deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-0547
Published: 2004-08-06
Description: Buffer overflow in the ODBC driver for PostgreSQL before 7.2.1 allows remote attackers to cause a denial of service (crash).
CVSS Score: 5.0 (MEDIUM)
References: http://www.debian.org/security/2004/dsa-516; http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:072; https://exchange.xforce.ibmcloud.com/vulnerabilities/16329
CVE: CVE-2004-0548
Published: 2004-08-06
Description: Multiple stack-based buffer overflows in the word-list-compress functionality in compress.c for Aspell allow local users to execute arbitrary code via a long entry in the wordlist that is not properly handled when using the (1) "c" compress option or (2) "d" decompress option.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4531&w=2; http://www.gentoo.org/security/en/glsa/glsa-200406-14.xml; http://www.oracle.com/technetwork/topics/security/bulletinjan2[PII_REDACTED].html
CVE: CVE-2004-0549
Published: 2004-08-06
Description: The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object.
CVSS Score: 10.0 (HIGH)
References: http://62.131.86.111/analysis.htm; http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0031.html; http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0104.html
CVE: CVE-2004-0550
Published: 2004-08-06
Description: Buffer overflow in Real Networks RealPlayer 10 allows remote attackers to execute arbitrary code via a URL with a large number of "." (period) characters.
CVSS Score: 7.5 (HIGH)
References: http://www.idefense.com/application/poi/display?id=109&type=vulnerabilities&flashstatus=false; https://exchange.xforce.ibmcloud.com/vulnerabilities/16388; http://www.idefense.com/application/poi/display?id=109&type=vulnerabilities&flashstatus=false
CVE: CVE-2004-0551
Published: 2004-08-06
Description: Cisco CatOS 5.x before 5.5(20) through 8.x before 8.2(2) and 8.3(2)GLX, as used in Catalyst switches, allows remote attackers to cause a denial of service (system crash and reload) by sending invalid packets instead of the final ACK portion of the three-way handshake to the (1) Telnet, (2) HTTP, or (3) SSH services, aka "TCP-ACK DoS attack."
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/cisco-sa-20040609-catos.shtml; http://www.kb.cert.org/vuls/id/245190; https://exchange.xforce.ibmcloud.com/vulnerabilities/16370
CVE: CVE-2004-0554
Published: 2004-08-06
Description: Linux kernel 2.4.x and 2.6.x for x86 allows local users to cause a denial of service (system crash), possibly via an infinite loop that triggers a signal handler with a certain sequence of fsave and frstor instructions, as originally demonstrated using a "crash.c" program.
CVSS Score: 2.1 (LOW)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000845; http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15905; http://linuxreviews.org/news/2004-06-11_kernel_crash/index.html
CVE: CVE-2004-0557
Published: 2004-08-06
Description: Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0014.html; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000855; http://lwn.net/Articles/95529/
CVE: CVE-2004-0579
Published: 2004-08-06
Description: Format string vulnerability in super before 3.23 allows local users to execute arbitrary code as root.
CVSS Score: 7.2 (HIGH)
References: http://www.debian.org/security/2004/dsa-522; https://exchange.xforce.ibmcloud.com/vulnerabilities/16458; http://www.debian.org/security/2004/dsa-522
CVE: CVE-2004-0580
Published: 2004-08-06
Description: DHCP on Linksys BEFSR11, BEFSR41, BEFSR81, and BEFSRU31 Cable/DSL Routers, firmware version 1.45.7, does not properly clear previously used buffer contents in a BOOTP reply packet, which allows remote attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
References: http://linksys.custhelp.com/cgi-bin/linksys.cfg/php/enduser/std_adp.php?p_faqid=832&p_%20%5Ccreated=[PII_REDACTED]&p_sid=pU1X1idh&p_lva=&p_sp=cF9zcmNoPSZwX3NvcnRfYnk9JnBfZ3JpZHNvcnQ9%20%5CJnBfcm93X2NudD02NTQmcF9wYWdlPTE%2A&p_li=; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9301&w=2; http://secunia.com/advisories/11606
CVE: CVE-2004-0581
Published: 2004-08-06
Description: ksymoops-gznm script in Mandrake Linux 9.1 through 10.0, and Corporate Server 2.1, allows local users to delete arbitrary files via a symlink attack on files in /tmp.
CVSS Score: 4.6 (MEDIUM)
References: http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:060; http://www.securityfocus.com/bid/10516; https://exchange.xforce.ibmcloud.com/vulnerabilities/16392
CVE: CVE-2004-0582
Published: 2004-08-06
Description: Unknown vulnerability in Webmin 1.140 allows remote attackers to bypass access control rules and gain read access to configuration information for a module.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000848; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2191&w=2; http://www.debian.org/security/2004/dsa-526
CVE: CVE-2004-0583
Published: 2004-08-06
Description: The account lockout functionality in (1) Webmin 1.140 and (2) Usermin 1.070 does not parse certain character strings, which allows remote attackers to conduct a brute force attack to guess user IDs and passwords.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3829&w=2; http://www.debian.org/security/2004/dsa-526; http://www.gentoo.org/security/en/glsa/glsa-200406-12.xml
CVE: CVE-2004-0584
Published: 2004-08-06
Description: Unknown vulnerability in Horde IMP 3.2.3 and earlier, before a "security fix," does not properly validate input, which allows remote attackers to execute arbitrary script as other users via script or HTML in an e-mail message, possibly triggering a cross-site scripting (XSS) vulnerability.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/11805; http://www.gentoo.org/security/en/glsa/glsa-200406-11.xml; http://www.horde.org/imp/3.2/
CVE: CVE-2004-0585
Published: 2004-08-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2004-0589.  Reason: This candidate is a duplicate of CVE-2004-0589.  Notes: All CVE users should reference CVE-2004-0589 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2004-0586
Published: 2004-08-06
Description: acpRunner ActiveX 1.2.5.0 allows remote attackers to execute arbitrary code via the (1) DownLoadURL, (2) SaveFilePath, and (3) Download ActiveX methods.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5176&w=2; http://www-306.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-54588; https://exchange.xforce.ibmcloud.com/vulnerabilities/16429
CVE: CVE-2004-0587
Published: 2004-08-06
Description: Insecure permissions for the /proc/scsi/qla2300/HbaApiNode file in Linux allows local users to cause a denial of service.
CVSS Score: 2.1 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20040804-01-U.asc; http://lwn.net/Articles/91155/; http://securitytracker.com/id?1010057
CVE: CVE-2004-0588
Published: 2004-08-06
Description: Cross-site scripting (XSS) vulnerability in the web mail module for Usermin 1.070 allows remote attackers to insert arbitrary HTML and script via e-mail messages.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8287&w=2; http://www.gentoo.org/security/en/glsa/glsa-200406-15.xml; http://www.lac.co.jp/security/csl/intelligence/SNSadvisory_e/73_e.html
CVE: CVE-2004-0589
Published: 2004-08-06
Description: Cisco IOS 11.1(x) through 11.3(x) and 12.0(x) through 12.2(x), when configured for BGP routing, allows remote attackers to cause a denial of service (device reload) via malformed BGP (1) OPEN or (2) UPDATE messages.
CVSS Score: 4.3 (MEDIUM)
References: http://www.cisco.com/warp/public/707/cisco-sa-20040616-bgp.shtml; http://www.kb.cert.org/vuls/id/784540; https://exchange.xforce.ibmcloud.com/vulnerabilities/16427
CVE: CVE-2004-0591
Published: 2004-08-06
Description: Cross-site scripting (XSS) vulnerability in the print_header_uc function for SqWebMail 4.0.4 and earlier, and possibly 3.x, allows remote attackers to inject arbitrary web script or HRML via (1) e-mail headers or (2) a message with a "message/delivery-status" MIME Content-Type.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0140&w=2; http://secunia.com/advisories/11918/; http://www.debian.org/security/2004/dsa-533
CVE: CVE-2004-0596
Published: 2004-08-06
Description: The Equalizer Load-balancer for serial network interfaces (eql.c) in Linux kernel 2.6.x up to 2.6.7 allows local users to cause a denial of service via a non-existent device name that triggers a null dereference.
CVSS Score: 2.1 (LOW)
References: http://linux.bkbits.net:8080/linux-2.6/cset%4040d4aa72hPLWy-jMLr0eJAXMxHcNZg; http://www.securityfocus.com/bid/10730; https://exchange.xforce.ibmcloud.com/vulnerabilities/16694
CVE: CVE-2004-0639
Published: 2004-08-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in read_body.php, (2) the $senderNames_part variable in mailbox_display.php, and possibly other vectors including (3) the $event_title variable or (4) the $event_text variable.
CVSS Score: 6.8 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=257973; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000858; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5078&w=2
CVE: CVE-2004-0640
Published: 2004-08-06
Description: Format string vulnerability in the SSL_set_verify function in telnetd.c for SSLtelnet daemon (SSLtelnetd) 0.13 allows remote attackers to execute arbitrary code.
CVSS Score: 10.0 (HIGH)
References: http://www.debian.org/security/2004/dsa-529; http://www.idefense.com/application/poi/display?id=114&type=vulnerabilities; https://exchange.xforce.ibmcloud.com/vulnerabilities/16653
CVE: CVE-2004-0645
Published: 2004-08-06
Description: Buffer overflow in the wvHandleDateTimePicture function in wv library (wvWare) 0.7.4 through 0.7.6 and 1.0.0 allows remote attackers to execute arbitrary code via a document with a long DateTime field.
CVSS Score: 10.0 (HIGH)
References: http://cpan.cybercomm.nl/pub/gentoo-portage/app-text/wv/files/wv-1.0.0-fix_overflow.patch; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000863; http://security.gentoo.org/glsa/glsa-200407-11.xml
CVE: CVE-2004-0647
Published: 2004-08-06
Description: shorewall 1.4.10c and earlier, and 2.0.x before 2.0.3a, allows local users to overwrite arbitrary files via a symlink attack on the chains-$$ temporary file.
CVSS Score: 4.6 (MEDIUM)
References: http://lists.shorewall.net/pipermail/shorewall-announce/2004-June/000385.html; http://www.gentoo.org/security/en/glsa/glsa-200407-07.xml; http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:080
CVE: CVE-2004-0648
Published: 2004-08-06
Description: Mozilla (Suite) before 1.7.1, Firefox before 0.9.2, and Thunderbird before 0.7.2 allow remote attackers to launch arbitrary programs via a URI referencing the shell: protocol.
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023573.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5719&w=2; http://secunia.com/advisories/12027
CVE: CVE-2004-0649
Published: 2004-08-06
Description: Buffer overflow in write_packet in control.c for l2tpd may allow remote attackers to execute arbitrary code.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5735&w=2; http://security.gentoo.org/glsa/glsa-200407-17.xml; http://www.debian.org/security/2004/dsa-530
CVE: CVE-2004-0650
Published: 2004-08-06
Description: UploadServlet in Cisco Collaboration Server (CCS) running ServletExec before 3.0E allows remote attackers to upload and execute arbitrary files via a direct call to the UploadServlet URL.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/11979/; http://www.cisco.com/warp/public/707/cisco-sa-20040630-CCS.shtml; http://www.kb.cert.org/vuls/id/718896
CVE: CVE-2004-0651
Published: 2004-08-06
Description: Unknown vulnerability in Sun Java Runtime Environment (JRE) 1.4.2 through 1.4.2_03 allows remote attackers to cause a denial of service (virtual machine hang).
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0233&w=2; http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57555; http://www.kb.cert.org/vuls/id/118558
CVE: CVE-2004-0652
Published: 2004-08-06
Description: BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods.
CVSS Score: 7.2 (HIGH)
References: http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA04_55.00.jsp; http://secunia.com/advisories/11359; http://securitytracker.com/id?1009766
CVE: CVE-2004-0653
Published: 2004-08-06
Description: Solaris 9, when configured as a Kerberos client with patch 112908-12 or 115168-03 and using pam_krb5 as an "auth" module with the debug feature enabled, records passwords in plaintext, which could allow local users to gain other user's passwords by reading log files.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/11940/; http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57587; http://sunsolve.sun.com/search/document.do?assetkey=1-26-101519-1
CVE: CVE-2004-0654
Published: 2004-08-06
Description: Unknown vulnerability in the Basic Security Module (BSM), when configured to audit either the Administrative (ad) or the System-Wide Administration (as) audit class in Solaris 7, 8, and 9, allows local users to cause a denial of service (kernel panic).
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/11930/; http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57497; http://www.kb.cert.org/vuls/id/901582
CVE: CVE-2004-0655
Published: 2004-08-06
Description: eupdatedb in esearch 0.6.1 and earlier allows local users to create arbitrary files via a symlink attack on the esearchdb.py.tmp temporary file.
CVSS Score: 7.2 (HIGH)
References: http://www.gentoo.org/security/en/glsa/glsa-200407-01.xml; http://www.securityfocus.com/bid/10644; https://exchange.xforce.ibmcloud.com/vulnerabilities/16584
CVE: CVE-2004-0656
Published: 2004-08-06
Description: The accept_client function in PureFTPd 1.0.18 and earlier allows remote attackers to cause a denial of service by exceeding the maximum number of connections.
CVSS Score: 5.0 (MEDIUM)
References: http://www.gentoo.org/security/en/glsa/glsa-200407-04.xml; http://www.pureftpd.org/; https://exchange.xforce.ibmcloud.com/vulnerabilities/16611
CVE: CVE-2004-0657
Published: 2004-08-06
Description: Integer overflow in the NTP daemon (NTPd) before 4.0 causes the NTP server to return the wrong date/time offset when a client requests a date/time that is more than 34 years away from the server's time.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-190
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5219&w=2; http://www.kb.cert.org/vuls/id/584606; https://exchange.xforce.ibmcloud.com/vulnerabilities/15406
CVE: CVE-2004-0658
Published: 2004-08-06
Description: Integer overflow in the hpsb_alloc_packet function (incorrectly reported as alloc_hpsb_packet) in IEEE 1394 (Firewire) driver 2.4 and 2.6 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via the functions (1) raw1394_write, (2) state_connected, (3) handle_remote_request, or (4) hpsb_make_writebpacket.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0740; https://exchange.xforce.ibmcloud.com/vulnerabilities/16480; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0740
CVE: CVE-2004-0659
Published: 2004-08-06
Description: Buffer overflow in TranslateFilename for common.c in MPlayer 1.0pre4 allows remote attackers to execute arbitrary code via a long file name.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0791&w=2; http://www.gentoo.org/security/en/glsa/glsa-200408-01.xml; http://www.securityfocus.com/bid/10615
CVE: CVE-2004-0660
Published: 2004-08-06
Description: Cross-site scripting (XSS) vulnerability in (1) show_archives.php, (2) show_news.php, and possibly other php files in CuteNews 1.3.1 allows remote attackers to inject arbitrary script or HTML via the id parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9449&w=2; http://www.swp-zone.org/archivos/advisory-06.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/16525
CVE: CVE-2004-0661
Published: 2004-08-06
Description: Integer signedness error in D-Link AirPlus DI-614+ running firmware 2.30 and earlier allows remote attackers to cause a denial of service (IP lease depletion) via a DHCP request with the LEASETIME option set to -1, which makes the DHCP lease valid for thirteen or more years.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3785&w=2; http://secunia.com/advisories/12018; http://www.osvdb.org/7294
CVE: CVE-2004-0662
Published: 2004-08-06
Description: PowerPortal 1.x allows remote attackers to gain sensitive information via invalid or missing parameters in HTTP requests to (1) resize.php or (2) modules.php, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7811&w=2; http://www.securityfocus.com/bid/10622; http://www.swp-zone.org/archivos/advisory-07.txt
CVE: CVE-2004-0663
Published: 2004-08-06
Description: Cross-site scripting (XSS) vulnerability in modules.php in PowerPortal 1.x allows remote attackers to inject arbitrary script or HTML via the (1) id parameter to the (a) private_messages module; (2) search parameter to the (b) links and (c) content modules; and (3) files parameter to the gallery module.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7811&w=2; http://www.swp-zone.org/archivos/advisory-07.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/16528
CVE: CVE-2004-0664
Published: 2004-08-06
Description: Directory traversal vulnerability in modules.php in PowerPortal 1.x allows remote attackers to list arbitrary directories via a .. (dot dot) in the files parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7811&w=2; http://www.securityfocus.com/bid/10622; http://www.swp-zone.org/archivos/advisory-07.txt
CVE: CVE-2004-0665
Published: 2004-08-06
Description: csFAQ.cgi in csFAQ allows remote attackers to gain sensitive information via an invalid database parameter, which reveals the path to the web server in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1238&w=2; http://www.securityfocus.com/bid/10618; http://www.swp-zone.org/archivos/advisory-08.txt
CVE: CVE-2004-0666
Published: 2004-08-06
Description: Off-by-one error in the POP3_readmsg function in popclient 3.0b6 allows remote attackers to cause a denial of service (application crash) via an e-mail message with a certain line length, which leads to a buffer overflow.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/023147.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3293&w=2; http://www.grok.org.uk/advisories/popclient.html
CVE: CVE-2004-0667
Published: 2004-08-06
Description: Rule Set Based Access Control (RSBAC) 1.2.2 through 1.2.3 allows access to sys_creat, sys_open, and sys_mknod inside jails, which could allow local users to gain elevated privileges.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6067&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0430&w=2; http://www.rsbac.org/download/bugfixes/
CVE: CVE-2004-0668
Published: 2004-08-06
Description: Web Access in Lotus Domino 6.5.1 allows remote attackers to cause a denial of service (server crash) via a large e-mail message, as demonstrated using a large image attachment.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4307&w=2; http://www.securityfocus.com/bid/10641; https://exchange.xforce.ibmcloud.com/vulnerabilities/16596
CVE: CVE-2004-0669
Published: 2004-08-06
Description: Lotus Domino 6.5.0 and 6.5.1, with IMAP enabled, allows remote authenticated users to change their quota by using the IMAP setquota command.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8571&w=2; http://www.securityfocus.com/bid/10642; https://exchange.xforce.ibmcloud.com/vulnerabilities/16575
CVE: CVE-2004-0670
Published: 2004-08-06
Description: Prestige 650HW-31 running Rompager 4.7 software allows remote attackers to cause a denial of service (device reboot) via a long password.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/023196.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5952&w=2; http://www.securityfocus.com/bid/10638
CVE: CVE-2004-0671
Published: 2004-08-06
Description: Brightmail Spamfilter 6.0 and earlier beta releases allows remote attackers to read mail from other users by modifying the id parameter in a viewMsgDetails.do request.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5802&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1353&w=2; http://www.securityfocus.com/bid/10657
CVE: CVE-2004-0672
Published: 2004-08-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in the primary and management web interfaces in Netegrity IdentityMinder Web Edition 5.6 allows remote attackers to execute script as other users via (1) script that starts with %00 in the numOfExpressions parameter or (2) the mobjtype parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4336&w=2; http://www.securityfocus.com/bid/10645; https://exchange.xforce.ibmcloud.com/vulnerabilities/16618
CVE: CVE-2004-0673
Published: 2004-08-06
Description: Cross-site scripting (XSS) vulnerability in SCI Photo Chat Server 3.4.9 allows remote attackers to execute arbitrary web script as other users via an invalid request that is echoed in the resulting error message.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0833&w=2; http://www.securityfocus.com/bid/10648; https://exchange.xforce.ibmcloud.com/vulnerabilities/16602
CVE: CVE-2004-0674
Published: 2004-08-06
Description: Enterasys XSR-1800 series Security Routers, when running firmware 7.0.0.0 and using Policy-Based Routing, allow remote attackers to cause a denial of service (crash) via a packet with the IP record route option set.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7906&w=2; http://www.enterasys.com/support/security/incidents/2004/07/11036.html; http://www.securityfocus.com/bid/10653
CVE: CVE-2004-0675
Published: 2004-08-06
Description: Cross-site scripting (XSS) vulnerability in (1) cart32.exe or (2) c32web.exe in Cart32 shopping cart allows remote attackers to execute arbitrary web script via the cart32 parameter to a GetLatestBuilds command.
CVSS Score: 6.8 (MEDIUM)
References: http://drponidi.5u.com/advisory.htm; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8398&w=2; http://www.securityfocus.com/bid/10617