yahoo-inc/cve-impacts huggingface dataset:
CVE-2004-1683: A race condition in crrtrap for QNX RTP 6.1 allows local users to gain privileges by modifying the PATH environment variable to reference a malicious io-graphics program before is executed by crrtrap.
Key phrases: gain privileges, gain privileges by modifying the PATH environment variable, race condition
CVE-2004-1684: Zyxel P681 running ZyNOS Vt020225a contains portions of memory in an ARP request, which allows remote attackers to obtain sensitive information by sniffing the network.
Key phrases: obtain sensitive information, obtain sensitive information by sniffing the network
CVE-2004-1685: SMC routers SMC7004VWBR running firmware 1.00.014 and SMC7008ABR EU running firmware 1.42.003 allow remote attackers to bypass authentication by connecting to it from the same IP address as the administrator who is logged in, then accessing the setup_status.htm or status.HTM pages.
Key phrases: bypass authentication, bypass authentication by connecting to it from the
CVE-2004-1686: Internet Explorer 6.0 in Windows XP SP2 allows remote attackers to bypass the Information Bar prompt for ActiveX and Javascript via an XHTML page that contains an Internet Explorer formatted comment between the DOCTYPE tag and the HTML tag, as demonstrated using the DesignScience MathPlayer ActiveX plugin.
Key phrases: bypass the Information Bar prompt for ActiveX and Javascript
CVE-2004-1687: CRLF injection vulnerability in down.asp for Snitz Forums 2000 3.4.04 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the location parameter.
Key phrases: perform HTTP Response Splitting attacks to modify expected, crlf injection, http response splitting
CVE-2004-1688: Pigeon Server 3.02.0143 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a long login name sent to port 3103.
Key phrases: denial of service (infinite loop and CPU consumption), cause a denial of service (infinite loop, cpu consumption
CVE-2004-1689: sudoedit (aka sudo -e) in sudo 1.6.8 opens a temporary file with root privileges, which allows local users to read arbitrary files via a symlink attack on the temporary file before quitting sudoedit.
Key phrases: read arbitrary files, read arbitrary files via a symlink attack on, root privilege
CVE-2004-1690: Cross-site scripting (XSS) vulnerability in the Web Server in DNS4Me 3.0.0.4 allows remote attackers to execute arbitrary web script or HTML via the URL.
Key phrases: execute arbitrary web script or HTML, execute arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1691: The Web Server in DNS4Me 3.0.0.4 allows remote attackers to cause a denial of service (CPU consumption and crash) via a large amount of data.
Key phrases: denial of service (CPU consumption and crash), cause a denial of service (CPU consumption
CVE-2004-1692: Cross-site scripting (XSS) vulnerability in index.php in Mambo 4.5 (1.0.9) allows remote attackers to inject arbitrary web script or HTML via the (1) Itemid, (2) mosmsg, or (3) limit parameters.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1693: PHP remote file inclusion vulnerability in Function.php in Mambo 4.5 (1.0.9) allows remote attackers to execute arbitrary PHP code by modifying the mosConfig_absolute_path parameter to reference a URL on a remote web server that contains the code.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code by modifying the mosConfig_absolute_path, php remote file inclusion
CVE-2004-1694: Symantec ON Command CCM 5.4.x and iCommand 3.0.x has four default usernames and passwords, one of which is hardcoded, which allows remote attackers to gain unauthorized access.
Key phrases: gain unauthorized access, hardcoded
CVE-2004-1695: EmuLive Server4 Commerce Edition Build 7560 allows remote attackers to bypass authentication for the remote administration feature via a URL that contains an extra leading / (slash).
Key phrases: bypass authentication, bypass authentication for the remote administration feature via
CVE-2004-1696: EmuLive Server4 Commerce Edition Build 7560 allows remote attackers to cause a denial of service (application crash) via a sequence of carriage returns sent to TCP port 66.
Key phrases: denial of service (application crash), cause a denial of service (application crash, sequence of carriage returns
CVE-2004-1697: The "Forgot your Password" link in Computer Associates (CA) Unicenter Management Portal 2.0 and 3.1 displays different error messages for users that exist and users that do not exist, which could allow remote attackers to guess valid usernames.
Key phrases: guess valid usernames
CVE-2004-1698: The Base64 function in PopMessenger 1.60 (before 20 Sep 2004) and earlier allows remote attackers to cause a denial of service (application crash) via invalid characters in a message, which causes several alert dialogs to be displayed and leads to a crash.
Key phrases: denial of service (application crash), cause a denial of service (application crash, invalid characters
CVE-2004-1699: SettingsBase.php in Pinnacle ShowCenter 1.51 allows remote attackers to cause a denial of service (web interface errors) via an invalid Skin parameter.
Key phrases: denial of service (web interface errors), cause a denial of service (web interface, invalid skin parameter
CVE-2004-1700: Cross-site scripting (XSS) vulnerability in SettingsBase.php in Pinnacle ShowCenter 1.51 build 121 allows remote attackers to inject arbitrary HTML or web script via the Skin parameter, which is echoed in an error message.
Key phrases: inject arbitrary HTML or web, inject arbitrary HTML or web script via the, cross-site scripting (xss)
CVE-2004-1701: Heap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers to execute arbitrary code via a long SAUTH command during RSA authentication.
Key phrases: execute arbitrary code, execute arbitrary code via a long SAUTH command, heap-based buffer overflow, heap based buffer overflow
CVE-2004-1702: The AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 does not properly check the return value of the ReceiveTransaction function, which leads to a failed malloc call and triggers to a null dereference, which allows remote attackers to cause a denial of service (crash).
Key phrases: denial of service (crash), cause a denial of service (crash), null dereference
CVE-2004-1703: Fusion News 3.6.1 allows remote attackers to add user accounts, if the administrator is logged in, via a comment that contains an img bbcode tag that calls index.php with the signup action, which is executed when the administrator's browser loads the page with the img tag.
Key phrases: add user accounts
CVE-2004-1704: WpQuiz 2.60b1 through 2.60b8 allows remote attackers to gain privileges via a direct request to adminrestore.php in the extras directory.
Key phrases: gain privileges, gain privileges via a direct request to adminrestore.php
CVE-2004-1705: Buffer overflow in Citadel/UX 6.23 and earlier allows remote attackers to cause a denial of service via a long username.
Key phrases: cause a denial of service via a long, buffer overflow
CVE-2004-1706: The U.S. Robotics USR808054 wireless access point allows remote attackers to cause a denial of service (device crash) and possibly execute arbitrary code via an HTTP GET request with a long version string.
Key phrases: execute arbitrary code, denial of service (device crash), cause a denial of service (device crash, long version string
CVE-2004-1707: The (1) dbsnmp and (2) nmo programs in Oracle 8i, Oracle 9i, and Oracle IAS 9.0.2.0.1, on Unix systems, use a default path to find and execute library files while operating at raised privileges, which allows certain Oracle user accounts to gain root privileges via a modified libclntsh.so.9.0.
Key phrases: gain root privileges, gain root privileges via a modified libclntsh.so.9.0, default path
CVE-2004-1708: Webbsyte Chat 0.9.0 allows remote attackers to cause a denial of service (crash) via a large number of connections.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2004-1709: Datakey Rainbow iKey2032 USB token, when using the CIP client package, does not encrypt communications between the token and the driver, which could allow local users to obtain the PINs of other users.
Key phrases: obtain the PINs of other users.
CVE-2004-1710: page.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the url parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-2004-1711: Cross-site scripting (XSS) vulnerability in post.php in Moodle before 1.3 allows remote attackers to inject arbitrary web script or HTML via the reply parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1712: Cross-site scripting (XSS) vulnerability in TypePad allows remote attackers to inject arbitrary Javascript via the name parameter.
Key phrases: inject arbitrary Javascript, inject arbitrary Javascript via the name parameter, cross-site scripting (xss)
CVE-2004-1713: Unknown vulnerability in HP Process Resource Manager (PRM) C.02.01[.01] and earlier, as used by HP-UX Workload Manager (WLM), allows local users to corrupt data files.
Key phrases: corrupt data files, unknown
CVE-2004-1714: BlackICE PC Protection and Server Protection installs (1) firewall.ini, (2) blackice.ini, (3) sigs.ini and (4) protect.ini with Everyone Full Control permissions, which allows local users to cause a denial of service (crash) or modify configuration, as demonstrated by modifying firewall.ini to contain a large firewall rule.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2004-1715: Directory traversal vulnerability in MIMEsweeper for Web before 5.0.4 allows remote attackers or local users to read arbitrary files via "..\\\\", "..\\", and similar dot dot sequences in the URL.
Key phrases: read arbitrary files, read arbitrary files via "..\\\\", directory traversal
CVE-2004-1716: Cross-site scripting (XSS) vulnerability in PForum before 1.26 allows remote attackers to inject arbitrary web script or HTML via the (1) IRC Server or (2) AIM ID fields in the user profile.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1717: Multiple buffer overflows in the psscan function in ps.c for gv (ghostview) allow remote attackers to execute arbitrary code via a Postscript file with a long (1) BoundingBox, (2) comment, (3) Orientation, (4) PageOrder, or (5) Pages value.
Key phrases: execute arbitrary code, execute arbitrary code via a Postscript file with, buffer overflows
CVE-2004-1718: The ZwOpenSection function in Integrity Protection Driver (IPD) 1.4 and earlier allows local users to cause a denial of service (crash) via an invalid pointer in the "oa" argument.
Key phrases: denial of service (crash), cause a denial of service (crash), invalid pointer
CVE-2004-1719: Multiple cross-site scripting (XSS) vulnerabilities in Merak Webmail Server 5.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) category, (2) cserver, (3) ext, (4) global, (5) showgroups, (6) or showlite parameters to address.html, or the (7) spage or (8) autoresponder parameters to settings.html, the (9) folder parameter to readmail.html, or the (10) attachmentpage_text_error parameter to attachment.html, (11) folder, (12) ct, or (13) cv parameters to calendar.html, (14) an <img> tag, or (15) the subject of an e-mail message.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1720: The (1) address.html and possibly (2) calendar.html pages in Merak Mail Server 5.2.7 allow remote attackers to gain sensitive information via an invalid HTTP request, which reveals the installation path. NOTE: it is unclear whether the calendar.html is an exposure, since the path is leaked in web logs that may only be available to the administrators, who would have access to the path through legitimate means.
Key phrases: gain sensitive information, gain sensitive information via an invalid HTTP request
CVE-2004-1721: The (1) function.php or (2) function.view.php scripts in Merak Mail Server 5.2.7 allow remote attackers to read arbitrary PHP files via a direct HTTP request to port 32000.
Key phrases: read arbitrary PHP files, read arbitrary PHP files via a direct HTTP
CVE-2004-1722: SQL injection vulnerability in calendar.html in Merak Mail Server 5.2.7 allows remote attackers to execute arbitrary SQL statements via the schedule parameter.
Key phrases: execute arbitrary SQL statements, execute arbitrary SQL statements via the schedule parameter, sql injection
CVE-2004-1723: The (1) updateuser.php and (2) forums_prune.php scripts in PHP-Fusion 4.00 allow remote attackers to obtain sensitive information via a direct HTTP request, which reveals the installation path in an error message.
Key phrases: obtain sensitive information, obtain sensitive information via a direct HTTP request, direct http request, installation path
CVE-2004-1724: The ReadMe First.txt file in PHP-Fusion 4.0 instructs users to set the permissions on the fusion_admin/db_backups directory to world read/write/execute (777), which allows remote attackers to download or view database backups, which have easily guessable filenames and contain the administrator username and password.
Key phrases: download or view database backups, guessable filenames
CVE-2004-1725: Stack-based buffer overflow in xvbmp.c in XV allows remote attackers to execute arbitrary code via a crafted image file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted image file, stack-based buffer overflow, stack based buffer overflow
CVE-2004-1726: Multiple integer overflows in (1) xviris.c, (2) xvpcx.c, and (3) xvpm.c in XV allow remote attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted image file, integer overflows, heap-based buffer overflow, heap based buffer overflow
CVE-2004-1727: BadBlue 2.5 allows remote attackers to cause a denial of service (refuse HTTP connections) via a large number of connections from the same IP address.
Key phrases: denial of service (refuse HTTP connections), cause a denial of service (refuse HTTP, badblue
CVE-2004-1728: Buffer overflow in British National Corpus SARA (sarad) allows remote attackers to execute arbitrary code by calling the client with a long string.
Key phrases: execute arbitrary code, execute arbitrary code by calling the client with, buffer overflow
CVE-2004-1729: Cross-site scripting (XSS) vulnerability in Nihuo Web Log Analyzer 1.6 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1730: Cross-site scripting (XSS) vulnerability in Mantis bugtracker allows remote attackers to inject arbitrary web script or HTML via (1) the return parameter to login_page.php, (2) e-mail field in signup.php, (3) action parameter to login_select_proj_page.php, or (4) hide_status parameter to view_all_set.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via (, cross-site scripting (xss)
CVE-2004-1731: signup_page.php in Mantis bugtracker allows remote attackers to send e-mail bombs by creating multiple users and providing the same e-mail address.
Key phrases: send e-mail bombs by creating multiple
CVE-2004-1732: SQL injection vulnerability in out.ViewFolder.php in MyDMS before 1.4.2 allows remote attackers to execute arbitrary SQL commands via the folderid parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the folderid parameter, sql injection
CVE-2004-1733: Directory traversal vulnerability in MyDMS 1.4.2 and other versions allows remote registered users to read arbitrary files via .. (dot dot) sequences in the URL.
Key phrases: read arbitrary files, read arbitrary files via .. (dot dot, directory traversal
CVE-2004-1734: PHP remote file inclusion vulnerability in Mantis 0.19.0a allows remote attackers to execute arbitrary PHP code by modifying the (1) t_core_path parameter to bug_api.php or (2) t_core_dir parameter to relationship_api.php to reference a URL on a remote web server that contains the code.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code by modifying the (, php remote file inclusion
CVE-2004-1735: Cross-site scripting (XSS) vulnerability in the create list option in Sympa 4.1.x and earlier allows remote authenticated users to inject arbitrary web script or HTML via the description field.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1736: Cacti 0.8.5a allows remote attackers to gain sensitive information via an HTTP request to (1) auth.php, (2) auth_login.php, (3) auth_changepassword.php, and possibly other php files, which reveal the installation path in a PHP error message.
Key phrases: gain sensitive information, gain sensitive information via an HTTP request to
CVE-2004-1737: SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
Key phrases: execute arbitrary SQL commands, bypass authentication, execute arbitrary SQL commands and bypass authentication via, sql injection, arbitrary sql commands
CVE-2004-1738: Cross-site scripting (XSS) vulnerability in page.php in JShop allows remote attackers to inject arbitrary web script or HTML via the xPage parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1739: Bird Chat 1.61 allows remote attackers to cause a denial of service (crash) via invalid users.
Key phrases: denial of service (crash), cause a denial of service (crash), invalid users
CVE-2004-1740: Music daemon (musicd) 0.0.3 and earlier allows remote attackers to read arbitrary files by calling LOAD with a full pathname, then calling SHOWLIST.
Key phrases: read arbitrary files, read arbitrary files by calling LOAD with a
CVE-2004-1741: Music daemon (musicd) 0.0.3 and earlier allows remote attackers to cause a denial of service (crash) by calling LOAD with a binary file as an argument, then calling SHOWLIST.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2004-1742: Directory traversal vulnerability in WebAPP 0.9.9 allows remote attackers to view arbitrary files via a .. (dot dot) in the viewcat parameter.
Key phrases: view arbitrary files, view arbitrary files via a .. (dot, directory traversal
CVE-2004-1743: Easy File Sharing (EFS) Webserver 1.25 allows remote attackers to view arbitrary files via an HTTP request for the disk_c virtual folder.
Key phrases: view arbitrary files, view arbitrary files via an HTTP request for
CVE-2004-1744: Easy File Sharing (EFS) Webserver 1.25 allows remote attackers to cause a denial of service (CPU consumption or crash) via many large HTTP requests.
Key phrases: denial of service (CPU consumption or crash), cause a denial of service (CPU consumption, cpu consumption
CVE-2004-1745: Buffer overflow in Painkiller 1.3.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2004-1746: Cross-site scripting (XSS) vulnerability in index.php in PHP Code Snippet Library allows remote attackers to inject arbitrary web script or HTML via the (1) cat_select or (2) show parameters.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1747: Cross-site scripting (XSS) vulnerability in NetworkEverywhere NR041 running firmware 1.2 Release 03 allows remote attackers to inject arbitrary web script or HTML via the DHCP HOSTNAME option.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1748: NtRegmon before 6.12 allows local users to cause a denial of service (crash), while NtRegmon is running, via invalid pointers to hook functions such as ZwSetQueryValue.
Key phrases: denial of service (crash), cause a denial of service (crash), invalid pointers
CVE-2004-1749: Attack Mitigator IPS 5500 3.11.008, and possibly other versions, when configured in a one-armed routing configuration, allows remote attackers to cause a denial of service (CPU consumption) via a large number of HTTP requests.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption
CVE-2004-1750: RealVNC 4.0 and earlier allows remote attackers to cause a denial of service (crash) via a large number of connections to port 5900.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2004-1751: Ground Control II: Operation Exodus 1.0.0.7 and earlier allows remote servers to cause a denial of service (client or server crash) via a large packet, which generates a "Message too long" socket error that is treated as a critical error.
Key phrases: denial of service (client or server crash), cause a denial of service (client or, large packet
CVE-2004-1752: Stack-based buffer overflow in Gaucho 1.4 Build 145 allows remote attackers to execute arbitrary code via a POP3 email with a long Content-Type header.
Key phrases: execute arbitrary code, execute arbitrary code via a POP3 email with, stack-based buffer overflow, stack based buffer overflow
CVE-2004-1753: The Apple Java plugin, as used in Netscape 7.1 and 7.2, Mozilla 1.7.2, and Firefox 0.9.3 on MacOS X 10.3.5, when tabbed browsing is enabled, does not properly handle SetWindow(NULL) calls, which allows Java applets from one tab to draw to other tabs and facilitates phishing attacks that spoof tabs.
Key phrases: draw to other tabs and facilitates phishing attacks, setwindow(null) calls, spoofing
CVE-2004-1754: The DNS proxy (DNSd) for multiple Symantec Gateway Security products allows remote attackers to poison the DNS cache via a malicious DNS server query response that contains authoritative or additional records.
Key phrases: poison the DNS cache via a malicious DNS, dns cache, malicious dns server query response
CVE-2004-1755: The Web Services fat client for BEA WebLogic Server and Express 7.0 SP4 and earlier, when using 2-way SSL and multiple certificates to connect to the same URL, may use the incorrect identity after the first connection, which could allow users to gain privileges.
Key phrases: gain privileges, incorrect identity
CVE-2004-1756: BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may accept a certificate chain even if the trust manager rejects it, which allows remote attackers to spoof other users or servers.
Key phrases: spoof other users or servers, spoofing
CVE-2004-1757: BEA WebLogic Server and Express 8.1, SP1 and earlier, stores the administrator password in cleartext in config.xml, which allows local users to gain privileges.
Key phrases: gain privileges, cleartext
CVE-2004-1758: BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, which allows local users to gain privileges.
Key phrases: gain privileges
CVE-2004-1759: Cisco voice products, when running the IBM Director Agent on IBM servers before OS 2000.2.6, allows remote attackers to cause a denial of service (CPU consumption) via arbitrary packets to TCP port 14247, as demonstrated using port scanning.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption
CVE-2004-1760: The default installation of Cisco voice products, when running the IBM Director Agent on IBM servers before OS 2000.2.6, does not require authentication, which allows remote attackers to gain administrator privileges by connecting to TCP port 14247.
Key phrases: gain administrator privileges, gain administrator privileges by connecting to TCP port
CVE-2004-1761: Unknown vulnerability in Ethereal 0.8.13 to 0.10.2 allows attackers to cause a denial of service (segmentation fault) via a malformed color filter file.
Key phrases: denial of service (segmentation fault), cause a denial of service (segmentation fault, unknown
CVE-2004-1762: Unknown vulnerability in F-Secure Anti-Virus (FSAV) 4.52 for Linux before Hotfix 3 allows the Sober.D worm to bypass FASV.
Key phrases: bypass FASV, unknown
CVE-2004-1763: Buffer overflow in hsrun.exe for HAHTsite Scenario Server 5.1 Patch 06 (build 91) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long project name.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2004-1764: Buffer overflow in CDE libDtSvc on HP-UX B.11.00, B.11.04, B.11.11, and B.11.22 allows local users to gain root privileges via unknown vectors.
Key phrases: gain root privileges, gain root privileges via unknown vectors, buffer overflow
CVE-2004-1765: Off-by-one buffer overflow in ModSecurity (mod_security) 1.7.4 for Apache 2.x, when SecFilterScanPost is enabled, allows remote attackers to execute arbitrary code via crafted POST requests.
Key phrases: execute arbitrary code, execute arbitrary code via crafted POST requests, buffer overflow
CVE-2004-1766: The default installation of NetScreen-Security Manager before Feature Pack 1 does not enable encryption for communication with devices running ScreenOS 5.0, which allows remote attackers to obtain sensitive information via sniffing.
Key phrases: obtain sensitive information, obtain sensitive information via sniffing
CVE-2004-1767: The kernel in Solaris 2.6, 7, 8, and 9 allows local users to gain privileges by loading arbitrary loadable kernel modules (LKM), possibly involving the modload function.
Key phrases: gain privileges, gain privileges by loading arbitrary loadable kernel modules, arbitrary loadable kernel modules (lkm)
CVE-2004-1768: The character converters in the Spamhunter and Language ID modules for Symantec Brightmail AntiSpam 6.0.1 before patch 132 allow remote attackers to cause a denial of service (crash) via messages with the ISO-8859-10 character set, which is not recognized by the converters.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2004-1769: The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass.
Key phrases: execute arbitrary code, reset their password via email" feature in, execute arbitrary code via the user parameter to
CVE-2004-1770: The login page for cPanel 9.1.0, and possibly other versions, allows remote attackers to execute arbitrary code via shell metacharacters in the user parameter.
Key phrases: execute arbitrary code, execute arbitrary code via shell metacharacters in the
CVE-2004-1771: Scalable OGo (SOGo) 1.0 allows remote authenticated users to bypass intended permissions and view private appointments of other users.
Key phrases: bypass intended permissions, bypass intended permissions and view private appointments of
CVE-2004-1772: Stack-based buffer overflow in shar in GNU sharutils 4.2.1 allows local users to execute arbitrary code via a long -o command line argument.
Key phrases: execute arbitrary code, execute arbitrary code via a long -o command, stack-based buffer overflow, stack based buffer overflow
CVE-2004-1773: Multiple buffer overflows in sharutils 4.2.1 and earlier may allow attackers to execute arbitrary code via (1) long output from wc to shar, or (2) unknown vectors in unshar.
Key phrases: execute arbitrary code, execute arbitrary code via (1) long, buffer overflows, unknown vectors
CVE-2004-1774: Buffer overflow in the SDO_CODE_SIZE procedure of the MD2 package (MDSYS.MD2.SDO_CODE_SIZE) in Oracle 10g before 10.1.0.2 Patch 2 allows local users to execute arbitrary code via a long LAYER parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a long LAYER parameter, buffer overflow
CVE-2004-1775: Cisco VACM (View-based Access Control MIB) for Catalyst Operating Software (CatOS) 5.5 and 6.1 and IOS 12.0 and 12.1 allows remote attackers to read and modify device configuration via the read-write community string.
Key phrases: read and modify device configuration via the read, read-write community string
CVE-2004-1776: Cisco IOS 12.1(3) and 12.1(3)T allows remote attackers to read and modify device configuration data via the cable-docsis read-write community string used by the Data Over Cable Service Interface Specification (DOCSIS) standard.
Key phrases: read and modify device configuration data via the, cable-docsis read-write community string
CVE-2004-1777: A "range check error" in Skype for Windows before 0.98.0.28 allows local and remote attackers to cause a denial of service (application crash) via long command line arguments or a long callto:// URL, a different vulnerability than CVE-2004-1114.
Key phrases: denial of service (application crash), cause a denial of service (application crash, range check error
CVE-2004-1778: Skype 0.92.0.12 and 1.0.0.1 for Linux, and possibly other versions, creates the /usr/share/skype/lang directory with world-writable permissions, which allows local users to modify language files and possibly conduct social engineering or other attacks.
Key phrases: modify language files and possibly conduct social engineering, world-writable permissions
CVE-2004-1779: Cross-site scripting (XSS) vulnerability in board.php for ThWboard before beta 2.84 allows remote attackers to inject arbitrary web script or HTML via the lastvisited parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1780: Info Touch Surfnet kiosk allows local users to deposit extra time into Internet kiosk accounts via repeated authentication attempts.
Key phrases: deposit extra time into Internet kiosk accounts via
CVE-2004-1781: Info Touch Surfnet kiosk allows local users to crash Surfnet and access the underlying operating system via the CMD_CREDITCARD_CHARGE command.
Key phrases: crash Surfnet and access the underlying operating system
CVE-2004-1782: athenareg.php in Athena Web Registration allows remote attackers to execute arbitrary commands via shell metacharacters in the pass parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-2004-1783: Directory traversal vulnerability in Net2Soft Flash FTP Server 1.0 allows remote attackers to read and create arbitrary files via a /.. (slash dot dot).
Key phrases: create arbitrary files, read and create arbitrary files via a /, directory traversal
CVE-2004-1784: Buffer overflow in the web server of Webcam Watchdog 3.63 allows remote attackers to execute arbitrary code via a long HTTP GET request.
Key phrases: execute arbitrary code, execute arbitrary code via a long HTTP GET, buffer overflow
CVE-2004-1785: SQL injection vulnerability in calendar.php for Invision Power Board 1.3 allows remote attackers to execute arbitrary SQL commands via the m parameter, which sets the $this->chosen_month variable.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the m parameter, sql injection
CVE-2004-1786: PortalApp places user credentials under the web root with insufficient access control, which allows remote attackers to gain access to sensitive information via a direct request to 8275.mdb.
Key phrases: gain access, gain access to sensitive information via a direct, insufficient access control, access sensitive information
CVE-2004-1787: SQL injection vulnerability in PostCalendar 4.0.0 allows remote attackers to execute arbitrary SQL commands via search queries.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via search queries, sql injection
CVE-2004-1788: ASP-Nuke 1.3 and earlier places user credentials under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to main.mdb.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to, insufficient access control
CVE-2004-1789: Cross-site scripting (XSS) vulnerability in the web management interface in ZyWALL 10 4.07 allows remote attackers to inject arbitrary web script or HTML via the rpAuth_1 page.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1790: Cross-site scripting (XSS) vulnerability in the web management interface in Edimax AR-6004 ADSL Routers allows remote attackers to inject arbitrary web script or HTML via the URL.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1791: The web management interface in Edimax AR-6004 ADSL Routers uses a default administrator name and password, which also appear as the default login text for the management interface, which allows remote attackers to gain access.
Key phrases: gain access, login text
CVE-2004-1792: swnet.dll in YaSoft Switch Off 2.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a long packet with two CRLF sequences to the service management port (TCP 8000).
Key phrases: denial of service (infinite loop), cause a denial of service (infinite loop
CVE-2004-1793: Stack-based buffer overflow in swnet.dll in YaSoft Switch Off 2.3 and earlier allows remote authenticated users to execute arbitrary code via a long message parameter in a SendMsg action to action.htm.
Key phrases: execute arbitrary code, execute arbitrary code via a long message parameter, stack-based buffer overflow, stack based buffer overflow
CVE-2004-1794: Cross-site scripting (XSS) vulnerability in the VCard4J Toolkit allows remote attackers to inject arbitrary web script or HTML via the NICKNAME tag in a vCard.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1795: Info Touch Surfnet kiosk allows local users to access the underlying filesystem via a 'file://' URI.
Key phrases: access the underlying filesystem via a 'file://
CVE-2004-1796: PHP remote file inclusion vulnerability in HotNews 0.7.2 and earlier allows remote attackers to execute arbitrary PHP code via the (1) config[header] parameter to hotnews-engine.inc.php3 or (2) config[incdir] parameter to hnmain.inc.php3.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the (1, php remote file inclusion, arbitrary php code
CVE-2004-1797: Cross-site scripting (XSS) vulnerability in search.php for FreznoShop 1.3.0 RC1 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1798: RealOne player 6.0.11.868 allows remote attackers to execute arbitrary script in the "My Computer" zone via a Synchronized Multimedia Integration Language (SMIL) presentation with a "file:javascript:" URL, which is executed in the security context of the previously loaded URL, a different vulnerability than CVE-2003-0726.
Key phrases: execute arbitrary script, execute arbitrary script in the "My Computer
CVE-2004-1799: PF in certain OpenBSD versions, when stateful filtering is enabled, does not limit packets for a session to the original interface, which allows remote attackers to bypass intended packet filters via spoofed packets to other interfaces.
Key phrases: bypass intended packet filters, bypass intended packet filters via spoofed packets to, spoofing
CVE-2004-1800: Unknown vulnerability in Sysbotz SimpleData 4.0.1 and possibly earlier versions allows remote attackers to gain access via a crafted URL and a certain cookie.
Key phrases: gain access, gain access via a crafted URL and a, unknown
CVE-2004-1801: Directory traversal vulnerability in PWebServer 0.3.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2004-1802: Chat Anywhere 2.72 and earlier allows remote attackers to hide their IP address by using %00 before the nickname, which causes the IP address to be displayed as $IP$ on the administration web page.
Key phrases: hide their IP address by using %00
CVE-2004-1804: wMCam server 2.1.348 allows remote attackers to cause a denial of service (no new connections) via multiple malformed HTTP requests without the GET command.
Key phrases: denial of service (no new connections), cause a denial of service (no new, malformed http requests
CVE-2004-1805: Format string vulnerability in games using the Epic Games Unreal Engine 436 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in class names.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), format string
CVE-2004-1806: SQL injection vulnerability in index.cfm in CFWebstore 5.0 allows remote attackers to execute SQL commands via the (1) category_id, (2) product_id, or (3) feature_id parameters.
Key phrases: execute SQL commands via the (1), sql injection
CVE-2004-1807: Cross-site scripting (XSS) vulnerability in index.cfm in CFWebstore 5.0 allows remote attackers to inject arbitrary web script or HTML via the URL.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1808: Extcompose in metamail does not verify the output file before writing to it, which allows local users to overwrite arbitrary files via a symlink attack.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack, file write
CVE-2004-1809: Cross-site scripting (XSS) vulnerability in phpBB 2.0.6d and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) postdays parameter to viewtopic.php or (2) topicdays parameter to viewforum.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1810: The Javascript engine in Opera 7.23 allows remote attackers to cause a denial of service (crash) by creating a new Array object with a large size value, then writing into that array.
Key phrases: denial of service (crash), cause a denial of service (crash), large size value
CVE-2004-1811: The SSL HTTP Server in HP Web-enabled Management Software 5.0 through 5.92, with anonymous access enabled, allows remote attackers to compromise the trusted certificates by uploading their own certificates.
Key phrases: compromise the trusted certificates by uploading their own, anonymous access
CVE-2004-1812: Multiple stack-based buffer overflows in Agent Common Services (1) cam.exe and (2) awservices.exe in Unicenter TNG 2.4 allow remote attackers to execute arbitrary code.
Key phrases: execute arbitrary code, stack-based buffer overflows, stack based buffer overflow
CVE-2004-1813: VocalTec VGW4/8 Gateway 8.0 allows remote attackers to bypass authentication via an HTTP request to home.asp with a trailing slash (/).
Key phrases: bypass authentication, bypass authentication via an HTTP request to home.asp
CVE-2004-1814: Directory traversal vulnerability in VocalTec VGW4/8 Gateway 8.0 allows remote attackers to read protected files via .. (dot dot) sequences in an HTTP request, as demonstrated using home.asp.
Key phrases: read protected files via .. (dot dot, directory traversal
CVE-2004-1815: Unknown vulnerability in ColdFusion MX 6.0 and 6.1, and JRun 4.0, when a SOAP web service expects an array of objects as an argument, allows remote attackers to cause a denial of service (memory consumption).
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption, unknown
CVE-2004-1816: Unknown vulnerability in Sun Java System Application Server 7.0 Update 2 and earlier, when a SOAP web service expects an array of objects as an argument, allows remote attackers to cause a denial of service (memory consumption).
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption, unknown
CVE-2004-1817: Cross-site scripting (XSS) vulnerability in modules.php in Php-Nuke 7.1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) Your Name field, (2) e-mail field, (3) nicname field, (4) fname parameter, (5) ratenum parameter, or (6) search field.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1818: Cross-site scripting (XSS) vulnerability in nmimage.php in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to execute arbitrary script as other users by injecting arbitrary script into the z parameter.
Key phrases: execute arbitrary script, execute arbitrary script as other users by injecting, cross-site scripting (xss)
CVE-2004-1819: 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to obtain sensitive information via a direct request to displaycategory.php, which reveals the path in an error message.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2004-1820: PHP remote file inclusion vulnerability in displaycategory.php in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to execute arbitrary PHP code by modifying the basepath parameter to reference a URL on a remote web server that contains fileFunctions.php.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code by modifying the basepath, php remote file inclusion, arbitrary php code
CVE-2004-1821: SQL injection vulnerability in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to gain privileges or perform unauthorized database operations via the gid parameter.
Key phrases: gain privileges, gain privileges or perform unauthorized database operations via, sql injection
CVE-2004-1822: Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.1 through 5.0.3 beta allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_REFERER parameter to login.php, (2) HTTP_REFERER parameter to register.php, or (3) target parameter to profile.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1823: Multiple cross-site scripting (XSS) vulnerabilities in Jelsoft vBulletin 2.0 beta 3 through 3.0 can4 allows remote attackers to inject arbitrary web script or HTML via the (1) page parameter to showthread.php or (2) order parameter to forumdisplay.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1824: Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin before 3.0 allows remote attackers to inject arbitrary web script or HTML via the what parameter to memberlist.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1825: Cross-site scripting (XSS) vulnerability in index.php in Mambo Open Source 4.5 stable 1.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) return or (2) mos_change_template parameters.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1826: SQL injection vulnerability in index.php in Mambo Open Source 4.5 stable 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the id, sql injection, arbitrary sql commands
CVE-2004-1827: Cross-site scripting (XSS) vulnerability in YaBB 1 Gold(SP1.3) and YaBB SE 1.5.1 Final allows remote attackers to inject arbitrary web script via the background:url property in (1) glow or (2) shadow tags.
Key phrases: inject arbitrary web script, inject arbitrary web script via the background:, cross-site scripting (xss)
CVE-2004-1828: Vcard 2.9 and possibly other versions does not require authorization to run uninstall.php, which could allow remote attackers to uninstall Vcard and delete database tables via a direct request to uninstall.php.
Key phrases: uninstall Vcard and delete database tables via a
CVE-2004-1829: Multiple cross-site scripting (XSS) vulnerabilities in error.php in Gijza.net Error Manager 2.1 for PHP-Nuke 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) pagetitle or (2) error parameters, or (3) certain parameters in the error log.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1830: error.php in Error Manager 2.1 for PHP-Nuke 6.0 allows remote attackers to obtain sensitive information via an invalid (1) language, (2) newlang, or (3) lang parameter, which leaks the pathname in a PHP error message.
Key phrases: obtain sensitive information, obtain sensitive information via an invalid (1
CVE-2004-1831: Buffer overflow in Chrome 1.2.0.0 and earlier allows remote attackers to cause a denial of service (crash) via a packet with a large length value, which leads to a null dereference or out-of-bounds read.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow, null dereference, out-of-bounds read, out of bounds read
CVE-2004-1832: Buffer overflow in the GUI admin service in Mac OS X Server 10.3 allows remote attackers to cause a denial of service (crash and restart) via a large amount of data to TCP port 660.
Key phrases: denial of service (crash and restart), cause a denial of service (crash and, buffer overflow
CVE-2004-1833: The admin.ib file in Borland Interbase 7.1 for Linux has default world writable permissions, which allows local users to gain database administrative privileges.
Key phrases: gain database administrative privileges, world writable permissions
CVE-2004-1834: mod_disk_cache in Apache 2.0 through 2.0.49 stores client headers, including authentication information, on the hard disk, which could allow local users to gain sensitive information.
Key phrases: gain sensitive information
CVE-2004-1835: Multiple SQL injection vulnerabilities in index.php in Invision Gallery 1.0.1 allow remote attackers to execute arbitrary SQL via the (1) img, (2) cat, (3) sort_key, (4) order_key, (5) user, or (6) album parameters.
Key phrases: execute arbitrary SQL, execute arbitrary SQL via the (1), sql injection
CVE-2004-1836: SQL injection vulnerability in index.php in Invision Power Top Site List 1.1 RC 2 and earlier allows remote attackers to execute arbitrary SQL via the id parameter of the comments action.
Key phrases: execute arbitrary SQL, execute arbitrary SQL via the id parameter, sql injection
CVE-2004-1837: Cross-site scripting (XSS) vulnerability in Mod_survey 3.0.x before 3.0.16-pre2 and 3.2.x before 3.2.0-pre4 allows remote attackers to inject arbitrary web script or HTML via the certain survey fields or error messages for malformed query strings.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-1838: Directory traversal vulnerability in xweb 1.0 allows remote attackers to download arbitrary files via a .. (dot dot) in the URL.
Key phrases: download arbitrary files, download arbitrary files via a .. (dot, directory traversal