deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-1449
Published: 2004-12-31
Description: Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7 allows remote attackers to determine the location of files on a user's hard drive by obscuring a file upload control and tricking the user into dragging text into that control.
CVSS Score: 2.6 (LOW)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=206859#c0; http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:082; http://bugzilla.mozilla.org/show_bug.cgi?id=206859#c0
CVE: CVE-2004-1450
Published: 2004-12-31
Description: Unknown vulnerability in LiveConnect in Mozilla 1.7 beta allows remote attackers to read arbitrary files in known locations.
CVSS Score: 5.0 (MEDIUM)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=239122; http://www.mozilla.org/projects/security/known-vulnerabilities.html; http://bugzilla.mozilla.org/show_bug.cgi?id=239122
CVE: CVE-2004-1451
Published: 2004-12-31
Description: Mozilla before 1.6 does not display the entire URL in the status bar when a link contains %00, which could allow remote attackers to trick users into clicking on unknown or untrusted sites and facilitate phishing attacks.
CVSS Score: 2.6 (LOW)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=228176; http://secunia.com/advisories/10419/; http://www.mozilla.org/projects/security/known-vulnerabilities.html
CVE: CVE-2004-1452
Published: 2004-12-31
Description: Tomcat before 5.0.27-r3 in Gentoo Linux sets the default permissions on the init scripts as tomcat:tomcat, but executes the scripts with root privileges, which could allow local users in the tomcat group to execute arbitrary commands as root by modifying the scripts.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/12296/; http://www.gentoo.org/security/en/glsa/glsa-200408-15.xml; http://www.securityfocus.com/bid/10951
CVE: CVE-2004-1453
Published: 2004-12-31
Description: GNU glibc 2.3.4 before 2.3.4.20040619, 2.3.3 before 2.3.3.20040420, and 2.3.2 before 2.3.2-r10 does not restrict the use of LD_DEBUG for a setuid program, which allows local users to gain sensitive information, such as the list of symbols used by the program.
CVSS Score: 2.1 (LOW)
References: http://bugs.gentoo.org/show_bug.cgi?id=59526; http://secunia.com/advisories/12306; http://www.gentoo.org/security/en/glsa/glsa-200408-16.xml
CVE: CVE-2004-1454
Published: 2004-12-31
Description: Cisco IOS 12.0S, 12.2, and 12.3, with Open Shortest Path First (OSPF) enabled, allows remote attackers to cause a denial of service (device reload) via a malformed OSPF packet.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/12322; http://www.ciac.org/ciac/bulletins/o-199.shtml; http://www.cisco.com/warp/public/707/cisco-sa-20040818-ospf.shtml
CVE: CVE-2004-1455
Published: 2004-12-31
Description: Stack-based buffer overflow in Xine-lib-rc5 in xine-lib 1_rc5-r2 and earlier allows remote attackers to execute arbitrary code via crafted playlists that result in a long vcd:// URL.
CVSS Score: 5.1 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8045&w=2; http://open-security.org/advisories/6; http://secunia.com/advisories/12194/
CVE: CVE-2004-1456
Published: 2004-12-31
Description: filediff in CVStrac allows remote attackers to execute arbitrary commands via shell metacharacters in rcsinfo.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8253&w=2; http://secunia.com/advisories/12090/; http://www.cvstrac.org/cvstrac/chngview?cn=316
CVE: CVE-2004-1457
Published: 2004-12-31
Description: The Virtual Private Network (VPN) capability in Novell Bordermanager 3.8 allows remote attackers to cause a denial of service (ABEND in IKE.NLM) via a malformed IKE packet, as sent by the Striker ISAKMP Protocol Test Suite.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/12067/; http://support.novell.com/cgi-bin/search/searchtid.cgi?/10093576.htm; http://www.kb.cert.org/vuls/id/432097
CVE: CVE-2004-1458
Published: 2004-12-31
Description: The CSAdmin web administration interface for Cisco Secure Access Control Server (ACS) 3.2(2) build 15 allows remote attackers to cause a denial of service (hang) via a flood of TCP connections to port 2002.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/9182; http://secunia.com/advisories/12386/; http://www.ciac.org/ciac/bulletins/o-203.shtml
CVE: CVE-2004-1459
Published: 2004-12-31
Description: Cisco Secure Access Control Server (ACS) 3.2, when configured as a Light Extensible Authentication Protocol (LEAP) RADIUS proxy, allows remote attackers to cause a denial of service (device crash) via certain LEAP authentication requests.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/cisco-sa-20040825-acs.shtml; http://www.securityfocus.com/bid/11047; https://exchange.xforce.ibmcloud.com/vulnerabilities/17116
CVE: CVE-2004-1460
Published: 2004-12-31
Description: Cisco Secure Access Control Server (ACS) 3.2(3) and earlier, when configured with an anonymous bind in Novell Directory Services (NDS) and authenticating NDS users with NDS, allows remote attackers to gain unauthorized access to AAA clients via a blank password.
CVSS Score: 7.5 (HIGH)
References: http://www.cisco.com/warp/public/707/cisco-sa-20040825-acs.shtml; http://www.securityfocus.com/bid/11047; https://exchange.xforce.ibmcloud.com/vulnerabilities/17117
CVE: CVE-2004-1461
Published: 2004-12-31
Description: Cisco Secure Access Control Server (ACS) 3.2(3) and earlier spawns a separate unauthenticated TCP connection on a random port when a user authenticates to the ACS GUI, which allows remote attackers to bypass authentication by connecting to that port from the same IP address.
CVSS Score: 7.5 (HIGH)
References: http://www.cisco.com/warp/public/707/cisco-sa-20040825-acs.shtml; http://www.securityfocus.com/bid/11047; https://exchange.xforce.ibmcloud.com/vulnerabilities/17118
CVE: CVE-2004-1462
Published: 2004-12-31
Description: Unknown vulnerability in MoinMoin 1.2.2 and earlier allows remote attackers to gain unauthorized access to administrator functions such as (1) revert and (2) delete.
CVSS Score: 7.5 (HIGH)
References: http://www.gentoo.org/security/en/glsa/glsa-200408-25.xml; http://www.osvdb.org/displayvuln.php?osvdb_id=8194; http://www.securityfocus.com/bid/10805
CVE: CVE-2004-1463
Published: 2004-12-31
Description: Unknown vulnerability in the PageEditor in MoinMoin 1.2.2 and earlier, related to Access Control Lists (ACL), has unknown impact.
CVSS Score: 10.0 (HIGH)
References: http://sourceforge.net/project/shownotes.php?group_id=8482&release_id=254801; http://www.gentoo.org/security/en/glsa/glsa-200408-25.xml; http://www.osvdb.org/displayvuln.php?osvdb_id=8195
CVE: CVE-2004-1464
Published: 2004-12-31
Description: Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection to the Telnet or reverse Telnet port.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400, CWE-400
References: http://secunia.com/advisories/12395/; http://securitytracker.com/id?1011079; http://www.cisco.com/warp/public/707/cisco-sa-20040827-telnet.shtml
CVE: CVE-2004-1465
Published: 2004-12-31
Description: Multiple buffer overflows in WinZip 9.0 and earlier may allow attackers to execute arbitrary code via multiple vectors, including the command line.
CVSS Score: 3.7 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1369&w=2; http://securitytracker.com/id?1011132; http://www.ciac.org/ciac/bulletins/o-211.shtml
CVE: CVE-2004-1466
Published: 2004-12-31
Description: The set_time_limit function in Gallery before 1.4.4_p2 deletes non-image files in a temporary directory every 30 seconds after they have been uploaded using save_photos.php, which allows remote attackers to upload and execute execute arbitrary scripts before they are deleted, if the temporary directory is under the web root.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0757.html; http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=134&mode=thread&order=0&thold=0; http://www.gentoo.org/security/en/glsa/glsa-200409-05.xml
CVE: CVE-2004-1467
Published: 2004-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in eGroupWare 1.0.00.003 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) date or search text field in the calendar module, (2) Field parameter, Filter parameter, QField parameter, Start parameter or Search field in the address module, (3) Subject field in the message module or (4) Subject field in the Ticket module.
CVSS Score: 4.3 (MEDIUM)
References: http://sourceforge.net/forum/forum.php?forum_id=401807; http://www.gentoo.org/security/en/glsa/glsa-200409-06.xml; http://www.securityfocus.com/archive/1/372603
CVE: CVE-2004-1468
Published: 2004-12-31
Description: The web mail functionality in Usermin 1.x and Webmin 1.x allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail message.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/12488/; http://www.gentoo.org/security/en/glsa/glsa-200409-15.xml; http://www.lac.co.jp/security/csl/intelligence/SNSadvisory_e/77_e.html
CVE: CVE-2004-1469
Published: 2004-12-31
Description: Format string vulnerability in the log function in SUS 2.0.2, and other versions before 2.0.6, allows local users to execute arbitrary code via format string specifiers in a command line argument that is passed directly to syslog.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0407&w=2; http://pdg.uow.edu.au/sus/CHANGES; http://security.lss.hr/index.php?page=details&ID=LSS-2004-09-01
CVE: CVE-2004-1470
Published: 2004-12-31
Description: CRLF injection vulnerability in SnipSnap 0.5.2a, and other versions before 1.0b1, allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3511&w=2; http://www.gentoo.org/security/en/glsa/glsa-200409-23.xml; http://www.securityfocus.com/bid/11180
CVE: CVE-2004-1471
Published: 2004-12-31
Description: Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.
CVSS Score: 7.1 (HIGH)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:14.cvs.asc; http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/022441.html; http://security.e-matters.de/advisories/092004.html
CVE: CVE-2004-1472
Published: 2004-12-31
Description: Symantec Enterprise Firewall/VPN Appliances 100, 200, and 200R running firmware before 1.63 allow remote attackers to cause a denial of service (device freeze) via a fast UDP port scan on the WAN interface.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6070&w=2; http://secunia.com/advisories/12635; http://securityresponse.symantec.com/avcenter/security/Content/2004.09.22.html
CVE: CVE-2004-1473
Published: 2004-12-31
Description: Symantec Enterprise Firewall/VPN Appliances 100, 200, and 200R running firmware before 1.63 and Gateway Security 320, 360, and 360R running firmware before 622 allow remote attackers to bypass filtering and determine whether the device is running services such as tftpd, snmpd, or isakmp via a UDP port scan with a source port of UDP 53.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6070&w=2; http://secunia.com/advisories/12635; http://securityresponse.symantec.com/avcenter/security/Content/2004.09.22.html
CVE: CVE-2004-1474
Published: 2004-12-31
Description: Symantec Enterprise Firewall/VPN Appliances 100, 200, and 200R running firmware before 1.63 and Gateway Security 320, 360, and 360R running firmware before 622 uses a default read/write SNMP community string, which allows remote attackers to alter the firewall's configuration file.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6070&w=2; http://secunia.com/advisories/12635; http://securityresponse.symantec.com/avcenter/security/Content/2004.09.22.html
CVE: CVE-2004-1475
Published: 2004-12-31
Description: Multiple stack-based buffer overflows in xine-lib 1-rc2 through 1-rc5 allow attackers to execute arbitrary code via (1) long VideoCD vcd:// MRLs or (2) long subtitle lines.
CVSS Score: 5.1 (MEDIUM)
References: http://security.gentoo.org/glsa/glsa-200408-18.xml; http://www.gentoo.org/security/en/glsa/glsa-200409-30.xml; http://www.securityfocus.com/archive/1/375485/2004-09-02/2004-09-08/0
CVE: CVE-2004-1476
Published: 2004-12-31
Description: Stack-based buffer overflow in the VideoCD (VCD) code in xine-lib 1-rc2 through 1-rc5, as derived from libcdio, allows attackers to execute arbitrary code via a VideoCD with an unterminated disk label.
CVSS Score: 5.1 (MEDIUM)
References: http://www.gentoo.org/security/en/glsa/glsa-200409-30.xml; http://www.securityfocus.com/archive/1/375485/2004-09-02/2004-09-08/0; http://www.securityfocus.com/bid/11206
CVE: CVE-2004-1477
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in the Management Console in JRun 4.0 allows remote attackers to execute arbitrary web script or HTML and possibly hijack a user's session.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3823&w=2; http://secunia.com/advisories/12638/; http://www.kb.cert.org/vuls/id/668206
CVE: CVE-2004-1478
Published: 2004-12-31
Description: JRun 4.0 does not properly generate and handle the JSESSIONID, which allows remote attackers to perform a session fixation attack and hijack a user's HTTP session.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3823&w=2; http://secunia.com/advisories/12638/; http://www.kb.cert.org/vuls/id/584958
CVE: CVE-2004-1479
Published: 2004-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2004-0928.  Reason: This candidate is a duplicate of CVE-2004-0928.  Notes: All CVE users should reference CVE-2004-0928 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2004-1480
Published: 2004-12-31
Description: Unknown vulnerability in the management station in HP StorageWorks Command View XP 1.8B and earlier allows remote attackers to bypass access restrictions.
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=PSD_HPSBST01071; http://securitytracker.com/id?1011407; http://www.securityfocus.com/bid/11249
CVE: CVE-2004-1481
Published: 2004-12-31
Description: Integer overflow in pnen3260.dll in RealPlayer 8 through 10.5 (6.0.12.1040) and earlier, and RealOne Player 1 or 2 on Windows or Mac OS, allows remote attackers to execute arbitrary code via a SMIL file and a .rm movie file with a large length field for the data chunk, which leads to a heap-based buffer overflow.
CVSS Score: 5.1 (MEDIUM)
References: http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]5061&w=2; http://secunia.com/advisories/12672; http://www.securityfocus.com/bid/11309
CVE: CVE-2004-1482
Published: 2004-12-31
Description: The sbuf_getmsg function in BNC incorrectly handles backspace characters, which could allow remote attackers to bypass authentication and gain access to arbitrary scripts.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/12770/; http://www.gentoo.org/security/en/glsa/glsa-200410-13.xml; http://www.gotbnc.com/changes.html#2.8.9
CVE: CVE-2004-1483
Published: 2004-12-31
Description: Multiple unknown vulnerabilities in the ActiveX and HTML file browsers in Symantec Clientless VPN Gateway 4400 Series 5.0 have unknown attack vectors and unknown impact.
CVSS Score: 10.0 (HIGH)
References: ftp://ftp.symantec.com/public/english_us_canada/products/sym_clientless_vpn/sym_clientless_vpn_5/updates/hf3-readme.txt; http://secunia.com/advisories/12254/; http://www.kb.cert.org/vuls/id/760256
CVE: CVE-2004-1484
Published: 2004-12-31
Description: Format string vulnerability in the _msg function in error.c in socat 1.4.0.3 and earlier, when used as an HTTP proxy client and run with the -ly option, allows remote attackers or local users to execute arbitrary code via format string specifiers in a syslog message.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/12936/; http://www.dest-unreach.org/socat/advisory/socat-adv-1.html; http://www.gentoo.org/security/en/glsa/glsa-200410-26.xml
CVE: CVE-2004-1485
Published: 2004-12-31
Description: Buffer overflow in the TFTP client in InetUtils 1.4.2 allows remote malicious DNS servers to execute arbitrary code via a large DNS response that is handled by the gethostbyname function.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2915&w=2; http://www.securityfocus.com/bid/11527; https://exchange.xforce.ibmcloud.com/vulnerabilities/17878
CVE: CVE-2004-1486
Published: 2004-12-31
Description: Unknown vulnerability in Serviceguard A.11.13 through A.11.16.00 and Cluster Object Manager A.01.03 and B.01.04 through B.03.00.01 on HP-UX, Serviceguard A.11.14.04 and A.11.15.04 and Cluster Object Manager B.02.01.02 and B.02.02.02 on HP Linux, allow remote attackers to gain privileges via unknown attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4267&w=2; http://secunia.com/advisories/12946; http://www.securityfocus.com/bid/11507
CVE: CVE-2004-1489
Published: 2004-12-31
Description: Opera 7.54 and earlier does not properly limit an applet's access to internal Java packages from Sun, which allows remote attackers to gain sensitive information, such as user names and the installation directory.
CVSS Score: 2.6 (LOW)
CWE: CWE-668
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/029044.html; http://www.gentoo.org/security/en/glsa/glsa-200502-17.xml; http://www.opera.com/linux/changelogs/754u1/
CVE: CVE-2004-1490
Published: 2004-12-31
Description: Opera 7.54 and earlier allows remote attackers to spoof file types in the download dialog via dots and non-breaking spaces (ASCII character code 160) in the (1) Content-Disposition or (2) Content-Type headers.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/12981; http://secunia.com/secunia_research/2004-19/advisory/; http://www.gentoo.org/security/en/glsa/glsa-200502-17.xml
CVE: CVE-2004-1491
Published: 2004-12-31
Description: Opera 7.54 and earlier uses kfmclient exec to handle unknown MIME types, which allows remote attackers to execute arbitrary code via a shortcut or launcher that contains an Exec entry.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.suse.com/archive/suse-security-announce/2005-Mar/0007.html; http://secunia.com/advisories/13447/; http://www.gentoo.org/security/en/glsa/glsa-200502-17.xml
CVE: CVE-2004-1492
Published: 2004-12-31
Description: Master of Orion III 1.2.5 and earlier allows remote attackers to cause a denial of service (game exit) via a data packet that contains a large size specifier, which causes a large memory allocation to fail.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6038&w=2; http://secunia.com/advisories/13008; http://www.securityfocus.com/bid/11550
CVE: CVE-2004-1493
Published: 2004-12-31
Description: Master of Orion III 1.2.5 and earlier allows remote attackers to cause a denial of service (server crash) via multiple connections with long nicknames, possibly triggering a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6038&w=2; http://packetstormsecurity.nl/0410-advisories/masterOrionIII.txt; http://secunia.com/advisories/13008
CVE: CVE-2004-1494
Published: 2004-12-31
Description: Buffer overflow in the Screen Fetch option in XDICT 2002 through 2005 allows remote attackers to cause a denial of service ( CPU consumption or application exit) and possibly execute arbitrary code via a long string.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/028241.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1725&w=2; http://secway.org/Advisory/Ad20041026EN.txt
CVE: CVE-2004-1495
Published: 2004-12-31
Description: The Repair Archive command in WinRAR 3.40 allows remote attackers to cause a denial of service (application crash) via a corrupt ZIP archive.
CVSS Score: 2.6 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2699&w=2; http://secunia.com/advisories/13070; http://www.rarlabs.com/rarnew.htm
CVE: CVE-2004-1496
Published: 2004-12-31
Description: Directory traversal vulnerability in Web Forums Server 1.6 and 2.0 Power Pack allows remote attackers to read arbitrary files via a URL containing (1) "..\" (dot dot backslash), (2) "../" (dot dot slash), (3) "/%2E%2E%5C" (encoded dot dot backslash), or (4) "%2E%2E%2F" (encoded dot dot slash).
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8552&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8552&w=2
CVE: CVE-2004-1497
Published: 2004-12-31
Description: Web Forums Server 1.6 and 2.0 Power Pack stores passwords in plaintext in the Username.ini file, which allows local users to gain privileges.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8552&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8552&w=2
CVE: CVE-2004-1498
Published: 2004-12-31
Description: SQL injection vulnerability in the compose message form in HELM 3.1.19 and earlier allows remote attackers to execute arbitrary SQL commands via the messageToUserAccNum parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6542&w=2; http://secunia.com/advisories/13079; http://www.hat-squad.com/en/000077.html
CVE: CVE-2004-1499
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in the compose message form in HELM 3.1.19 and earlier allows remote attackers to execute arbitrary web script or HTML via the Subject field.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6542&w=2; http://secunia.com/advisories/13079; http://www.hat-squad.com/en/000077.html
CVE: CVE-2004-1500
Published: 2004-12-31
Description: Format string vulnerability in the Lithtech engine, as used in multiple games, allows remote authenticated users to cause a denial of service (application crash) via format string specifiers in (1) a nickname or (2) a message.
CVSS Score: 2.1 (LOW)
References: http://aluigi.altervista.org/adv/lithfs-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1331&w=2; http://secunia.com/advisories/13116/
CVE: CVE-2004-1501
Published: 2004-12-31
Description: The webmail service in 602 Lan Suite 2004.0.04.0909 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) by sending a POST request with a large Content-Length value, then disconnecting without sending that amount of data.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7459&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/17977; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7459&w=2
CVE: CVE-2004-1502
Published: 2004-12-31
Description: The Telnet proxy in 602 Lan Suite 2004.0.04.0909 and earlier allows remote attackers to cause a denial of service (socket exhaustion) via a Telnet request to an IP address of the proxy's network interface, which causes a loop.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7459&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/17979; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7459&w=2
CVE: CVE-2004-1503
Published: 2004-12-31
Description: Integer overflow in the InitialDirContext in Java Runtime Environment (JRE) 1.4.2, 1.5.0 and possibly other versions allows remote attackers to cause a denial of service (Java exception and failed DNS requests) via a large number of DNS requests, which causes the xid variable to wrap around and become negative.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1773&w=2; http://secunia.com/advisories/13142; http://www.securityfocus.com/bid/11619