deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-1964
Published: 2004-04-23
Description: Cross-site scripting (XSS) vulnerability in nqt.php in Network Query Tool (NQT) 1.6 allows remote attackers to inject arbitrary web script or HTML via the portNum parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8267&w=2; http://secunia.com/advisories/11479; http://www.securityfocus.com/bid/10205
CVE: CVE-2004-1965
Published: 2004-04-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Open Bulletin Board (OpenBB) 1.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) redirect parameter to member.php, (2) to parameter to myhome.php (3) TID parameter to post.php, or (4) redirect parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6107&w=2; http://secunia.com/advisories/11481; http://securitytracker.com/id?1009935
CVE: CVE-2004-1967
Published: 2004-04-25
Description: Cross-site request forgery (CSRF) vulnerabilities in (1) cp_forums.php, (2) cp_usergroup.php, (3) cp_ipbans.php, (4) myhome.php, (5) post.php, or (6) moderator.php in Open Bulletin Board (OpenBB) 1.0.6 and earlier allow remote attackers to execute arbitrary code by including the code in an image tag or a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6107&w=2; http://secunia.com/advisories/11481; http://securitytracker.com/id?1009935
CVE: CVE-2004-1969
Published: 2004-04-25
Description: The avatar upload capability in Open Bulletin Board (OpenBB) 1.0.6 and earlier allows remote attackers to execute arbitrary script by uploading files that include scripting code such as Javascript.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6107&w=2; http://secunia.com/advisories/11481; http://securitytracker.com/id?1009935
CVE: CVE-2004-1077
Published: 2004-04-26
Description: Citrix Program Neighborhood Agent for Win32 8.00.24737 and earlier and MetaFrame Presentation Server client for WinCE before 8.33 allows remote servers to create arbitrary shortcuts on the client via a full UNC path in the AppInStartmenu directive.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/15108; http://support.citrix.com/kb/entry.jspa?externalID=CTX105650; http://www.idefense.com/application/poi/display?id=237&type=vulnerabilities
CVE: CVE-2004-1078
Published: 2004-04-26
Description: Stack-based buffer overflow in the client for Citrix Program Neighborhood Agent for Win32 8.00.24737 and earlier and Citrix MetaFrame Presentation Server client for WinCE before 8.33 allows remote attackers to execute arbitrary code via a long cached icon filename in the InName XML element.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15108; http://support.citrix.com/kb/entry.jspa?externalID=CTX105650; http://www.idefense.com/application/poi/display?id=238&type=vulnerabilities
CVE: CVE-2004-1355
Published: 2004-04-26
Description: Unknown vulnerability in the TCP/IP stack for Sun Solaris 8 and 9 allows local users to cause a denial of service (system panic) via unknown vectors.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/11483/; http://sunsolve.sun.com/search/document.do?assetkey=1-26-57545-1&searchclause=%22category:security%22%20%20111313-02; http://www.auscert.org.au/render.html?it=4057
CVE: CVE-2004-1968
Published: 2004-04-26
Description: The readmsg action in myhome.php in Open Bulletin Board (OpenBB) 1.0.6 and earlier allows remote attackers to read arbitrary messages by modifying the id parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6107&w=2; http://secunia.com/advisories/11481; http://securitytracker.com/id?1009935
CVE: CVE-2004-1970
Published: 2004-04-26
Description: Samsung SmartEther SS6215S switch, and possibly other Samsung switches, allows remote attackers and local users to gain administrative access by providing the admin username followed by a password that is the maximum allowed length, then pressing the enter key after the resulting error message.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4571&w=2; http://www.securityfocus.com/bid/10219; https://exchange.xforce.ibmcloud.com/vulnerabilities/15973
CVE: CVE-2004-1971
Published: 2004-04-26
Description: modules.php in PHP-Nuke Video Gallery Module 0.1 Beta 5 allows remote attackers to gain sensitive information via an HTTP request with an invalid (1) catid or (2) clipid parameter, which reveals the full path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8557&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/15978; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8557&w=2
CVE: CVE-2004-1972
Published: 2004-04-26
Description: SQL injection vulnerability in modules.php in PHP-Nuke Video Gallery Module 0.1 Beta 5 allows remote attackers to execute arbitrary SQL code via the (1) clipid or (2) catid parameters in a viewclip, viewcat, or voteclip action.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8557&w=2; http://www.securityfocus.com/bid/10215; https://exchange.xforce.ibmcloud.com/vulnerabilities/15979
CVE: CVE-2004-1973
Published: 2004-04-27
Description: DiGi Web Server allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request that contains a large number of / (slash) characters, which consumes resources when DiGi converts the slashes to \ (backslash) characters.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8203&w=2; http://secunia.com/advisories/11490; http://securitytracker.com/alerts/2004/Apr/1009957.html
CVE: CVE-2004-1974
Published: 2004-04-27
Description: paFileDB 3.1 allows remote attackers to gain sensitive information via a direct request to (1) login.php, (2) category.php, (3) search.php, (4) main.php, (5) viewall.php, (6) download.php, (7) email.php, (8) file.php, (9) rate.php, or (10) stats.php, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2485&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/15990; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2485&w=2
CVE: CVE-2004-1975
Published: 2004-04-27
Description: Cross-site scripting (XSS) vulnerability in the category module in pafiledb.php for paFileDB 3.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter, a vulnerability that is closely related to CVE-2004-1551.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2485&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4184&w=2; http://www.securityfocus.com/bid/10229
CVE: CVE-2004-1976
Published: 2004-04-28
Description: SMC Barricade broadband router 7008ABR and 7004VBR enable remote administration by default, which allows remote attackers to gain access by connecting to port 1900.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2004-06/0101.html; http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020580.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1816&w=2
CVE: CVE-2004-1977
Published: 2004-04-29
Description: 3com NBX IP VOIP NetSet Configuration Manager allows remote attackers to cause a denial of service (crash) via a Nessus scan in safeChecks mode.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0092.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8554&w=2; http://secunia.com/advisories/11504
CVE: CVE-2004-1978
Published: 2004-04-30
Description: Cross-site scripting (XSS) vulnerability in help.php in Moodle before 1.3 allows remote attackers to inject arbitrary HTML and web script via the text parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5605&w=2; http://secunia.com/advisories/11535; http://securitytracker.com/id?1010008
CVE: CVE-2004-1979
Published: 2004-04-30
Description: Cross-site scripting (XSS) vulnerability in do_search.php in PROPS 0.6.1 allows remote attackers to inject arbitrary HTML or web script via the search_string parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6155&w=2; http://sourceforge.net/project/shownotes.php?group_id=29581&release_id=234433; http://www.securityfocus.com/bid/10258
CVE: CVE-2004-1980
Published: 2004-04-30
Description: Directory traversal vulnerability in glossary.php in PROPS 0.6.1 allows remote attackers to view arbitrary files via a .. (dot dot) in (1) module or (2) format variables.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6155&w=2; http://sourceforge.net/project/shownotes.php?group_id=29581&release_id=234433; https://exchange.xforce.ibmcloud.com/vulnerabilities/16036
CVE: CVE-2004-1985
Published: 2004-04-30
Description: Cross-site scripting (XSS) vulnerability in menu.inc.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to inject arbitrary HTML or web script via the CPG_URL parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2014&w=2; http://secunia.com/advisories/11524; http://www.osvdb.org/5757
CVE: CVE-2004-1987
Published: 2004-04-30
Description: picmgmtbatch.inc.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrative privileges to execute arbitrary commands via shell metacharacters in the (1) $CONFIG['impath'] or (2) $CONFIG['jpeg_qual'] parameters.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2014&w=2; http://secunia.com/advisories/11524; http://securitytracker.com/id?1010001
CVE: CVE-2004-1988
Published: 2004-04-30
Description: PHP remote file inclusion vulnerability in init.inc.php in Coppermine Photo Gallery 1.2.0 RC4 allows remote attackers to execute arbitrary PHP code by modifying the CPG_M_DIR to reference a URL on a remote web server that contains functions.inc.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2014&w=2; http://secunia.com/advisories/11524; http://securitytracker.com/id?1010001
CVE: CVE-2004-1989
Published: 2004-04-30
Description: PHP remote file inclusion vulnerability in theme.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to execute arbitrary PHP code by modifying the THEME_DIR parameter to reference a URL on a remote web server that contains user_list_info_box.inc.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2014&w=2; http://secunia.com/advisories/11524; http://securitytracker.com/id?1010001
CVE: CVE-2004-2043
Published: 2004-05-01
Description: Buffer overflow in ibserver for Firebird Database 1.0 and other versions before 1.5, and possibly other products that use the InterBase codebase, allows remote attackers to cause a denial of service (crash) via a long database name, as demonstrated using the gsec command.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0027.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2493&w=2; http://secunia.com/advisories/11756
CVE: CVE-2004-1981
Published: 2004-05-02
Description: The web interface for Crystal Reports allows remote attackers to cause a denial of service (disk exhaustion) by repeatedly requesting reports without retrieving the associated image files, which are not cleared from the image file folder.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1017&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7360&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/16046
CVE: CVE-2004-1983
Published: 2004-05-02
Description: The arch_get_unmapped_area function in mmap.c in the PaX patches for Linux kernel 2.6, when Address Space Layout Randomization (ASLR) is enabled, allows local users to cause a denial of service (infinite loop) via unknown attack vectors.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0312&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0369&w=2; http://pax.grsecurity.net/
CVE: CVE-2004-1984
Published: 2004-05-02
Description: Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers to obtain sensitive information via a direct HTTP request to (1) phpinfo.php, (2) addpic.php, (3) config.php, (4) db_input.php, (5) displayecard.php, (6) ecard.php, (7) crop.inc.php, which reveal the full path in a PHP error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2014&w=2; http://secunia.com/advisories/11524; http://securitytracker.com/id?1010001
CVE: CVE-2004-0428
Published: 2004-05-03
Description: Unknown vulnerability in CoreFoundation in Mac OS X 10.3.3 and Mac OS X 10.3.3 Server, related to "the handling of an environment variable," has unknown attack vectors and unknown impact.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.virus.org/macsec-0405/msg00000.html; http://secunia.com/advisories/11539; http://securitytracker.com/id?1010045
CVE: CVE-2004-1982
Published: 2004-05-03
Description: Post.pl in YaBB 1 Gold SP 1.2 allows remote attackers to modify records in the board's .txt file via carriage return characters in the subject field.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3935&w=2; http://secunia.com/advisories/12609; http://www.securityfocus.com/bid/10263
CVE: CVE-2004-1991
Published: 2004-05-03
Description: Directory traversal vulnerability in Aldo's Web Server (aweb) 1.5 allows remote attackers to view arbitrary files via a .. (dot dot) in an HTTP GET request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1227&w=2; http://secunia.com/advisories/11542; http://www.oliverkarow.de/research/AldosWebserverMultipleVulns.txt
CVE: CVE-2003-0618
Published: 2004-05-04
Description: Multiple vulnerabilities in suidperl 5.6.1 and earlier allow a local user to obtain sensitive information about files for which the user does not have appropriate permissions.
CVSS Score: 2.1 (LOW)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=203426; http://www.debian.org/security/2004/dsa-431; http://www.securityfocus.com/bid/9543
CVE: CVE-2003-0648
Published: 2004-05-04
Description: Multiple buffer overflows in vfte, based on FTE, before 0.50, allow local users to execute arbitrary code.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/11290; http://securitytracker.com/id?1009655; http://securitytracker.com/id?1009656
CVE: CVE-2003-0781
Published: 2004-05-04
Description: Unknown vulnerability in ecartis before 1.0.0 does not properly validate user input, which allows attackers to obtain mailing list passwords.
CVSS Score: 10.0 (HIGH)
References: http://www.debian.org/security/2004/dsa-467; https://exchange.xforce.ibmcloud.com/vulnerabilities/12929; http://www.debian.org/security/2004/dsa-467
CVE: CVE-2003-0782
Published: 2004-05-04
Description: Multiple buffer overflows in ecartis before 1.0.0 allow attackers to cause a denial of service and possibly execute arbitrary code.
CVSS Score: 10.0 (HIGH)
References: http://www.debian.org/security/2004/dsa-467; https://exchange.xforce.ibmcloud.com/vulnerabilities/12928; http://www.debian.org/security/2004/dsa-467
CVE: CVE-2004-0149
Published: 2004-05-04
Description: Multiple buffer overflows in xboing before 2.4 allow local users to gain privileges.
CVSS Score: 4.6 (MEDIUM)
References: http://www.debian.org/security/2004/dsa-451; http://www.securityfocus.com/bid/9764; https://exchange.xforce.ibmcloud.com/vulnerabilities/15347
CVE: CVE-2004-0174
Published: 2004-05-04
Description: Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-accessed listening socket."
CVSS Score: 7.5 (HIGH)
CWE: CWE-667
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8806&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0552&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4244&w=2
CVE: CVE-2004-0176
Published: 2004-05-04
Description: Multiple buffer overflows in Ethereal 0.8.13 to 0.10.2 allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) NetFlow, (2) IGAP, (3) EIGRP, (4) PGM, (5) IrDA, (6) BGP, (7) ISUP, or (8) TCAP dissectors.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000835; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5742&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4316&w=2
CVE: CVE-2004-0183
Published: 2004-05-04
Description: TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via ISAKMP packets containing a Delete payload with a large number of SPI's, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1525&w=2; http://secunia.com/advisories/11258; http://secunia.com/advisories/11320
CVE: CVE-2004-0184
Published: 2004-05-04
Description: Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125, CWE-191
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1525&w=2; http://secunia.com/advisories/11258; http://securitytracker.com/id?1009593
CVE: CVE-2004-0218
Published: 2004-05-04
Description: isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (infinite loop) via an ISAKMP packet with a zero-length payload, as demonstrated by the Striker ISAKMP Protocol Test Suite.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8019&w=2; http://secunia.com/advisories/11156; http://www.kb.cert.org/vuls/id/349113
CVE: CVE-2004-0219
Published: 2004-05-04
Description: isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a malformed IPSEC SA payload, as demonstrated by the Striker ISAKMP Protocol Test Suite.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8019&w=2; http://www.kb.cert.org/vuls/id/785945; http://www.openbsd.org/errata.html
CVE: CVE-2004-0220
Published: 2004-05-04
Description: isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service via an ISAKMP packet with a malformed Cert Request payload, which causes an integer underflow that is used in a malloc operation that is not properly handled, as demonstrated by the Striker ISAKMP Protocol Test Suite.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8019&w=2; http://www.kb.cert.org/vuls/id/223273; http://www.openbsd.org/errata.html
CVE: CVE-2004-0221
Published: 2004-05-04
Description: isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a delete payload containing a large number of SPIs, which triggers an out-of-bounds read error, as demonstrated by the Striker ISAKMP Protocol Test Suite.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8019&w=2; http://www.kb.cert.org/vuls/id/524497; http://www.openbsd.org/errata.html
CVE: CVE-2004-0222
Published: 2004-05-04
Description: Multiple memory leaks in isakmpd in OpenBSD 3.4 and earlier allow remote attackers to cause a denial of service (memory exhaustion) via certain ISAKMP packets, as demonstrated by the Striker ISAKMP Protocol Test Suite.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-401
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8019&w=2; http://www.kb.cert.org/vuls/id/996177; http://www.openbsd.org/errata.html
CVE: CVE-2004-0365
Published: 2004-05-04
Description: The dissect_attribute_value_pairs function in packet-radius.c for Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000835; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4316&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6260&w=2
CVE: CVE-2004-0366
Published: 2004-05-04
Description: SQL injection vulnerability in the libpam-pgsql library before 0.5.2 allows attackers to execute arbitrary SQL statements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/11237; http://www.debian.org/security/2004/dsa-469; http://www.securityfocus.com/bid/10266
CVE: CVE-2004-0367
Published: 2004-05-04
Description: Ethereal 0.10.1 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a zero-length Presentation protocol selector.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000835; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4316&w=2; http://secunia.com/advisories/11185
CVE: CVE-2004-0368
Published: 2004-05-04
Description: Double free vulnerability in dtlogin in CDE on Solaris, HP-UX, and other operating systems allows remote attackers to execute arbitrary code via a crafted XDMCP packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: ftp://patches.sgi.com/support/free/security/advisories/20040801-01-P; http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0064.html; http://lists.immunitysec.com/pipermail/dailydave/2004-March/000402.html
CVE: CVE-2004-0370
Published: 2004-05-04
Description: The setsockopt call in the KAME Project IPv6 implementation, as used in FreeBSD 5.2, does not properly handle certain IPv6 socket options, which could allow attackers to read kernel memory and cause a system panic.
CVSS Score: 2.1 (LOW)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:06.ipv6.asc; http://secunia.com/advisories/11233; http://www.securityfocus.com/bid/9992
CVE: CVE-2004-0371
Published: 2004-05-04
Description: Heimdal 0.6.x before 0.6.1 and 0.5.x before 0.5.3 does not properly perform certain consistency checks for cross-realm requests, which allows remote attackers with control of a realm to impersonate others in the cross-realm trust path.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:08.heimdal.asc; ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/009_kerberos.patch; http://security.gentoo.org/glsa/glsa-200404-09.xml
CVE: CVE-2004-0374
Published: 2004-05-04
Description: Interchange before 5.0.1 allows remote attackers to "expose the content of arbitrary variables" and read or modify sensitive SQL information via an HTTP request ending with the "__SQLUSER__" string.
CVSS Score: 6.4 (MEDIUM)
References: http://ftp.icdevgroup.org/interchange/5.0/WHATSNEW; http://secunia.com/advisories/11234; http://www.debian.org/security/2004/dsa-471
CVE: CVE-2004-0376
Published: 2004-05-04
Description: oftpd 0.3.6 and earlier allows remote attackers to cause a denial of service (crash) via a PORT command with a large value.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/11220; http://security.gentoo.org/glsa/glsa-200403-08.xml; http://www.debian.org/security/2004/dsa-473
CVE: CVE-2004-0377
Published: 2004-05-04
Description: Buffer overflow in the win32_stat function for (1) ActiveState's ActivePerl and (2) Larry Wall's Perl before 5.8.3 allows local or remote attackers to execute arbitrary commands via filenames that end in a backslash character.
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/019794.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7979&w=2; http://public.activestate.com/cgi-bin/perlbrowse?patch=22552