deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-1136
Published: 2005-01-10
Description: Buffer overflow in CuteFTP Professional 6.0, and possibly other versions, allows remote FTP servers to cause a denial of service (application crash) via large replies to FTP commands.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2642&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/18309; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2642&w=2
CVE: CVE-2004-1137
Published: 2005-01-10
Description: Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28, and 2.6.x to 2.6.9, allow local and remote attackers to cause a denial of service or execute arbitrary code via (1) the ip_mc_source function, which decrements a counter to -1, or (2) the igmp_marksources function, which does not properly validate IGMP message parameters and performs an out-of-bounds read.
CVSS Score: 10.0 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000930; http://isec.pl/vulnerabilities/isec-0018-igmp.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0336&w=2
CVE: CVE-2004-1138
Published: 2005-01-10
Description: VIM before 6.3 and gVim before 6.3 allow local users to execute arbitrary commands via a file containing a crafted modeline that is executed when the file is viewed using options such as (1) termcap, (2) printdevice, (3) titleold, (4) filetype, (5) syntax, (6) backupext, (7) keymap, (8) patchmode, or (9) langmenu.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5609&w=2; http://www.gentoo.org/security/en/glsa/glsa-200412-10.xml; http://www.redhat.com/support/errata/RHSA-2005-010.html
CVE: CVE-2004-1147
Published: 2005-01-10
Description: phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands via shell metacharacters.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8323&w=2; http://www.exaprobe.com/labs/advisories/esa-2004-1213.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/18441
CVE: CVE-2004-1148
Published: 2005-01-10
Description: phpMyAdmin before 2.6.1, when configured with UploadDir functionality, allows remote attackers to read arbitrary files via the sql_localfile parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8323&w=2; http://www.exaprobe.com/labs/advisories/esa-2004-1213.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/18441
CVE: CVE-2004-1149
Published: 2005-01-10
Description: Computer Associates eTrust EZ Antivirus 7.0.0 to 7.0.4, including 7.0.1.4, installs its files with insecure permissions (ACLs), which allows local users to gain privileges by replacing critical programs with malicious ones, as demonstrated using VetMsg.exe.
CVSS Score: 7.2 (HIGH)
References: http://crm.my-etrust.com/login.asp?username=guest&target=DOCUMENT&openparameter; http://www.idefense.com/application/poi/display?id=164; https://exchange.xforce.ibmcloud.com/vulnerabilities/18502
CVE: CVE-2004-1151
Published: 2005-01-10
Description: Multiple buffer overflows in the (1) sys32_ni_syscall and (2) sys32_vm86_warning functions in sys_ia32.c for Linux 2.6.x may allow local attackers to modify kernel memory and gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://linux.bkbits.net:8080/linux-2.6/cset%401.2079; http://linux.bkbits.net:8080/linux-2.6/gnupatch%4041ae6af1cR3mJYlW6D8EHxCKSxuJiQ; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0336&w=2
CVE: CVE-2004-1152
Published: 2005-01-10
Description: Buffer overflow in the mailListIsPdf function in Adobe Acrobat Reader 5.09 for Unix allows remote attackers to execute arbitrary code via an e-mail message with a crafted PDF attachment.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/13474; http://www.adobe.com/support/techdocs/331153.html; http://www.idefense.com/application/poi/display?id=161&type=vulnerabilities&flashstatus=false
CVE: CVE-2004-1153
Published: 2005-01-10
Description: Format string vulnerability in Adobe Acrobat Reader 6.0.0 through 6.0.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an .ETD document containing format string specifiers in (1) title or (2) baseurl fields.
CVSS Score: 10.0 (HIGH)
References: http://www.adobe.com/support/downloads/detail.jsp?ftpID=2679; http://www.idefense.com/application/poi/display?id=163&type=vulnerabilities; https://exchange.xforce.ibmcloud.com/vulnerabilities/18478
CVE: CVE-2004-1154
Published: 2005-01-10
Description: Integer overflow in the Samba daemon (smbd) in Samba 2.x and 3.0.x through 3.0.9 allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a Samba request with a large number of security descriptors that triggers a heap-based buffer overflow.
CVSS Score: 10.0 (HIGH)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.17/SCOSA-2005.17.txt; http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html; http://secunia.com/advisories/13453/
CVE: CVE-2004-1157
Published: 2005-01-10
Description: Opera 7.x up to 7.54, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: http://secunia.com/advisories/13253/; http://secunia.com/multiple_browsers_window_injection_vulnerability_test/; http://secunia.com/secunia_research/2004-13/advisory/
CVE: CVE-2004-1158
Published: 2005-01-10
Description: Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window or tab whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3575&w=2; http://secunia.com/advisories/13254; http://secunia.com/advisories/13477
CVE: CVE-2004-1159
Published: 2005-01-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2004-1122, CVE-2004-1314.  Reason: this was an out-of-band assignment duplicate intended for one issue, but the description and references inadvertently combined multiple issues.  Notes: All CVE users should consult CVE-2004-1122 and CVE-2004-1314 to determine which ID is appropriate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2004-1160
Published: 2005-01-10
Description: Netscape 7.x to 7.2, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/13402/; http://secunia.com/multiple_browsers_window_injection_vulnerability_test/; http://secunia.com/secunia_research/2004-13/advisory/
CVE: CVE-2004-1161
Published: 2005-01-10
Description: rssh 2.2.2 and earlier does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended access restrictions and execute arbitrary programs via (1) rdist -P, (2) rsync, or (3) scp -S.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7273&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4623&w=2; http://www.gentoo.org/security/en/glsa/glsa-200412-01.xml
CVE: CVE-2004-1162
Published: 2005-01-10
Description: The unison command in scponly before 4.0 does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended access restrictions and execute arbitrary programs via the (1) -rshcmd or (2) -sshcmd flags.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7273&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4623&w=2; http://www.gentoo.org/security/en/glsa/glsa-200412-01.xml
CVE: CVE-2004-1163
Published: 2005-01-10
Description: Cisco CNS Network Registrar Central Configuration Management (CCM) server 6.0 through 6.1.1.3 allows remote attackers to cause a denial of service (CPU consumption) by ending a connection after sending a certain sequence of packets.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a008036786d.shtml; https://exchange.xforce.ibmcloud.com/vulnerabilities/18327; http://www.cisco.com/en/US/products/products_security_advisory09186a008036786d.shtml
CVE: CVE-2004-1164
Published: 2005-01-10
Description: The lock manager in Cisco CNS Network Registrar 6.0 through 6.1.1.3 allows remote attackers to cause a denial of service (process crash) via a certain "unexpected packet sequence."
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a008036786d.shtml; http://www.securityfocus.com/bid/11793; https://exchange.xforce.ibmcloud.com/vulnerabilities/18328
CVE: CVE-2004-1165
Published: 2005-01-10
Description: Konqueror 3.3.1 allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline ("%0a") before the FTP command, which causes the commands to be inserted into the resulting FTP session, as demonstrated using a PORT command.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2681&w=2; http://www.debian.org/security/2005/dsa-631; http://www.gentoo.org/security/en/glsa/glsa-200501-18.xml
CVE: CVE-2004-1167
Published: 2005-01-10
Description: mirrorselect before 0.89 creates temporary files in a world-writable location with predictable file names, which allows remote attackers to overwrite arbitrary files via a symlink attack.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/13392/; http://www.gentoo.org/security/en/glsa/glsa-200412-05.xml; https://exchange.xforce.ibmcloud.com/vulnerabilities/18382
CVE: CVE-2004-1168
Published: 2005-01-10
Description: Stack-based buffer overflow in the WebDav handler in MaxDB WebTools 7.5.00.18 and earlier allows remote attackers to execute arbitrary code via a long Overwrite header.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0340&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/18386; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0340&w=2
CVE: CVE-2004-1169
Published: 2005-01-10
Description: MaxDB WebTools 7.5.00.18 and earlier allows remote attackers to cause a denial of service (application crash) via an HTTP GET request for a file that does not exist, followed by two carriage returns, which causes a NULL dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0340&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/18387; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0340&w=2
CVE: CVE-2004-1170
Published: 2005-01-10
Description: a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-08/1026.html; http://bugs.debian.org/283134; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6660&w=2
CVE: CVE-2004-1171
Published: 2005-01-10
Description: KDE 3.2.x and 3.3.0 through 3.3.2, when saving credentials that are (1) manually entered by the user or (2) created by the SMB protocol handler, stores those credentials for plaintext in the user's .desktop file, which may be created with world-readable permissions, which could allow local users to obtain usernames and passwords for remote resources such as SMB shares.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-11/1292.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9694&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1488&w=2
CVE: CVE-2004-1172
Published: 2005-01-10
Description: Stack-based buffer overflow in the Agent Browser in Veritas Backup Exec 8.x before 8.60.3878 Hotfix 68, and 9.x before 9.1.4691 Hotfix 40, allows remote attackers to execute arbitrary code via a registration request with a long hostname.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/13495/; http://seer.support.veritas.com/docs/273419.htm; http://seer.support.veritas.com/docs/273420.htm
CVE: CVE-2004-1177
Published: 2005-01-10
Description: Cross-site scripting (XSS) vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page.
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=287555; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6351&w=2; http://secunia.com/advisories/13603
CVE: CVE-2004-1187
Published: 2005-01-10
Description: Heap-based buffer overflow in the pnm_get_chunk function for xine 0.99.2, and other packages such as MPlayer that use the same code, allows remote attackers to execute arbitrary code via long PNA_TAG values, a different vulnerability than CVE-2004-1188.
CVSS Score: 10.0 (HIGH)
References: http://cvs.sourceforge.net/viewcvs.py/xine/xine-lib/src/input/pnm.c?r1=1.20&r2=1.21; http://www.idefense.com/application/poi/display?id=176&type=vulnerabilities; http://www.mandriva.com/security/advisories?name=MDKSA-2005:011
CVE: CVE-2004-1188
Published: 2005-01-10
Description: The pnm_get_chunk function in xine 0.99.2 and earlier, and other packages such as MPlayer that use the same code, does not properly verify that the chunk size is less than the PREAMBLE_SIZE, which causes a read operation with a negative length that leads to a buffer overflow via (1) RMF_TAG, (2) DATA_TAG, (3) PROP_TAG, (4) MDPR_TAG, and (5) CONT_TAG values, a different vulnerability than CVE-2004-1187.
CVSS Score: 10.0 (HIGH)
References: http://cvs.sourceforge.net/viewcvs.py/xine/xine-lib/src/input/pnm.c?r1=1.20&r2=1.21; http://www.idefense.com/application/poi/display?id=177&type=vulnerabilities; http://www.mandriva.com/security/advisories?name=MDKSA-2005:011
CVE: CVE-2004-1190
Published: 2005-01-10
Description: SUSE Linux before 9.1 and SUSE Linux Enterprise Server before 9 do not properly check commands sent to CD devices that have been opened read-only, which could allow local users to conduct unauthorized write activities to modify the firmware of associated SCSI devices.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/18510; http://www.novell.com/linux/security/advisories/2004_42_kernel.html; http://www.redhat.com/support/errata/RHSA-2006-0101.html
CVE: CVE-2004-1191
Published: 2005-01-10
Description: Race condition in SuSE Linux 8.1 through 9.2, when run on SMP systems that have more than 4GB of memory, could allow local users to read unauthorized memory from "foreign memory pages."
CVSS Score: 1.2 (LOW)
References: http://www.novell.com/linux/security/advisories/2004_42_kernel.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/18137; http://www.novell.com/linux/security/advisories/2004_42_kernel.html
CVE: CVE-2004-1192
Published: 2005-01-10
Description: Format string vulnerability in the lprintf function in Citadel/UX 6.27 and earlier allows remote attackers to execute arbitrary code via format string specifiers sent to the server.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0696&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3400&w=2; http://www.nosystem.com.ar/advisories/advisory-09.txt
CVE: CVE-2004-1193
Published: 2005-01-10
Description: Prevx Home 1.0 allows local users with administrator privileges to bypass the intrusion prevention features by directly writing to \device\physicalmemory, which restores the running kernel's original SDT ServiceTable.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3639&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6367&w=2; http://securitytracker.com/id?1012294
CVE: CVE-2004-1194
Published: 2005-01-10
Description: Buffer overflow in Star Wars Battlefront 1.11 and earlier allows remote attackers to cause a denial of service (application crash) via a long nickname.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2050&w=2; http://www.securityfocus.com/bid/11750; https://exchange.xforce.ibmcloud.com/vulnerabilities/18256
CVE: CVE-2004-1195
Published: 2005-01-10
Description: Star Wars Battlefront 1.11 and earlier allows remote attackers to cause a denial of service (application crash) via a join request that contains a memory address that causes the server to read arbitrary memory.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2050&w=2; http://www.securityfocus.com/bid/11750; https://exchange.xforce.ibmcloud.com/vulnerabilities/18257
CVE: CVE-2004-1196
Published: 2005-01-10
Description: Cross-site scripting (XSS) vulnerability in inmail.pl in Insite Inmail allows remote attackers to inject arbitrary web script or HTML via the acao parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9018&w=2; http://secunia.com/advisories/13188/; http://www.securityfocus.com/bid/11758
CVE: CVE-2004-1197
Published: 2005-01-10
Description: Cross-site scripting (XSS) vulnerability in inshop.pl in Insite inShop allows remote attackers to inject arbitrary web script or HTML via the screen parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9018&w=2; http://secunia.com/advisories/13188/; http://www.securityfocus.com/bid/11758
CVE: CVE-2004-1199
Published: 2005-01-10
Description: Safari 1.2.4 on Mac OS X 10.3.6 allows remote attackers to cause a denial of service (application crash from memory exhaustion), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/029458.html; http://www.securityfocus.com/bid/11759; https://exchange.xforce.ibmcloud.com/vulnerabilities/18282
CVE: CVE-2004-1201
Published: 2005-01-10
Description: Opera 7.54 allows remote attackers to cause a denial of service (application crash from memory exhaustion), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-400
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2530&w=2; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]3993&w=2; http://www.securityfocus.com/bid/11762
CVE: CVE-2004-1202
Published: 2005-01-10
Description: Cross-site scripting (XSS) vulnerability in parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to inject arbitrary web script or HTML via the file parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/029499.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3510&w=2; http://www.phpcms.de/download/index.en.html
CVE: CVE-2004-1203
Published: 2005-01-10
Description: parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to gain sensitive information via an invalid file parameter, which reveals the web server's installation path.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/029499.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3510&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/18272
CVE: CVE-2004-1204
Published: 2005-01-10
Description: FluxBox 0.9.10 and earlier versions allows local users to cause a denial of service (application crash) by calling Xman with a long -title value, possibly triggering a buffer overflow.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5867&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/18264; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5867&w=2
CVE: CVE-2004-1205
Published: 2005-01-10
Description: codebrowserpntm.php in PnTresMailer 6.03 allows remote attackers to gain sensitive information via an invalid filetohighlight parameter, which reveals the full path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6037&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/18263; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6037&w=2
CVE: CVE-2004-1206
Published: 2005-01-10
Description: Directory traversal vulnerability in codebrowserpntm.php in pnTresMailer 6.0.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the filetodownload parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6037&w=2; http://www.securityfocus.com/bid/11767; https://exchange.xforce.ibmcloud.com/vulnerabilities/18263
CVE: CVE-2004-1207
Published: 2005-01-10
Description: The Serious engine, as used in (1) Alpha Black Zero Intrepid Protocol 1.04 and earlier, (2) Nitro family, and (3) Serious Sam Second Encounter 1.07 allows remote attackers to cause a denial of service (server crash) via a large number of UDP join requests that exceeds the maximum player limit, as originally reported for Alpha Black Zero.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8405&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5605&w=2; http://secunia.com/advisories/12687
CVE: CVE-2004-1208
Published: 2005-01-10
Description: Buffer overflow in Orbz 2.10 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long password field in a join request.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2580&w=2; http://www.securityfocus.com/bid/11774; https://exchange.xforce.ibmcloud.com/vulnerabilities/18298
CVE: CVE-2004-1209
Published: 2005-01-10
Description: Verisign Payflow Link, when running with empty Accepted URL fields, does not properly verify the data in the hidden AMOUNT field, which allows remote attackers to modify the price of the items that they purchase.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0226&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/18299; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0226&w=2
CVE: CVE-2004-1210
Published: 2005-01-10
Description: Cross-site scripting (XSS) vulnerability in proxylog.dat in IPCop 1.4.1 and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the (1) url or (2) part variables.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5001&w=2; http://www.kurczaba.com/html/security/0411291.htm; http://www.securityfocus.com/bid/11779
CVE: CVE-2004-1211
Published: 2005-01-10
Description: Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via long arguments to the (1) EXAMINE, (2) SUBSCRIBE, (3) STATUS, (4) APPEND, (5) CHECK, (6) CLOSE, (7) EXPUNGE, (8) FETCH, (9) RENAME, (10) DELETE, (11) LIST, (12) SEARCH, (13) CREATE, or (14) UNSUBSCRIBE commands.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://home.kabelfoon.nl/~jaabogae/han/m_401b.html; http://lists.grok.org.uk/pipermail/full-disclosure/2004-December/029701.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9991&w=2
CVE: CVE-2004-1212
Published: 2005-01-10
Description: Directory traversal vulnerability in btdownload.php in Blog Torrent preview 0.8 allows remote attackers to download arbitrary files via a .. (dot dot) in the file argument.
CVSS Score: 5.0 (MEDIUM)
References: http://cvs.sourceforge.net/viewcvs.py/battletorrent/btorrent_server/btdownload.php?r1=1.6&r2=1.7; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7165&w=2; http://www.securityfocus.com/bid/11795