deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-0052
Published: 2004-10-20
Description: Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use non-standard separator characters, or use standard separators incorrectly, within MIME headers, fields, parameters, or values, which may be interpreted differently by mail clients.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5891&w=2; http://www.uniras.gov.uk/vuls/2004/380375/mime.htm; https://exchange.xforce.ibmcloud.com/vulnerabilities/17334
CVE: CVE-2004-0053
Published: 2004-10-20
Description: Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use fields that use RFC2047 encoding, which may be interpreted differently by mail clients.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8739&w=2; http://www.uniras.gov.uk/vuls/2004/380375/mime.htm; https://exchange.xforce.ibmcloud.com/vulnerabilities/17331
CVE: CVE-2004-0161
Published: 2004-10-20
Description: Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use RFC2231 encoding, which may be interpreted differently by mail clients.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2568&w=2; http://www.uniras.gov.uk/vuls/2004/380375/mime.htm; https://exchange.xforce.ibmcloud.com/vulnerabilities/9274
CVE: CVE-2004-0162
Published: 2004-10-20
Description: Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME encapsulation that uses RFC822 comment fields, which may be interpreted as other fields by mail clients.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3776&w=2; http://www.uniras.gov.uk/vuls/2004/380375/mime.htm; https://exchange.xforce.ibmcloud.com/vulnerabilities/17332
CVE: CVE-2004-0559
Published: 2004-10-20
Description: The maketemp.pl script in Usermin 1.070 and 1.080 allows local users to overwrite arbitrary files at install time via a symlink attack on the /tmp/.usermin directory.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/12488/; http://www.gentoo.org/security/en/glsa/glsa-200409-15.xml; http://www.securityfocus.com/bid/11153
CVE: CVE-2004-0687
Published: 2004-10-20
Description: Multiple stack-based buffer overflows in (1) xpmParseColors in parse.c, (2) ParseAndPutPixels in create.c, and (3) ParsePixels in parse.c for libXpm before 6.8.1 allow remote attackers to execute arbitrary code via a malformed XPM image file.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000924; http://ftp.x.org/pub/X11R6.8.0/patches/README.xorg-CAN-2004-0687-0688.patch; http://lists.apple.com/archives/security-announce/2005/May/msg00001.html
CVE: CVE-2004-0688
Published: 2004-10-20
Description: Multiple integer overflows in (1) the xpmParseColors function in parse.c, (2) XpmCreateImageFromXpmImage, (3) CreateXImage, (4) ParsePixels, and (5) ParseAndPutPixels for libXpm before 6.8.1 may allow remote attackers to execute arbitrary code via a malformed XPM image file.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000924; http://ftp.x.org/pub/X11R6.8.0/patches/README.xorg-CAN-2004-0687-0688.patch; http://lists.apple.com/archives/security-announce/2005/May/msg00001.html
CVE: CVE-2004-0746
Published: 2004-10-20
Description: Konqueror in KDE 3.2.3 and earlier allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk and .firm.in, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000864; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4401&w=2; http://secunia.com/advisories/12341
CVE: CVE-2004-0747
Published: 2004-10-20
Description: Buffer overflow in Apache 2.0.50 and earlier allows local users to gain apache privileges via a .htaccess file that causes the overflow during expansion of environment variables.
CVSS Score: 7.8 (HIGH)
CWE: CWE-131, CWE-131
References: http://secunia.com/advisories/12540; http://secunia.com/advisories/34920; http://securitytracker.com/id?1011303
CVE: CVE-2004-0748
Published: 2004-10-20
Description: mod_ssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (CPU consumption) by aborting an SSL connection in a way that causes an Apache child process to enter an infinite loop.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-835
References: http://www.gentoo.org/security/en/glsa/glsa-200409-21.xml; http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:096; http://www.novell.com/linux/security/advisories/2004_30_apache2.html
CVE: CVE-2004-0750
Published: 2004-10-20
Description: Unknown vulnerability in redhat-config-nfs before 1.0.13, when shares are exported to multiple hosts, can produce incorrect permissions and prevent the all_squash option from being applied.
CVSS Score: 7.5 (HIGH)
References: http://www.redhat.com/support/errata/RHSA-2004-434.html; http://www.securityfocus.com/archive/1/419762/100/0/threaded; http://www.securityfocus.com/bid/11240
CVE: CVE-2004-0751
Published: 2004-10-20
Description: The char_buffer_read function in the mod_ssl module for Apache 2.x, when using reverse proxying to an SSL server, allows remote attackers to cause a denial of service (segmentation fault).
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-09/0096.html; http://issues.apache.org/bugzilla/show_bug.cgi?id=30134; http://www.gentoo.org/security/en/glsa/glsa-200409-21.xml
CVE: CVE-2004-0752
Published: 2004-10-20
Description: OpenOffice (OOo) 1.1.2 creates predictable directory names with insecure permissions during startup, which may allow local users to read or list files of other users.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1566&w=2; http://secunia.com/advisories/12302/; http://secunia.com/advisories/12546/
CVE: CVE-2004-0753
Published: 2004-10-20
Description: The BMP image processor for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted BMP file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-835
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000875; http://secunia.com/advisories/17657; http://www.debian.org/security/2004/dsa-546
CVE: CVE-2004-0754
Published: 2004-10-20
Description: Integer overflow in Gaim before 0.82 allows remote attackers to cause a denial of service and possibly execute arbitrary code via the size variable in Groupware server messages.
CVSS Score: 7.5 (HIGH)
References: http://gaim.sourceforge.net/security/?id=2; http://secunia.com/advisories/12383; http://secunia.com/advisories/12480
CVE: CVE-2004-0755
Published: 2004-10-20
Description: The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/12290/; http://www.debian.org/security/2004/dsa-537; http://www.gentoo.org/security/en/glsa/glsa-200409-08.xml
CVE: CVE-2004-0768
Published: 2004-10-20
Description: libpng 1.2.5 and earlier does not properly calculate certain buffer offsets, which could allow remote attackers to execute arbitrary code via a buffer overflow attack.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/33137; http://security.gentoo.org/glsa/glsa-200812-15.xml; http://www.debian.org/security/2004/dsa-536
CVE: CVE-2004-0772
Published: 2004-10-20
Description: Double free vulnerabilities in error handling code in krb524d for MIT Kerberos 5 (krb5) 1.2.8 and earlier may allow remote attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000860; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4753&w=2; http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2004-002-dblfree.txt
CVE: CVE-2004-0775
Published: 2004-10-20
Description: Buffer overflow in WIDCOMM Bluetooth Connectivity Software, as used in products such as BTStackServer 1.3.2.7 and 1.4.2.10, Windows XP and Windows 98 with MSI Bluetooth Dongles, and HP IPAQ 5450 running WinCE 3.0, allows remote attackers to execute arbitrary code via certain service requests.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0029.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2624&w=2; http://www.internetnews.com/security/article.php/3394181
CVE: CVE-2004-0777
Published: 2004-10-20
Description: Format string vulnerability in the auth_debug function in Courier-IMAP 1.6.0 through 2.2.1 and 3.x through 3.0.3, when login debugging (DEBUG_LOGIN) is enabled, allows remote attackers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://security.gentoo.org/glsa/glsa-200408-19.xml; http://www.securityfocus.com/bid/10976; http://www.trustix.net/errata/2004/0043/
CVE: CVE-2004-0778
Published: 2004-10-20
Description: CVS 1.11.x before 1.11.17, and 1.12.x before 1.12.9, allows remote attackers to determine the existence of arbitrary files and directories via the -X command for an alternate history file, which causes different error messages to be returned.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-203
References: http://www.idefense.com/application/poi/display?id=130&type=vulnerabilities; http://www.kb.cert.org/vuls/id/579225; http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:108
CVE: CVE-2004-0781
Published: 2004-10-20
Description: Cross-site scripting (XSS) vulnerability in list.cgi in the Icecast internal web server (icecast-server) 1.3.12 and earlier allows remote attackers to inject arbitrary web script via the UserAgent parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://www.debian.org/security/2004/dsa-541; http://www.securityfocus.com/bid/11021; https://exchange.xforce.ibmcloud.com/vulnerabilities/17086
CVE: CVE-2004-0782
Published: 2004-10-20
Description: Integer overflow in pixbuf_create_from_xpm (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, allows remote attackers to execute arbitrary code via certain n_col and cpp values that enable a heap-based buffer overflow.  NOTE: this identifier is ONLY for gtk+.  It was incorrectly referenced in an advisory for a different issue (CVE-2004-0687).
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000875; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6275&w=2; http://scary.beasts.org/security/CESA-2004-005.txt
CVE: CVE-2004-0783
Published: 2004-10-20
Description: Stack-based buffer overflow in xpm_extract_color (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, may allow remote attackers to execute arbitrary code via a certain color string.  NOTE: this identifier is ONLY for gtk+.  It was incorrectly referenced in an advisory for a different issue (CVE-2004-0688).
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000875; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6275&w=2; http://scary.beasts.org/security/CESA-2004-005.txt
CVE: CVE-2004-0784
Published: 2004-10-20
Description: The smiley theme functionality in Gaim before 0.82 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of the tar file that is dragged to the smiley selector.
CVSS Score: 7.5 (HIGH)
References: http://gaim.sourceforge.net/security/?id=1; http://www.fedoranews.org/updates/FEDORA-2004-278.shtml; http://www.fedoranews.org/updates/FEDORA-2004-279.shtml
CVE: CVE-2004-0785
Published: 2004-10-20
Description: Multiple buffer overflows in Gaim before 0.82 allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) Rich Text Format (RTF) messages, (2) a long hostname for the local system as obtained from DNS, or (3) a long URL that is not properly handled by the URL decoder.
CVSS Score: 7.5 (HIGH)
References: http://gaim.sourceforge.net/security/?id=3; http://gaim.sourceforge.net/security/?id=4; http://gaim.sourceforge.net/security/?id=5
CVE: CVE-2004-0786
Published: 2004-10-20
Description: The IPv6 URI parsing routines in the apr-util library for Apache 2.0.50 and earlier allow remote attackers to cause a denial of service (child process crash) via a certain URI, as demonstrated using the Codenomicon HTTP Test Tool.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/12540; http://www.gentoo.org/security/en/glsa/glsa-200409-21.xml; http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:096
CVE: CVE-2004-0787
Published: 2004-10-20
Description: Cross-site scripting (XSS) vulnerability in the web frontend in OpenCA 0.9.1-8 and earlier, and 0.9.2 RC6 and earlier, allows remote attackers to inject arbitrary web script or HTML via the form input fields.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3954&w=2; http://www.openca.org/news/CAN-2004-0787.txt; http://www.securityfocus.com/bid/11113
CVE: CVE-2004-0788
Published: 2004-10-20
Description: Integer overflow in the ICO image decoder for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted ICO file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-190
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000875; http://secunia.com/advisories/17657; http://www.debian.org/security/2004/dsa-546
CVE: CVE-2004-0792
Published: 2004-10-20
Description: Directory traversal vulnerability in the sanitize_path function in util.c for rsync 2.6.2 and earlier, when chroot is disabled, allows attackers to read or write certain files.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2290&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3839&w=2; http://samba.org/rsync/#security_aug04
CVE: CVE-2004-0793
Published: 2004-10-20
Description: The calendar program in bsdmainutils 6.0 through 6.0.14 does not drop root privileges when executed with the -a flag, which allows attackers to execute arbitrary commands via a calendar event file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7359&w=2; http://www.securityfocus.com/bid/11077; https://exchange.xforce.ibmcloud.com/vulnerabilities/17162
CVE: CVE-2004-0794
Published: 2004-10-20
Description: Multiple signal handler race conditions in lukemftpd (aka tnftpd before 20040810) allow remote authenticated attackers to cause a denial of service or execute arbitrary code.
CVSS Score: 5.1 (MEDIUM)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-009.txt.asc; http://lists.grok.org.uk/pipermail/full-disclosure/2004-August/025418.html; http://www.debian.org/security/2004/dsa-551
CVE: CVE-2004-0795
Published: 2004-10-20
Description: DB2 8.1 remote command server (DB2RCMD.EXE) executes the db2rcmdc.exe program as the db2admin administrator, which allows local users to gain privileges via the DB2REMOTECMD named pipe.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4173&w=2; http://www-1.ibm.com/support/docview.wss?uid=swg1IY53894; http://www.nextgenss.com/advisories/db2rmtcmd.txt
CVE: CVE-2004-0796
Published: 2004-10-20
Description: SpamAssassin 2.5x, and 2.6x before 2.64, allows remote attackers to cause a denial of service via certain malformed messages.
CVSS Score: 5.0 (MEDIUM)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=129337; http://marc.info/?l=spamassassin-announce&m=[PII_REDACTED]8767&w=2; http://security.gentoo.org/glsa/glsa-200408-06.xml
CVE: CVE-2004-0797
Published: 2004-10-20
Description: The error handling in the (1) inflate and (2) inflateBack functions in ZLib compression library 1.2.x allows local users to cause a denial of service (application crash).
CVSS Score: 2.1 (LOW)
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.6/SCOSA-2006.6.txt; ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2004.17/SCOSA-2004.17.txt; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=252253
CVE: CVE-2004-0798
Published: 2004-10-20
Description: Buffer overflow in the _maincfgret.cgi script for Ipswitch WhatsUp Gold before 8.03 Hotfix 1 allows remote attackers to execute arbitrary code via a long instancename parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.idefense.com/application/poi/display?type=vulnerabilities; http://www.ipswitch.com/Support/WhatsUp/patch-upgrades.html; http://www.securityfocus.com/bid/11043
CVE: CVE-2004-0799
Published: 2004-10-20
Description: The HTTP daemon in Ipswitch WhatsUp Gold 8.03 and 8.03 Hotfix 1 allows remote attackers to cause a denial of service (server crash) via a GET request containing an MS-DOS device name, as demonstrated using "prn.htm".
CVSS Score: 5.0 (MEDIUM)
References: http://www.idefense.com/application/poi/display?id=142&type=vulnerabilities; http://www.ipswitch.com/Support/WhatsUp/patch-upgrades.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/17418
CVE: CVE-2004-1380
Published: 2004-10-20
Description: Firefox before 1.0 and Mozilla before 1.7.5 allows inactive (background) tabs to launch dialog boxes, which can allow remote attackers to spoof the dialog boxes from web sites in other windows and facilitate phishing attacks, aka the "Dialog Box Spoofing Vulnerability."
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/12712; http://secunia.com/multiple_browsers_dialog_box_spoofing_test/; http://secunia.com/multiple_browsers_form_field_focus_test/
CVE: CVE-2004-1381
Published: 2004-10-20
Description: Firefox before 1.0 and Mozilla before 1.7.5 allow inactive (background) tabs to focus on input being entered in the active tab, as originally reported using form fields, which allows remote attackers to steal sensitive data that is intended for other sites, which could facilitate phishing attacks.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/12712; http://secunia.com/multiple_browsers_dialog_box_spoofing_test/; http://secunia.com/multiple_browsers_form_field_focus_test/
CVE: CVE-2004-1619
Published: 2004-10-20
Description: Buffer overflow in Privateer's Bounty: Age of Sail II allows remote attackers to execute arbitrary code via a long nickname.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7842&w=2; http://secunia.com/advisories/12905; http://www.securityfocus.com/bid/11479
CVE: CVE-2004-1620
Published: 2004-10-21
Description: CRLF injection vulnerability in Serendipity before 0.7rc1 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the url parameter in (1) index.php and (2) exit.php, or (3) the HTTP Referer field in comment.php.
CVSS Score: 5.0 (MEDIUM)
References: http://cvs.sourceforge.net/viewcvs.py/php-blog/serendipity/comment.php?rev=1.49&view=markup; http://cvs.sourceforge.net/viewcvs.py/php-blog/serendipity/exit.php?rev=1.10&view=markup; http://cvs.sourceforge.net/viewcvs.py/php-blog/serendipity/index.php?rev=1.52&view=markup
CVE: CVE-2004-1622
Published: 2004-10-21
Description: SQL injection vulnerability in dosearch.php in UBB.threads 3.4.x allows remote attackers to execute arbitrary SQL statements via the Name parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7038&w=2; http://www.securityfocus.com/bid/11502; https://exchange.xforce.ibmcloud.com/vulnerabilities/17821
CVE: CVE-2004-1624
Published: 2004-10-21
Description: Carbon Copy 6.0.5257 does not drop system privileges when opening external programs through the help topic interface, which allows local users to gain privileges via (1) the help topic interface in CCW32.exe, which launches Notepad, or (2) the help button in the Carbon Copy Scheduler (CCSched.exe).
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6459&w=2; http://secunia.com/advisories/12962; http://www.securityfocus.com/bid/11500
CVE: CVE-2004-1623
Published: 2004-10-22
Description: The WAV file property handler in Windows XP SP1 allows remote attackers to cause a denial of service (infinite loop in Explorer) via a WAV file with an invalid file header whose fmt chunk length is set to 0xFFFFFFFF.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3443&w=2; http://securitytracker.com/id?1011880; http://www.hexview.com/docs/20041021-1.txt
CVE: CVE-2004-1625
Published: 2004-10-22
Description: pGina 1.7.6 and possibly older versions, when the Restart or Shutdown options are enabled on the login screen, allows remote attackers to cause a denial of service by connecting via Remote Desktop and clicking restart or shutdown.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8245&w=2; http://www.lovebug.org/pgina_dos.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/17836
CVE: CVE-2004-1626
Published: 2004-10-22
Description: Buffer overflow in Ability Server 2.34, and possibly other versions, allows remote attackers to execute arbitrary code via a long STOR command.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8816&w=2; http://secunia.com/advisories/12941; http://www.kb.cert.org/vuls/id/857846
CVE: CVE-2004-1627
Published: 2004-10-22
Description: Buffer overflow in Ability Server 2.25, 2.32, 2.34, and possibly other versions, allows remote attackers to execute arbitrary code via a long APPE command.
CVSS Score: 7.5 (HIGH)
References: http://lists.virus.org/dw-0day-0412/msg00004.html; http://secunia.com/advisories/12941; http://securitytracker.com/id?1012464
CVE: CVE-2004-1628
Published: 2004-10-23
Description: Format string vulnerability in log.c in rssh before 2.2.2 allows remote authenticated users to execute arbitrary code.
CVSS Score: 9.0 (HIGH)
CWE: CWE-134
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5122&w=2; http://secunia.com/advisories/12954; http://www.gentoo.org/security/en/glsa/glsa-200410-28.xml
CVE: CVE-2004-1629
Published: 2004-10-23
Description: Multiple SQL injection vulnerabilities in Dwc_articles 1.6 and earlier allow remote attackers to execute arbitrary SQL statements.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2903&w=2; http://www.securityfocus.com/bid/11509; https://exchange.xforce.ibmcloud.com/vulnerabilities/17830
CVE: CVE-2004-1635
Published: 2004-10-24
Description: Bugzilla 2.17.1 through 2.18rc2 and 2.19 from cvs, when using the insidergroup feature, does not sufficiently protect private attachments when there are changes to the metadata, such as filename, description, MIME type, or review flags, which allows remote authenticated users to obtain sensitive information when (1) viewing the bug activity log or (2) receiving bug change notification mails.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1238&w=2; http://www.securityfocus.com/bid/11511; https://bugzilla.mozilla.org/show_bug.cgi?id=250605
CVE: CVE-2004-1630
Published: 2004-10-25
Description: Cross-site scripting (XSS) vulnerability in the login form in Open WorkFlow Engine (OpenWFE) 1.4.x allows remote attackers to execute arbitrary web script or HTML via the url parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5234&w=2; http://secunia.com/advisories/12970; http://www.securityfocus.com/bid/11514
CVE: CVE-2004-1631
Published: 2004-10-25
Description: Open WorkFlow Engine (OpenWFE) 1.4.x allows remote attackers to conduct port scans of remote hosts by specifying the target in an rmi:// Worklist URL, then using the response times to infer the results.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5234&w=2; http://secunia.com/advisories/12970; http://www.securityfocus.com/bid/11514