deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-0676
Published: 2004-08-06
Description: Directory traversal vulnerability in Fastream NETFile FTP/Web Server 6.7.2.1085 and earlier allows remote attackers to create or delete arbitrary files via .. (dot dot) and // (double slash) sequences in the filename parameter.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4880&w=2; http://www.haxorcitos.com/Fastream_advisory.txt; http://www.securityfocus.com/bid/10658
CVE: CVE-2004-0677
Published: 2004-08-06
Description: Fastream NETFile FTP Server 6.7.2.1085 and earlier allows remote attackers to cause a denial of service (temporary hang) via the cd command with an unusual argument, possibly due to multiple leading slashes and/or an access to the floppy drive ("A").
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4880&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/16615; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4880&w=2
CVE: CVE-2004-0678
Published: 2004-08-06
Description: Cross-site scripting (XSS) in one2planet.infolet.InfoServlet in 12Planet Chat Server 2.9 allows remote attackers to execute arbitrary script as other users via the page parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8706&w=2; http://www.autistici.org/fdonato/advisory/12PlanetChatServer2.9-adv.txt; http://www.securityfocus.com/bid/10659
CVE: CVE-2004-0679
Published: 2004-08-06
Description: The IP cloaking feature (cloak.c) in UnrealIRCd 3.2, and possibly other versions, uses a weak hashing scheme to hide IP addresses, which could allow remote attackers to use brute force methods to gain other user's IP addresses.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3166&w=2; http://securityreason.com/securityalert/560; http://www.bandecon.com/advisory/unreal.txt
CVE: CVE-2004-0680
Published: 2004-08-06
Description: Zoom X3 ADSL modem has a terminal running on port 254 that can be accessed using the default HTML management password, even if the password has been changed for the HTTP interface, which could allow remote attackers to gain unauthorized access.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0924&w=2; http://www.securityfocus.com/bid/10669; https://exchange.xforce.ibmcloud.com/vulnerabilities/16639
CVE: CVE-2004-0681
Published: 2004-08-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) comersus_customerAuthenticateForm.asp, (2) comersus_backoffice_message.asp, (3) comersus_supportError.asp, or (4) comersus_message.asp in Comersus Cart 5.09 allow remote attackers to execute web script as other users via the message parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7403&w=2; http://www.securityfocus.com/bid/10674; https://exchange.xforce.ibmcloud.com/vulnerabilities/16646
CVE: CVE-2004-0682
Published: 2004-08-06
Description: comersus_gatewayPayPal.asp in Comersus Cart 5.09, and possibly other versions before 5.098, allows remote attackers to change the prices of items by directly modifying them in the URL.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9987&w=2; http://www.securityfocus.com/bid/10674; https://exchange.xforce.ibmcloud.com/vulnerabilities/16645
CVE: CVE-2004-0683
Published: 2004-08-06
Description: Symantec Norton AntiVirus 2002 and 2003 allows remote attackers to cause a denial of service (CPU consumption) via a compressed archive that contains a large number of directories.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2894&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/16658; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2894&w=2
CVE: CVE-2004-0684
Published: 2004-08-06
Description: WebSphere Edge Component Caching Proxy in WebSphere Edge Server 5.02, with the JunctionRewrite directive enabled, allows remote attackers to cause a denial of service via an HTTP GET request without any parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8245&w=2; http://www.cybsec.com/vuln/IBM-WebSphere-Edge-Server-DOS.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/16607
CVE: CVE-2004-0716
Published: 2004-08-06
Description: Buffer overflow in the DCE daemon (DCED) for the DCE endpoint mapper (epmap) on HP-UX 11 allows remote attackers to execute arbitrary code via a request with a small fragment length and a large amount of data.
CVSS Score: 10.0 (HIGH)
References: http://support.entegrity.com/private/patches/dce/ssrt4741.asp; http://www.atstake.com/research/advisories/2004/a072204-1.txt; http://www.kb.cert.org/vuls/id/259796
CVE: CVE-2004-1710
Published: 2004-08-06
Description: page.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the url parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2634&w=2; http://www.osvdb.org/8936; https://exchange.xforce.ibmcloud.com/vulnerabilities/19713
CVE: CVE-2004-1711
Published: 2004-08-06
Description: Cross-site scripting (XSS) vulnerability in post.php in Moodle before 1.3 allows remote attackers to inject arbitrary web script or HTML via the reply parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6921&w=2; http://secunia.com/advisories/12262; http://www.securityfocus.com/bid/10884
CVE: CVE-2004-1712
Published: 2004-08-06
Description: Cross-site scripting (XSS) vulnerability in TypePad allows remote attackers to inject arbitrary Javascript via the name parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2959&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/19664; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2959&w=2
CVE: CVE-2004-1701
Published: 2004-08-09
Description: Heap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers to execute arbitrary code via a long SAUTH command during RSA authentication.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0086&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8775&w=2; http://secunia.com/advisories/12251
CVE: CVE-2004-1702
Published: 2004-08-09
Description: The AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 does not properly check the return value of the ReceiveTransaction function, which leads to a failed malloc call and triggers to a null dereference, which allows remote attackers to cause a denial of service (crash).
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0086&w=2; http://secunia.com/advisories/12251; http://security.gentoo.org/glsa/glsa-200408-08.xml
CVE: CVE-2004-1347
Published: 2004-08-10
Description: X Display Manager (XDM) on Solaris 8 allows remote attackers to cause a denial of service (XDM crash) via an invalid X Display Manager Control Protocol (XDMCP) request.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/12257/; http://sunsolve.sun.com/search/document.do?assetkey=1-26-101549-1; http://sunsolve.sun.com/search/document.do?assetkey=1-26-57619-1&searchclause=security
CVE: CVE-2004-1713
Published: 2004-08-10
Description: Unknown vulnerability in HP Process Resource Manager (PRM) C.02.01[.01] and earlier, as used by HP-UX Workload Manager (WLM), allows local users to corrupt data files.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9027&w=2; http://secunia.com/advisories/12245; http://www.securityfocus.com/bid/10907
CVE: CVE-2004-1714
Published: 2004-08-11
Description: BlackICE PC Protection and Server Protection installs (1) firewall.ini, (2) blackice.ini, (3) sigs.ini and (4) protect.ini with Everyone Full Control permissions, which allows local users to cause a denial of service (crash) or modify configuration, as demonstrated by modifying firewall.ini to contain a large firewall rule.
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-August/025112.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1166&w=2; http://www.securityfocus.com/bid/10915
CVE: CVE-2004-1715
Published: 2004-08-11
Description: Directory traversal vulnerability in MIMEsweeper for Web before 5.0.4 allows remote attackers or local users to read arbitrary files via "..\\", "..\", and similar dot dot sequences in the URL.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2029&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2978&w=2; http://packetstormsecurity.nl/0408-exploits/clearswift.txt
CVE: CVE-2004-1682
Published: 2004-08-15
Description: Format string vulnerability in QNX 6.1 FTP client allows remote authenticated users to gain group bin privileges via format string specifiers in the QUOTE command.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5476&w=2; http://secunia.com/advisories/12533; http://www.rfdslabs.com.br/qnx-advs-04-2004.txt
CVE: CVE-2004-1716
Published: 2004-08-16
Description: Cross-site scripting (XSS) vulnerability in PForum before 1.26 allows remote attackers to inject arbitrary web script or HTML via the (1) IRC Server or (2) AIM ID fields in the user profile.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2298&w=2; http://secunia.com/advisories/12317/; http://www.kb.cert.org/vuls/id/674542
CVE: CVE-2004-1717
Published: 2004-08-16
Description: Multiple buffer overflows in the psscan function in ps.c for gv (ghostview) allow remote attackers to execute arbitrary code via a Postscript file with a long (1) BoundingBox, (2) comment, (3) Orientation, (4) PageOrder, or (5) Pages value.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4331&w=2; http://www.securityfocus.com/bid/10944; https://exchange.xforce.ibmcloud.com/vulnerabilities/17019
CVE: CVE-2004-1737
Published: 2004-08-16
Description: SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-August/025376.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1038&w=2; http://secunia.com/advisories/12308
CVE: CVE-2004-1718
Published: 2004-08-17
Description: The ZwOpenSection function in Integrity Protection Driver (IPD) 1.4 and earlier allows local users to cause a denial of service (crash) via an invalid pointer in the "oa" argument.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1133&w=2; http://secunia.com/advisories/12169; http://www.ngsec.com/docs/advisories/NGSEC-2004-6.txt
CVE: CVE-2004-1719
Published: 2004-08-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in Merak Webmail Server 5.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) category, (2) cserver, (3) ext, (4) global, (5) showgroups, (6) or showlite parameters to address.html, or the (7) spage or (8) autoresponder parameters to settings.html, the (9) folder parameter to readmail.html, or the (10) attachmentpage_text_error parameter to attachment.html, (11) folder, (12) ct, or (13) cv parameters to calendar.html, (14) an <img> tag, or (15) the subject of an e-mail message.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6044&w=2; http://packetstormsecurity.nl/0408-exploits/merak527.txt; http://secunia.com/advisories/12269
CVE: CVE-2004-1720
Published: 2004-08-17
Description: The (1) address.html and possibly (2) calendar.html pages in Merak Mail Server 5.2.7 allow remote attackers to gain sensitive information via an invalid HTTP request, which reveals the installation path. NOTE: it is unclear whether the calendar.html is an exposure, since the path is leaked in web logs that may only be available to the administrators, who would have access to the path through legitimate means.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6044&w=2; http://packetstormsecurity.nl/0408-exploits/merak527.txt; http://secunia.com/advisories/12269
CVE: CVE-2004-1721
Published: 2004-08-17
Description: The (1) function.php or (2) function.view.php scripts in Merak Mail Server 5.2.7 allow remote attackers to read arbitrary PHP files via a direct HTTP request to port 32000.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6044&w=2; http://packetstormsecurity.nl/0408-exploits/merak527.txt; http://secunia.com/advisories/12269
CVE: CVE-2004-1722
Published: 2004-08-17
Description: SQL injection vulnerability in calendar.html in Merak Mail Server 5.2.7 allows remote attackers to execute arbitrary SQL statements via the schedule parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6044&w=2; http://packetstormsecurity.nl/0408-exploits/merak527.txt; http://secunia.com/advisories/12269
CVE: CVE-2003-0193
Published: 2004-08-18
Description: msxlsview.sh in xlsview for catdoc 0.91 and earlier allows local users to overwrite arbitrary files via a symlink attack on predictable temporary file names ("word$$.html").
CVSS Score: 2.1 (LOW)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?archive=no&bug=183525; http://secunia.com/advisories/13021/; http://secunia.com/advisories/13022/
CVE: CVE-2003-0687
Published: 2004-08-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate has been revoked by its Candidate Numbering Authority (CNA) because it was internally assigned to a problem that was not reachable (the affected routine was not used by the software).  Notes: none
CVE: CVE-2003-1042
Published: 2004-08-18
Description: SQL injection vulnerability in collectstats.pl for Bugzilla 2.16.3 and earlier allows remote authenticated users with editproducts privileges to execute arbitrary SQL via the product name.
CVSS Score: 10.0 (HIGH)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=214290; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000774; http://www.securityfocus.com/archive/1/343185
CVE: CVE-2003-1043
Published: 2004-08-18
Description: SQL injection vulnerability in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote authenticated users with editkeywords privileges to execute arbitrary SQL via the id parameter to editkeywords.cgi.
CVSS Score: 10.0 (HIGH)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=219044; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000774; http://www.securityfocus.com/archive/1/343185
CVE: CVE-2003-1044
Published: 2004-08-18
Description: editproducts.cgi in Bugzilla 2.16.3 and earlier, when usebuggroups is enabled, does not properly remove group add privileges from a group that is being deleted, which allows users with those privileges to perform unauthorized additions to the next group that is assigned with the original group ID.
CVSS Score: 7.5 (HIGH)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=219690; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000774; http://www.securityfocus.com/archive/1/343185
CVE: CVE-2003-1045
Published: 2004-08-18
Description: votes.cgi in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote attackers to read a user's voting page when that user has voted on a restricted bug, which allows remote attackers to read potentially sensitive voting information by modifying the who parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=209376; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000774; http://www.securityfocus.com/archive/1/343185
CVE: CVE-2003-1046
Published: 2004-08-18
Description: describecomponents.cgi in Bugzilla 2.17.3 and 2.17.4 does not properly verify group membership when bug entry groups are used, which allows remote attackers to list component descriptions for otherwise restricted products.
CVSS Score: 7.5 (HIGH)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=209742; http://www.securityfocus.com/archive/1/343185; http://www.securityfocus.com/bid/8953
CVE: CVE-2004-0076
Published: 2004-08-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was removed from consideration by its Candidate Numbering Authority.  Notes: none
CVE: CVE-2004-0134
Published: 2004-08-18
Description: cpr (libcpr) in SGI IRIX before 6.5.25 allows local users to gain privileges by loading a user provided library while restarting the checkpointed process.
CVSS Score: 7.2 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20040507-01-P.asc; http://www.securityfocus.com/bid/10418; https://exchange.xforce.ibmcloud.com/vulnerabilities/16259
CVE: CVE-2004-0175
Published: 2004-08-18
Description: Directory traversal vulnerability in scp for OpenSSH before 3.4p1 allows remote malicious servers to overwrite arbitrary files.  NOTE: this may be a rediscovery of CVE-2000-0992.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.11/SCOSA-2006.11.txt; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000831; http://secunia.com/advisories/17135
CVE: CVE-2004-0226
Published: 2004-08-18
Description: Multiple buffer overflows in Midnight Commander (mc) before 4.6.0 may allow attackers to cause a denial of service or execute arbitrary code.
CVSS Score: 10.0 (HIGH)
References: http://security.gentoo.org/glsa/glsa-200405-21.xml; http://www.debian.org/security/2004/dsa-497; http://www.mandriva.com/security/advisories?name=MDKSA-2004:039
CVE: CVE-2004-0228
Published: 2004-08-18
Description: Integer signedness error in the cpufreq proc handler (cpufreq_procctl) in Linux kernel 2.6 allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000852; http://fedoranews.org/updates/FEDORA-2004-111.shtml; http://secunia.com/advisories/11429
CVE: CVE-2004-0229
Published: 2004-08-18
Description: The framebuffer driver in Linux kernel 2.6.x does not properly use the fb_copy_cmap function, with unknown impact.
CVSS Score: 4.6 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000852; http://security.gentoo.org/glsa/glsa-200407-02.xml; http://www.mandriva.com/security/advisories?name=MDKSA-2004:037
CVE: CVE-2004-0230
Published: 2004-08-18
Description: TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc; ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt; ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
CVE: CVE-2004-0231
Published: 2004-08-18
Description: Multiple vulnerabilities in Midnight Commander (mc) before 4.6.0, with unknown impact, related to "Insecure temporary file and directory creations."
CVSS Score: 2.1 (LOW)
References: http://security.gentoo.org/glsa/glsa-200405-21.xml; http://www.debian.org/security/2004/dsa-497; http://www.mandriva.com/security/advisories?name=MDKSA-2004:039
CVE: CVE-2004-0232
Published: 2004-08-18
Description: Multiple format string vulnerabilities in Midnight Commander (mc) before 4.6.0 may allow attackers to cause a denial of service or execute arbitrary code.
CVSS Score: 5.0 (MEDIUM)
References: http://security.gentoo.org/glsa/glsa-200405-21.xml; http://www.debian.org/security/2004/dsa-497; http://www.mandriva.com/security/advisories?name=MDKSA-2004:039
CVE: CVE-2004-0233
Published: 2004-08-18
Description: Utempter allows device names that contain .. (dot dot) directory traversal sequences, which allows local users to overwrite arbitrary files via a symlink attack on device names in combination with an application that trusts the utmp or wtmp files.
CVSS Score: 2.1 (LOW)
References: http://security.gentoo.org/glsa/glsa-200405-05.xml; http://sunsolve.sun.com/search/document.do?assetkey=1-77-1000752.1-1; http://www.mandriva.com/security/advisories?name=MDKSA-2004:031
CVE: CVE-2004-0234
Published: 2004-08-18
Description: Multiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14, as used in products such as Barracuda Spam Firewall, allow remote attackers or local users to execute arbitrary code via long directory or file names in an LHA archive, which triggers the overflow when testing or extracting the archive.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2006-04/0059.html; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000840; http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/020776.html
CVE: CVE-2004-0235
Published: 2004-08-18
Description: Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with (1) .. sequences or (2) absolute pathnames with double leading slashes ("//absolute/path").
CVSS Score: 6.4 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000840; http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/020776.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8885&w=2
CVE: CVE-2004-0375
Published: 2004-08-18
Description: SYMNDIS.SYS in Symantec Norton Internet Security 2003 and 2004, Norton Personal Firewall 2003 and 2004, Client Firewall 5.01 and 5.1.1, and Client Security 1.0 and 1.1 allow remote attackers to cause a denial of service (infinite loop) via a TCP packet with (1) SACK option or (2) Alternate Checksum Data option followed by a length of zero.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2246&w=2; http://securitytracker.com/id?1009379; http://securitytracker.com/id?1009380
CVE: CVE-2004-0394
Published: 2004-08-18
Description: A "potential" buffer overflow exists in the panic() function in Linux 2.4.x, although it may not be exploitable due to the functionality of panic.
CVSS Score: 2.1 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20040504-01-U.asc; ftp://patches.sgi.com/support/free/security/advisories/20040505-01-U.asc; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000846
CVE: CVE-2004-0412
Published: 2004-08-18
Description: Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000842; http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7955&w=2
CVE: CVE-2004-0419
Published: 2004-08-18
Description: XDM in XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0, which could allow remote attackers to connect to the port, in violation of the intended restrictions.
CVSS Score: 7.5 (HIGH)
References: http://bugs.xfree86.org/show_bug.cgi?id=1376; http://secunia.com/advisories/12019; http://securitytracker.com/id?1010306
CVE: CVE-2004-0421
Published: 2004-08-18
Description: The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://lists.apple.com/mhonarc/security-announce/msg00056.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0309&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8523&w=2
CVE: CVE-2004-0425
Published: 2004-08-18
Description: Heap-based buffer overflow in SiteMinder Affiliate Agent 4.x allows remote attackers to execute arbitrary code via a large SMPROFILE cookie.
CVSS Score: 10.0 (HIGH)
References: http://www.atstake.com/research/advisories/2004/a042204-1.txt; http://www.securityfocus.com/bid/10198; https://exchange.xforce.ibmcloud.com/vulnerabilities/15950