deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-0350
Published: 2004-11-23
Description: SpiderSales shopping cart does not enforce a minimum length for the private key, which can make it easier for local users to obtain the private key by factoring.
CVSS Score: 2.1 (LOW)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018177.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5486&w=2; http://www.s-quadra.com/advisories/Adv-20040303.txt
CVE: CVE-2004-0351
Published: 2004-11-23
Description: Spider Sales shopping cart stores the private key in the same database and table as the public key, which allows local users with access to the database to decrypt data.
CVSS Score: 2.1 (LOW)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018177.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5486&w=2; http://www.securityfocus.com/bid/9799
CVE: CVE-2004-0352
Published: 2004-11-23
Description: Cisco 11000 Series Content Services Switches (CSS) running WebNS 5.0(x) before 05.0(04.07)S, and 6.10(x) before 06.10(02.05)S allow remote attackers to cause a denial of service (device reset) via a malformed packet to UDP port 5002.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/cisco-sa-20040304-css.shtml; http://www.kb.cert.org/vuls/id/363374; http://www.securityfocus.com/bid/9806
CVE: CVE-2004-0353
Published: 2004-11-23
Description: Multiple buffer overflows in auth_ident() function in auth.c for GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to gain privileges via a long string.
CVSS Score: 10.0 (HIGH)
References: http://mail.gnu.org/archive/html/bug-anubis/2004-02/msg00000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4588&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2081&w=2
CVE: CVE-2004-0354
Published: 2004-11-23
Description: Multiple format string vulnerabilities in GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to execute arbitrary code via format string specifiers in strings passed to (1) the info function in log.c, (2) the anubis_error function in errs.c, or (3) the ssl_error function in ssl.c.
CVSS Score: 10.0 (HIGH)
References: http://mail.gnu.org/archive/html/bug-anubis/2004-02/msg00000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4588&w=2; http://www.securityfocus.com/bid/9772
CVE: CVE-2004-0355
Published: 2004-11-23
Description: Invision Power Board 1.3 Final allows remote attackers to gain sensitive information by selecting a file for "Personal Photo" that is not an image file, which displays the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8567&w=2; http://www.securityfocus.com/bid/9810; https://exchange.xforce.ibmcloud.com/vulnerabilities/15400
CVE: CVE-2004-0356
Published: 2004-11-23
Description: Stack-based buffer overflow in Supervisor Report Center in SL Mail Pro 2.0.9 and earlier allows remote attackers to execute arbitrary code via an HTTP request with a long HTTP sub-version.
CVSS Score: 10.0 (HIGH)
References: http://216.26.170.92/Download/webfiles/Patches/SLMPPatch-2.0.14.pdf; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6232&w=2; http://www.nextgenss.com/advisories/slmailsrc.txt
CVE: CVE-2004-0357
Published: 2004-11-23
Description: Stack-based buffer overflows in SL Mail Pro 2.0.9 allow remote attackers to execute arbitrary code via (1) user.dll, (2) loadpageadmin.dll or (3) loadpageuser.dll.
CVSS Score: 10.0 (HIGH)
References: http://216.26.170.92/Download/webfiles/Patches/SLMPPatch-2.0.14.pdf; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7699&w=2; http://www.nextgenss.com/advisories/slmailwm.txt
CVE: CVE-2004-0358
Published: 2004-11-23
Description: Cross-site scripting (XSS) vulnerability in VirtuaNews Admin Panel Pro 1.0.3 allows remote attackers to execute arbitrary script as other users via (1) the mainnews parameter in admin.php, (2) the expand parameter in admin.php, (3) the id parameter in admin.php, (4) the catid parameter in admin.php, or (5) an unnamed parameter during the newslogo_upload action in admin.php.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-03/0069.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6088&w=2; http://www.securityfocus.com/bid/9812
CVE: CVE-2004-0359
Published: 2004-11-23
Description: Cross-site scripting (XSS) vulnerability in index.php for Invision Power Board 1.3 final allows remote attackers to execute arbitrary script as other users via the (1) c, (2) f, (3) showtopic, (4) showuser, or (5) username parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1916&w=2; http://secunia.com/advisories/11053; http://www.osvdb.org/4154
CVE: CVE-2004-0360
Published: 2004-11-23
Description: Unknown vulnerability in passwd(1) in Solaris 8.0 and 9.0 allows local users to gain privileges via unknown attack vectors.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3414&w=2; http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57454; http://www.ciac.org/ciac/bulletins/o-088.shtml
CVE: CVE-2004-0361
Published: 2004-11-23
Description: The Javascript engine in Safari 1.2 and earlier allows remote attackers to cause a denial of service (segmentation fault) by creating a new Array object with a large size value, then writing into that array.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0106&w=2; http://www.insecure.ws/article.php?story=[PII_REDACTED]; http://www.securityfocus.com/bid/9815
CVE: CVE-2004-0415
Published: 2004-11-23
Description: Linux kernel does not properly convert 64-bit file offset pointers to 32 bits, which allows local users to access portions of kernel memory.
CVSS Score: 2.1 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20040804-01-U.asc; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000879; http://www.gentoo.org/security/en/glsa/glsa-200408-24.xml
CVE: CVE-2004-0494
Published: 2004-11-23
Description: Multiple extfs backend scripts for GNOME virtual file system (VFS) before 1.0.1 may allow remote attackers to perform certain unauthorized actions via a gnome-vfs URI.
CVSS Score: 7.5 (HIGH)
References: http://rpmfind.net/linux/RPM/suse/9.3/i386/suse/i586/gnome-vfs-1.0.5-816.2.i586.html; http://www.redhat.com/support/errata/RHSA-2004-373.html; https://bugzilla.fedora.us/show_bug.cgi?id=1944
CVE: CVE-2004-0597
Published: 2004-11-23
Description: Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
CVSS Score: 10.0 (HIGH)
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000856; http://lists.apple.com/mhonarc/security-announce/msg00056.html
CVE: CVE-2004-0598
Published: 2004-11-23
Description: The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000856; http://lists.apple.com/mhonarc/security-announce/msg00056.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7909&w=2
CVE: CVE-2004-0599
Published: 2004-11-23
Description: Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000856; http://lists.apple.com/mhonarc/security-announce/msg00056.html
CVE: CVE-2004-0636
Published: 2004-11-23
Description: Buffer overflow in the goaway function in the aim:goaway URI handler for AOL Instant Messenger (AIM) 5.5, including 5.5.3595, allows remote attackers to execute arbitrary code via a long Away message.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/12198/; http://www.idefense.com/application/poi/display?id=121&type=vulnerabilities; http://www.kb.cert.org/vuls/id/735966
CVE: CVE-2004-0743
Published: 2004-11-23
Description: Safari in Mac OS X before 10.3.5, after sending form data using the POST method, may re-send the data to a GET method URL if that URL is redirected after the POST data and the user uses the forward or backward buttons, which may cause an information leak.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/mhonarc/security-announce/msg00056.html; http://www.kb.cert.org/vuls/id/128414; https://exchange.xforce.ibmcloud.com/vulnerabilities/16944
CVE: CVE-2004-0744
Published: 2004-11-23
Description: The TCP/IP Networking component in Mac OS X before 10.3.5 allows remote attackers to cause a denial of service (memory and resource consumption) via a "Rose Attack" that involves sending a subset of small IP fragments that do not form a complete, larger packet.
CVSS Score: 5.0 (MEDIUM)
References: http://digital.net/~gandalf/Rose_Frag_Attack_Explained.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9193&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9618&w=2
CVE: CVE-2004-0771
Published: 2004-11-23
Description: Buffer overflow in the extract_one function from lhext.c in LHA may allow attackers to execute arbitrary code via a long w (working directory) command line option, a different issue than CVE-2004-0769. NOTE: this issue may be REJECTED if there are not any cases in which LHA is setuid or is otherwise used across security boundaries.
CVSS Score: 10.0 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=51285; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0153; http://www.gentoo.org/security/en/glsa/glsa-200409-13.xml
CVE: CVE-2004-0308
Published: 2004-11-24
Description: Unknown vulnerability in Cisco ONS 15327 before 4.1(3), ONS 15454 before 4.6(1), ONS 15454 SD before 4.1(3), and Cisco ONS15600 before 1.3(0) allows a superuser whose account is locked out, disabled, or suspended to gain unauthorized access via a Telnet connection to the VxWorks shell.
CVSS Score: 10.0 (HIGH)
References: http://www.cisco.com/warp/public/707/cisco-sa-20040219-ONS.shtml; http://www.osvdb.org/4010; http://www.securityfocus.com/bid/9699
CVE: CVE-2004-1771
Published: 2004-11-30
Description: Scalable OGo (SOGo) 1.0 allows remote authenticated users to bypass intended permissions and view private appointments of other users.
CVSS Score: 5.0 (MEDIUM)
References: http://bugzilla.opengroupware.org/bugzilla/show_bug.cgi?id=1060; http://securitytracker.com/id?1013553; http://www.osvdb.org/14675
CVE: CVE-2004-1352
Published: 2004-12-01
Description: Buffer overflow in the ping daemon of Sun Solaris 7 through 9 may allow local users to execute arbitrary code.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/13340; http://securitytracker.com/id?1012368; http://sunsolve.sun.com/search/document.do?assetkey=1-26-57675-1&searchclause=%22category:security%22%20%22availability%2C%20security%22
CVE: CVE-2004-1081
Published: 2004-12-02
Description: The Application Framework (AppKit) for Apple Mac OS X 10.2.8 and 10.3.6 does not properly restrict access to a secure text input field, which allows local users to read keyboard input from other applications within the same window session.
CVSS Score: 2.1 (LOW)
References: http://lists.apple.com/archives/security-announce/2004/Dec/msg00000.html; http://secunia.com/advisories/13362/; http://www.ciac.org/ciac/bulletins/p-049.shtml
CVE: CVE-2004-1084
Published: 2004-12-02
Description: Apache for Apple Mac OS X 10.2.8 and 10.3.6 allows remote attackers to read files and resource fork content via HTTP requests to certain special file names related to multiple data streams in HFS+, which bypass Apache file handles.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2004/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html; http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html
CVE: CVE-2004-1085
Published: 2004-12-02
Description: Human Interface Toolbox (HIToolBox) for Apple Mac 0S X 10.3.6 allows local users to exit applications via the force-quit key combination, even when the system is running in kiosk mode.
CVSS Score: 2.1 (LOW)
References: http://lists.apple.com/archives/security-announce/2004/Dec/msg00000.html; http://secunia.com/advisories/13362/; http://www.ciac.org/ciac/bulletins/p-049.shtml
CVE: CVE-2004-1086
Published: 2004-12-02
Description: Buffer overflow in PSNormalizer for Apple Mac OS X 10.3.6 allows remote attackers to execute arbitrary code via a crafted PostScript input file.
CVSS Score: 7.5 (HIGH)
References: http://lists.apple.com/archives/security-announce/2004/Dec/msg00000.html; http://secunia.com/advisories/13362/; http://www.ciac.org/ciac/bulletins/p-049.shtml
CVE: CVE-2004-1087
Published: 2004-12-02
Description: Terminal for Apple Mac OS X 10.3.6 may indicate that "Secure Keyboard Entry" is enabled even when it is not, which could result in a false sense of security for the user.
CVSS Score: 2.1 (LOW)
References: http://lists.apple.com/archives/security-announce/2004/Dec/msg00000.html; http://secunia.com/advisories/13362/; http://www.ciac.org/ciac/bulletins/p-049.shtml
CVE: CVE-2004-1088
Published: 2004-12-02
Description: Postfix server for Apple Mac OS X 10.3.6, when using CRAM-MD5, allows remote attackers to send mail without authentication by replaying authentication information.
CVSS Score: 7.5 (HIGH)
References: http://lists.apple.com/archives/security-announce/2004/Dec/msg00000.html; http://secunia.com/advisories/13362/; http://www.ciac.org/ciac/bulletins/p-049.shtml
CVE: CVE-2004-1089
Published: 2004-12-02
Description: Unknown vulnerability in Apple Mac OS X 10.3.6 server, when using Kerberos authentication and Cyrus IMAP allows local users to access mailboxes of other users.
CVSS Score: 4.6 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2004/Dec/msg00000.html; http://secunia.com/advisories/13362/; http://www.ciac.org/ciac/bulletins/p-049.shtml
CVE: CVE-2003-1208
Published: 2004-12-03
Description: Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow local users to execute arbitrary code by (1) setting the TIME_ZONE session parameter to a long value, or providing long parameters to the (2) NUMTOYMINTERVAL, (3) NUMTODSINTERVAL or (4) FROM_TZ functions.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0030.html; http://secunia.com/advisories/10805; http://www.ciac.org/ciac/bulletins/o-093.shtml
CVE: CVE-2004-1083
Published: 2004-12-03
Description: Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which allows remote attackers to read .DS_Store files and files beginning with ".ht" using alternate capitalization.
CVSS Score: 7.5 (HIGH)
CWE: CWE-178
References: http://lists.apple.com/archives/security-announce/2004/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html; http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html
CVE: CVE-2002-1581
Published: 2004-12-06
Description: Directory traversal vulnerability in nph-mr.cgi in Mailreader.com 2.3.20 through 2.3.31 allows remote attackers to view arbitrary files via .. (dot dot) sequences and a null byte (%00) in the configLanguage parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://mailreader.com/download/ChangeLog; http://mailreader.com/download/ChangeLog; http://www.debian.org/security/2004/dsa-534
CVE: CVE-2002-1582
Published: 2004-12-06
Description: compose.cgi in Mailreader.com 2.3.30 and 2.3.31, when using Sendmail as the Mail Transfer Agent, allows remote attackers to execute arbitrary commands via shell metacharacters in the RealEmail configuration variable, which is used to call Sendmail in network.cgi.
CVSS Score: 10.0 (HIGH)
References: http://www.iss.net/security_center/static/10491.php; http://www.mailreader.com/download/ChangeLog; http://www.securityfocus.com/archive/1/297428
CVE: CVE-2004-0393
Published: 2004-12-06
Description: Format string vulnerability in the msg function for rlpr daemon (rlprd) 2.0.4 allows remote attackers to execute arbitrary code via format string specifiers in a buffer that can not be resolved, which is provided to the syslog function.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3652&w=2; http://www.debian.org/security/2004/dsa-524; http://www.securityfocus.com/bid/10578
CVE: CVE-2004-0395
Published: 2004-12-06
Description: The xatitv program in the gatos package does not properly drop root privileges when the configuration file does not exist, which allows local users to execute arbitrary commands via shell metacharacters in a system call.
CVSS Score: 7.2 (HIGH)
References: http://www.debian.org/security/2004/dsa-509; http://www.securityfocus.com/bid/10437; https://exchange.xforce.ibmcloud.com/vulnerabilities/16273
CVE: CVE-2004-0448
Published: 2004-12-06
Description: Format string vulnerability in the log function for jftpgw 0.13.4 and earlier allows remote authenticated users to execute arbitrary code via format string specifiers in certain syslog messages.
CVSS Score: 10.0 (HIGH)
References: http://www.debian.org/security/2004/dsa-510; http://www.securityfocus.com/bid/10438; https://exchange.xforce.ibmcloud.com/vulnerabilities/16271
CVE: CVE-2004-0451
Published: 2004-12-06
Description: Multiple format string vulnerabilities in the (1) logquit, (2) logerr, or (3) loginfo functions in Software Upgrade Protocol (SUP) allows remote attackers to execute arbitrary code via format string specifiers in messages that are logged by syslog.
CVSS Score: 10.0 (HIGH)
References: http://securitytracker.com/id?1010539; http://www.debian.org/security/2004/dsa-521; http://www.securityfocus.com/bid/10571
CVE: CVE-2004-0454
Published: 2004-12-06
Description: Buffer overflow in the msg function for rlpr daemon (rlprd) 2.04 allows local users to execute arbitrary code.
CVSS Score: 7.2 (HIGH)
References: http://www.debian.org/security/2004/dsa-524; http://www.securityfocus.com/bid/10578; https://exchange.xforce.ibmcloud.com/vulnerabilities/16454
CVE: CVE-2004-0455
Published: 2004-12-06
Description: Buffer overflow in cgi.c in www-sql before 0.5.7 allows local users to execute arbitrary code via a web page that is processed by www-sql.
CVSS Score: 7.2 (HIGH)
CWE: CWE-120
References: http://www.debian.org/security/2004/dsa-523; http://www.securityfocus.com/bid/10577; https://exchange.xforce.ibmcloud.com/vulnerabilities/16455
CVE: CVE-2004-0456
Published: 2004-12-06
Description: Stack-based buffer overflow in pavuk 0.9pl28, 0.9pl27, and possibly other versions allows remote web sites to execute arbitrary code via a long HTTP Location header.
CVSS Score: 7.6 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023322.html; http://security.gentoo.org/glsa/glsa-200406-22.xml; http://www.debian.org/security/2004/dsa-527
CVE: CVE-2004-0468
Published: 2004-12-06
Description: Memory leak in Juniper JUNOS Packet Forwarding Engine (PFE) allows remote attackers to cause a denial of service (memory exhaustion and device reboot) via certain IPv6 packets.
CVSS Score: 5.0 (MEDIUM)
References: http://www.jpcert.or.jp/at/2004/at040009.txt; http://www.kb.cert.org/vuls/id/658859; http://www.kb.cert.org/vuls/id/JSHA-6253CC
CVE: CVE-2004-0477
Published: 2004-12-06
Description: Unknown vulnerability in 3Com OfficeConnect Remote 812 ADSL Router allows remote attackers to bypass authentication via repeated attempts using any username and password.  NOTE: this identifier was inadvertently re-used for another issue due to a typo; that issue was assigned CVE-2004-0447.  This candidate is ONLY for the ADSL router bypass.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/11716; http://www.idefense.com/application/poi/display?id=106&type=vulnerabilities&flashstatus=false; http://www.securityfocus.com/bid/10426
CVE: CVE-2004-0480
Published: 2004-12-06
Description: Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via a notes: URI that uses a UNC network share pathname to provide an alternate notes.ini configuration file to notes.exe.
CVSS Score: 10.0 (HIGH)
CWE: CWE-88
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6099&w=2; http://www-1.ibm.com/support/docview.wss?rs=475/context=SSKTWP&uid=swg21169510; http://www.idefense.com/application/poi/display?id=111&type=vulnerabilities
CVE: CVE-2004-0496
Published: 2004-12-06
Description: Multiple unknown vulnerabilities in Linux kernel 2.6 allow local users to gain privileges or access kernel memory, a different set of vulnerabilities than those identified in CVE-2004-0495, as found by the Sparse source code checking tool.
CVSS Score: 7.2 (HIGH)
References: http://www.novell.com/linux/security/advisories/2004_20_kernel.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/16625; http://www.novell.com/linux/security/advisories/2004_20_kernel.html
CVE: CVE-2004-0497
Published: 2004-12-06
Description: Unknown vulnerability in Linux kernel 2.x may allow local users to modify the group ID of files, such as NFS exported files in kernel 2.4.
CVSS Score: 2.1 (LOW)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000852; http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:066; http://www.novell.com/linux/security/advisories/2004_20_kernel.html
CVE: CVE-2004-0565
Published: 2004-12-06
Description: Floating point information leak in the context switch code for Linux 2.4.x only checks the MFH bit but does not verify the FPH owner, which allows local users to read register values of other processes by setting the MFH bit.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/linux/owl/2004-q2/0038.html; http://secunia.com/advisories/20162; http://secunia.com/advisories/20163
CVE: CVE-2004-0576
Published: 2004-12-06
Description: The radius daemon (radiusd) for GNU Radius 1.1, when compiled with the -enable-snmp option, allows remote attackers to cause a denial of service (server crash) via malformed SNMP messages containing an invalid OID.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6726&w=2; http://www.idefense.com/application/poi/display?id=110&type=vulnerabilities; https://exchange.xforce.ibmcloud.com/vulnerabilities/16466
CVE: CVE-2004-0577
Published: 2004-12-06
Description: WinGate 5.2.3 build 901 and 6.0 beta 2 build 942, and other versions such as 5.0.5, allows remote attackers to read arbitrary files from the root directory via a URL request to the wingate-internal directory.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]3695&w=2; http://www.idefense.com/application/poi/display?id=113; https://exchange.xforce.ibmcloud.com/vulnerabilities/16589
CVE: CVE-2004-0578
Published: 2004-12-06
Description: WinGate 5.2.3 build 901 and 6.0 beta 2 build 942, and other versions such as 5.0.5, allows remote attackers to read arbitrary files via leading slash (//) characters in a URL request to the wingate-internal directory.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]3695&w=2; http://www.idefense.com/application/poi/display?id=113; https://exchange.xforce.ibmcloud.com/vulnerabilities/16589