexus beta) allows remote attackers to obtain sensitive information such as the configuration of the web server and the PHP application.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-03/0265.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5265&w=2; http://securitytracker.com/id?1009561
CVE: CVE-2004-2589
Published: 2004-12-31
Description: Gaim before 0.82 allows remote servers to cause a denial of service (application crash) via a long HTTP Content-Length header, which causes Gaim to abort when attempting to allocate memory.
CVSS Score: 5.0 (MEDIUM)
References: http://gaim.sourceforge.net/security/?id=6; http://secunia.com/advisories/12383; http://securitytracker.com/id?1011083
CVE: CVE-2004-2590
Published: 2004-12-31
Description: Unspecified vulnerability in meindlSOFT Cute PHP Library (aka cphplib) 0.46 has unknown impact and attack vectors, related to regular expressions.
CVSS Score: 10.0 (HIGH)
References: http://prdownloads.sourceforge.net/cphplib/cphplib-0.47.tar.gz?download; http://securitytracker.com/id?1011076; http://www.meindlsoft.com/cphplib_changelog.php
CVE: CVE-2004-2591
Published: 2004-12-31
Description: The data-overwrite capability of ButtUglySoftware CleanCache 2.19 does not properly overwrite data in files, which allows attackers to recover the data.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2004-12/0418.html; http://secunia.com/advisories/13630; http://securitytracker.com/id?1012701
CVE: CVE-2004-2592
Published: 2004-12-31
Description: Quake II server before R1Q2, as used in multiple products, allows remote attackers to cause a denial of service (application crash) via a modified client that asks the server to send data stored at a negative array offset, which is not handled when processing Configstrings and Baselines.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2004-10/0299.html; http://secunia.com/advisories/13013; http://secur1ty.net/advisories/001
CVE: CVE-2004-2593
Published: 2004-12-31
Description: Buffer overflow in command-packet processing of Quake II server before R1Q2, as used in multiple products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a packet with a long cmd_args buffer.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2004-10/0299.html; http://secunia.com/advisories/13013; http://secur1ty.net/advisories/001
CVE: CVE-2004-2594
Published: 2004-12-31
Description: Absolute path traversal vulnerability in Quake II server before R1Q2 on Windows, as used in multiple products, allows remote attackers to read arbitrary files via a "\/" in a pathname argument, as demonstrated by "download \/server.cfg".
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-10/0299.html; http://secunia.com/advisories/13013; http://secur1ty.net/advisories/001
CVE: CVE-2004-2595
Published: 2004-12-31
Description: Absolute path traversal vulnerability in Quake II server before R1Q2 on Linux, as used in multiple products, allows remote attackers to cause a denial of service (application crash) via a download command with a full pathname for a directory in the argument, which causes the server to crash when it cannot read data.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-10/0299.html; http://secunia.com/advisories/13013; http://secur1ty.net/advisories/001
CVE: CVE-2004-2596
Published: 2004-12-31
Description: Quake II server before R1Q2, as used in multiple products, allows remote attackers to cause a denial of service (exhaustion of connection slots) via a large number of connections from the same IP address.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2004-10/0299.html; http://secunia.com/advisories/13013; http://secur1ty.net/advisories/001
CVE: CVE-2004-2597
Published: 2004-12-31
Description: Quake II server before R1Q2, as used in multiple products, allows remote attackers to bypass IP-based access control rules via a userinfo string that already contains an "ip" key/value pair but is also long enough to cause a new key/value pair to be truncated, which interferes with the server's ability to find the client's IP address.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-10/0299.html; http://secunia.com/advisories/13013; http://secur1ty.net/advisories/001
CVE: CVE-2004-2598
Published: 2004-12-31
Description: Quake II server before R1Q2, as used in multiple products, allows remote attackers to corrupt the server's client state data structure by exiting a session without a valid disconnect command, then reconnecting, which prevents a mod from being notified of changes in the client state.  NOTE: the impact of this issue will vary depending on which mod is being used.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-10/0299.html; http://secur1ty.net/advisories/001; http://securitytracker.com/id?1011979
CVE: CVE-2004-2599
Published: 2004-12-31
Description: Multiple buffer overflows in Quake II server before R1Q2, as used in multiple products, allow local users to cause a denial of service (application crash) via the server console or rcon.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2004-10/0299.html; http://secur1ty.net/advisories/001; http://securitytracker.com/id?1011979
CVE: CVE-2004-2600
Published: 2004-12-31
Description: The firmware for Intelligent Platform Management Interface (IPMI) 1.5-based Intel Server Boards and Platforms is shipped with an Authentication Type Enables parameter set to an invalid None parameter, which allows remote attackers to obtain sensitive information when LAN management functionality is enabled.
CVSS Score: 5.0 (MEDIUM)
References: ftp://download.intel.com/support/motherboards/server/sb/aa6791invalidlanconfiguration040504.pdf; http://secunia.com/advisories/11315; http://support.intel.com/support/motherboards/server/sb/CS-010422.htm
CVE: CVE-2004-2601
Published: 2004-12-31
Description: PHP remote file inclusion vulnerability in UberTec Help Center Live (HCL) allows remote attackers to read local files and possibly execute PHP code via a URL in the SKIN_inner parameter to inc/skin.php.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/13652; http://securitytracker.com/id?1012685; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]4
CVE: CVE-2004-2602
Published: 2004-12-31
Description: PHP remote file inclusion vulnerability in UberTec Help Center Live (HCL) before 1.2.7 allows remote attackers to execute arbitrary PHP code via a URL in the HCL_path parameter to pipe.php.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/13652; http://securitytracker.com/id?1012685; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]4
CVE: CVE-2004-2603
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in the Search module in UberTec Help Center Live (HCL) allows remote attackers to inject arbitrary web script or HTML via the find parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/13652; http://securitytracker.com/id?1012685; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]4
CVE: CVE-2004-2604
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in index.php in PHProxy allows remote attackers to inject arbitrary web script or HTML via the error parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1012702; http://www.osvdb.org/12627; http://www.securityfocus.com/bid/12115
CVE: CVE-2004-2605
Published: 2004-12-31
Description: aStats 1.6.5 allows local users to overwrite arbitrary files via a symlink attack on (1) the aStats-Graphic-Signature-Generation file and (2) certain PNG image files.
CVSS Score: 2.1 (LOW)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=287604; http://secunia.com/advisories/13679; http://shellcode.org/pipermail/debian-audit/2004-December/000078.html
CVE: CVE-2004-2606
Published: 2004-12-31
Description: The Web interface in Linksys WRT54G 2.02.7 and BEFSR41 version 3, with the firewall disabled, allows remote attackers to attempt to login to an administration web page, even when the configuration specifies that remote administration is disabled.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.linksys.com/pub/network/wrt54g_2.02.8_US_code_beta.zip; http://archives.neohapsis.com/archives/bugtraq/2004-05/0316.html; http://archives.neohapsis.com/archives/bugtraq/2004-06/0002.html
CVE: CVE-2004-2607
Published: 2004-12-31
Description: A numeric casting discrepancy in sdla_xfer in Linux kernel 2.6.x up to 2.6.5 and 2.4 up to 2.4.29-rc1 allows local users to read portions of kernel memory via a large len argument, which is received as an int but cast to a short, which prevents a read loop from filling a buffer.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/18977; http://secunia.com/advisories/19369; http://www.debian.org/security/2006/dsa-1018
CVE: CVE-2004-2608
Published: 2004-12-31
Description: SmartWebby Smart Guest Book stores SmartGuestBook.mdb (aka the "news database") under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as the unencrypted username and password of the administrator's account.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/12401; http://securitytracker.com/id?1011084; http://www.osvdb.org/9363
CVE: CVE-2004-2609
Published: 2004-12-31
Description: The stuffit.com executable on Symantec PowerQuest DeployCenter 5.5 boot disks allows local users to obtain sensitive information (an unencrypted password for a Windows domain account) via four "stuffit /f:stuffit.dat" invocations, possibly due to a buffer overflow.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-08/1180.html; http://securitytracker.com/id?1011081; http://www.osvdb.org/9276
CVE: CVE-2004-2610
Published: 2004-12-31
Description: mntd_mount.c in mntd before 0.4.2 might allow local users to gain privileges via shell metacharacters in a remount option in the configuration file.  NOTE: It is not clear whether this is a vulnerability because there is not necessarily any common usage in which privilege boundaries are crossed.  Typical usage would restrict write access to the configuration file.
CVSS Score: 4.6 (MEDIUM)
References: http://prdownloads.sourceforge.net/mntd/mntd-0.4.2.tar.gz?download; http://securitytracker.com/id?1011088; http://www.osvdb.org/9380
CVE: CVE-2004-2611
Published: 2004-12-31
Description: The Change Permissions function in the Sophster suite before 0.9.6 28 May 2004 (aka 0.9.6-r5), possibly including Sophster, FreeSophster, and FreeSophsterPAM, removes the (1) setuid, (2) setgid, and (3) sticky bits when changing a file, which might allow attackers to gain privileges or conduct other unauthorized activities.
CVSS Score: 4.6 (MEDIUM)
References: http://securitytracker.com/id?1010431; http://www.osvdb.org/6657; http://www.schaefer.dhcp.biz/CHANGELOG.txt
CVE: CVE-2004-2612
Published: 2004-12-31
Description: BNC 2.9.0 only grants access when an incorrect password is provided, which allows remote attackers to use the functionality intended for authorized users.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/13302; http://www.gotbnc.com/changes.html#2.9.1; http://www.osvdb.org/12144
CVE: CVE-2004-2613
Published: 2004-12-31
Description: Unspecified vulnerability in procfs in the Linux-VServer stable branch for the 2.4 kernel before 1.23 and Linux-VServer development branch for the 2.4 kernel before 1.3.5 has unspecified impact and attack vectors, related to "write access to specific proc entries from a vserver context", a different vulnerability than CVE-2004-2408.
CVSS Score: 10.0 (HIGH)
References: http://linux-vserver.org/ChangeLog; http://list.linux-vserver.org/archive/vserver/msg05824.html; http://www.osvdb.org/7586
CVE: CVE-2004-2614
Published: 2004-12-31
Description: Buffer overflow in MyWeb 3.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.
CVSS Score: 7.5 (HIGH)
References: http://fux0r.phathookups.com/advisory/sp-x11-advisory.txt; http://secunia.com/advisories/11566; http://security-protocols.com/modules.php?name=News&file=article&sid=1931
CVE: CVE-2004-2615
Published: 2004-12-31
Description: The documentation for CuteNews 1.3.6 and possibly other versions specifies that files under cutenews/data must be manually given world-writable permissions, which allows local users to insert false news, delete news, and possibly gain privileges or have other unknown impact.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-08/0396.html; http://securitytracker.com/id?1011099; http://www.osvdb.org/9385
CVE: CVE-2004-2616
Published: 2004-12-31
Description: The file server in ActivePost Standard 3.1 and earlier allows remote authenticated users to obtain sensitive information by uploading a file, which reveals the path in a success message.
CVSS Score: 4.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/actp-adv.txt; http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0852.html; http://marc.info/?l=bugtraq&amp%3Bm=[PII_REDACTED]1373&amp%3Bw=2
CVE: CVE-2004-2617
Published: 2004-12-31
Description: Directory traversal vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to read files outside of the web root via a .. (dot dot) directly after the initial '/' (slash) in the URI.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-03/0109.html; http://archives.neohapsis.com/archives/bugtraq/2004-03/0136.html; http://secunia.com/advisories/11122
CVE: CVE-2004-2618
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to inject arbitrary web script or HTML via the URI, directly after the initial '/' (slash).
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-03/0109.html; http://archives.neohapsis.com/archives/bugtraq/2004-03/0136.html; http://secunia.com/advisories/11122
CVE: CVE-2004-2619
Published: 2004-12-31
Description: ripMIME 1.3.2.3 and earlier allows remote attackers to bypass e-mail protection via a base64 MIME encoded attachment containing invalid characters that are not properly extracted.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/12201; http://www.osvdb.org/8287; http://www.pldaniels.com/ripmime/CHANGELOG
CVE: CVE-2004-2620
Published: 2004-12-31
Description: The MIMEH_read_headers function in ripMIME 1.3.1.0 does not properly handle trailing "\r" and "\n" characters in headers, which leads to a buffer underflow.
CVSS Score: 5.0 (MEDIUM)
References: http://www.osvdb.org/8731; http://www.pldaniels.com/ripmime/CHANGELOG; http://www.osvdb.org/8731
CVE: CVE-2004-2621
Published: 2004-12-31
Description: Nortel Contivity VPN Client 2.1.7, 3.00, 3.01, 4.91, and 5.01, when opening a VPN tunnel, does not check the gateway certificate until after a dialog box has been displayed to the user, which creates a race condition that allows remote attackers to perform a man-in-the-middle (MITM) attack.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/12881; http://securitytracker.com/id?1011846; http://www.osvdb.org/11002