deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-0590
Published: 2004-12-06
Description: FreeS/WAN 1.x and 2.x, and other related products including superfreeswan 1.x, openswan 1.x before 1.0.6, openswan 2.x before 2.1.4, and strongSwan before 2.1.3, allows remote attackers to authenticate using spoofed PKCS#7 certificates in which a self-signed certificate identifies an alternate Certificate Authority (CA) and spoofed issuer and subject.
CVSS Score: 10.0 (HIGH)
References: http://security.gentoo.org/glsa/glsa-200406-20.xml; http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:070; http://www.openswan.org/support/vuln/can-2004-0590/
CVE: CVE-2004-0602
Published: 2004-12-06
Description: The binary compatibility mode for FreeBSD 4.x and 5.x does not properly handle certain Linux system calls, which could allow local users to access kernel memory to gain privileges or cause a system panic.
CVSS Score: 2.1 (LOW)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:13.linux.asc; http://www.securityfocus.com/bid/10643; https://exchange.xforce.ibmcloud.com/vulnerabilities/16558
CVE: CVE-2004-0603
Published: 2004-12-06
Description: gzexe in gzip 1.3.3 and earlier will execute an argument when the creation of a temp file fails instead of exiting the program, which could allow remote attackers or local users to execute arbitrary commands, a different vulnerability than CVE-1999-1332.
CVSS Score: 10.0 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=54890; http://security.gentoo.org/glsa/glsa-200406-18.xml; http://www.securityfocus.com/bid/10603
CVE: CVE-2004-0604
Published: 2004-12-06
Description: The HTTP client and server in giFT-FastTrack 0.8.6 and earlier allows remote attackers to cause a denial of service (crash), possibly via an empty search query, which triggers a NULL dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://developer.berlios.de/bugs/?func=detailbug&bug_id=1573&group_id=809; http://gift-fasttrack.berlios.de/; http://secunia.com/advisories/11941/
CVE: CVE-2004-0605
Published: 2004-12-06
Description: Non-registered IRC users using (1) ircd-hybrid 7.0.1 and earlier, (2) ircd-ratbox 1.5.1 and earlier, or (3) ircd-ratbox 2.0rc6 and earlier do not have a rate-limit imposed, which could allow remote attackers to cause a denial of service by repeatedly making requests, which are slowly dequeued.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7406&w=2; http://www.securityfocus.com/bid/10572; https://exchange.xforce.ibmcloud.com/vulnerabilities/16457
CVE: CVE-2004-0606
Published: 2004-12-06
Description: Cross-site scripting (XSS) vulnerability in Infoblox DNS One running firmware 2.4.0-8 and earlier allows remote attackers to execute arbitrary scripts as other users via the (1) CLIENTID or (2) HOSTNAME option of a DHCP request.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5349&w=2; http://www.securityfocus.com/bid/10573; https://exchange.xforce.ibmcloud.com/vulnerabilities/16456
CVE: CVE-2004-0607
Published: 2004-12-06
Description: The eay_check_x509cert function in KAME Racoon successfully verifies certificates even when OpenSSL validation fails, which could allow remote attackers to bypass authentication.
CVSS Score: 10.0 (HIGH)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.10/SCOSA-2005.10.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4507&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6033&w=2
CVE: CVE-2004-0608
Published: 2004-12-06
Description: The Unreal Engine, as used in DeusEx 1.112fm and earlier, Devastation 390 and earlier, Mobile Forces 20000 and earlier, Nerf Arena Blast 1.2 and earlier, Postal 2 1337 and earlier, Rune 107 and earlier, Tactical Ops 3.4.0 and earlier, Unreal 1 226f and earlier, Unreal II XMP 7710 and earlier, Unreal Tournament 451b and earlier, Unreal Tournament 2003 2225 and earlier, Unreal Tournament 2004 before 3236, Wheel of Time 333b and earlier, and X-com Enforcer, allows remote attackers to execute arbitrary code via a UDP packet containing a secure query with a long value, which overwrites memory.
CVSS Score: 10.0 (HIGH)
References: http://aluigi.altervista.org/adv/unsecure-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3304&w=2; http://www.gentoo.org/security/en/glsa/glsa-200407-14.xml
CVE: CVE-2004-0609
Published: 2004-12-06
Description: rssh 2.0 through 2.1.x expands command line arguments before entering a chroot jail, which allows remote authenticated users to determine the existence of files in a directory outside the jail.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2844&w=2; http://www.securityfocus.com/bid/10574; https://exchange.xforce.ibmcloud.com/vulnerabilities/16470
CVE: CVE-2004-0610
Published: 2004-12-06
Description: The Web administration interface in Microsoft MN-500 Wireless Router allows remote attackers to cause a denial of service (connection refusal) via a large number of open HTTP connections.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1258&w=2; http://www.kurczaba.com/securityadvisories/0406213.htm; http://www.securityfocus.com/bid/10585
CVE: CVE-2004-0611
Published: 2004-12-06
Description: Web-Based Administration in Netgear FVS318 VPN Router allows remote attackers to cause a denial of service (no new connections) via a large number of open HTTP connections.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1059&w=2; http://www.securityfocus.com/bid/10585; https://exchange.xforce.ibmcloud.com/vulnerabilities/16462
CVE: CVE-2004-0612
Published: 2004-12-06
Description: The Mobile Code filter in ZoneAlarm Pro 5.0.590.015 does not filter mobile code within an SSL encrypted session, which could allow remote attackers to bypass the mobile code filtering.  NOTE: it has been disputed by the vendor that this behavior is required by the SSL specification.
CVSS Score: 5.1 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-06/0420.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8208&w=2; http://www.securityfocus.com/bid/10584
CVE: CVE-2004-0613
Published: 2004-12-06
Description: osTicket allows remote attackers to view sensitive uploaded files and possibly execute arbitrary code via an HTTP request that uploads a PHP file to the ticket attachments directory.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0957&w=2; http://www.securityfocus.com/bid/10586; https://exchange.xforce.ibmcloud.com/vulnerabilities/16477
CVE: CVE-2004-0614
Published: 2004-12-06
Description: osTicket trusts a hidden form field in the submit form to limit the upload size of a document, which could allow remote attackers to upload a file of any size.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0957&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/16477; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0957&w=2
CVE: CVE-2004-0615
Published: 2004-12-06
Description: Cross-site scripting (XSS) vulnerability in D-Link DI-614+ SOHO router running firmware 2.30, and DI-704 SOHO router running firmware 2.60B2, and DI-624, allows remote attackers to inject arbitrary script or HTML via the DHCP HOSTNAME option in a DHCP request.
CVSS Score: 5.1 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-07/0014.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9932&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7182&w=2
CVE: CVE-2004-0616
Published: 2004-12-06
Description: The BT Voyager 2000 Wireless ADSL Router has a default public SNMP community name, which allows remote attackers to obtain sensitive information such as the password, which is stored in plaintext.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0710.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9034&w=2; http://www.securityfocus.com/bid/10589
CVE: CVE-2004-0617
Published: 2004-12-06
Description: Cross-site scripting (XSS) vulnerability in ArbitroWeb 0.6 allows remote attackers to inject arbitrary script or HTML via the rawURL parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3244&w=2; http://www.securityfocus.com/bid/10592; https://exchange.xforce.ibmcloud.com/vulnerabilities/16481
CVE: CVE-2004-0618
Published: 2004-12-06
Description: FreeBSD 5.1 for the Alpha processor allows local users to cause a denial of service (crash) via an execve system call with an unaligned memory address as an argument.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2865&w=2; http://www.securityfocus.com/bid/10596; https://exchange.xforce.ibmcloud.com/vulnerabilities/16499
CVE: CVE-2004-0619
Published: 2004-12-06
Description: Integer overflow in the ubsec_keysetup function for Linux Broadcom 5820 cryptonet driver allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a negative add_dsa_buf_bytes variable, which leads to a buffer overflow.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9053&w=2; http://secunia.com/advisories/11936; http://www.ciac.org/ciac/bulletins/p-047.shtml
CVE: CVE-2004-0620
Published: 2004-12-06
Description: Cross-site scripting (XSS) vulnerability in (1) newreply.php or (2) newthread.php in vBulletin 3.0.1 allows remote attackers to inject arbitrary HTML or script as other users via the Edit-panel.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6642&w=2; http://www.securityfocus.com/bid/10602; https://exchange.xforce.ibmcloud.com/vulnerabilities/16502
CVE: CVE-2004-0621
Published: 2004-12-06
Description: admin.php in Newsletter ZWS allows remote attackers to gain administrative privileges via a list_user operation with the ulevel parameter set to 1 (administrator level), which lists all users and their passwords.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5216&w=2; http://www.securityfocus.com/bid/10605; https://exchange.xforce.ibmcloud.com/vulnerabilities/16507
CVE: CVE-2004-0622
Published: 2004-12-06
Description: Apple Mac OS X 10.3.4, 10.4, 10.5, and possibly other versions does not properly clear memory for login (aka Loginwindow.app), Keychain, or FileVault passwords, which could allow the root user or an attacker with physical access to obtain sensitive information by reading memory.
CVSS Score: 2.1 (LOW)
References: http://citp.princeton.edu/pub/coldboot.pdf; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5981&w=2; http://www.securityfocus.com/archive/1/488930/100/100/threaded
CVE: CVE-2004-0623
Published: 2004-12-06
Description: Format string vulnerability in misc.c in GNU GNATS 4.00 may allow remote attackers to execute arbitrary code via format string specifiers in a string that gets logged by syslog.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3191&w=2; http://www.securityfocus.com/bid/10609; https://exchange.xforce.ibmcloud.com/vulnerabilities/16517
CVE: CVE-2004-0624
Published: 2004-12-06
Description: PHP remote file inclusion vulnerability in index.php for Artmedic links 5.0 (artmedic_links5) allows remote attackers to execute arbitrary PHP code by modifying the id parameter to reference a URL on a remote web server that contains the code.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2904&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/16518; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2904&w=2
CVE: CVE-2004-0625
Published: 2004-12-06
Description: SQL injection vulnerability in Infinity WEB 1.0 allows remote attackers to bypass authentication and gain privileges via the login page.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0893.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1959&w=2; http://www.securityfocus.com/bid/10614
CVE: CVE-2004-0626
Published: 2004-12-06
Description: The tcp_find_option function of the netfilter subsystem in Linux kernel 2.6, when using iptables and TCP options rules, allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a large option length that produces a negative integer after a casting operation to the char type.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000852; http://lwn.net/Articles/91964/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4495&w=2
CVE: CVE-2004-0627
Published: 2004-12-06
Description: The check_scramble_323 function in MySQL 4.1.x before 4.1.3, and 5.0, allows remote attackers to bypass authentication via a zero-length scrambled string.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0001.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8205&w=2; http://www.kb.cert.org/vuls/id/184030
CVE: CVE-2004-0628
Published: 2004-12-06
Description: Stack-based buffer overflow in MySQL 4.1.x before 4.1.3, and 5.0, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long scramble string.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0001.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8205&w=2; http://www.kb.cert.org/vuls/id/645326
CVE: CVE-2004-0633
Published: 2004-12-06
Description: The iSNS dissector for Ethereal 0.10.3 through 0.10.4 allows remote attackers to cause a denial of service (process abort) via an integer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=127381; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000916; http://secunia.com/advisories/12024
CVE: CVE-2004-0634
Published: 2004-12-06
Description: The SMB SID snooping capability in Ethereal 0.9.15 to 0.10.4 allows remote attackers to cause a denial of service (process crash) via a handle without a policy name, which causes a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=127381; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000916; http://secunia.com/advisories/12024
CVE: CVE-2004-0635
Published: 2004-12-06
Description: The SNMP dissector in Ethereal 0.8.15 through 0.10.4 allows remote attackers to cause a denial of service (process crash) via a (1) malformed or (2) missing community string, which causes an out-of-bounds read.
CVSS Score: 5.0 (MEDIUM)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=127381; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000916; http://secunia.com/advisories/12024
CVE: CVE-2004-1351
Published: 2004-12-07
Description: Unknown vulnerability in the rwho daemon (in.rwhod) for Solaris 7 through 9 allows remote attackers to execute arbitrary code.
CVSS Score: 10.0 (HIGH)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-57659-1&searchclause=%22category:security%22%20%22availability%2C%20security%22; http://www.auscert.org.au/render.html?it=4597; http://www.ciac.org/ciac/bulletins/p-050.shtml
CVE: CVE-2004-1059
Published: 2004-12-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in mnoGoSearch 3.2.26 and earlier allow remote attackers to inject arbitrary HTML and web script via the (1) next and (2) prev result search pages, and the (3) extended and (4) simple search forms.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-December/030222.html; http://www.mikx.de/index.php?p=6; http://www.mnogosearch.org/history.html
CVE: CVE-2004-1139
Published: 2004-12-15
Description: Unknown vulnerability in the DICOM dissector in Ethereal 0.10.4 through 0.10.7 allows remote attackers to cause a denial of service (application crash).
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000916; http://secunia.com/advisories/13468/; http://www.ciac.org/ciac/bulletins/p-061.shtml
CVE: CVE-2004-1142
Published: 2004-12-15
Description: Ethereal 0.9.0 through 0.10.7 allows remote attackers to cause a denial of service (CPU consumption) via a certain malformed SMB packet.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000916; http://secunia.com/advisories/13468/; http://www.ciac.org/ciac/bulletins/p-061.shtml
CVE: CVE-2004-1145
Published: 2004-12-15
Description: Multiple vulnerabilities in Konqueror in KDE 3.3.1 and earlier (1) allow access to restricted Java classes via JavaScript and (2) do not properly restrict access to certain Java classes from the Java applet, which allows remote attackers to bypass sandbox restrictions and read or write arbitrary files.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2875&w=2; http://secunia.com/advisories/13586; http://www.gentoo.org/security/en/glsa/glsa-200501-16.xml
CVE: CVE-2004-1319
Published: 2004-12-15
Description: The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-12/0167.html; http://freehost07.websamba.com/greyhats/abusiveparent-discussion.htm; http://secunia.com/advisories/13482/
CVE: CVE-2004-1320
Published: 2004-12-15
Description: Asante FM2008 running firmware 1.06 is shipped with a default username and password, which could allow remote attackers to gain unauthorized access.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4864&w=2; http://www.securityfocus.com/bid/11947; https://exchange.xforce.ibmcloud.com/vulnerabilities/18521
CVE: CVE-2004-1321
Published: 2004-12-15
Description: The configuration backup in Asante FM2008 running firmware 1.06 stores the username and password in cleartext, which could allow remote attackers to gain unauthorized access.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4864&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4864&w=2
CVE: CVE-2004-1322
Published: 2004-12-15
Description: Cisco Unity 2.x, 3.x, and 4.x, when integrated with Microsoft Exchange, has several hard coded usernames and passwords, which allows remote attackers to gain unauthorized access and change configuration settings or read outgoing or incoming e-mail messages.
CVSS Score: 7.5 (HIGH)
References: http://www.ciac.org/ciac/bulletins/p-060.shtml; http://www.cisco.com/warp/public/707/cisco-sa-20041215-unity.shtml; http://www.securityfocus.com/bid/11954
CVE: CVE-2004-1333
Published: 2004-12-15
Description: Integer overflow in the vc_resize function in the Linux kernel 2.4 and 2.6 before 2.6.10 allows local users to cause a denial of service (kernel crash) via a short new screen value, which leads to a buffer overflow.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/17826; http://secunia.com/advisories/20162; http://secunia.com/advisories/20163
CVE: CVE-2004-1334
Published: 2004-12-15
Description: Integer overflow in the ip_options_get function in the Linux kernel before 2.6.10 allows local users to cause a denial of service (kernel crash) via a cmsg_len that contains a -1, which leads to a buffer overflow.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1524&w=2; http://www.guninski.com/where_do_you_want_billg_to_go_today_2.html; http://www.securityfocus.com/bid/11956
CVE: CVE-2004-1335
Published: 2004-12-15
Description: Memory leak in the ip_options_get function in the Linux kernel before 2.6.10 allows local users to cause a denial of service (memory consumption) by repeatedly calling the ip_cmsg_send function.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1524&w=2; http://secunia.com/advisories/20163; http://secunia.com/advisories/20202
CVE: CVE-2004-1323
Published: 2004-12-16
Description: Multiple syscalls in the compat subsystem for NetBSD before 2.0 allow local users to cause a denial of service (kernel crash) via a large signal number to (1) xxx_sys_kill, (2) xxx_sys_sigaction, and possibly other translation functions.
CVSS Score: 2.1 (LOW)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-010.txt.asc; http://gleg.net/advisory_netbsd2.shtml; http://secunia.com/advisories/13501/
CVE: CVE-2004-1768
Published: 2004-12-17
Description: The character converters in the Spamhunter and Language ID modules for Symantec Brightmail AntiSpam 6.0.1 before patch 132 allow remote attackers to cause a denial of service (crash) via messages with the ISO-8859-10 character set, which is not recognized by the converters.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.symantec.com/public/english_us_canada/products/sba/sba_60x/updates/p132_notes.htm; http://secunia.com/advisories/13489; http://www.kb.cert.org/vuls/id/697598
CVE: CVE-2004-1324
Published: 2004-12-18
Description: The Microsoft Windows Media Player 9.0 ActiveX control may allow remote attackers to execute arbitrary web script in the Local computer zone via the (1) artist or (2) song fields of a music file, if the file is processed using Internet Explorer.
CVSS Score: 2.6 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1306&w=2; http://www.securityfocus.com/bid/12031; https://exchange.xforce.ibmcloud.com/vulnerabilities/18576
CVE: CVE-2004-1325
Published: 2004-12-18
Description: The getItemInfoByAtom function in the ActiveX control for Microsoft Windows Media Player 9.0 returns a 0 if the file does not exist and the size of the file if the file exists, which allows remote attackers to determine the existence of files on the local system.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1306&w=2; http://www.securityfocus.com/bid/12032; https://exchange.xforce.ibmcloud.com/vulnerabilities/18587
CVE: CVE-2004-1374
Published: 2004-12-18
Description: Multiple buffer overflows in NetBSD kernel may allow local users to execute arbitrary code and gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://gleg.net/advisory_netbsd2.shtml; http://gleg.net/advisory_netbsd2.shtml
CVE: CVE-2004-0852
Published: 2004-12-20
Description: Buffer overflow in htget 0.93 allows remote attackers to execute arbitrary code via a crafted URL.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/13579; http://www.debian.org/security/2004/dsa-611; https://exchange.xforce.ibmcloud.com/vulnerabilities/18603
CVE: CVE-2004-1326
Published: 2004-12-20
Description: Buffer overflow in dxterm in Ultrix 4.5 allows local users to execute arbitrary code via a long -setup parameter.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9424&w=2; http://www.frsirt.com/exploits/20041220.ultrix_dxterm_4.5_exploit.c.php; http://www.securityfocus.com/bid/12049
CVE: CVE-2004-1329
Published: 2004-12-20
Description: Untrusted execution path vulnerability in the diag commands (1) lsmcode, (2) diag_exec, (3) invscout, and (4) invscoutd in AIX 5.1 through 5.3 allows local users to execute arbitrary programs by modifying the DIAGNOSTICS environment variable to point to a malicious Dctrl program.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0123&w=2; http://www-1.ibm.com/support/search.wss?rs=0&q=IY64277&apar=only; http://www-1.ibm.com/support/search.wss?rs=0&q=IY64389&apar=only
CVE: CVE-2004-0452
Published: 2004-12-21
Description: Race condition in the rmtree function in the File::Path module in Perl 5.6.1 and 5.8.4 sets read/write permissions for the world, which allows local users to delete arbitrary files and directories, and possibly read files and directories, via a symlink attack.
CVSS Score: 2.6 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U; http://fedoranews.org/updates/FEDORA--.shtml; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9788&w=2