deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2003-0816
Published: 2004-02-03
Description: Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6884&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7858&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9727&w=2
CVE: CVE-2003-0817
Published: 2004-02-03
Description: Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/10192; http://www.securityfocus.com/bid/9012; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-048
CVE: CVE-2003-0823
Published: 2004-02-03
Description: Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2006&w=2; http://secunia.com/advisories/10192; http://www.kb.cert.org/vuls/id/413886
CVE: CVE-2003-0902
Published: 2004-02-03
Description: Unknown vulnerability in minimalist mailing list manager 2.4, 2.2, and possibly other versions, allows remote attackers to execute arbitrary commands.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2003/dsa-402; http://www.debian.org/security/2003/dsa-402
CVE: CVE-2003-0949
Published: 2004-02-03
Description: xsok 1.02 does not properly drop privileges before finding and executing the "gunzip" program, which allows local users to execute arbitrary commands.
CVSS Score: 4.6 (MEDIUM)
References: http://www.debian.org/security/2003/dsa-405; http://www.securityfocus.com/bid/9321; https://exchange.xforce.ibmcloud.com/vulnerabilities/14098
CVE: CVE-2003-0994
Published: 2004-02-03
Description: The GUI functionality for an interactive session in Symantec LiveUpdate 1.70.x through 1.90.x, as used in Norton Internet Security 2001 through 2004, SystemWorks 2001 through 2004, and AntiVirus and Norton AntiVirus Pro 2001 through 2004, AntiVirus for Handhelds v3.0, allows local users to gain SYSTEM privileges.
CVSS Score: 7.2 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-January/015510.html; http://lists.grok.org.uk/pipermail/full-disclosure/2004-January/015510.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8245&w=2
CVE: CVE-2004-0013
Published: 2004-02-03
Description: jabber 1.4.2, 1.4.2a, and possibly earlier versions, does not properly handle SSL connections, which allows remote attackers to cause a denial of service (crash).
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/10559; http://www.debian.org/security/2004/dsa-414; http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:005
CVE: CVE-2004-0015
Published: 2004-02-03
Description: vbox3 0.1.8 and earlier does not properly drop privileges before executing a user-provided TCL script, which allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://www.debian.org/security/2004/dsa-418; http://www.securityfocus.com/bid/9381; https://exchange.xforce.ibmcloud.com/vulnerabilities/14170
CVE: CVE-2004-0016
Published: 2004-02-03
Description: The calendar module for phpgroupware 0.9.14 does not enforce the "save extension" feature for holiday files, which allows remote attackers to create and execute PHP files.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2004/dsa-419; http://www.osvdb.org/6860; http://www.securityfocus.com/bid/9387
CVE: CVE-2004-0017
Published: 2004-02-03
Description: Multiple SQL injection vulnerabilities in the (1) calendar and (2) infolog modules for phpgroupware 0.9.14 allow remote attackers to perform unauthorized database operations.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/10591; http://www.debian.org/security/2004/dsa-419; http://www.securityfocus.com/bid/9386
CVE: CVE-2004-0028
Published: 2004-02-03
Description: jitterbug 1.6.2 does not properly sanitize inputs, which allows remote authenticated users to execute arbitrary commands.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2004/dsa-420; http://www.securityfocus.com/bid/9397; https://exchange.xforce.ibmcloud.com/vulnerabilities/14207
CVE: CVE-2004-0041
Published: 2004-02-03
Description: The mod_auth_shadow module 1.4 and earlier does not properly enforce the expiration of a user account and password, which could allow remote authenticated users to bypass intended access restrictions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/10612; http://www.debian.org/security/2004/dsa-421; http://www.osvdb.org/3454
CVE: CVE-2004-0042
Published: 2004-02-03
Description: vsftpd 1.1.3 generates different error messages depending on whether or not a valid username exists, which allows remote attackers to identify valid usernames.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1008628; http://securitytracker.com/id?1008628
CVE: CVE-2004-0043
Published: 2004-02-03
Description: Buffer overflow in Yahoo Instant Messenger 5.6.0.1351 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long filename in the download feature.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-January/015334.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2255&w=2; http://secunia.com/advisories/10573
CVE: CVE-2004-0044
Published: 2004-02-03
Description: Cisco Personal Assistant 1.4(1) and 1.4(2) disables password authentication when "Allow Only Cisco CallManager Users" is enabled and the Corporate Directory settings refer to the directory service being used by Cisco CallManager, which allows remote attackers to gain access with a valid username.
CVSS Score: 7.5 (HIGH)
References: http://www.cisco.com/warp/public/707/cisco-sa-20040108-pa.shtml; http://www.osvdb.org/3430; http://www.securityfocus.com/bid/9384
CVE: CVE-2004-0045
Published: 2004-02-03
Description: Buffer overflow in the ARTpost function in art.c in the control message handling code for INN 2.4.0 may allow remote attackers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2004-01/0063.html; http://archives.neohapsis.com/archives/bugtraq/2004-01/0064.html; http://secunia.com/advisories/10578
CVE: CVE-2004-0046
Published: 2004-02-03
Description: Cross-site scripting (XSS) vulnerability in SnapStream PVS LITE allows remote attackers to inject arbitrary web script or HTML via a GET request containing a terminating '"' (double quote) character.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7867&w=2; http://secunia.com/advisories/10575; http://securitytracker.com/id?1008646
CVE: CVE-2004-1082
Published: 2004-02-03
Description: mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.
CVSS Score: 7.5 (HIGH)
References: http://lists.apple.com/archives/security-announce/2004/Dec/msg00000.html; http://www.ciac.org/ciac/bulletins/p-049.shtml; http://www.securityfocus.com/bid/9571
CVE: CVE-2004-2085
Published: 2004-02-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in Brad Fears phpCodeCabinet 0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via multiple parameters, including (1) the sid parameter to comments.php, (2) the cid, cf, or rfd parameters to category.php, or the cid parameter to (3) input.php, (4) browse.php, (5) themes/facade/header.php, or (6) themes/phpcc/header.php.
CVSS Score: 4.3 (MEDIUM)
References: http://cvs.sourceforge.net/viewcvs.py/phpcodecabinet/phpcc/browse.php?r1=1.5&r2=1.6; http://cvs.sourceforge.net/viewcvs.py/phpcodecabinet/phpcc/category.php?r1=1.4&r2=1.5; http://cvs.sourceforge.net/viewcvs.py/phpcodecabinet/phpcc/comments.php?r1=1.1&r2=1.2
CVE: CVE-2004-2073
Published: 2004-02-06
Description: Linux-VServer 1.24 allows local users with root privileges on a virtual server to gain access to the filesystem outside the virtual server via a modified chroot-again exploit using the chmod command.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/10816; http://www.linux-vserver.org/index.php?page=ChangeLog; http://www.osvdb.org/3875
CVE: CVE-2004-2086
Published: 2004-02-06
Description: Stack-based buffer overflow in results.stm for Sambar Server before the 6.0 production release allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP POST request with a long query parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1008979; http://www.osvdb.org/5786; http://www.sambar.com/security.htm
CVE: CVE-2004-2089
Published: 2004-02-06
Description: Matrix FTP Server allows remote attackers to cause a denial of service (crash) by logging in using four spaces as the username and password and then issuing a LIST command.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1008970; https://exchange.xforce.ibmcloud.com/vulnerabilities/15075; http://securitytracker.com/id?1008970
CVE: CVE-2004-2084
Published: 2004-02-07
Description: Cross-site scripting (XSS) vulnerability in search.php in JShop E-Commerce Server allows remote attackers to inject arbitrary web script or HTML via the xSearch parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/10825; http://securitytracker.com/id?1008988; http://www.osvdb.org/3889
CVE: CVE-2004-2090
Published: 2004-02-07
Description: Microsoft Internet Explorer 5.0.1 through 6.0 allows remote attackers to determine the existence of arbitrary files via the VBScript LoadPicture method, which returns an error code if the file does not exist.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-February/016881.html; http://secunia.com/advisories/10820; http://www.securityfocus.com/bid/9611
CVE: CVE-2004-1244
Published: 2004-02-08
Description: Windows Media Player 9 allows remote attackers to execute arbitrary code via a PNG file containing large (1) width or (2) height values, aka the "PNG Processing Vulnerability."
CVSS Score: 7.5 (HIGH)
References: http://www.kb.cert.org/vuls/id/259890; http://www.us-cert.gov/cas/techalerts/TA05-039A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-009
CVE: CVE-2004-2077
Published: 2004-02-08
Description: Nadeo Game Engine for Nadeo TrackMania and Nadeo Virtual Skipper 3 allows remote attackers to cause a denial of service (server crash) via malformed data to TCP port 2350, possibly due to long values or incorrect size fields.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.netsys.com/pipermail/full-disclosure/2004-February/016906.html; http://www.securiteinfo.com/attaques/hacking/trackmaniados.shtml; http://www.securityfocus.com/archive/1/353182
CVE: CVE-2004-2087
Published: 2004-02-08
Description: Unknown vulnerability in SandSurfer before 1.7.0 allows remote attackers to gain access as a logged-in user.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/10829; http://securitytracker.com/id?1009110; http://sourceforge.net/forum/forum.php?forum_id=351705
CVE: CVE-2004-2078
Published: 2004-02-09
Description: Red-M Red-Alert 2.7.5 with software 3.1 build 24 allows remote attackers to cause a denial of service (reboot and loss of logged events) via a long request to TCP port 80, possibly triggering a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://genhex.org/releases/031003.txt; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]5407&w=2; http://secunia.com/advisories/10832
CVE: CVE-2004-2079
Published: 2004-02-09
Description: Red-M Red-Alert 2.7.5 with software 3.1 build 24 binds authentication to IP addresses, which allows remote attackers to bypass authentication by connecting from the same IP address as an active authenticated user.
CVSS Score: 7.5 (HIGH)
References: http://genhex.org/releases/031003.txt; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]5407&w=2; http://securitytracker.com/id?1009001
CVE: CVE-2004-2080
Published: 2004-02-09
Description: Red-M Red-Alert 2.7.5 with software 3.1 build 24 converts multiple spaces in a Service Set Identifier (SSID) to a single space, which prevents Red-Alert from correctly identifying the SSID.
CVSS Score: 5.0 (MEDIUM)
References: http://genhex.org/releases/031003.txt; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]5407&w=2; http://securitytracker.com/id?1009001
CVE: CVE-2004-2092
Published: 2004-02-09
Description: eTrust InoculateIT for Linux 6.0 uses insecure permissions for multiple files and directories, including the application's registry and tmp directories, which allows local users to delete, modify, or examine sensitive information.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1518&w=2; http://secunia.com/advisories/10833; http://www.excluded.org/advisories/advisory10.txt
CVE: CVE-2004-2093
Published: 2004-02-09
Description: Buffer overflow in the open_socket_out function in socket.c for rsync 2.5.7 and earlier allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long RSYNC_PROXY environment variable.  NOTE: since rsync is not setuid, this issue does not provide any additional privileges beyond those that are already available to the user.  Therefore this issue may be REJECTED in the future.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/vuln-dev/2004-q1/0091.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/15108; http://archives.neohapsis.com/archives/vuln-dev/2004-q1/0091.html
CVE: CVE-2004-2091
Published: 2004-02-10
Description: Microsoft Baseline Security Analyzer (MBSA) 1.2 does not correctly identify systems that have been patched but remain vulnerable to exploit until the system is rebooted, possibly giving the administrator a false sense of security.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/353324; http://www.securityfocus.com/bid/9634; http://www.securityfocus.com/archive/1/353324
CVE: CVE-2003-1214
Published: 2004-02-11
Description: Unknown vulnerability in the server login for VisualShapers ezContents 2.02 and earlier allows remote attackers to bypass access restrictions and gain access to restricted functions.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/10839; http://www.ezcontents.org/forum/viewtopic.php?t=361; https://exchange.xforce.ibmcloud.com/vulnerabilities/15136
CVE: CVE-2004-2083
Published: 2004-02-11
Description: Opera Web Browser 7.0 through 7.23 allows remote attackers to trick users into executing a malicious file by embedding a CLSID in the file name, which causes the malicious file to appear as a trusted file type, aka "File Download Extension Spoofing."
CVSS Score: 2.6 (LOW)
References: http://secunia.com/Internet_Explorer_File_Download_Extension_Spoofing_Test/; http://secunia.com/advisories/10760; http://www.opera.com/docs/changelogs/windows/750b1/
CVE: CVE-2004-2088
Published: 2004-02-12
Description: Sophos Anti-Virus 3.78 allows remote attackers to bypass virus scanning by using a qmail generated Delivery Status Notification (DSN) where the original email is not included in the bounce message.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/10855; http://securitytracker.com/id?1009042; http://www.securityfocus.com/bid/9650
CVE: CVE-2004-2082
Published: 2004-02-13
Description: The samiftp.dll library in Sami FTP Server 1.1.3 allows remote authenticated users to cause a denial of service (pmsystem.exe crash) via a GET request wit a large number of leading "/" (slash) characters.
CVSS Score: 5.0 (MEDIUM)
References: http://www.karja.com/samiftp/news.html; http://www.securityfocus.com/archive/1/353753; http://www.securityfocus.com/bid/9657
CVE: CVE-2004-1180
Published: 2004-02-16
Description: Unknown vulnerability in the rwho daemon (rwhod) before 0.17, on little endian architectures, allows remote attackers to cause a denial of service (application crash).
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/14309; http://www.debian.org/security/2005/dsa-678; http://www.mandriva.com/security/advisories?name=MDKSA-2005:039
CVE: CVE-2003-0700
Published: 2004-02-17
Description: The C-Media PCI sound driver in Linux before 2.4.22 does not use the get_user function to access userspace in certain conditions, which crosses security boundaries and may facilitate the exploitation of vulnerabilities, a different vulnerability than CVE-2003-0699.
CVSS Score: 7.5 (HIGH)
References: http://www.redhat.com/support/errata/RHSA-2003-238.html; http://www.redhat.com/support/errata/RHSA-2004-044.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A401
CVE: CVE-2003-0819
Published: 2004-02-17
Description: Buffer overflow in the H.323 filter of Microsoft Internet Security and Acceleration Server 2000 allows remote attackers to execute arbitrary code in the Microsoft Firewall Service via certain H.323 traffic, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/10611; http://www.cert.org/advisories/CA-2004-01.html; http://www.kb.cert.org/vuls/id/749342
CVE: CVE-2003-0903
Published: 2004-02-17
Description: Buffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a malformed UDP response to a broadcast request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/139150; http://www.osvdb.org/3457; http://www.securityfocus.com/bid/9407
CVE: CVE-2003-0924
Published: 2004-02-17
Description: netpbm 9.25 and earlier does not properly create temporary files, which allows local users to overwrite arbitrary files.
CVSS Score: 3.7 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20040201-01-U.asc; http://www.debian.org/security/2004/dsa-426; http://www.gentoo.org/security/en/glsa/glsa-200410-02.xml
CVE: CVE-2003-0965
Published: 2004-02-17
Description: Cross-site scripting (XSS) vulnerability in the admin CGI script for Mailman before 2.1.4 allows remote attackers to steal session cookies and conduct unauthorized activities.
CVSS Score: 6.8 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000842; http://mail.python.org/pipermail/mailman-announce/2003-December/000066.html; http://secunia.com/advisories/10519
CVE: CVE-2003-0966
Published: 2004-02-17
Description: Buffer overflow in the frm command in elm 2.5.6 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code via a long Subject line.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20040103-01-U.asc; http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=112078; http://www.redhat.com/support/errata/RHSA-2004-009.html
CVE: CVE-2003-0988
Published: 2004-02-17
Description: Buffer overflow in the VCF file information reader for KDE Personal Information Management (kdepim) suite in KDE 3.1.0 through 3.1.4 allows attackers to execute arbitrary code via a VCF file.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000810; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7906&w=2; http://security.gentoo.org/glsa/glsa-200404-02.xml
CVE: CVE-2003-0989
Published: 2004-02-17
Description: tcpdump before 3.8.1 allows remote attackers to cause a denial of service (infinite loop) via certain ISAKMP packets, a different vulnerability than CVE-2004-0057.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2004-008.0.txt; ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2004.9/SCOSA-2004.9.txt; ftp://patches.sgi.com/support/free/security/advisories/20040103-01-U.asc
CVE: CVE-2003-0992
Published: 2004-02-17
Description: Cross-site scripting (XSS) vulnerability in the create CGI script for Mailman before 2.1.3 allows remote attackers to steal cookies of other users.
CVSS Score: 4.3 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000842; http://mail.python.org/pipermail/mailman-announce/2003-September/000061.html; http://www.mandriva.com/security/advisories?name=MDKSA-2004:013
CVE: CVE-2003-1029
Published: 2004-02-17
Description: The L2TP protocol parser in tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (infinite loop and memory consumption) via a packet with invalid data to UDP port 1701, which causes l2tp_avp_print to use a bad length value when calling print_octets.
CVSS Score: 5.0 (MEDIUM)
References: http://lwn.net/Alerts/66805/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8533&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4985&w=2
CVE: CVE-2003-1030
Published: 2004-02-17
Description: Buffer overflow in DameWare Mini Remote Control before 3.73 allows remote attackers to execute arbitrary code via a long pre-authentication request to TCP port 6129.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9279&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7266&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5840&w=2
CVE: CVE-2003-1031
Published: 2004-02-17
Description: Cross-site scripting (XSS) vulnerability in register.php for vBulletin 3.0 Beta 2 allows remote attackers to inject arbitrary HTML or web script via optional fields such as (1) "Interests-Hobbies", (2) "Biography", or (3) "Occupation."
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0078.html; http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0078.html
CVE: CVE-2003-1032
Published: 2004-02-17
Description: Pi3Web web server 2.0.2 Beta 1, when the Directory Index is configured to use the "Name" column and sort using the column title as a hyperlink, allows remote attackers to cause a denial of service (crash) via a malformed URL to the web server, possibly involving a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9100&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8325&w=2; http://securitytracker.com/id?1006913
CVE: CVE-2004-0001
Published: 2004-02-17
Description: Unknown vulnerability in the eflags checking in the 32-bit ptrace emulation for the Linux kernel on AMD64 systems allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://security.gentoo.org/glsa/glsa-200402-06.xml; http://www.kb.cert.org/vuls/id/337238; http://www.redhat.com/support/errata/RHSA-2004-017.html
CVE: CVE-2004-0004
Published: 2004-02-17
Description: The libCheckSignature function in crypto-utils.lib for OpenCA 0.9.1.6 and earlier only compares the serial of the signer's certificate and the one in the database, which can cause OpenCA to incorrectly accept a signature if the certificate's chain is trusted by OpenCA's chain directory, allowing remote attackers to spoof requests from other users.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0554&w=2; http://www.kb.cert.org/vuls/id/336446; http://www.openca.org/news/CAN-2004-0004.txt