deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-2727
Published: 2004-12-31
Description: Buffer overflow in MEHTTPS (HTTPMail) of MailEnable Professional 1.5 through 1.7 allows remote attackers to cause a denial of service (application crash) via a long HTTP GET request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/11588; http://securitytracker.com/id?1010107; http://www.hat-squad.com/en/000071.html
CVE: CVE-2004-2728
Published: 2004-12-31
Description: Buffer overflow in the FTP server of Hummingbird Connectivity 7.1 and 9.0 allows remote, authenticated users to cause a denial of service (application crash) via a long argument to the XCWD command.
CVSS Score: 3.5 (LOW)
CWE: CWE-119
References: http://secunia.com/advisories/12984; http://securitytracker.com/id?1011942; http://www.osvdb.org/11133
CVE: CVE-2004-2729
Published: 2004-12-31
Description: Inetd32 Administration Tool of Hummingbird Connectivity 7.1 and 9.0 allows local users to execute arbitrary code by changing the program for handling incoming connections.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/12984; http://securitytracker.com/id?1011942; http://www.osvdb.org/11132
CVE: CVE-2004-2730
Published: 2004-12-31
Description: Sysinternals PsTools before 2.05, including (1) PsExec before 1.54, (2) PsGetsid before 1.41, (3) PsInfo before 1.61, (4) PsKill before 1.03, (5) PsList before 1.26, (6) PsLoglist before 2.51, (7) PsPasswd before 1.21, (8) PsService before 2.12, (9) PsSuspend before 1.05, and (10) PsShutdown before 2.32, does not properly disconnect from remote IPC$ and ADMIN$ shares, which allows local users to access the shares with elevated privileges by using the existing share mapping.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/12108; http://securitytracker.com/id?1010737; http://www.osvdb.org/8140
CVE: CVE-2004-2731
Published: 2004-12-31
Description: Multiple integer overflows in Sbus PROM driver (drivers/sbus/char/openprom.c) for the Linux kernel 2.4.x up to 2.4.27, 2.6.x up to 2.6.7, and possibly later versions, allow local users to execute arbitrary code by specifying (1) a small buffer size to the copyin_string function or (2) a negative buffer size to the copyin function.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-189
References: http://archives.neohapsis.com/archives/bugtraq/2004-06/0463.html; http://secunia.com/advisories/11981; http://secunia.com/advisories/29058
CVE: CVE-2004-2732
Published: 2004-12-31
Description: nbmember.cgi in Netbilling 2.0 allows remote attackers to obtain sensitive information via the cmd=test option, which can be leveraged to determine the access key.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-78
References: http://securitytracker.com/id?1011881; http://web.archive.org/web/[PII_REDACTED]0147/http://www.it-helpnet.de/bugless/bugs.php?mode=show&id=8&SID=; http://www.osvdb.org/10902
CVE: CVE-2004-2733
Published: 2004-12-31
Description: Web Wiz Forums 7.7a uses invalid logic to determine user privileges, which allows remote attackers to (1) block arbitrary IP addresses via pop_up_ip_blocking.asp or (2) modify topics via pop_up_topic_admin.asp.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-04/1119.html; http://secunia.com/advisories/11525; http://securitytracker.com/id?1010012
CVE: CVE-2004-2734
Published: 2004-12-31
Description: webadmin-apache.conf in Novell Web Manager of Novell NetWare 6.5 uses an uppercase Alias tag with an inconsistent lowercase directory tag for a volume, which allows remote attackers to bypass access control to the WEB-INF folder.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/12049; http://securitytracker.com/id?1011012; http://support.novell.com/cgi-bin/search/searchtid.cgi?/10094233.htm
CVE: CVE-2004-2735
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in P4DB 2.01 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) SET_PREFERENCES parameter in SetPreferences.cgi; (2) BRANCH parameter in branchView.cgi; (3) FSPC and (4) COMPLETE parameters in changeByUsers.cgi; (5) FSPC, (6) LABEL, (7) EXLABEL, (8) STATUS, (9) MAXCH, (10) FIRSTCH, (11) CHOFFSETDISP, (12) SEARCHDESC, (13) SEARCH_INVERT, (14) USER, (15) GROUP, and (16) CLIENT parameters in changeList.cgi; (17) CH parameter in changeView.cgi; (18) USER parameter in clientList.cgi; (19) CLIENT parameter in clientView.cgi; (20) FSPC parameter in depotTreeBrowser.cgi; (21) FSPC parameter in depotStats.cgi; (22) FSPC, (23) REV, (24) ACT, (25) FSPC2, (26) REV2, (27) CH, and (28) CONTEXT parameters in fileDiffView.cgi; (29) FSPC and (30) REV parameters in fileDownLoad.cgi; (31) FSPC, (32) LISTLAB, and (33) SHOWBRANCH parameters in fileLogView.cgi; (34) FSPC and (35) LABEL parameters in fileSearch.cgi; (36) FSPC, (37) REV, and (38) FORCE parameters in fileViewer.cgi; (39) FSPC parameter in filesChangedSince.cgi; (40) GROUP parameter in groupView.cgi; (41) TYPE, (42) FSPC, and (43) REV parameters in htmlFileView.cgi; (44) CMD parameter in javaDataView.cgi; (45) JOBVIEW and (46) FLD parameters in jobList.cgi; (47) JOB parameter in jobView.cgi; (48) LABEL1 and (49) LABEL2 parameters in labelDiffView.cgi; (50) LABEL parameter in labelView.cgi; (51) FSPC parameter in searchPattern.cgi; (52) TYPE, (53) FSPC, and (54) REV parameters in specialFileView.cgi; (55) GROUPSONLY parameter in userList.cgi; or (56) USER parameter in userView.cgi.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2004-05/0046.html; http://secunia.com/advisories/11559; http://securitytracker.com/id?1010078
CVE: CVE-2004-2736
Published: 2004-12-31
Description: Polar HelpDesk 3.0 allows remote attackers to bypass authentication by setting the UserId and UserType values in a cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/12120; http://www.osvdb.org/8168; http://www.securiteam.com/windowsntfocus/5OP0K0ADGA.html
CVE: CVE-2004-2737
Published: 2004-12-31
Description: SQL injection vulnerability in problist.asp in NetSupport DNA HelpDesk 1.01 allows remote attackers to execute arbitrary SQL commands via the where parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/12119; http://www.osvdb.org/8169; http://www.securiteam.com/windowsntfocus/5PP0L0ADGE.html
CVE: CVE-2004-2738
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in check_user_id.php in ZeroBoard 4.1pl4 and earlier allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-December/030224.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4947&w=2; http://secunia.com/advisories/13649
CVE: CVE-2004-2739
Published: 2004-12-31
Description: The setup routine (setup.php) in PHProjekt 4.2.1 and earlier allows remote attackers to modify system configuration via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/13355; http://securitytracker.com/id?1012369; http://www.gentoo.org/security/en/glsa/glsa-200412-06.xml
CVE: CVE-2004-2740
Published: 2004-12-31
Description: PHP remote file inclusion vulnerability in authform.inc.php in PHProjekt 4.2.3 and earlier allows remote attackers to include arbitrary PHP code via a URL in the path_pre parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/13660; http://securitytracker.com/id?1012708; http://www.gentoo.org/security/en/glsa/glsa-200412-27.xml
CVE: CVE-2004-2741
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in the "help window" (help.php) in Horde Application Framework 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) module, (2) topic, or (3) module parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cvs.horde.org/diff.php/horde/templates/help/index.inc?r1=1.9.2.4&r2=1.9.2.5&ty=u; http://lists.horde.org/archives/announce/2004/000107.html; http://secunia.com/advisories/12992
CVE: CVE-2004-2742
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in the report viewer in Crystal Enterprise 8.5, 9, and 10 allows remote attackers to inject arbitrary web script or HTML via script in the URL to a report (RPT) file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/13644; http://securitytracker.com/id?1012703; http://support.businessobjects.com/library/kbase/articles/c2016559.asp
CVE: CVE-2004-2743
Published: 2004-12-31
Description: upload.cgi in Mega Upload Progress Bar before 1.45 allows remote attackers to copy or overwrite arbitrary files via unspecified parameters related to names of uploaded files.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/12993; http://securitytracker.com/id?1011960; http://sourceforge.net/project/shownotes.php?release_id=277989
CVE: CVE-2004-2744
Published: 2004-12-31
Description: Unspecified vulnerability in Tincan Limited PHPlist before 2.8.12 has unknown impact and attack vectors, related to a "security update release."
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/12994; http://securitytracker.com/id?1011958; http://sourceforge.net/project/shownotes.php?release_id=277981
CVE: CVE-2004-2745
Published: 2004-12-31
Description: Directory traversal vulnerability in Anteco Visual Technologies OwnServer 1.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in a URL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/3329; http://www.securityfocus.com/archive/1/350421/30/21610/threaded; http://www.securityfocus.com/bid/9461
CVE: CVE-2004-2746
Published: 2004-12-31
Description: SQL injection vulnerability in adminlogin.asp in XTREME ASP Photo Gallery 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/10659; http://securityreason.com/securityalert/3346; http://securitytracker.com/id?1008745
CVE: CVE-2004-2747
Published: 2004-12-31
Description: Directory traversal vulnerability in Pablo Software Solutions Quick 'n Easy FTP Server 1.77, and possibly earlier versions, allows remote authenticated users to determine the existence of arbitrary files via a .. (dot dot) in the DEL command, which triggers different error messages depending on whether the file exists or not.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/10661; http://www.osvdb.org/3574; http://www.securityfocus.com/archive/1/350224/30/21640/threaded
CVE: CVE-2004-2748
Published: 2004-12-31
Description: viewreport.pl in NetIQ WebTrends Reporting Center Enterprise Edition 6.1a allows remote attackers to determine the installation path via an invalid profileid parameter, which leaks the pathname in an error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/10689; http://securityreason.com/securityalert/3354; http://www.osvdb.org/3680
CVE: CVE-2004-2749
Published: 2004-12-31
Description: Directory traversal vulnerability in wra/public/wralogin in 2Wire Gateway, possibly as used in HomePortal and other product lines, allows remote attackers to read arbitrary files via a .. (dot dot) in the return parameter.  NOTE: this issue was reported as XSS, but this might be a terminology error.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2004-01/0179.html; http://secunia.com/advisories/10666; http://securitytracker.com/id?1008798
CVE: CVE-2004-2750
Published: 2004-12-31
Description: Directory traversal vulnerability in browser.php in JBrowser 1.0 through 2.1 allows remote attackers to read arbitrary files via the directory parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://securitytracker.com/id?1008909; http://www.securityfocus.com/bid/9535; http://securitytracker.com/id?1008909
CVE: CVE-2004-2751
Published: 2004-12-31
Description: SQL injection vulnerability in the members_list module in PostNuke 0.726, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the sortby parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0117.html; http://community.postnuke.com/Article2535.htm; http://lists.postnuke.com/pipermail/postnuke-security/2004q1/000001.html
CVE: CVE-2004-2752
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in the Downloads module in PostNuke up to 0.726, and possibly later versions, allows remote attackers to inject arbitrary HTML and web script via the ttitle parameter in a viewdownloaddetails action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securitytracker.com/id?1008629; http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2004-01/0015.html; http://www.gulftech.org/01032004.php
CVE: CVE-2004-2753
Published: 2004-12-31
Description: Unspecified vulnerability in SharedX in HP-UX B.11.00, B.11.11, and B.11.22 allows local users to access unspecified files or cause a denial of service via unknown vectors related to handling of "files in a potentially insecure manner."
CVSS Score: 5.6 (MEDIUM)
References: http://secunia.com/advisories/10657; http://www.ciac.org/ciac/bulletins/o-058.shtml; http://www.securityfocus.com/bid/9420
CVE: CVE-2004-2754
Published: 2004-12-31
Description: SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the ID_MEMBER parameter to the (1) recentTopics and (2) welcome functions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3371; http://sourceforge.net/project/shownotes.php?release_id=210608&group_id=57105; http://www.osvdb.org/3618
CVE: CVE-2004-2755
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in Symantec Web Security 2.5, 3.0.0, and 3.0.1 before build 62 allows remote attackers to inject arbitrary web script or HTML via the query string in blocked URLs that are listed in (1) error or (2) block page messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/10618; http://securityresponse.symantec.com/avcenter/security/Content/2004.01.13.html; http://www.osvdb.org/6754
CVE: CVE-2004-2756
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in viewtopic.php in Xoops 2.x, possibly 2 through 2.0.5, allows remote attackers to inject arbitrary web script or HTML via the (1) forum and (2) topic_id parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securitytracker.com/id?1008849; http://www.securityfocus.com/bid/9497; http://securitytracker.com/id?1008849
CVE: CVE-2004-2757
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in the failed login page in Novell iChain before 2.2 build 2.2.113 and 2.3 First Customer Ship (FCS) allows remote attackers to inject arbitrary web script or HTML via url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/10653; http://support.novell.com/cgi-bin/search/searchtid.cgi?/10080762.htm; http://www.securityfocus.com/bid/9412
CVE: CVE-2004-2758
Published: 2004-12-31
Description: Multiple unspecified vulnerabilities in the H.323 protocol implementation for Sun SunForum 3.2 and 3D 1.0 allow remote attackers to cause a denial of service (segmentation fault and process crash), as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/10665; http://securitytracker.com/id?1008749; http://sunsolve.sun.com/search/document.do?assetkey=1-26-101429-1
CVE: CVE-2004-2759
Published: 2004-12-31
Description: Shared Sun StorEdge QFS and SAM-QFS file systems, as used in Utilization Suite 4.0 through 4.1 and Performance Suite 4.0 through 4.1, might allow local users to read portions of deleted files by accessing data within sparse files.
CVSS Score: 2.1 (LOW)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-101527-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-200184-1; http://www.securityfocus.com/bid/11559
CVE: CVE-2004-2760
Published: 2004-12-31
Description: sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open after an attempt with an incorrect password, which makes it easier for remote attackers to guess the password by observing the connection state, a different vulnerability than CVE-2003-0190.  NOTE: it could be argued that in most environments, this does not cross privilege boundaries without requiring leverage of a separate vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-16
References: http://archive.cert.uni-stuttgart.de/bugtraq/2004/04/msg00162.html; http://securityreason.com/securityalert/4100; http://www.securityfocus.com/archive/1/360198
CVE: CVE-2004-9998
Published: 2004-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate has been used as a placeholder by multiple organizations for multiple issues, but it is invalid.  Notes: All CVE users should search CVE for the proper identifier.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2004-9999
Published: 2004-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate has been used as a placeholder by multiple organizations for multiple issues, but it is invalid.  Notes: All CVE users should search CVE for the proper identifier.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-0266
Published: 2005-01-01
Description: Cross-site scripting (XSS) vulnerability in index.php in SugarCRM 1.X allows remote attackers to inject arbitrary web script or HTML via the (1) return_module, (2) return_action, (3) name, (4) module, or (5) record parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2174&w=2; http://www.securityfocus.com/bid/12113; https://exchange.xforce.ibmcloud.com/vulnerabilities/18719
CVE: CVE-2004-1312
Published: 2005-01-03
Description: A bug in the HTML parser in a certain Microsoft HTML library, as used in various third party products, may allow remote attackers to cause a denial of service via certain strings, as reported in GFI MailEssentials for Exchange 9 and 10, and GFI MailSecurity for Exchange 8, which causes emails to remain in IIS or Exchange mail queues.
CVSS Score: 10.0 (HIGH)
References: http://kbase.gfi.com/showarticle.asp?id=KBID002249; http://secunia.com/advisories/13708; http://www.csis.dk/default.asp?m=1&a=194
CVE: CVE-2005-0268
Published: 2005-01-03
Description: Direct code injection vulnerability in FlatNuke 2.5.1 allows remote attackers to execute arbitrary PHP code by placing the code into the url_avatar field.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6772&w=2; http://www.securityfocus.com/bid/12150; https://exchange.xforce.ibmcloud.com/vulnerabilities/18746
CVE: CVE-2005-0271
Published: 2005-01-03
Description: Multiple SQL injection vulnerabilities in ReviewPost PHP Pro before 2.84 allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to showcat.php or (2) product parameter to addfav.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4110&w=2; http://secunia.com/advisories/13697/; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5
CVE: CVE-2005-0274
Published: 2005-01-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in showgallery.php in PhotoPost before 4.86 allow remote attackers to inject arbitrary web script or HTML via the (1) cat, (2) si, (3) page, or (4) ppuser parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2196&w=2; http://secunia.com/advisories/13680/; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5
CVE: CVE-2004-1061
Published: 2005-01-04
Description: Cross-site scripting (XSS) vulnerability in Bugzilla before 2.18, including 2.16.x before 2.16.11, allows remote attackers to inject arbitrary HTML and web script via forced error messages, as demonstrated using the action parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=001040; http://lists.grok.org.uk/pipermail/full-disclosure/2004-December/030222.html; http://www.mikx.de/index.php?p=6
CVE: CVE-2005-0280
Published: 2005-01-04
Description: Format string vulnerability in Soldner Secret Wars 30830 and earlier allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in a message.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3504&w=2; http://secunia.com/advisories/13716; http://www.securityfocus.com/bid/12162
CVE: CVE-2005-0283
Published: 2005-01-04
Description: Directory traversal vulnerability in index.php in QwikiWiki allows remote attackers to read arbitrary files via a .. (dot dot) and a %00 at the end of the filename in the page parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1053&w=2; http://secunia.com/advisories/12044; http://www.qwikiwiki.com/index.php?page=QwikiVulnerability
CVE: CVE-1999-1373
Published: 2005-01-05
Description: FORE PowerHub before 5.0.1 allows remote attackers to cause a denial of service (hang) via a TCP SYN scan with TCP/IP OS fingerprinting, e.g. via nmap.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0771&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0771&w=2
CVE: CVE-2004-1183
Published: 2005-01-06
Description: Integer overflow in the tiffdump utility for libtiff 3.7.1 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted TIFF file.
CVSS Score: 5.1 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000920; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3419&w=2; http://secunia.com/advisories/13728/
CVE: CVE-2004-1318
Published: 2005-01-06
Description: Cross-site scripting (XSS) vulnerability in namazu.cgi for Namazu 2.0.13 and earlier allows remote attackers to inject arbitrary HTML and web script via a query that starts with a tab ("%09") character, which prevents the rest of the query from being properly sanitized.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/jp/JVN%23904429FE.html; http://secunia.com/advisories/13600; http://securitytracker.com/alerts/2005/Jan/1012802.html
CVE: CVE-2005-0182
Published: 2005-01-06
Description: The mod_dosevasive module 1.9 and earlier for Apache creates temporary files with predictable filenames, which could allow remote attackers to overwrite arbitrary files via a symlink attack.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0582&w=2; http://secunia.com/advisories/13725; http://security.lss.hr/index.php?page=details&ID=LSS-2005-01-01
CVE: CVE-1999-1431
Published: 2005-01-07
Description: ZAK in Appstation mode allows users to bypass the "Run only allowed apps" policy by starting Explorer from Office 97 applications (such as Word), installing software into the TEMP directory, and changing the name to that for an allowed application, such as Winword.exe.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]2688&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]0008&w=2; http://www.securityfocus.com/bid/181