deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-1377
Published: 2004-12-27
Description: The (1) fixps (aka fixps.in) and (2) psmandup (aka psmandup.in) scripts in a2ps before 4.13 allow local users to overwrite arbitrary files via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/13641; http://www.gentoo.org/security/en/glsa/glsa-200501-02.xml; http://www.securityfocus.com/bid/12108
CVE: CVE-2004-1062
Published: 2004-12-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in ViewCVS 0.9.2 allow remote attackers to inject arbitrary HTML and web script via certain error messages.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-December/030222.html; http://security.gentoo.org/glsa/glsa-200412-26.xml; http://www.mikx.de/index.php?p=6
CVE: CVE-2004-1316
Published: 2004-12-29
Description: Heap-based buffer overflow in MSG_UnEscapeSearchUrl in nsNNTPProtocol.cpp for Mozilla 1.7.3 and earlier allows remote attackers to cause a denial of service (application crash) via an NNTP URL (news:) with a trailing '\' (backslash) character, which prevents a string from being NULL terminated.
CVSS Score: 5.0 (MEDIUM)
References: http://isec.pl/vulnerabilities/isec-0020-mozilla.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8949&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6478&w=2
CVE: CVE-2004-1376
Published: 2004-12-30
Description: Directory traversal vulnerability in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote malicious FTP servers to overwrite arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0103&w=2; http://secunia.com/advisories/13704; http://www.7a69ezine.org/node/view/176
CVE: CVE-2004-0090
Published: 2004-12-31
Description: Unknown vulnerability in Windows File Sharing for Mac OS X 10.1.5 through 10.3.2 does not "shutdown properly," which has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2004/Jan/msg00000.html; http://secunia.com/advisories/10723/; http://www.auscert.org.au/render.html?it=3791&cid=1
CVE: CVE-2004-0138
Published: 2004-12-31
Description: The ELF loader in Linux kernel 2.4 before 2.4.25 allows local users to cause a denial of service (crash) via a crafted ELF file with an interpreter with an invalid arch (architecture), which triggers a BUG() when an invalid VMA is unmapped.
CVSS Score: 4.9 (MEDIUM)
References: http://kernel.debian.net/debian/pool/main/kernel-source-2.4.17/kernel-source-2.4.17_2.4.17-1woody4_ia64.changes; http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.25; http://linux.bkbits.net:8080/linux-2.4/cset%404021346f79nBb-4X_usRikR3Iyb4Vg
CVE: CVE-2004-0323
Published: 2004-12-31
Description: Multiple SQL injection vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to inject arbitrary SQL and gain privileges via the (1) ppp parameter in viewthread.php, (2) desc parameter in misc.php, (3) tpp parameter in forumdisplay.php, (4) ascdesc parameter in forumdisplay.php, or (5) the addon parameter in stats.php.  NOTE: it has also been shown that item (3) is also in XMB 1.9 beta.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2004-02/0645.html; http://archives.neohapsis.com/archives/bugtraq/2004-03/0265.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5179&w=2
CVE: CVE-2004-0325
Published: 2004-12-31
Description: TYPSoft FTP Server 1.10 allows remote authenticated users to cause a denial of service (CPU consumption) via "//../" arguments to (1) mkd, (2) xmkd, (3) dele, (4) size, (5) retr, (6) stor, (7) appe, (8) rnfr, (9) rnto, (10) rmd, or (11) xrmd, as demonstrated using "//../qwerty".
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1905&w=2; http://www.securityfocus.com/bid/9702; https://exchange.xforce.ibmcloud.com/vulnerabilities/15306
CVE: CVE-2004-0369
Published: 2004-12-31
Description: Buffer overflow in Entrust LibKmp ISAKMP library, as used by Symantec Enterprise Firewall 7.0 through 8.0, Gateway Security 5300 1.0, Gateway Security 5400 2.0, and VelociRaptor 1.5, allows remote attackers to execute arbitrary code via a crafted ISAKMP payload.
CVSS Score: 7.5 (HIGH)
References: http://securityresponse.symantec.com/avcenter/security/Content/2004.08.26.html; http://www.auscert.org.au/render.html?it=4339; http://www.ciac.org/ciac/bulletins/o-206.shtml
CVE: CVE-2004-0390
Published: 2004-12-31
Description: SCO OpenServer 5.0.5 through 5.0.7 only supports Xauthority style access control when users log in using scologin, which allows remote attackers to gain unauthorized access to an X session via other X login methods.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0424.html; http://www.securityfocus.com/advisories/6684; https://exchange.xforce.ibmcloud.com/vulnerabilities/16113
CVE: CVE-2004-0410
Published: 2004-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2004-0429
Published: 2004-12-31
Description: Unknown vulnerability related to "the handling of large requests" in RAdmin for Apple Mac OS X 10.3.3 and Mac OS X 10.2.8 may allow attackers to have unknown impact via unknown attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2004/May/msg00000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4244&w=2; http://secunia.com/advisories/11539/
CVE: CVE-2004-0462
Published: 2004-12-31
Description: The built-in web servers for multiple networking devices do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session with the same server.
CVSS Score: 2.1 (LOW)
References: http://www.kb.cert.org/vuls/id/546483; https://exchange.xforce.ibmcloud.com/vulnerabilities/17702; http://www.kb.cert.org/vuls/id/546483
CVE: CVE-2004-0465
Published: 2004-12-31
Description: Directory traversal vulnerability in jretest.html in WebConnect 6.5 and 6.4.4, and possibly earlier versions, allows remote attackers to read keys within arbitrary INI formatted files via "..//" sequences in the WCP_USER parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0145&w=2; http://secunia.com/advisories/14006/; http://www.cirt.dk/advisories/cirt-29-advisory.pdf
CVE: CVE-2004-0467
Published: 2004-12-31
Description: Juniper JUNOS 5.x through JUNOS 7.x allows remote attackers to cause a denial of service (routing disabled) via a large number of MPLS packets, which are not filtered or verified before being sent to the Routing Engine, which reduces the speed at which other packets are processed.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/14049; http://securitytracker.com/id?1013039; http://www.kb.cert.org/vuls/id/409555
CVE: CVE-2004-0491
Published: 2004-12-31
Description: The linux-2.4.21-mlock.patch in Red Hat Enterprise Linux 3 does not properly maintain the mlock page count when one process unlocks pages that belong to another process, which allows local users to mlock more memory than specified by the rlimit.
CVSS Score: 2.1 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20060402-01-U; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]0947&w=2; http://secunia.com/advisories/19607
CVE: CVE-2004-0498
Published: 2004-12-31
Description: The H.323 protocol agent in StoneSoft firewall engine 2.2.8 and earlier allows remote attackers to cause a denial of service (crash) via crafted H.323 packets.
CVSS Score: 5.0 (MEDIUM)
References: http://www.stonesoft.com/support/Security_Advisories/6735.html; http://www.uniras.gov.uk/niscc/docs/re-20[PII_REDACTED]6.pdf?lang=en; http://www.stonesoft.com/support/Security_Advisories/6735.html
CVE: CVE-2004-0499
Published: 2004-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Notes: none
CVE: CVE-2004-0533
Published: 2004-12-31
Description: Business Objects WebIntelligence 2.7.0 through 2.7.4 only enforces access controls on the client, which allows remote authenticated users to delete arbitrary files on the server via a crafted delete request using the InfoView web client.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0056.html; http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/026549.html; http://secunia.com/advisories/12587/
CVE: CVE-2004-0555
Published: 2004-12-31
Description: Buffer overflow in (1) queue.c and (2) queued.c in queue before 1.30.1 may allow remote attackers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1012929; http://www.debian.org/security/2005/dsa-643; https://exchange.xforce.ibmcloud.com/vulnerabilities/18945
CVE: CVE-2004-0560
Published: 2004-12-31
Description: Integer overflow in gopher daemon (gopherd) 3.0.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted content of a certain size that triggers the overflow.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/13855; http://www.debian.org/security/2004/dsa-638; http://secunia.com/advisories/13855
CVE: CVE-2004-0561
Published: 2004-12-31
Description: Format string vulnerability in the log routine for gopher daemon (gopherd) 3.0.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/13855; http://www.debian.org/security/2004/dsa-638; http://secunia.com/advisories/13855
CVE: CVE-2004-0567
Published: 2004-12-31
Description: The Windows Internet Naming Service (WINS) in Windows NT Server 4.0 SP 6a, NT Terminal Server 4.0 SP 6, Windows 2000 Server SP3 and SP4, and Windows Server 2003 does not properly validate the computer name value in a WINS packet, which allows remote attackers to execute arbitrary code or cause a denial of service (server crash), which results in an "unchecked buffer" and possibly triggers a buffer overflow, aka the "Name Validation Vulnerability."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/13466; http://securitytracker.com/id?1012517; http://www.ciac.org/ciac/bulletins/p-054.shtml
CVE: CVE-2004-0592
Published: 2004-12-31
Description: The tcp_find_option function of the netfilter subsystem for IPv6 in the SUSE Linux 2.6.5 kernel with USAGI patches, when using iptables and TCP options rules, allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a large option length that produces a negative integer after a casting operation to the char type, a similar flaw to CVE-2004-0626.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023408.html; http://www.novell.com/linux/security/advisories/2004_20_kernel.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/43137
CVE: CVE-2004-0638
Published: 2004-12-31
Description: Buffer overflow in the KSDWRTB function in the dbms_system package (dbms_system.ksdwrt) for Oracle 9i Database Server Release 2 9.2.0.3 and 9.2.0.4, 9i Release 1 9.0.1.4 and 9.0.1.5, and 8i Release 1 8.1.7.4, allows remote authorized users to execute arbitrary code via a long second argument.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0178.html; http://www.idefense.com/application/poi/display?id=135&type=vulnerabilities&flashstatus=false; http://www.oracle.com/technology/deploy/security/pdf/2004alert68.pdf
CVE: CVE-2004-0780
Published: 2004-12-31
Description: Buffer overflow in uustat in Sun Solaris 8 and 9 allows local users to execute arbitrary code via a long -S command line argument.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/18371; http://secunia.com/advisories/19087; http://securitytracker.com/id?1015455
CVE: CVE-2004-0789
Published: 2004-12-31
Description: Multiple implementations of the DNS protocol, including (1) Poslib 1.0.2-1 and earlier as used by Posadis, (2) Axis Network products before firmware 3.13, and (3) Men & Mice Suite 2.2x before 2.2.3 and 3.5.x before 3.5.2, allow remote attackers to cause a denial of service (CPU and network bandwidth consumption) by triggering a communications loop via (a) DNS query packets with localhost as a spoofed source address, or (b) a response packet that triggers a response packet.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/13145; http://securitytracker.com/id?1012157; http://www.niscc.gov.uk/niscc/docs/al-20[PII_REDACTED]2.html?lang=en
CVE: CVE-2004-0802
Published: 2004-12-31
Description: Buffer overflow in the BMP loader in imlib2 before 1.1.2 allows remote attackers to execute arbitrary code via a specially-crafted BMP image, a different vulnerability than CVE-2004-0817.
CVSS Score: 5.1 (MEDIUM)
References: http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/ChangeLog?rev=1.20&view=markup; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000870; http://sunsolve.sun.com/search/document.do?assetkey=1-66-201611-1
CVE: CVE-2004-0806
Published: 2004-12-31
Description: cdrecord in the cdrtools package before 2.01, when installed setuid root, does not properly drop privileges before executing a program specified in the RSH environment variable, which allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U; http://seclists.org/lists/bugtraq/2004/Sep/0097.html; http://secunia.com/advisories/12481/
CVE: CVE-2004-0808
Published: 2004-12-31
Description: The process_logon_packet function in the nmbd server for Samba 3.0.6 and earlier, when domain logons are enabled, allows remote attackers to cause a denial of service via a SAM_UAS_CHANGE request with a length value that is larger than the number of structures that are provided.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000873; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0495&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3307&w=2
CVE: CVE-2004-0811
Published: 2004-12-31
Description: Unknown vulnerability in Apache 2.0.51 prevents "the merging of the Satisfy directive," which could allow attackers to obtain access to restricted resources contrary to the specified authentication configuration.
CVSS Score: 7.5 (HIGH)
References: http://fedoranews.org/updates/FEDORA-2004-313.shtml; http://security.gentoo.org/glsa/glsa-200409-33.xml; http://www.apache.org/dist/httpd/patches/apply_to_2.0.51/CAN-2004-0811.patch
CVE: CVE-2004-0813
Published: 2004-12-31
Description: Unknown vulnerability in the SG_IO functionality in ide-cd allows local users to bypass read-only access and perform unauthorized write and erase operations.
CVSS Score: 2.1 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc; http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html; http://lkml.org/lkml/2004/7/30/147
CVE: CVE-2004-0817
Published: 2004-12-31
Description: Multiple heap-based buffer overflows in the imlib BMP image handler allow remote attackers to execute arbitrary code via a crafted BMP file.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000870; http://sunsolve.sun.com/search/document.do?assetkey=1-66-201611-1; http://www.debian.org/security/2004/dsa-548
CVE: CVE-2004-0821
Published: 2004-12-31
Description: The CFPlugIn in Core Foundation framework in Mac OS X allows user supplied libraries to be loaded, which could allow local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/12491/; http://www.auscert.org.au/render.html?it=4363; http://www.auscert.org.au/render.html?it=4363
CVE: CVE-2004-0824
Published: 2004-12-31
Description: PPPDialer for Mac OS X 10.2.8 through 10.3.5 allows local users to overwrite system files via a symlink attack on PPPDialer log files.
CVSS Score: 2.1 (LOW)
References: http://securitytracker.com/id?1011175; http://www.auscert.org.au/render.html?it=4363; http://www.ciac.org/ciac/bulletins/o-212.shtml
CVE: CVE-2004-0825
Published: 2004-12-31
Description: QuickTime Streaming Server in Mac OS X Server 10.2.8, 10.3.4, and 10.3.5 allows remote attackers to cause a denial of service (application deadlock) via a certain sequence of operations.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7466&w=2; http://secunia.com/advisories/12491; http://securitytracker.com/id?1011176
CVE: CVE-2004-0826
Published: 2004-12-31
Description: Heap-based buffer overflow in Netscape Network Security Services (NSS) library allows remote attackers to execute arbitrary code via a modified record length field in an SSLv2 client hello message.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7731&w=2; http://www.securityfocus.com/bid/11015; http://xforce.iss.net/xforce/alerts/id/180
CVE: CVE-2004-0829
Published: 2004-12-31
Description: smbd in Samba before 2.2.11 allows remote attackers to cause a denial of service (daemon crash) by sending a FindNextPrintChangeNotify request without a previous FindFirstPrintChangeNotify, as demonstrated by the SMB client in Windows XP SP2.
CVSS Score: 5.0 (MEDIUM)
References: http://samba.org/samba/history/samba-2.2.11.html; http://seclists.org/lists/bugtraq/2004/Sep/0003.html; http://www.gentoo.org/security/en/glsa/glsa-200409-14.xml
CVE: CVE-2004-0904
Published: 2004-12-31
Description: Integer overflow in the bitmap (BMP) decoder for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote attackers to execute arbitrary code via wide bitmap files that trigger heap-based buffer overflows.
CVSS Score: 10.0 (HIGH)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=255067; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4418&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9363&w=2
CVE: CVE-2004-0906
Published: 2004-12-31
Description: The XPInstall installer in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 sets insecure permissions for certain installed files within xpi packages, which could allow local users to overwrite arbitrary files or execute arbitrary code.
CVSS Score: 4.6 (MEDIUM)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=231083; http://bugzilla.mozilla.org/show_bug.cgi?id=235781; http://secunia.com/advisories/12526/
CVE: CVE-2004-0907
Published: 2004-12-31
Description: The Linux install .tar.gz archives for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8, create certain files with insecure permissions, which could allow local users to overwrite those files and execute arbitrary code.
CVSS Score: 4.6 (MEDIUM)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=254303; http://security.gentoo.org/glsa/glsa-200409-26.xml; http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3
CVE: CVE-2004-0908
Published: 2004-12-31
Description: Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows untrusted Javascript code to read and write to the clipboard, and possibly obtain sensitive information, via script-generated events such as Ctrl-Ins.
CVSS Score: 4.0 (MEDIUM)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=257523; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4418&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9363&w=2
CVE: CVE-2004-0909
Published: 2004-12-31
Description: Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 may allow remote attackers to trick users into performing unexpected actions, including installing software, via signed scripts that request enhanced abilities using the enablePrivilege parameter, then modify the meaning of certain security-relevant dialog messages.
CVSS Score: 5.1 (MEDIUM)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=253942; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4418&w=2; http://secunia.com/advisories/12526
CVE: CVE-2004-0913
Published: 2004-12-31
Description: Unknown vulnerability in ecartis 0.x before 0.129a+1.0.0-snap20020514-1.3 and 1.x before 1.0.0+cvs.20030911-8 allows attackers in the same domain to gain administrator privileges and modify configuration.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/12918/; http://www.auscert.org.au/render.html?it=4491; http://www.debian.org/security/2004/dsa-572
CVE: CVE-2004-0919
Published: 2004-12-31
Description: The syscons CONS_SCRSHOT ioctl in FreeBSD 5.x allows local users to read arbitrary kernel memory via (1) negative coordinates or (2) large coordinates.
CVSS Score: 4.6 (MEDIUM)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:15.syscons.asc; http://secunia.com/advisories/12722; http://www.kb.cert.org/vuls/id/969078
CVE: CVE-2004-0931
Published: 2004-12-31
Description: MySQL MaxDB before 7.5.00.18 allows remote attackers to cause a denial of service (crash) via an HTTP request to webdbm with high ASCII values in the Server field, which triggers an assert error in the IsAscii7 function.
CVSS Score: 5.0 (MEDIUM)
References: http://www.idefense.com/application/poi/display?id=150&type=vulnerabilities&flashstatus=false; http://www.osvdb.org/10532; http://www.secunia.com/advisories/12756
CVE: CVE-2004-0943
Published: 2004-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2004-0948
Published: 2004-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  It was a duplicate assignment before public disclosure.  Notes: none
CVE: CVE-2004-0951
Published: 2004-12-31
Description: The make_recovery command for the TFTP server in HP Ignite-UX before C.6.2.241 makes a copy of the password file in the TFTP directory tree, which allows remote attackers to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16456/; http://securitytracker.com/id?1014711; http://www.corsaire.com/advisories/c041123-001.txt
CVE: CVE-2004-0952
Published: 2004-12-31
Description: HP-UX B.11.00 through B.11.23, when running Ignite-UX and using the add_new_client command, causes the TFTP server to set world-writable permissions on part of the directory tree, which allows remote attackers to modify data or cause disk consumption.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1136&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9112&w=2; http://secunia.com/advisories/16456/
CVE: CVE-2004-0979
Published: 2004-12-31
Description: Internet Explorer on Windows XP does not properly modify the "Drag and Drop or copy and paste files" setting when the user sets it to "Disable" or "Prompt," which may enable security-sensitive operations that are inconsistent with the user's intended configuration.
CVSS Score: 4.6 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/630720; http://www.us-cert.gov/cas/techalerts/TA04-293A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-038
CVE: CVE-2004-0984
Published: 2004-12-31
Description: Unknown vulnerability in the dotlock implementation in mailutils before 1:0.5-4 on Debian GNU/Linux allows attackers to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://packages.debian.org/changelogs/pool/main/m/mailutils/mailutils_0.6-2/changelog; http://packages.debian.org/changelogs/pool/main/m/mailutils/mailutils_0.6-2/changelog