morpheuslord/cve-llm-training huggingface dataset:
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0277.

assistant: Format string vulnerability in Dream FTP 1.02 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the username.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0278.

assistant: Ratbag game engine, as used in products such as Dirt Track Racing, Leadfoot, and World of Outlaws Spring Cars, allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet that specifies the length of data to read and then sends a second TCP packet that contains less data than specified, which causes Ratbag to repeatedly check the socket for more data.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0279.

assistant: AIM Sniff (aimSniff.pl) 0.9b allows local users to overwrite arbitrary files via a symlink attack on /tmp/AS.log.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0280.

assistant: Caucho Technology Resin 2.1.12 allows remote attackers to view JSP source via an HTTP request to a .jsp file that ends in a "%20" (encoded space character), e.g. index.jsp%20.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0281.

assistant: Caucho Technology Resin 2.1.12 allows remote attackers to gain sensitive information and view the contents of the /WEB-INF/ directory via an HTTP request for "WEB-INF..", which is equivalent to "WEB-INF" in Windows.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0282.

assistant: Crob FTP daemon 3.5.2 allows remote attackers to cause a denial of service (crash) by repeatedly connecting to and disconnecting from the server.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0283.

assistant: Mailmgr 1.2.3 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/mailmgr.unsort, (2) /tmp/mailmgr.tmp, or (3) /tmp/mailmgr.sort.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0284.

assistant: Microsoft Internet Explorer 6.0, Outlook 2002, and Outlook 2003 allow remote attackers to cause a denial of service (CPU consumption), if "Do not save encrypted pages to disk" is disabled, via a web site or HTML e-mail that contains two null characters (%00) after the host name.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0285.

assistant: PHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2) AllMyLinks, and (3) AllMyGuests allow remote attackers to execute arbitrary PHP code via a URL in the _AMVconfig[cfg_serverpath] parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0286.

assistant: Buffer overflow in RobotFTP 1.0 and 2.0 beta 1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long username.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0287.

assistant: Xlight FTP server 1.52 allows remote authenticated users to cause a denial of service (crash) via a RETR command with a long argument containing a large number of / (slash) characters, possibly triggering a buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0288.

assistant: Buffer overflow in the UdmDocToTextBuf function in mnoGoSearch 3.2.13 through 3.2.15 could allow remote attackers to execute arbitrary code by indexing a large document.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0289.

assistant: Buffer overflow in sdbscan in SignatureDB 0.1.1 allows local users to cause a denial of service (segmentation fault) via a database file that contains a large key parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0290.

assistant: Buffer overflow in Purge Jihad 2.0.1 and earlier allows remote game servers to execute arbitrary code via an information packet that contains large (1) battle type and (2) map name fields.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0291.

assistant: SQL injection vulnerability in post.php for YaBB SE 1.5.4 and 1.5.5 allows remote attackers to obtain hashed passwords via the quote parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0292.

assistant: Buffer overflow in KarjaSoft Sami HTTP Server 1.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0293.

assistant: Directory traversal vulnerability in ShopCartCGI 2.3 allows remote attackers to retrieve arbitrary files via a .. (dot dot) in a HTTP request to (1) gotopage.cgi or (2) genindexpage.cgi.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0294.

assistant: YaBB 1 SP 1.3.1 displays different error messages when a user exists or not, which makes it easier for remote attackers to identify valid users and conduct a brute force password guessing attack.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0295.

assistant: TsFtpSrv.exe in Broker FTP 6.1.0.0 allows remote attackers to cause a denial of service (CPU consumption) via an open idle connection.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0296.

assistant: TsFtpSrv.exe in Broker FTP 6.1.0.0 allows remote attackers to cause a TsFtpSrv.exe to exit with an exception by opening and immediately closing a connection.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0297.

assistant: Buffer overflow in the Lightweight Directory Access Protocol (LDAP) daemon (iLDAP.exe 3.9.15.10) in Ipswitch IMail Server 8.03 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via an LDAP message with a large tag length.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0298.

assistant: CesarFTP 0.99e allows remote attackers to cause a denial of service (CPU consumption) via a long RETR parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0299.

assistant: Buffer overflow in smallftpd 0.99 allows local users to cause a denial of service (crash) via an FTP request with a large number of "/" (slash) characters.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0300.

assistant: SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access via (1) the cat parameter in shop.php, (2) the id parameter in more.php, (3) the cat_manufacturer parameter in shop_by_brand.php, or (4) the id parameter in listing.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0301.

assistant: Cross-site scripting (XSS) vulnerability in more.php for Online Store Kit 3.0 allows remote attackers to inject arbitrary HTML via the id parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0302.

assistant: Directory traversal vulnerability in OWLS 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the (1) file parameter in index.php, (2) editfile in glossary.php, or (3) editfile in newmultiplechoice.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0303.

assistant: OWLS 1.0 allows remote attackers to retrieve arbitrary files via absolute pathnames in (1) the file parameter in /glossaries/index.php, (2) the filename parameter in /readings/index.php, or (3) the filename parameter in /multiplechoice/resultsignore.php, as demonstrated using /etc/passwd.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0304.

assistant: SQL injection vulnerability in browse_items.asp in WebCortex WebStores 2000 6.0 allows remote attackers to gain unauthorized access and execute arbitrary commands via the Search_Text parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0305.

assistant: Cross-site scripting (XSS) vulnerability in error.asp in WebCortex WebStores 2000 6.0 allows remote attackers to execute arbitrary script as other users and steal session IDs via the Message_id parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0306.

assistant: Cisco ONS 15327 before 4.1(3), ONS 15454 before 4.6(1), ONS 15454 SD before 4.1(3), and Cisco ONS 15600 before 1.3(0) enable TFTP service on UDP port 69 by default, which allows remote attackers to GET or PUT ONS system files on the current active TCC in the /flash0 or /flash1 directories.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0307.

assistant: Cisco ONS 15327 before 4.1(3), ONS 15454 before 4.6(1), and ONS 15454 SD before 4.1(3) allows remote attackers to cause a denial of service (reset) by not sending the ACK portion of the TCP three-way handshake and sending an invalid response instead.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0308.

assistant: Unknown vulnerability in Cisco ONS 15327 before 4.1(3), ONS 15454 before 4.6(1), ONS 15454 SD before 4.1(3), and Cisco ONS15600 before 1.3(0) allows a superuser whose account is locked out, disabled, or suspended to gain unauthorized access via a Telnet connection to the VxWorks shell.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0309.

assistant: Stack-based buffer overflow in the SMTP service support in vsmon.exe in Zone Labs ZoneAlarm before 4.5.538.001, ZoneLabs Integrity client 4.0 before 4.0.146.046, and 4.5 before 4.5.085, allows remote attackers to execute arbitrary code via a long RCPT TO argument.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0310.

assistant: Cross-site scripting (XSS) vulnerability in LiveJournal 1.0 and 1.1 allows remote attackers to execute Javascript as other users via the stylesheet, which does not strip the semicolon or parentheses, as demonstrated using a background:url.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0311.

assistant: American Power Conversion (APC) Web/SNMP Management SmartSlot Card 3.0 through 3.0.3 and 3.21 are shipped with a default password of TENmanUFactOryPOWER, which allows remote attackers to gain unauthorized access.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0312.

assistant: Linksys WAP55AG 1.07 allows remote attackers with access to an SNMP read only community string to gain access to read/write communtiy strings via a query for OID 1.3.6.1.4.1.3955.2.1.13.1.2.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0313.

assistant: Buffer overflow in PSOProxy 0.91 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP request, as demonstrated using a long (1) GET argument or (2) method name.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0314.

assistant: Cross-site scripting (XSS) vulnerability in done.jsp in WebzEdit 1.9 and earlier allows remote attackers to execute arbitrary script as other users via the message parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0315.

assistant: Buffer overflow in Avirt Voice 4.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long GET request on port 1080.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0316.

assistant: Buffer overflow in Avirt Soho 4.3 allows remote attackers to cause a denial of service (crash) via (1) a large GET request to port 1080 or (2) a large GET request of % characters to port 8080.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0317.

assistant: Buffer overflow in eauth in Load Sharing Facility 4.x, 5.x, and 6.x allows local users or remote attackers within the LSF cluster to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long LSF_From_PC parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0318.

assistant: Load Sharing Facility (LSF) 4.x, 5.x, and 6.x uses the LSF_EAUTH_UID environment variable, if it exists, instead of the real UID of the user, which could allow remote attackers within the local cluster to gain privileges.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0319.

assistant: Cross-site scripting (XSS) vulnerability in the font tag in ezBoard 7.3u allows remote attackers to execute arbitrary script as other users, as demonstrated using the background:url in a (1) font color or (2) font face argument.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0320.

assistant: Unknown vulnerability in nCipher Hardware Security Modules (HSM) 1.67.x through 1.99.x allows local users to access secrets stored in the module's run-time memory via certain sequences of commands.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0321.

assistant: Team Factor 1.25 and earlier allows remote attackers to cause a denial of service (crash) via a packet that uses a negative number to specify the size of the data block that follows, which causes Team Factor to read unallocated memory.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0322.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to execute arbitrary script as other users via the (1) member parameter in member.php, (2) uid parameter in u2uadmin.php, (3) user parameter in editprofile.php, (4) an onmouseover event in an align tag when bbcode is allowed, or (5) img tag where bbcode is allowed.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0323.

assistant: Multiple SQL injection vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to inject arbitrary SQL and gain privileges via the (1) ppp parameter in viewthread.php, (2) desc parameter in misc.php, (3) tpp parameter in forumdisplay.php, (4) ascdesc parameter in forumdisplay.php, or (5) the addon parameter in stats.php.  NOTE: it has also been shown that item (3) is also in XMB 1.9 beta.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0324.

assistant: Confirm 0.62 and earlier could allow remote attackers to execute arbitrary code via an e-mail header that contains shell metacharacters such as ", `, |, ;, or $.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0325.

assistant: TYPSoft FTP Server 1.10 allows remote authenticated users to cause a denial of service (CPU consumption) via "//../" arguments to (1) mkd, (2) xmkd, (3) dele, (4) size, (5) retr, (6) stor, (7) appe, (8) rnfr, (9) rnto, (10) rmd, or (11) xrmd, as demonstrated using "//../qwerty".
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0326.

assistant: Buffer overflow in the web proxy for GateKeeper Pro 4.7 allows remote attackers to execute arbitrary code via a long GET request.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0327.

assistant: Directory traversal vulnerability in functions.php in PhpNewsManager 1.46 allows remote attackers to retrieve arbitrary files via ..  (dot dot) sequences in the clang parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0328.

assistant: Gigabyte Gn-B46B 2.4Ghz wireless broadband router firmware 1.003.00 allows local users on the same local network as the router to bypass authentication by using a copy of the router's html menu on a separate system.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0329.

assistant: FreeChat 1.1.1a allows remote attackers to cause a denial of service (crash) via certain unexpected strings, as demonstrated using "aaaaa".
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0330.

assistant: Buffer overflow in Serv-U ftp before 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM command.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0331.

assistant: Heap-based buffer overflow in Dell OpenManage Web Server 3.4.0 allows remote attackers to cause a denial of service (crash) via a HTTP POST with a long application variable.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0332.

assistant: Extremail 1.5.9 does not check passwords correctly when they are all digits or begin with a digit, which allows remote attackers to gain privileges.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0333.

assistant: Buffer overflow in the UUDeview package, as used in WinZip 6.2 through WinZip 8.1 SR-1, and possibly other packages, allows remote attackers to execute arbitrary code via a MIME archive with certain long MIME parameters.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0334.

assistant: InnoMedia VideoPhone allows remote attackers to bypass Basic Authorization via an HTTP request to (1) videophone_admindetail.asp, (2) videophone_syscfg.asp, (3) videophone_upgrade.asp, or (4) videophone_sysctrl.asp that contains a trailing / (slash).  NOTE: the original report mentioned AXIS 2100 Network Camera, but this was likely a cut-and-paste error.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0335.

assistant: LAN SUITE Web Mail 602Pro, when configured to use the "Directory browsing" feature, allows remote attackers to obtain a directory listing via an HTTP request to (1) index.html, (2) cgi-bin/, or (3) users/.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0336.

assistant: LAN SUITE Web Mail 602Pro allows remote attackers to gain sensitive information via the mail login form, which contains the path to the mail directory.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0337.

assistant: Cross-site scripting (XSS) vulnerability in LAN SUITE Web Mail 602Pro allows remote attackers to execute arbitrary script or HTML as other users via a URL to index.html, followed by a / (slash) and the desired script.  NOTE: the vendor states that this bug could not be reproduced, so this issue may be REJECTed in the future.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0338.

assistant: SQL injection vulnerability in search.php for Invision Board Forum allows remote attackers to execute arbitrary SQL queries via the st parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0339.

assistant: Cross-site scripting (XSS) vulnerability in ViewTopic.php in phpBB, possibly 2.0.6c and earlier, allows remote attackers to execute arbitrary script or HTML as other users via the postorder parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0340.

assistant: Stack-based buffer overflow in WFTPD Pro Server 3.21 Release 1, Pro Server 3.20 Release 2, Server 3.21 Release 1, and Server 3.10 allows local users to execute arbitrary code via long (1) LIST, (2) NLST, or (3) STAT commands.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0341.

assistant: WFTPD Pro Server 3.21 Release 1 allocates memory for a command until a 0Ah byte (newline) is sent, which allows local users to cause a denial of service (CPU consumption) by continuing to send a long command that does not contain a newline.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0342.

assistant: WFTPD Pro Server 3.21 Release 1, with the XeroxDocutech option enabled, allows local users to cause a denial of service (crash) via a (1) MKD or (2) XMKD command that causes an absolute path of 260 characters to be used, which overwrites a cookie with a null character, possibly due to an off-by-one error.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0343.

assistant: Multiple SQL injection vulnerabilities in YaBB SE 1.5.4 through 1.5.5b allow remote attackers to execute arbitrary SQL via (1) the msg parameter in ModifyMessage.php or (2) the postid parameter in ModifyMessage.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0344.

assistant: Directory traversal vulnerability in ModifyMessage.php in YaBB SE 1.5.4 through 1.5.5b allows remote attackers to delete arbitrary files via a .. (dot dot) in the attachOld parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0345.

assistant: Buffer overflow in Red Faction client 1.20 and earlier allows remote servers to execute arbitrary code via a long server name.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0346.

assistant: Off-by-one buffer overflow in _xlate_ascii_write() in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0347.

assistant: Cross-site scripting (XSS) vulnerability in delhomepage.cgi in NetScreen-SA 5000 Series running firmware 3.3 Patch 1 (build 4797) allows remote authenticated users to execute arbitrary script as other users via the row parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0348.

assistant: SQL injection vulnerability in viewCart.asp in SpiderSales shopping cart software allows remote attackers to execute arbitrary SQL via the userId parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0349.

assistant: Directory traversal vulnerability in GWeb HTTP Server 0.6 allows remote attackers to view arbitrary files via a .. (dot dot) in the URL.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0350.

assistant: SpiderSales shopping cart does not enforce a minimum length for the private key, which can make it easier for local users to obtain the private key by factoring.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0351.

assistant: Spider Sales shopping cart stores the private key in the same database and table as the public key, which allows local users with access to the database to decrypt data.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0352.

assistant: Cisco 11000 Series Content Services Switches (CSS) running WebNS 5.0(x) before 05.0(04.07)S, and 6.10(x) before 06.10(02.05)S allow remote attackers to cause a denial of service (device reset) via a malformed packet to UDP port 5002.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0353.

assistant: Multiple buffer overflows in auth_ident() function in auth.c for GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to gain privileges via a long string.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0354.

assistant: Multiple format string vulnerabilities in GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to execute arbitrary code via format string specifiers in strings passed to (1) the info function in log.c, (2) the anubis_error function in errs.c, or (3) the ssl_error function in ssl.c.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0355.

assistant: Invision Power Board 1.3 Final allows remote attackers to gain sensitive information by selecting a file for "Personal Photo" that is not an image file, which displays the installation path in an error message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0356.

assistant: Stack-based buffer overflow in Supervisor Report Center in SL Mail Pro 2.0.9 and earlier allows remote attackers to execute arbitrary code via an HTTP request with a long HTTP sub-version.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0357.

assistant: Stack-based buffer overflows in SL Mail Pro 2.0.9 allow remote attackers to execute arbitrary code via (1) user.dll, (2) loadpageadmin.dll or (3) loadpageuser.dll.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0358.

assistant: Cross-site scripting (XSS) vulnerability in VirtuaNews Admin Panel Pro 1.0.3 allows remote attackers to execute arbitrary script as other users via (1) the mainnews parameter in admin.php, (2) the expand parameter in admin.php, (3) the id parameter in admin.php, (4) the catid parameter in admin.php, or (5) an unnamed parameter during the newslogo_upload action in admin.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0359.

assistant: Cross-site scripting (XSS) vulnerability in index.php for Invision Power Board 1.3 final allows remote attackers to execute arbitrary script as other users via the (1) c, (2) f, (3) showtopic, (4) showuser, or (5) username parameters.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0360.

assistant: Unknown vulnerability in passwd(1) in Solaris 8.0 and 9.0 allows local users to gain privileges via unknown attack vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0361.

assistant: The Javascript engine in Safari 1.2 and earlier allows remote attackers to cause a denial of service (segmentation fault) by creating a new Array object with a large size value, then writing into that array.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0362.

assistant: Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRV_MULTI response containing a SRV_USER_ONLINE response packet and a SRV_META_USER response packet with long (1) nickname, (2) firstname, (3) lastname, or (4) email address fields, as exploited by the Witty worm.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0363.

assistant: Stack-based buffer overflow in the SymSpamHelper ActiveX component (symspam.dll) in Norton AntiSpam 2004, as used in Norton Internet Security 2004, allows remote attackers to execute arbitrary code via a long parameter to the LaunchCustomRuleWizard method.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0364.

assistant: The WrapNISUM ActiveX component (WrapUM.dll) in Norton Internet Security 2004 is marked safe for scripting, which allows remote attackers to execute arbitrary programs via the LaunchURL method.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0365.

assistant: The dissect_attribute_value_pairs function in packet-radius.c for Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0366.

assistant: SQL injection vulnerability in the libpam-pgsql library before 0.5.2 allows attackers to execute arbitrary SQL statements.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0367.

assistant: Ethereal 0.10.1 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a zero-length Presentation protocol selector.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0368.

assistant: Double free vulnerability in dtlogin in CDE on Solaris, HP-UX, and other operating systems allows remote attackers to execute arbitrary code via a crafted XDMCP packet.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0369.

assistant: Buffer overflow in Entrust LibKmp ISAKMP library, as used by Symantec Enterprise Firewall 7.0 through 8.0, Gateway Security 5300 1.0, Gateway Security 5400 2.0, and VelociRaptor 1.5, allows remote attackers to execute arbitrary code via a crafted ISAKMP payload.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0370.

assistant: The setsockopt call in the KAME Project IPv6 implementation, as used in FreeBSD 5.2, does not properly handle certain IPv6 socket options, which could allow attackers to read kernel memory and cause a system panic.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0371.

assistant: Heimdal 0.6.x before 0.6.1 and 0.5.x before 0.5.3 does not properly perform certain consistency checks for cross-realm requests, which allows remote attackers with control of a realm to impersonate others in the cross-realm trust path.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0372.

assistant: xine allows local users to overwrite arbitrary files via a symlink attack on a bug report email that is generated by the (1) xine-bugreport or (2) xine-check scripts.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0374.

assistant: Interchange before 5.0.1 allows remote attackers to "expose the content of arbitrary variables" and read or modify sensitive SQL information via an HTTP request ending with the "__SQLUSER__" string.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0375.

assistant: SYMNDIS.SYS in Symantec Norton Internet Security 2003 and 2004, Norton Personal Firewall 2003 and 2004, Client Firewall 5.01 and 5.1.1, and Client Security 1.0 and 1.1 allow remote attackers to cause a denial of service (infinite loop) via a TCP packet with (1) SACK option or (2) Alternate Checksum Data option followed by a length of zero.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0376.

assistant: oftpd 0.3.6 and earlier allows remote attackers to cause a denial of service (crash) via a PORT command with a large value.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0377.

assistant: Buffer overflow in the win32_stat function for (1) ActiveState's ActivePerl and (2) Larry Wall's Perl before 5.8.3 allows local or remote attackers to execute arbitrary commands via filenames that end in a backslash character.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0379.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in Microsoft SharePoint Portal Server 2001 allow remote attackers to process arbitrary web content and steal cookies via certain server scripts.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0380.

assistant: The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0381.

assistant: mysqlbug in MySQL allows local users to overwrite arbitrary files via a symlink attack on the failed-mysql-bugreport temporary file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0382.

assistant: Unknown vulnerability in the CUPS printing system in Mac OS X 10.3.3 and Mac OS X 10.2.8 with unknown impact, possibly related to a configuration file setting.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0383.

assistant: Unknown vulnerability in Mail for Mac OS X 10.3.3 and 10.2.8, with unknown impact, related to "the handling of HTML-formatted email."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0385.

assistant: Heap-based buffer overflow in Oracle 9i Application Server Web Cache 9.0.4.0.0, 9.0.3.1.0, 9.0.2.3.0, and 9.0.0.4.0 allows remote attackers to execute arbitrary code via a long HTTP request method header to the Web Cache listener.  NOTE: due to the vagueness of the Oracle advisory, it is not clear whether there are additional issues besides this overflow, although the advisory alludes to multiple "vulnerabilities."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0386.

assistant: Buffer overflow in the HTTP parser for MPlayer 1.0pre3 and earlier, 0.90, and 0.91 allows remote attackers to execute arbitrary code via a long Location header.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0387.

assistant: Stack-based buffer overflow in the RT3 plugin, as used in RealPlayer 8, RealOne Player, RealOne Player 10 beta, and RealOne Player Enterprise, allows remote attackers to execute arbitrary code via a malformed .R3T file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0388.

assistant: The mysqld_multi script in MySQL allows local users to overwrite arbitrary files via a symlink attack.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0389.

assistant: RealNetworks Helix Universal Server 9.0.1 and 9.0.2 allows remote attackers to cause a denial of service (crash) via malformed requests that trigger a null dereference, as demonstrated using (1) GET_PARAMETER or (2) DESCRIBE requests.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0390.

assistant: SCO OpenServer 5.0.5 through 5.0.7 only supports Xauthority style access control when users log in using scologin, which allows remote attackers to gain unauthorized access to an X session via other X login methods.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0391.

assistant: Cisco Wireless LAN Solution Engine (WLSE) 2.0 through 2.5 and Hosting Solution Engine (HSE) 1.7 through 1.7.3 have a hardcoded username and password, which allows remote attackers to add new users, modify existing users, and change configuration.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0392.

assistant: racoon before 20040407b allows remote attackers to cause a denial of service (infinite loop and dropped connections) via an IKE message with a malformed Generic Payload Header containing invalid (1) "Security Association Next Payload" and (2) "RESERVED" fields.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0393.

assistant: Format string vulnerability in the msg function for rlpr daemon (rlprd) 2.0.4 allows remote attackers to execute arbitrary code via format string specifiers in a buffer that can not be resolved, which is provided to the syslog function.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0394.

assistant: A "potential" buffer overflow exists in the panic() function in Linux 2.4.x, although it may not be exploitable due to the functionality of panic.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0395.

assistant: The xatitv program in the gatos package does not properly drop root privileges when the configuration file does not exist, which allows local users to execute arbitrary commands via shell metacharacters in a system call.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0396.

assistant: Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0397.

assistant: Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0398.

assistant: Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library (libneon) 0.24.5 and earlier, as used by cadaver before 0.22, allows remote WebDAV servers to execute arbitrary code on the client.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0399.

assistant: Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify option is true, allows remote attackers to cause a denial of service and possibly execute arbitrary code during sender verification.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0400.

assistant: Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code during the header check.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0401.

assistant: Unknown vulnerability in libtasn1 0.1.x before 0.1.2, and 0.2.x before 0.2.7, related to the DER parsing functions.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0402.

assistant: Buffer overflow in xpcd-svga in xpcd before 2.08, and possibly other versions, may allow local users to execute arbitrary code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0403.

assistant: Racoon before 20040408a allows remote attackers to cause a denial of service (memory consumption) via an ISAKMP packet with a large length field.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0404.

assistant: logcheck before 1.1.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary directory in /var/tmp.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0405.

assistant: CVS before 1.11 allows CVS clients to read arbitrary files via .. (dot dot) sequences in filenames via CVS client requests, a different vulnerability than CVE-2004-0180.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0407.

assistant: The HTML form upload capability in ColdFusion MX 6.1 does not reclaim disk space if an upload is interrupted, which allows remote attackers to cause a denial of service (disk consumption) by repeatedly uploading files and interrupting the uploads before they finish.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0408.

assistant: Buffer overflow in the child_service function in the ident2 ident daemon allows remote attackers to execute arbitrary code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0409.

assistant: Stack-based buffer overflow in the Socks-5 proxy code for XChat 1.8.0 to 2.0.8, with socks5 traversal enabled, allows remote attackers to execute arbitrary code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0411.

assistant: The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0412.

assistant: Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0413.

assistant: libsvn_ra_svn in Subversion 1.0.4 trusts the length field of (1) svn://, (2) svn+ssh://, and (3) other svn protocol URL strings, which allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via an integer overflow that leads to a heap-based buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0414.

assistant: CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0415.

assistant: Linux kernel does not properly convert 64-bit file offset pointers to 32 bits, which allows local users to access portions of kernel memory.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0416.

assistant: Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0417.

assistant: Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0418.

assistant: serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0419.

assistant: XDM in XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0, which could allow remote attackers to connect to the port, in violation of the intended restrictions.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0420.

assistant: The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0421.

assistant: The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0422.

assistant: flim before 1.14.3 creates temporary files insecurely, which allows local users to overwrite arbitrary files of the Emacs user via a symlink attack.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0423.

assistant: The log_event function in ssmtp 2.50.6 and earlier allows local users to overwrite arbitrary files via a symlink attack on the ssmtp.log temporary log file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0424.

assistant: Integer overflow in the ip_setsockopt function in Linux kernel 2.4.22 through 2.4.25 and 2.6.1 through 2.6.3 allows local users to cause a denial of service (crash) or execute arbitrary code via the MCAST_MSFILTER socket option.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0425.

assistant: Heap-based buffer overflow in SiteMinder Affiliate Agent 4.x allows remote attackers to execute arbitrary code via a large SMPROFILE cookie.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0426.

assistant: rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, which allows remote attackers to write files outside of the module's path.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0427.

assistant: The do_fork function in Linux 2.4.x before 2.4.26, and 2.6.x before 2.6.6, does not properly decrement the mm_count counter when an error occurs after the mm_struct for a child process has been activated, which triggers a memory leak that allows local users to cause a denial of service (memory exhaustion) via the clone (CLONE_VM) system call.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0428.

assistant: Unknown vulnerability in CoreFoundation in Mac OS X 10.3.3 and Mac OS X 10.3.3 Server, related to "the handling of an environment variable," has unknown attack vectors and unknown impact.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-0429.

assistant: Unknown vulnerability related to "the handling of large requests" in RAdmin for Apple Mac OS X 10.3.3 and Mac OS X 10.2.8 may allow attackers to have unknown impact via unknown attack vectors.