deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-0315
Published: 2005-01-27
Description: The FTP service in Magic Winmail Server 4.0 Build 1112 does not verify that the IP address in a PORT command is the same as the IP address of the user of the FTP session, which allows remote authenticated users to use the server as an intermediary for port scanning.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5461&w=2; http://secunia.com/advisories/14053; http://securitytracker.com/id?1013017
CVE: CVE-2005-0316
Published: 2005-01-28
Description: WebWasher Classic 2.2.1 and 3.3, when running in server mode, does not properly drop CONNECT requests to the localhost from external systems, which could allow remote attackers to bypass intended access restrictions.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7245&w=2; http://secunia.com/advisories/14058; http://securitytracker.com/id?1013036
CVE: CVE-2005-0317
Published: 2005-01-28
Description: Cross-site scripting (XSS) vulnerability in useredit_account.wdm in Alt-N WebAdmin 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the user parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3614&w=2; http://secunia.com/advisories/14079; http://securitytracker.com/id?1013038
CVE: CVE-2005-0318
Published: 2005-01-28
Description: useredit_account.wdm in Alt-N WebAdmin 3.0.4 does not properly validate account edits by the logged in user, which allows remote authenticated users to edit other users' account information via a modified user parameter.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3614&w=2; http://securitytracker.com/id?1013038; http://www.securityfocus.com/bid/12395
CVE: CVE-2005-0319
Published: 2005-01-28
Description: Direct remote injection vulnerability in modalfram.wdm in Alt-N WebAdmin 3.0.4 allows remote attackers to load external webpages that appear to come from the WebAdmin server, which allows remote attackers to inject arbitrary HTML or web script to facilitate cross-site scripting (XSS) and phishing attacks.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3614&w=2; http://www.securityfocus.com/bid/12395; https://exchange.xforce.ibmcloud.com/vulnerabilities/19162
CVE: CVE-2005-0320
Published: 2005-01-28
Description: Multiple cross-site scripting vulnerabilities in MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter to login.html, (2) accountid parameter to accountsettings_add.html, or the (3) note, (4) title, and (5) location fields to calendar.html.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5007&w=2; http://www.securityfocus.com/bid/12396; https://exchange.xforce.ibmcloud.com/vulnerabilities/19147
CVE: CVE-2005-0075
Published: 2005-01-29
Description: prefs.php in SquirrelMail before 1.4.4, with register_globals enabled, allows remote attackers to inject local code into the SquirrelMail code via custom preference handlers.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4662&w=2; http://secunia.com/advisories/13962/
CVE: CVE-2005-0104
Published: 2005-01-29
Description: Cross-site scripting (XSS) vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to inject arbitrary web script or HTML via certain integer variables.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4662&w=2; http://secunia.com/advisories/13962/
CVE: CVE-2005-0224
Published: 2005-01-31
Description: Unknown vulnerability in HP-UX B.11.04 running Virtualvault 4.5 through 4.7, when running the TGA daemon, allows remote attackers to cause a denial of service via certain network traffic.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0080&w=2; http://secunia.com/advisories/14082/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0080&w=2
CVE: CVE-2005-0101
Published: 2005-02-01
Description: Buffer overflow in the socket_getline function in Newspost 2.1.1 and earlier allows remote malicious NNTP servers to execute arbitrary code via a long string without a newline character.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8781&w=2; http://people.freebsd.org/~niels/issues/newspost-20050114.txt; http://secunia.com/advisories/14092/
CVE: CVE-2005-0245
Published: 2005-02-01
Description: Buffer overflow in gram.y for PostgreSQL 8.0.0 and earlier may allow attackers to execute arbitrary code via a large number of arguments to a refcursor function (gram.y), which leads to a heap-based buffer overflow, a different vulnerability than CVE-2005-0247.
CVSS Score: 7.5 (HIGH)
References: http://archives.postgresql.org/pgsql-committers/2005-01/msg00298.php; http://archives.postgresql.org/pgsql-committers/2005-02/msg00049.php; http://archives.postgresql.org/pgsql-patches/2005-01/msg00216.php
CVE: CVE-2005-0152
Published: 2005-02-02
Description: PHP remote file inclusion vulnerability in Squirrelmail 1.2.6 allows remote attackers to execute arbitrary code via "URL manipulation."
CVSS Score: 7.5 (HIGH)
References: http://ftp.debian.org/debian/dists/stable-proposed-updates/squirrelmail_1.2.6-2_i386.changes; http://secunia.com/advisories/14096; http://www.debian.org/security/2005/dsa-662
CVE: CVE-2005-0226
Published: 2005-02-03
Description: Format string vulnerability in the Log_Resolver function in log.c for ngIRCd 0.8.2 and earlier, when compiled with IDENT, logging to SYSLOG, and with DEBUG enabled, allows remote attackers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8183&w=2; http://secunia.com/advisories/14114/; http://www.nosystem.com.ar/advisories/advisory-11.txt
CVE: CVE-2004-1131
Published: 2005-02-07
Description: Multiple buffer overflows in the enable command for SCO OpenServer 5.0.6 and 5.0.7 allow local users to execute arbitrary code via long command line arguments.
CVSS Score: 7.2 (HIGH)
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.13/SCOSA-2005.13.txt; http://www.securityfocus.com/bid/12474; https://exchange.xforce.ibmcloud.com/vulnerabilities/19243
CVE: CVE-2005-0100
Published: 2005-02-07
Description: Format string vulnerability in the movemail utility in (1) Emacs 20.x, 21.3, and possibly other versions, and (2) XEmacs 21.4 and earlier, allows remote malicious POP3 servers to execute arbitrary code via crafted packets.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2719&w=2; http://www.debian.org/security/2005/dsa-670; http://www.debian.org/security/2005/dsa-671
CVE: CVE-2005-0156
Published: 2005-02-07
Description: Buffer overflow in the PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to execute arbitrary code by setting the PERLIO_DEBUG variable and executing a Perl script whose full pathname contains a long directory tree.
CVSS Score: 2.1 (LOW)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=001056; http://fedoranews.org/updates/FEDORA--.shtml; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2683&w=2
CVE: CVE-2005-0174
Published: 2005-02-07
Description: Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000931; http://fedoranews.org/updates/FEDORA--.shtml; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0947&w=2
CVE: CVE-2005-0175
Published: 2005-02-07
Description: Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache via an HTTP response splitting attack.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000931; http://fedoranews.org/updates/FEDORA--.shtml; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0947&w=2
CVE: CVE-2005-0231
Published: 2005-02-07
Description: Firefox 1.0 does not invoke the Javascript Security Manager when a user drags a javascript: or data: URL to a tab, which allows remote attackers to bypass the security model, aka "firetabbing."
CVSS Score: 2.6 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7144&w=2; http://www.gentoo.org/security/en/glsa/glsa-200503-10.xml; http://www.gentoo.org/security/en/glsa/glsa-200503-30.xml
CVE: CVE-2004-0848
Published: 2005-02-08
Description: Buffer overflow in Microsoft Office XP allows remote attackers to execute arbitrary code via a link with a URL file location containing long inputs after (1) "%00 (null byte) in .doc filenames or (2) "%0a" (carriage return) in .rtf filenames.
CVSS Score: 7.5 (HIGH)
References: http://www.kb.cert.org/vuls/id/416001; http://www.us-cert.gov/cas/techalerts/TA05-039A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-005
CVE: CVE-2005-0233
Published: 2005-02-08
Description: The International Domain Name (IDN) support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3280&w=2; http://www.gentoo.org/security/en/glsa/glsa-200503-10.xml
CVE: CVE-2005-0249
Published: 2005-02-08
Description: Heap-based buffer overflow in the DEC2EXE module for Symantec AntiVirus Library allows remote attackers to execute arbitrary code via a UPX compressed file containing a negative virtual offset to a crafted PE header.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1013133; http://www.kb.cert.org/vuls/id/107822; http://www.symantec.com/avcenter/security/Content/2005.02.08.html
CVE: CVE-2004-0937
Published: 2005-02-09
Description: Sophos Anti-Virus before 3.87.0, and Sophos Anti-Virus for Windows 95, 98, and Me before 3.88.0, allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.
CVSS Score: 7.5 (HIGH)
References: http://www.idefense.com/application/poi/display?id=153&type=vulnerabilities&flashstatus=true; http://www.kb.cert.org/vuls/id/968818; http://www.securityfocus.com/bid/11448
CVE: CVE-2004-0939
Published: 2005-02-09
Description: changepassword.cgi in Neoteris Instant Virtual Extranet (IVE) 3.x and 4.x, with LDAP authentication or NT domain authentication enabled, does not limit the number of times a bad password can be entered, which allows remote attackers to guess passwords via a brute force attack.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8794&w=2; http://secunia.com/advisories/12752; http://securitytracker.com/id?1011552
CVE: CVE-2004-0940
Published: 2005-02-09
Description: Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.
CVSS Score: 7.8 (HIGH)
CWE: CWE-131
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5051&w=2; http://secunia.com/advisories/12898/; http://secunia.com/advisories/19073
CVE: CVE-2004-0941
Published: 2005-02-09
Description: Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function, a different set of vulnerabilities than CVE-2004-0990.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/13179/; http://secunia.com/advisories/18686; http://secunia.com/advisories/20824
CVE: CVE-2004-0942
Published: 2005-02-09
Description: Apache webserver 2.0.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request with a MIME header containing multiple lines with a large number of space characters.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html; http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html; http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/028248.html
CVE: CVE-2004-0947
Published: 2005-02-09
Description: Buffer overflow in unarj before 2.63a-r2 allows remote attackers to execute arbitrary code via an arj archive that contains long filenames.
CVSS Score: 10.0 (HIGH)
References: http://lwn.net/Articles/121827/; http://www.debian.org/security/2005/dsa-652; http://www.gentoo.org/security/en/glsa/glsa-200411-29.xml
CVE: CVE-2004-0950
Published: 2005-02-09
Description: NetOp Host before 7.65 build 2004278 allows remote attackers to obtain sensitive hostname, username and local IP address information via (1) a NetOp HELO request, or (2) when responses are disabled, a "custom" HELO request.
CVSS Score: 5.0 (MEDIUM)
References: http://msgs.securepoint.com/cgi-bin/get/bugtraq0411/213.html; http://www.corsaire.com/advisories/c040619-001.txt; http://www.securityfocus.com/bid/11710
CVE: CVE-2004-0957
Published: 2005-02-09
Description: Unknown vulnerability in MySQL 3.23.58 and earlier, when a local user has privileges for a database whose name includes a "_" (underscore), grants privileges to other databases that have similar names, which can allow the user to conduct unauthorized activities.
CVSS Score: 6.8 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000947; http://www.ciac.org/ciac/bulletins/p-018.shtml; http://www.debian.org/security/2005/dsa-707
CVE: CVE-2004-0960
Published: 2005-02-09
Description: FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (core dump) via malformed USR vendor-specific attributes (VSA) that cause a memcpy operation with a -1 argument.
CVSS Score: 5.0 (MEDIUM)
References: http://security.gentoo.org/glsa/glsa-200409-29.xml; http://www.kb.cert.org/vuls/id/541574; http://www.securityfocus.com/bid/11222
CVE: CVE-2004-0961
Published: 2005-02-09
Description: Memory leak in FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (memory exhaustion) via a series of Access-Request packets with (1) Ascend-Send-Secret, (2) Ascend-Recv-Secret, or (3) Tunnel-Password attributes.
CVSS Score: 5.0 (MEDIUM)
References: http://security.gentoo.org/glsa/glsa-200409-29.xml; http://www.kb.cert.org/vuls/id/541574; http://www.securityfocus.com/bid/11222
CVE: CVE-2004-0962
Published: 2005-02-09
Description: Apple Remote Desktop Client 1.2.4 executes a GUI application as root when it is started by an Apple Remote Desktop Administrator application, which allows remote authenticated users to execute arbitrary code when loginwindow is active via Fast User Switching.
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2004/Oct/msg00002.html; http://lists.apple.com/archives/security-announce/2004/Oct/msg00002.html
CVE: CVE-2004-0963
Published: 2005-02-09
Description: Buffer overflow in Microsoft Word 2002 (10.6612.6714) SP3, and possibly other versions, allows remote attackers to cause a denial of service (application exception) and possibly execute arbitrary code in winword.exe via certain unexpected values in a .doc file, including (1) an offset that triggers an out-of-bounds memory access, (2) a certain value that causes a large memory copy as triggered by an integer conversion error, and other values.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0733&w=2; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-023; https://exchange.xforce.ibmcloud.com/vulnerabilities/17635
CVE: CVE-2004-0964
Published: 2005-02-09
Description: Buffer overflow in Zinf 2.2.1 on Windows, and other older versions for Linux, allows remote attackers or local users to execute arbitrary code via certain values in a .pls file.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9200&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8548&w=2; http://secunia.com/advisories/12656
CVE: CVE-2004-0965
Published: 2005-02-09
Description: stmkfont in HP-UX B.11.00 through B.11.23 relies on the user-specified PATH when executing certain commands, which allows local users to execute arbitrary code by modifying the PATH environment variable to point to malicious programs.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3696&w=2; http://www.nsfocus.com/english/homepage/research/0402.htm; http://www.securityfocus.com/advisories/7351
CVE: CVE-2004-0966
Published: 2005-02-09
Description: The (1) autopoint and (2) gettextize scripts in the GNU gettext package 1.14 and later versions, as used in Trustix Secure Linux 1.5 through 2.1 and other operating systems, allows local users to overwrite files via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136323; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6638&w=2; http://www.gentoo.org/security/en/glsa/glsa-200410-10.xml
CVE: CVE-2004-0967
Published: 2005-02-09
Description: The (1) pj-gs.sh, (2) ps2epsi, (3) pv.sh, and (4) sysvlp.sh scripts in the ESP Ghostscript (espgs) package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a symlink attack on temporary files.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.19/SCOSA-2006.19.txt; ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.23/SCOSA-2006.23.txt; http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136321
CVE: CVE-2004-0968
Published: 2005-02-09
Description: The catchsegv script in glibc 2.3.2 and earlier allows local users to overwrite files via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136318; http://security.gentoo.org/glsa/glsa-200410-19.xml; http://www.debian.org/security/2005/dsa-636
CVE: CVE-2004-0969
Published: 2005-02-09
Description: The groffer script in the Groff package 1.18 and later versions, as used in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136313; http://secunia.com/advisories/18764; http://www.gentoo.org/security/en/glsa/glsa-200411-15.xml
CVE: CVE-2004-0970
Published: 2005-02-09
Description: The (1) gzexe, (2) zdiff, and (3) znew scripts in the gzip package, as used by other packages such as ncompress, allows local users to overwrite files via a symlink attack on temporary files.  NOTE: the znew vulnerability may overlap CVE-2003-0367.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/13131; http://www.debian.org/security/2004/dsa-588; http://www.securityfocus.com/bid/11288
CVE: CVE-2004-0971
Published: 2005-02-09
Description: The krb5-send-pr script in the kerberos5 (krb5) package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136304; http://www.gentoo.org/security/en/glsa/glsa-200410-24.xml; http://www.redhat.com/support/errata/RHSA-2005-012.html
CVE: CVE-2004-0972
Published: 2005-02-09
Description: The lvmcreate_initrd script in the lvm package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136308; http://rhn.redhat.com/errata/RHBA-2004-232.html; http://www.securityfocus.com/bid/11290
CVE: CVE-2004-0974
Published: 2005-02-09
Description: The netatalk package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: http://www.gentoo.org/security/en/glsa/glsa-200410-25.xml; http://www.trustix.org/errata/2004/0050; https://exchange.xforce.ibmcloud.com/vulnerabilities/17583
CVE: CVE-2004-0975
Published: 2005-02-09
Description: The der_chop script in the openssl package in Trustix Secure Linux 1.5 through 2.1 and other operating systems allows local users to overwrite files via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136302; http://secunia.com/advisories/12973; http://www.debian.org/security/2004/dsa-603
CVE: CVE-2004-0976
Published: 2005-02-09
Description: Multiple scripts in the perl package in Trustix Secure Linux 1.5 through 2.1 and other operating systems allows local users to overwrite files via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: http://fedoranews.org/updates/FEDORA--.shtml; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9788&w=2; http://secunia.com/advisories/17661
CVE: CVE-2004-0977
Published: 2005-02-09
Description: The make_oidjoins_check script in PostgreSQL 7.4.5 and earlier allows local users to overwrite files via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136300; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8903&w=2; http://security.gentoo.org/glsa/glsa-200410-16.xml
CVE: CVE-2004-0978
Published: 2005-02-09
Description: Heap-based buffer overflow in the Hrtbeat.ocx (Heartbeat) ActiveX control for Internet Explorer 5.01 through 6, when users who visit online gaming sites that are associated with MSN, allows remote attackers to execute arbitrary code via the SetupData parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-787
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1579&w=2; http://www.kb.cert.org/vuls/id/673134; http://www.ngssoftware.com/advisories/heartbeatfull.txt
CVE: CVE-2004-0980
Published: 2005-02-09
Description: Format string vulnerability in ez-ipupdate.c for ez-ipupdate 3.0.10 through 3.0.11b8, when running in daemon mode with certain service types in use, allows remote servers to execute arbitrary code.
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/028590.html; http://secunia.com/advisories/13167/; http://www.debian.org/security/2004/dsa-592
CVE: CVE-2004-0981
Published: 2005-02-09
Description: Buffer overflow in the EXIF parsing routine in ImageMagick before 6.1.0 allows remote attackers to execute arbitrary code via a certain image file.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/12995/; http://security.gentoo.org/glsa/glsa-200411-11.xml; http://www.imagemagick.org/www/Changelog.html
CVE: CVE-2004-0982
Published: 2005-02-09
Description: Buffer overflow in the getauthfromURL function in httpget.c in mpg123 pre0.59s and mpg123 0.59r could allow remote attackers or local users to execute arbitrary code via an mp3 file that contains a long string before the @ (at sign) in a URL.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2407&w=2; http://secunia.com/advisories/12908; http://securitytracker.com/id?1011832
CVE: CVE-2005-0362
Published: 2005-02-09
Description: awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pluginmode", (2) "loadplugin", or (3) "noloadplugin" parameters.
CVSS Score: 4.6 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488; http://www.osvdb.org/16089; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488