deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-0078
Published: 2004-03-03
Description: Buffer overflow in the index menu code (menu_pad_string of menu.c) for Mutt 1.4.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain mail messages.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2004-013.0.txt; http://bugs.debian.org/126336; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7933&w=2
CVE: CVE-2004-0080
Published: 2004-03-03
Description: The login program in util-linux 2.11 and earlier uses a pointer after it has been freed and reallocated, which could cause login to leak sensitive data.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20040201-01-U.asc; ftp://patches.sgi.com/support/free/security/advisories/20040406-01-U; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1698&w=2
CVE: CVE-2004-0082
Published: 2004-03-03
Description: The mksmbpasswd shell script (mksmbpasswd.sh) in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password with an uninitialized buffer, which could enable the account with a more easily guessable password.
CVSS Score: 7.5 (HIGH)
References: http://us1.samba.org/samba/ftp/WHATSNEW-3.0.2a.txt; http://www.ciac.org/ciac/bulletins/o-078.shtml; http://www.osvdb.org/3919
CVE: CVE-2004-0083
Published: 2004-03-03
Description: Buffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token, a different vulnerability than CVE-2004-0084 and CVE-2004-0106.
CVSS Score: 10.0 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000821; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3678&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5914&w=2
CVE: CVE-2004-0084
Published: 2004-03-03
Description: Buffer overflow in the ReadFontAlias function in XFree86 4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered function, allows local or remote authenticated users to execute arbitrary code via a malformed entry in the font alias (font.alias) file, a different vulnerability than CVE-2004-0083 and CVE-2004-0106.
CVSS Score: 10.0 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000821; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2775&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8890&w=2
CVE: CVE-2004-0085
Published: 2004-03-03
Description: Unknown vulnerability in the Mail application for Mac OS X 10.1.5 and 10.2.8 with unknown impact, a different vulnerability than CVE-2004-0086.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2004/Jan/msg00000.html; http://www.securityfocus.com/bid/9504; https://exchange.xforce.ibmcloud.com/vulnerabilities/14992
CVE: CVE-2004-0086
Published: 2004-03-03
Description: Unknown vulnerability in the Mail application for Mac OS X 10.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2004-0085.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2004/Jan/msg00000.html; http://www.securityfocus.com/bid/9504; http://lists.apple.com/archives/security-announce/2004/Jan/msg00000.html
CVE: CVE-2004-0087
Published: 2004-03-03
Description: The System Configuration subsystem in Mac OS 10.2.8 and 10.3.2 allows local users to modify network settings, a different vulnerability than CVE-2004-0088.
CVSS Score: 2.1 (LOW)
References: http://lists.apple.com/archives/security-announce/2004/Jan/msg00000.html; http://www.osvdb.org/6819; http://www.securityfocus.com/bid/9504
CVE: CVE-2004-0088
Published: 2004-03-03
Description: The System Configuration subsystem in Mac OS 10.2.8 allows local users to modify network settings, a different vulnerability than CVE-2004-0087.
CVSS Score: 2.1 (LOW)
References: http://lists.apple.com/archives/security-announce/2004/Jan/msg00000.html; http://www.osvdb.org/6820; http://www.securityfocus.com/bid/9504
CVE: CVE-2004-0089
Published: 2004-03-03
Description: Buffer overflow in TruBlueEnvironment in Mac OS X 10.3.x and 10.2.x allows local users to gain privileges via a long environment variable.
CVSS Score: 4.6 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2004/Jan/msg00000.html; http://www.atstake.com/research/advisories/2004/a012704-1.txt; http://www.kb.cert.org/vuls/id/902374
CVE: CVE-2004-0092
Published: 2004-03-03
Description: Unknown vulnerability in Safari web browser in Mac OS X 10.2.8 and 10.3.2, with unknown impact.
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2004/Jan/msg00000.html; http://www.securityfocus.com/bid/9504; http://lists.apple.com/archives/security-announce/2004/Jan/msg00000.html
CVE: CVE-2004-0096
Published: 2004-03-03
Description: Unknown vulnerability in mod_python 2.7.9 allows remote attackers to cause a denial of service (httpd crash) via a certain query string, a variant of CAN-2003-0973.
CVSS Score: 5.0 (MEDIUM)
References: http://security.gentoo.org/glsa/glsa-200401-03.xml; http://www.modpython.org/pipermail/mod_python/2004-January/014879.html; http://www.redhat.com/support/errata/RHSA-2004-058.html
CVE: CVE-2004-0097
Published: 2004-03-03
Description: Multiple vulnerabilities in PWLib before 1.6.0 allow remote attackers to cause a denial of service and possibly execute arbitrary code, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.
CVSS Score: 10.0 (HIGH)
References: http://www.cert.org/advisories/CA-2004-01.html; http://www.debian.org/security/2004/dsa-448; http://www.kb.cert.org/vuls/id/749342
CVE: CVE-2004-0099
Published: 2004-03-03
Description: mksnap_ffs in FreeBSD 5.1 and 5.2 only sets the snapshot flag when creating a snapshot for a file system, which causes default values for other flags to be used, possibly disabling security-critical settings and allowing a local user to bypass intended access restrictions.
CVSS Score: 4.6 (MEDIUM)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:01.mksnap_ffs.asc; http://www.osvdb.org/3790; http://www.securityfocus.com/bid/9533
CVE: CVE-2004-0103
Published: 2004-03-03
Description: crawl before 4.0.0 beta23 does not properly "apply a size check" when copying a certain environment variable, which may allow local users to gain privileges, possibly as a result of a buffer overflow.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/10788/; http://www.debian.org/security/2004/dsa-432; http://www.securityfocus.com/bid/9566
CVE: CVE-2004-0104
Published: 2004-03-03
Description: Multiple format string vulnerabilities in Metamail 2.7 and earlier allow remote attackers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0041.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1429&w=2; http://secunia.com/advisories/10908
CVE: CVE-2004-0105
Published: 2004-03-03
Description: Multiple buffer overflows in Metamail 2.7 and earlier allow remote attackers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0041.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1429&w=2; http://secunia.com/advisories/10908
CVE: CVE-2004-0106
Published: 2004-03-03
Description: Multiple unknown vulnerabilities in XFree86 4.1.0 to 4.3.0, related to improper handling of font files, a different set of vulnerabilities than CVE-2004-0083 and CVE-2004-0084.
CVSS Score: 7.2 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000821; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8890&w=2; http://www.debian.org/security/2004/dsa-443
CVE: CVE-2004-0114
Published: 2004-03-03
Description: The shmat system call in the System V Shared Memory interface for FreeBSD 5.2 and earlier, NetBSD 1.3 and earlier, and OpenBSD 2.6 and earlier, does not properly decrement a shared memory segment's reference count when the vm_map_find function fails, which could allow local users to gain read or write access to a portion of kernel memory and gain privileges.
CVSS Score: 4.6 (MEDIUM)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:02.shmat.asc; ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-004.txt.asc; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7601&w=2
CVE: CVE-2004-0115
Published: 2004-03-03
Description: VirtualPC_Services in Microsoft Virtual PC for Mac 6.0 through 6.1 allows local attackers to truncate and overwrite arbitrary files, and execute arbitrary code, via a symlink attack on the VPCServices_Log temporary file.
CVSS Score: 4.6 (MEDIUM)
References: http://www.atstake.com/research/advisories/2004/a021004-1.txt; http://www.ciac.org/ciac/bulletins/o-076.shtml; http://www.osvdb.org/3893
CVE: CVE-2004-0127
Published: 2004-03-03
Description: Directory traversal vulnerability in editconfig_gedcom.php for phpGedView 2.65.1 and earlier allows remote attackers to read arbitrary files or execute arbitrary PHP programs on the server via .. (dot dot) sequences in the gedcom_config parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/10753/; http://www.osvdb.org/displayvuln.php?osvdb_id=3768; http://www.securityfocus.com/archive/1/352355
CVE: CVE-2004-0128
Published: 2004-03-03
Description: PHP remote file inclusion vulnerability in the GEDCOM configuration script for phpGedView 2.65.1 and earlier allows remote attackers to execute arbitrary PHP code by modifying the PGV_BASE_DIRECTORY parameter to reference a URL on a remote web server that contains a malicious theme.php script.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/10753/; http://sourceforge.net/project/shownotes.php?release_id=141517; http://www.osvdb.org/3769
CVE: CVE-2004-0129
Published: 2004-03-03
Description: Directory traversal vulnerability in export.php in phpMyAdmin 2.5.5 and earlier allows remote attackers to read arbitrary files via .. (dot dot) sequences in the what parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5932&w=2; http://secunia.com/advisories/10769; http://security.gentoo.org/glsa/glsa-200402-05.xml
CVE: CVE-2004-0130
Published: 2004-03-03
Description: login.php in phpGedView 2.65 and earlier allows remote attackers to obtain sensitive information via an HTTP request to login.php that does not contain the required username or password parameters, which causes the information to be leaked in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/alerts/2004/Jan/1008844.html; http://www.netvigilance.com/advisory0001; http://www.osvdb.org/6886
CVE: CVE-2004-0131
Published: 2004-03-03
Description: The rad_print_request function in logger.c for GNU Radius daemon (radiusd) before 1.2 allows remote attackers to cause a denial of service (crash) via a UDP packet with an Acct-Status-Type attribute without a value and no Acct-Session-Id attribute, which causes a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://ftp.gnu.org/gnu/radius/radius-1.2.tar.gz; http://secunia.com/advisories/10799; http://www.idefense.com/application/poi/display?id=71&type=vulnerabilities&flashstatus=true
CVE: CVE-2004-0132
Published: 2004-03-03
Description: Multiple PHP remote file inclusion vulnerabilities in ezContents 2.0.2 and earlier allow remote attackers to execute arbitrary PHP code from a remote web server, as demonstrated using (1) the GLOBALS[rootdp] parameter to db.php, or (2) the GLOBALS[language_home] parameter to archivednews.php, and a malicious version of lang_admin.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1958&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/15135; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1958&w=2
CVE: CVE-2004-0143
Published: 2004-03-03
Description: Multiple vulnerabilities in Nokia 6310(i) Mobile phones allow remote attackers to cause a denial of service (reset) via malformed Bluetooth OBject EXchange (OBEX) messages, probably triggering buffer overflows.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0034.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9065&w=2; http://www.pentest.co.uk/documents/ptl-2004-01.html
CVE: CVE-2004-0164
Published: 2004-03-03
Description: KAME IKE daemon (racoon) does not properly handle hash values, which allows remote attackers to delete certificates via (1) a certain delete message that is not properly handled in isakmp.c or isakmp_inf.c, or (2) a certain INITIAL-CONTACT message that is not properly handled in isakmp_inf.c.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-001.txt.asc; http://lists.apple.com/archives/security-announce/2004/Feb/msg00000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9838&w=2
CVE: CVE-2004-1990
Published: 2004-03-03
Description: Aldo's Web Server (aweb) 1.5 allows remote attackers to gain sensitive information via an arbitrary character, which reveals the full path and the user running the aweb process, possibly due to a malformed request.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1227&w=2; http://secunia.com/advisories/11542; http://www.oliverkarow.de/research/AldosWebserverMultipleVulns.txt
CVE: CVE-2004-1359
Published: 2004-03-04
Description: Multiple buffer overflows in uucp for Sun Solaris 2.6, 7, 8, and 9 allow local users to execute arbitrary code as the uucp user.
CVSS Score: 4.6 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-57508-1; http://www.auscert.org.au/render.html?it=3935; http://www.securityfocus.com/bid/9837
CVE: CVE-2003-1199
Published: 2004-03-11
Description: Cross-site scripting (XSS) vulnerability in MyProxy 20030629 allows remote attackers to inject arbitrary web script or HTML via the URL.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5344&w=2; http://secunia.com/advisories/11090; http://www.autistici.org/fdonato/advisory/MyProxy20030629-adv.txt
CVE: CVE-2004-1769
Published: 2004-03-11
Description: The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4201&w=2; http://secunia.com/advisories/11111; http://www.kb.cert.org/vuls/id/831534
CVE: CVE-2004-1770
Published: 2004-03-11
Description: The login page for cPanel 9.1.0, and possibly other versions, allows remote attackers to execute arbitrary code via shell metacharacters in the user parameter.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2035&w=2; http://secunia.com/advisories/11124; http://www.kb.cert.org/vuls/id/831534
CVE: CVE-2004-1358
Published: 2004-03-12
Description: The patches (1) 114332-08 and (2) 114929-06 for Sun Solaris 9 disable the auditing functionality of the Basic Security Module (BSM), which allows attackers to avoid having their activity logged.
CVSS Score: 5.0 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-57478-1&searchclause=%22category:security%22%20%20114332-08; http://www.auscert.org.au/render.html?it=3788; http://www.ciac.org/ciac/bulletins/o-099.shtml
CVE: CVE-2004-0075
Published: 2004-03-15
Description: The Vicam USB driver in Linux before 2.4.25 does not use the copy_from_user function when copying data from userspace to kernel space, which crosses security boundaries and allows local users to cause a denial of service.
CVSS Score: 2.1 (LOW)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000846; http://frontal2.mandriva.com/security/advisories?name=MDKSA-2004:015; http://www.ciac.org/ciac/bulletins/o-082.shtml
CVE: CVE-2004-0093
Published: 2004-03-15
Description: XFree86 4.1.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an out-of-bounds array index when using the GLX extension and Direct Rendering Infrastructure (DRI).
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20040406-01-U; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000824; http://www.debian.org/security/2004/dsa-443
CVE: CVE-2004-0094
Published: 2004-03-15
Description: Integer signedness errors in XFree86 4.1.0 allow remote attackers to cause a denial of service and possibly execute arbitrary code when using the GLX extension and Direct Rendering Infrastructure (DRI).
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20040406-01-U; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000824; http://www.debian.org/security/2004/dsa-443
CVE: CVE-2004-0110
Published: 2004-03-15
Description: Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5420&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8804&w=2; http://rhn.redhat.com/errata/RHSA-2004-090.html
CVE: CVE-2004-0159
Published: 2004-03-15
Description: Format string vulnerability in hsftp 1.11 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via file names containing format string characters that are not properly handled when executing an "ls" command.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-February/017737.html; http://www.osvdb.org/4029; http://www.securityfocus.com/bid/9715
CVE: CVE-2004-0165
Published: 2004-03-15
Description: Format string vulnerability in Point-to-Point Protocol (PPP) daemon (pppd) 2.4.0 for Mac OS X 10.3.2 and earlier allows remote attackers to read arbitrary pppd process data, including PAP or CHAP authentication credentials, to gain privileges.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2004/Feb/msg00000.html; http://www.atstake.com/research/advisories/2004/a022304-1.txt; http://www.kb.cert.org/vuls/id/841742
CVE: CVE-2004-0166
Published: 2004-03-15
Description: Unknown vulnerability in Safari web browser for Mac OS X 10.2.8 related to "the display of URLs in the status bar."
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2004/Feb/msg00000.html; http://secunia.com/advisories/10959; http://www.kb.cert.org/vuls/id/194238
CVE: CVE-2004-0167
Published: 2004-03-15
Description: DiskArbitration in Mac OS X 10.2.8 and 10.3.2 does not properly initialize writeable removable media.
CVSS Score: 7.5 (HIGH)
References: http://lists.apple.com/archives/security-announce/2004/Feb/msg00000.html; http://secunia.com/advisories/10959; http://www.kb.cert.org/vuls/id/578886
CVE: CVE-2004-0168
Published: 2004-03-15
Description: Unknown vulnerability in CoreFoundation for Mac OS X 10.3.2, related to "notification logging."
CVSS Score: 10.0 (HIGH)
References: http://lists.apple.com/archives/security-announce/2004/Feb/msg00000.html; http://secunia.com/advisories/10959/; https://exchange.xforce.ibmcloud.com/vulnerabilities/15299
CVE: CVE-2004-0169
Published: 2004-03-15
Description: QuickTime Streaming Server in MacOS X 10.2.8 and 10.3.2 allows remote attackers to cause a denial of service (crash) via DESCRIBE requests with long User-Agent fields, which causes an Assert error to be triggered in the BufferIsFull function.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2004/Feb/msg00000.html; http://www.idefense.com/application/poi/display?id=75&type=vulnerabilities; http://www.kb.cert.org/vuls/id/460350
CVE: CVE-2004-0171
Published: 2004-03-15
Description: FreeBSD 5.1 and earlier, and Mac OS X before 10.3.4, allows remote attackers to cause a denial of service (resource exhaustion of memory buffers and system crash) via a large number of out-of-sequence TCP packets, which prevents the operating system from creating new connections.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:04.tcp.asc; http://lists.seifried.org/pipermail/security/2004-May/003743.html; http://www.idefense.com/application/poi/display?id=78&type=vulnerabilities
CVE: CVE-2004-0172
Published: 2004-03-15
Description: Heap-based buffer overflow in the search_for_command function of ltrace 0.3.10, if it is installed setuid, could allow local users to execute arbitrary code via a long filename.  NOTE: It is unclear whether there are any packages that install ltrace as a setuid program, so this candidate might be REJECTed.
CVSS Score: 7.2 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/011600.html; http://lists.grok.org.uk/pipermail/full-disclosure/2003-October/011610.html; http://securitytracker.com/id?1007896
CVE: CVE-2004-0185
Published: 2004-03-15
Description: Buffer overflow in the skey_challenge function in ftpd.c for wu-ftp daemon (wu-ftpd) 2.6.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a s/key (SKEY) request with a long name.
CVSS Score: 10.0 (HIGH)
References: ftp://ftp.wu-ftpd.org/pub/wu-ftpd/patches/apply_to_2.6.2/skeychallenge.patch; http://unixpunx.org/txt/exploits_archive/packetstorm/0310-advisories/wuftpd-skey.txt; http://www.debian.org/security/2004/dsa-457
CVE: CVE-2004-0186
Published: 2004-03-15
Description: smbmnt in Samba 2.x and 3.x on Linux 2.6, when installed setuid, allows local users to gain root privileges by mounting a Samba share that contains a setuid root program, whose setuid attributes are not cleared when the share is mounted.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6296&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8743&w=2; http://www.debian.org/security/2004/dsa-463
CVE: CVE-2004-0187
Published: 2004-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2004-0185.  Reason: This candidate is a reservation duplicate of CVE-2004-0185.  Notes: All CVE users should reference CVE-2004-0185 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2004-0188
Published: 2004-03-15
Description: Heap-based buffer overflow in Calife 2.8.5 and earlier may allow local users to execute arbitrary code via a long password.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2092&w=2; http://www.debian.org/security/2004/dsa-461; http://www.securityfocus.com/bid/9756
CVE: CVE-2004-0189
Published: 2004-03-15
Description: The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.16/SCOSA-2005.16.txt; ftp://patches.sgi.com/support/free/security/advisories/20040404-01-U.asc; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000838
CVE: CVE-2004-0190
Published: 2004-03-15
Description: Symantec FireWall/VPN Appliance model 200 records a cleartext password for the password administration page, which may be cached on the administrator's local system or in a proxy, which allows attackers to steal the password and gain privileges.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-February/017414.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1839&w=2; http://www.osvdb.org/4117
CVE: CVE-2004-0191
Published: 2004-03-15
Description: Mozilla before 1.4.2 executes Javascript events in the context of a new page while it is being loaded, allowing it to interact with the previous page (zombie document) and enable cross-domain and cross-site scripting (XSS) attacks, as demonstrated using onmousemove events.
CVSS Score: 6.8 (MEDIUM)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=227417; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9469&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9944&w=2