morpheuslord/cve-llm-training huggingface dataset:
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1188.

assistant: The pnm_get_chunk function in xine 0.99.2 and earlier, and other packages such as MPlayer that use the same code, does not properly verify that the chunk size is less than the PREAMBLE_SIZE, which causes a read operation with a negative length that leads to a buffer overflow via (1) RMF_TAG, (2) DATA_TAG, (3) PROP_TAG, (4) MDPR_TAG, and (5) CONT_TAG values, a different vulnerability than CVE-2004-1187.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1189.

assistant: The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1190.

assistant: SUSE Linux before 9.1 and SUSE Linux Enterprise Server before 9 do not properly check commands sent to CD devices that have been opened read-only, which could allow local users to conduct unauthorized write activities to modify the firmware of associated SCSI devices.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1191.

assistant: Race condition in SuSE Linux 8.1 through 9.2, when run on SMP systems that have more than 4GB of memory, could allow local users to read unauthorized memory from "foreign memory pages."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1192.

assistant: Format string vulnerability in the lprintf function in Citadel/UX 6.27 and earlier allows remote attackers to execute arbitrary code via format string specifiers sent to the server.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1193.

assistant: Prevx Home 1.0 allows local users with administrator privileges to bypass the intrusion prevention features by directly writing to \device\physicalmemory, which restores the running kernel's original SDT ServiceTable.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1194.

assistant: Buffer overflow in Star Wars Battlefront 1.11 and earlier allows remote attackers to cause a denial of service (application crash) via a long nickname.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1195.

assistant: Star Wars Battlefront 1.11 and earlier allows remote attackers to cause a denial of service (application crash) via a join request that contains a memory address that causes the server to read arbitrary memory.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1196.

assistant: Cross-site scripting (XSS) vulnerability in inmail.pl in Insite Inmail allows remote attackers to inject arbitrary web script or HTML via the acao parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1197.

assistant: Cross-site scripting (XSS) vulnerability in inshop.pl in Insite inShop allows remote attackers to inject arbitrary web script or HTML via the screen parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1198.

assistant: Microsoft Internet Explorer allows remote attackers to cause a denial of service (application crash from memory consumption), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1199.

assistant: Safari 1.2.4 on Mac OS X 10.3.6 allows remote attackers to cause a denial of service (application crash from memory exhaustion), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1200.

assistant: Firefox and Mozilla allow remote attackers to cause a denial of service (application crash from memory consumption), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1201.

assistant: Opera 7.54 allows remote attackers to cause a denial of service (application crash from memory exhaustion), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1202.

assistant: Cross-site scripting (XSS) vulnerability in parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to inject arbitrary web script or HTML via the file parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1203.

assistant: parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to gain sensitive information via an invalid file parameter, which reveals the web server's installation path.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1204.

assistant: FluxBox 0.9.10 and earlier versions allows local users to cause a denial of service (application crash) by calling Xman with a long -title value, possibly triggering a buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1205.

assistant: codebrowserpntm.php in PnTresMailer 6.03 allows remote attackers to gain sensitive information via an invalid filetohighlight parameter, which reveals the full path in an error message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1206.

assistant: Directory traversal vulnerability in codebrowserpntm.php in pnTresMailer 6.0.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the filetodownload parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1207.

assistant: The Serious engine, as used in (1) Alpha Black Zero Intrepid Protocol 1.04 and earlier, (2) Nitro family, and (3) Serious Sam Second Encounter 1.07 allows remote attackers to cause a denial of service (server crash) via a large number of UDP join requests that exceeds the maximum player limit, as originally reported for Alpha Black Zero.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1208.

assistant: Buffer overflow in Orbz 2.10 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long password field in a join request.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1209.

assistant: Verisign Payflow Link, when running with empty Accepted URL fields, does not properly verify the data in the hidden AMOUNT field, which allows remote attackers to modify the price of the items that they purchase.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1210.

assistant: Cross-site scripting (XSS) vulnerability in proxylog.dat in IPCop 1.4.1 and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the (1) url or (2) part variables.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1211.

assistant: Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via long arguments to the (1) EXAMINE, (2) SUBSCRIBE, (3) STATUS, (4) APPEND, (5) CHECK, (6) CLOSE, (7) EXPUNGE, (8) FETCH, (9) RENAME, (10) DELETE, (11) LIST, (12) SEARCH, (13) CREATE, or (14) UNSUBSCRIBE commands.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1212.

assistant: Directory traversal vulnerability in btdownload.php in Blog Torrent preview 0.8 allows remote attackers to download arbitrary files via a .. (dot dot) in the file argument.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1213.

assistant: Cross-site scripting (XSS) vulnerability in index.php in Advanced Guestbook 2.3.1, 2.2, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the entry parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1214.

assistant: Format string vulnerability in Kreed 1.05 and earlier allows remote attackers to execute arbitrary code via format specifiers in (1) a nickname or (2) message text.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1215.

assistant: Kreed 1.05 and earlier allows remote attackers to cause a denial of service (server disconnect) via a long UDP packet, which causes a "message too long" socket error.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1216.

assistant: The scripts that handle players in Kreed 1.05 and earlier allow remote attackers to cause a denial of service (server freeze) via a long (1) nickname or (2) model type, which generates dialog boxes on the server that must be manually handled before the server continues the game.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1217.

assistant: Hosting Controller 6.1 Hotfix 1.4, and possibly other versions, allows remote attackers to view arbitrary directories by specifying the target pathname in the FilePath parameter to (1) Statsbrowse.asp or (2) Generalbrowse.asp.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1218.

assistant: Remote Execute 2.30 allows remote attackers to cause a denial of service (application crash) by making 7 simultaneous connections.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1219.

assistant: paFileDB 3.1, when using sessions authentication and while the administrator logs on, allows remote attackers to read the administrator's password hash and conduct brute force password guessing attacks by listing the contents of the sessions directory and reading the associated file for the administrator session.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1220.

assistant: Battlefield 1942 1.6.19 and earlier, and Battlefield Vietnam 1.2 and earlier, allows a remote master server to cause a denial of service (client crash) via a server reply that contains a large numplayers value, which triggers a null dereference.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1221.

assistant: Directory traversal vulnerability in weblibs.pl in WebLibs 1.0 allows remote attackers to read arbitrary files via .. sequences in the TextFile parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1222.

assistant: weblibs.pl in WebLibs 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the TextFile parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1223.

assistant: The Management Agent in F-Secure Policy Manager 5.11.2810 allows remote attackers to gain sensitive information, such as the absolute path for the web server, via an HTTP request to fsmsh.dll without any parameters.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1224.

assistant: Off-by-one error in the mtr_curses_keyaction function for mtr 0.55 through 0.65 allows local users to hijack raw sockets, as demonstrated using the "s" keybinding, which leaves a buffer without a NULL terminator.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1225.

assistant: SQL injection vulnerability in SugarCRM Sugar Sales before 2.0.1a allows remote attackers to execute arbitrary SQL commands and gain privileges via the record parameter in a DetailView action to index.php, and record parameters in other functionality.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1226.

assistant: SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to gain sensitive information via certain requests to scripts that contain invalid input, which reveals the path in an error message, as demonstrated using phprint.php with an empty module parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1227.

assistant: Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to read arbitrary files and possibly execute arbitrary PHP code via .. (dot dot) sequences in the (1) module, (2) action, or (3) theme parameters to index.php, (4) the theme parameter to Login.php, and possibly other parameters or scripts.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1228.

assistant: The install scripts in SugarCRM Sugar Sales 2.0.1c and earlier are not removed after installation, which allows attackers to obtain the MySQL administrative password in cleartext from an installation form, or to cause a denial of service by changing database settings to the default.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1229.

assistant: Cross-site scripting vulnerability in the parser for Gadu-Gadu allows remote attackers to inject arbitrary web script or HTML via (1) http:// or (2) news:// URLs, a different vulnerability than CVE-2004-1410.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1230.

assistant: Gadu-Gadu allows remote attackers to gain sensitive information and read files from the _cache directory of other users via a DCC connection and a CTCP packet that contains a 1 as the type and a 4 as the subtype.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1231.

assistant: Directory traversal vulnerability in Gadu-Gadu allows remote attackers to read arbitrary files via .. (dot dot) sequences in a DCC connection with a CTCP packet that contains a 1 as the type and a 4 as the subtype.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1232.

assistant: Stack-based buffer overflow in the code that sends images in Gadu-Gadu allows remote attackers to execute arbitrary code via a large image filename.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1233.

assistant: Integer overflow in Gadu-Gadu allows remote attackers to cause a denial of service (disk consumption) via a user packet to the DCC file transfer capability with an invalid file length.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1234.

assistant: load_elf_binary in Linux before 2.4.26 allows local users to cause a denial of service (system crash) via an ELF binary in which the interpreter is NULL.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1235.

assistant: Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2.4 through 2.429-rc2 and 2.6 through 2.6.10 allows local users to execute arbitrary code by manipulating the VMA descriptor.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1236.

assistant: Buffer overflow in the LDAP component for Netscape Directory Server (NDS) 3.6 on HP-UX and other operating systems allows remote attackers to execute arbitrary code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1237.

assistant: Unknown vulnerability in the system call filtering code in the audit subsystem for Red Hat Enterprise Linux 3 allows local users to cause a denial of service (system crash) via unknown vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1244.

assistant: Windows Media Player 9 allows remote attackers to execute arbitrary code via a PNG file containing large (1) width or (2) height values, aka the "PNG Processing Vulnerability."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1254.

assistant: WinRAR 3.40, and possibly earlier versions, allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename, possibly causing an integer overflow that leads to a buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1255.

assistant: Buffer overflow in the expandtabs function in 2fax 3.04 allows remote attackers to execute arbitrary code via a text file that is converted to TIFF.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1256.

assistant: Multiple buffer overflows in the (1) event_text and (2) event_specific functions in abc2midi 2004.12.04 allow remote attackers to execute arbitrary code via crafted ABC files.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1257.

assistant: Buffer overflow in the process_abc function in abc.c for abc2mtex 1.6.1 allows remote attackers to execute arbitrary code via crafted ABC files.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1258.

assistant: Buffer overflow in the put_words function in subs.c for abcm2ps 3.7.20 allows remote attackers to execute arbitrary code via crafted ABC files.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1259.

assistant: Multiple buffer overflows in the handle_directive function in abcpp.c for abcpp 1.3.0 allow remote attackers to execute arbitrary code via crafted ABC files.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1260.

assistant: Multiple buffer overflows in the (1) write_heading function in subs.cpp or (2) trim_title function in parse.cpp for abctab2ps 1.6.3 allow remote attackers to execute arbitrary code via crafted ABC files.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1261.

assistant: Multiple buffer overflows in the preparse function in asp2php 0.76.23 allow remote attackers to execute arbitrary code via crafted ASP scripts.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1262.

assistant: Buffer overflow in the bsb_open_header function in libbsb for bsb2ppm 0.0.6 allows remote attackers to execute arbitrary code via crafted BSB pictures.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1263.

assistant: changepassword.cgi in ChangePassword 0.8, when installed setuid, allows local users to execute arbitrary code by modifying the PATH environment variable to point to a malicious "make" program.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1264.

assistant: Buffer overflow in the simplify_path function in config.c for ChBg 1.5 allows remote attackers to execute arbitrary code via a crafted chbg scenario file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1265.

assistant: Buffer overflow in the readObjectChunk function in 3dsimp.cpp for the convex-tool program in Convex 3D 0.8pre1 allows remote attackers to execute arbitrary code via a crafted 3DS file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1266.

assistant: Buffer overflow in the get_field_headers function in csv2xml.cpp for csv2xml 0.5.1 allows remote attackers to execute arbitrary code via a crafted CSV file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1267.

assistant: Buffer overflow in the ParseCommand function in hpgl-input.c in the hpgltops program for CUPS 1.1.22 allows remote attackers to execute arbitrary code via a crafted HPGL file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1268.

assistant: lppasswd in CUPS 1.1.22 ignores write errors when modifying the CUPS passwd file, which allows local users to corrupt the file by filling the associated file system and triggering the write errors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1269.

assistant: lppasswd in CUPS 1.1.22 does not remove the passwd.new file if it encounters a file-size resource limit while writing to passwd.new, which causes subsequent invocations of lppasswd to fail.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1270.

assistant: lppasswd in CUPS 1.1.22, when run in environments that do not ensure that file descriptors 0, 1, and 2 are open when lppasswd is called, does not verify that the passwd.new file is different from STDERR, which allows local users to control output to passwd.new via certain user input that triggers an error message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1271.

assistant: Buffer overflow in the dxfin function in d.c for dxfscope 0.2 allows remote attackers to execute arbitrary code via a crafted DXF file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1272.

assistant: Buffer overflow in the save_embedded_address function in filter.c for elm/bolthole filter 2.6.1 allows remote attackers to execute arbitrary code via a crafted email message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1273.

assistant: Buffer overflow in the DownloadLoop function in main.c for greed 0.81p allows remote attackers to execute arbitrary code via a GRX file containing a long filename.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1274.

assistant: The DownloadLoop function in main.c for greed 0.81p allows remote attackers to execute arbitrary code via a GRX file containing a filename with shell metacharacters.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1275.

assistant: Buffer overflow in the remove_quote function in convert.c for html2hdml 1.0.3 allows remote attackers to execute arbitrary code via a crafted HTML file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1276.

assistant: IglooFTP 0.6.1, when recursively uploading a directory, allows local users to overwrite the files that are being uploaded by creating temporary files with names generated by the tmpnam function, before the files are opened by IglooFTP.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1277.

assistant: The download_selection_recursive() function in ftplist.c for IglooFTP 0.6.1 allows remote malicious FTP servers to overwrite arbitrary files via filenames that contain / (slash) characters.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1278.

assistant: Buffer overflow in the switch_voice function in parse.c for jcabc2ps 20040902 allows remote attackers to execute arbitrary code via a crafted ABC file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1279.

assistant: Buffer overflow in the get_file_list_stdin function in jpegtoavi 1.5 allows remote attackers to execute arbitrary code via a crafted set of JPEG files and filenames.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1280.

assistant: The gui_popup_view_fly function in gui_tview_popup.c for junkie 0.3.1 allows remote malicious FTP servers to execute arbitrary commands via shell metacharacters in a filename.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1281.

assistant: The ftp_retr function in junkie 0.3.1 allows remote malicious FTP servers to overwrite arbitrary files via .. (dot dot) sequences in a filename.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1282.

assistant: Buffer overflow in the strexpand function in string.c for LinPopUp 1.2.0 allows remote attackers to execute arbitrary code via a crafted message that is not properly handled during a Reply operation.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1283.

assistant: Buffer overflow in the Mesh::type method in mesh.c for the mview program in Mesh Viewer 0.2.2 allows remote attackers to execute arbitrary code via crafted mesh files.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1284.

assistant: Buffer overflow in the find_next_file function in playlist.c for mpg123 0.59r allows remote attackers to execute arbitrary code via a crafted MP3 playlist.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1285.

assistant: Buffer overflow in the get_header function in asf_mmst_streaming.c for MPlayer 1.0pre5 allows remote attackers to execute arbitrary code via a crafted ASF video stream.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1286.

assistant: Buffer overflow in the auto_filter_extern function in auto.c for NapShare 1.2, with the extern filter enabled, allows remote attackers to execute arbitrary code via a crafted gnutella response.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1287.

assistant: Buffer overflow in the error function in preproc.c for NASM 0.98.38 1.2 allows attackers to execute arbitrary code via a crafted asm file, a different vulnerability than CVE-2005-1194.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1288.

assistant: Buffer overflow in the parse_html function in o3read.c for o3read 0.0.3 allows remote attackers to execute arbitrary code via a crafted SXW file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1289.

assistant: Multiple buffer overflows in (1) the getline function in pcalutil.c and (2) the get_holiday function in readfile.c for pcal 4.7.1 allow remote attackers to execute arbitrary code via a crafted calendar file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1290.

assistant: Buffer overflow in the process_moves function in pgn2web.c for pgn2web 0.3 allows remote attackers to execute arbitrary code via a crafted PGN file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1291.

assistant: Buffer overflow in qwik-smtpd allows remote attackers to use the server as an SMTP spam relay via a long HELO command, which overwrites the adjacent localIP data buffer.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1292.

assistant: Buffer overflow in the parse_emelody function in parse_emelody.c for ringtonetools 2.22 allows remote attackers to execute arbitrary code via a crafted eMelody file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1293.

assistant: Buffer overflow in the ReadFontTbl function in reader.c for rtf2latex2e 1.0fc2 allows remote attackers to execute arbitrary code via a crafted RTF file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1294.

assistant: The mget function in cmds.c for tnftp 20030825 allows remote FTP servers to overwrite arbitrary files via FTP responses containing file names with / (slash) characters.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1295.

assistant: The slip_down function in slip.c for the uml_net program in uml-utilities 20030903, when uml_net is installed setuid root, does not verify whether the calling user has sufficient permission to disable an interface, which allows local users to cause a denial of service (network service disabled).
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1296.

assistant: The (1) eqn2graph and (2) pic2graph scripts in groff 1.18.1 allow local users to overwrite arbitrary files via a symlink attack on temporary files.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1297.

assistant: Buffer overflow in the process_font_table function in convert.c for unrtf 0.19.3 allows remote attackers to execute arbitrary code via a crafted RTF file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1298.

assistant: Buffer overflow in the parse function in vb2c.c for vb2c 0.02 allows remote attackers to execute arbitrary code via a crafted FRM file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1299.

assistant: Buffer overflow in the get_attr function in html.c for vilistextum 2.6.6 allows remote attackers to execute arbitrary code via a crafted web page.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1300.

assistant: Buffer overflow in the open_aiff_file function in demux_aiff.c for xine-lib (libxine) 1-rc7 allows remote attackers to execute arbitrary code via a crafted AIFF file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1301.

assistant: Buffer overflow in the book_format_sql function in format.c for xlreader 0.9.0 allows remote attackers to execute arbitrary code via a crafted Excel (XLS) file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1302.

assistant: The id3tag_sort function in id3tag.c for YAMT 0.5 allows remote attackers to execute arbitrary commands via an MP3 file with double quotes in the Artist tag.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1303.

assistant: Buffer overflow in the get function in get.c for Yanf 0.4 allows remote malicious web servers to execute arbitrary code via crafted HTTP responses.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1304.

assistant: Stack-based buffer overflow in the ELF header parsing code in file before 4.12 allows attackers to execute arbitrary code via a crafted ELF file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1305.

assistant: The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allow remote attackers to cause a denial of service via (1) the frame number set to zero, which causes an invalid memory address to be used and leads to a kernel crash, or (2) the rate number set to zero, which leads to resource exhaustion and hang.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1306.

assistant: Heap-based buffer overflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers to execute arbitrary code via a crafted .hlp file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1307.

assistant: Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips, which causes a zero byte buffer to be allocated and leads to a heap-based buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1308.

assistant: Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1309.

assistant: Heap-based buffer overflow in the demux_open_bmp function in demux_bmp.c for Unix MPlayer 1.0pre5 allows remote attackers to execute arbitrary code via a bitmap (BMP) file containing a large biClrUsed field.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1310.

assistant: Stack-based buffer overflow in the asf_mmst_streaming.c functionality for MPlayer 1.0pre5 allows remote attackers to execute arbitrary code via a large MMST stream packet.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1311.

assistant: Integer overflow in the real_setup_and_get_header function in real.c for Unix MPlayer 1.0pre5 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a Real RTSP streaming media file with a -1 content-length field, which leads to a heap-based buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1312.

assistant: A bug in the HTML parser in a certain Microsoft HTML library, as used in various third party products, may allow remote attackers to cause a denial of service via certain strings, as reported in GFI MailEssentials for Exchange 9 and 10, and GFI MailSecurity for Exchange 8, which causes emails to remain in IIS or Exchange mail queues.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1313.

assistant: The Smc.exe process in My Firewall Plus 5.0 build 1117, and possibly other versions, does not drop privileges before invoking help, which allows local users to gain privileges.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1314.

assistant: Safari 1.x allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability, a different vulnerability than CVE-2004-1122.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1315.

assistant: viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1316.

assistant: Heap-based buffer overflow in MSG_UnEscapeSearchUrl in nsNNTPProtocol.cpp for Mozilla 1.7.3 and earlier allows remote attackers to cause a denial of service (application crash) via an NNTP URL (news:) with a trailing '\' (backslash) character, which prevents a string from being NULL terminated.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1317.

assistant: Stack-based buffer overflow in doexec.c in Netcat for Windows 1.1, when running with the -e option, allows remote attackers to execute arbitrary code via a long DNS command.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1318.

assistant: Cross-site scripting (XSS) vulnerability in namazu.cgi for Namazu 2.0.13 and earlier allows remote attackers to inject arbitrary HTML and web script via a query that starts with a tab ("%09") character, which prevents the rest of the query from being properly sanitized.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1319.

assistant: The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1320.

assistant: Asante FM2008 running firmware 1.06 is shipped with a default username and password, which could allow remote attackers to gain unauthorized access.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1321.

assistant: The configuration backup in Asante FM2008 running firmware 1.06 stores the username and password in cleartext, which could allow remote attackers to gain unauthorized access.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1322.

assistant: Cisco Unity 2.x, 3.x, and 4.x, when integrated with Microsoft Exchange, has several hard coded usernames and passwords, which allows remote attackers to gain unauthorized access and change configuration settings or read outgoing or incoming e-mail messages.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1323.

assistant: Multiple syscalls in the compat subsystem for NetBSD before 2.0 allow local users to cause a denial of service (kernel crash) via a large signal number to (1) xxx_sys_kill, (2) xxx_sys_sigaction, and possibly other translation functions.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1324.

assistant: The Microsoft Windows Media Player 9.0 ActiveX control may allow remote attackers to execute arbitrary web script in the Local computer zone via the (1) artist or (2) song fields of a music file, if the file is processed using Internet Explorer.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1325.

assistant: The getItemInfoByAtom function in the ActiveX control for Microsoft Windows Media Player 9.0 returns a 0 if the file does not exist and the size of the file if the file exists, which allows remote attackers to determine the existence of files on the local system.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1326.

assistant: Buffer overflow in dxterm in Ultrix 4.5 allows local users to execute arbitrary code via a long -setup parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1327.

assistant: Buffer overflow in Crystal FTP Client 2.8 allows remote malicious servers to execute arbitrary code via a response to a LIST command that contains a file name with a long extension.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1328.

assistant: Unknown vulnerability in newgrp in HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain elevated privileges.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1329.

assistant: Untrusted execution path vulnerability in the diag commands (1) lsmcode, (2) diag_exec, (3) invscout, and (4) invscoutd in AIX 5.1 through 5.3 allows local users to execute arbitrary programs by modifying the DIAGNOSTICS environment variable to point to a malicious Dctrl program.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1330.

assistant: Buffer overflow in paginit in AIX 5.1 through 5.3 allows local users to execute arbitrary code via a long username.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1331.

assistant: The execCommand method in Microsoft Internet Explorer 6.0 SP2 allows remote attackers to bypass the "File Download - Security Warning" dialog and save arbitrary files with arbitrary extensions via the SaveAs command.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1332.

assistant: Stack-based buffer overflow in the FTP daemon in HP-UX 11.11i, with the -v (debug) option enabled, allows remote attackers to execute arbitrary code via a long command request.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1333.

assistant: Integer overflow in the vc_resize function in the Linux kernel 2.4 and 2.6 before 2.6.10 allows local users to cause a denial of service (kernel crash) via a short new screen value, which leads to a buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1334.

assistant: Integer overflow in the ip_options_get function in the Linux kernel before 2.6.10 allows local users to cause a denial of service (kernel crash) via a cmsg_len that contains a -1, which leads to a buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1335.

assistant: Memory leak in the ip_options_get function in the Linux kernel before 2.6.10 allows local users to cause a denial of service (memory consumption) by repeatedly calling the ip_cmsg_send function.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1336.

assistant: The xdvizilla script in tetex-bin 2.0.2 creates temporary files with predictable file names, which allows local users to overwrite arbitrary files via a symlink attack.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1337.

assistant: The POSIX Capability Linux Security Module (LSM) for Linux kernel 2.6 does not properly handle the credentials of a process that is launched before the module is loaded, which allows local users to gain privileges.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1338.

assistant: The triggers in Oracle 9i and 10g allow local users to gain privileges by using a sequence of partially privileged actions: using CCBKAPPLROWTRIG or EXEC_CBK_FN_DML to add arbitrary functions to the SDO_CMT_DBK_FN_TABLE and SDO_CMT_CBK_DML_TABLE, then performing a DELETE on the SDO_TXN_IDX_INSERTS table, which causes the SDO_CMT_CBK_TRIG trigger to execute the user-supplied functions.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1339.

assistant: SQL injection vulnerability in the (1) MDSYS.SDO_GEOM_TRIG_INS1 and (2) MDSYS.SDO_LRS_TRIG_INS default triggers in Oracle 9i and 10g allows remote attackers to execute arbitrary SQL commands via the new.table_name or new.column_name parameters.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1340.

assistant: Debian GNU/Linux 3.0 installs the libpam-radius-auth package with the pam_radius_auth.conf set to be world-readable, which allows local users to obtain sensitive information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1341.

assistant: Cross-site scripting (XSS) vulnerability in info2www before 1.2.2.9 allows remote attackers to inject arbitrary web script or HTML via the arguments to info2www.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1342.

assistant: CVS 1.12 and earlier on Debian GNU/Linux, when using the repouid patch, allows remote attackers to bypass authentication via the pserver access method.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1343.

assistant: CVS 1.12 and earlier on Debian GNU/Linux does not properly handle when a mapping for the current repository does not exist in the cvs-repouids file, which allows remote attackers to cause a denial of service (server crash).
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1345.

assistant: Unknown vulnerability in Sun StorEdge Enterprise Storage Manager (ESM) 2.1 for Solaris 8 and Solaris 9 allows local users with the "ESMUser" role to gain root access.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1346.

assistant: The Sun Solaris Volume Manager (SVM) on Solaris 9 allows local users to cause a denial of service (kernel panic) via a malformed probe request to the SVM.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1347.

assistant: X Display Manager (XDM) on Solaris 8 allows remote attackers to cause a denial of service (XDM crash) via an invalid X Display Manager Control Protocol (XDMCP) request.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1348.

assistant: Unknown vulnerability in in.named on Solaris 8 allows remote attackers to cause a denial of service (process crash).
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1349.

assistant: gzip before 1.3 in Solaris 8, when called with the -f or -force flags, will change the permissions of files that are hard linked to the target files, which allows local users to view or modify these files.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1350.

assistant: Multiple buffer overflows in Sun Java System Web Proxy Server (formerly Sun ONE Proxy Server) 3.6 through 3.6 SP4 allow remote attackers to execute arbitrary code via unknown vectors, possibly CONNECT requests.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1351.

assistant: Unknown vulnerability in the rwho daemon (in.rwhod) for Solaris 7 through 9 allows remote attackers to execute arbitrary code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1352.

assistant: Buffer overflow in the ping daemon of Sun Solaris 7 through 9 may allow local users to execute arbitrary code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1353.

assistant: Unknown vulnerability in LDAP on Sun Solaris 8 and 9, when using Role Based Access Control (RBAC), allows local users to execute certain commands with additional privileges.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1354.

assistant: The Solaris Management Console (SMC) in Sun Solaris 8 and 9 generates different 404 error messages when a file does not exist versus when a file exists but is otherwise inaccessible, which could allow remote attackers to obtain sensitive information in conjunction with a directory traversal (..) attack.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2004-1355.

assistant: Unknown vulnerability in the TCP/IP stack for Sun Solaris 8 and 9 allows local users to cause a denial of service (system panic) via unknown vectors.