CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2004

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2001-1413 Exec Code Overflow 2004-12-23 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the comprexx function for ncompress 4.2.4 and earlier, when used in situations that cross security boundaries (such as FTP server), may allow remote attackers to execute arbitrary code via a long filename argument.
2 CVE-2002-0034 2004-02-03 2019-04-30
4.6
None Local Low Not required Partial Partial Partial
The Microsoft CONVERT.EXE program, when used on Windows 2000 and Windows XP systems, does not apply the default NTFS permissions when converting a FAT32 file system, which could cause the conversion to produce a file system with less secure permissions than expected.
3 CVE-2002-0385 +Info 2004-06-01 2017-07-11
5.0
None Remote Low Not required Partial None None
Vignette Story Server 4.1 and 6.0 allows remote attackers to obtain sensitive information via a request that contains a large number of '"' (double quote) and and '>' characters, which causes the TCL interpreter to crash and include stack data in the output.
4 CVE-2002-0712 2004-02-03 2017-07-11
2.1
None Local Low Not required None None Partial
Entrust Authority Security Manager (EASM) 6.0 does not properly require multiple master users to change the password of a master user, which could allow a master user to perform operations that require multiple authorizations.
5 CVE-2002-1574 Overflow 2004-03-03 2017-10-10
4.6
None Local Low Not required Partial Partial Partial
Buffer overflow in the ixj telephony card driver in Linux before 2.4.20 has unknown impact and attack vectors.
6 CVE-2002-1575 2004-03-03 2017-07-11
5.0
None Remote Low Not required None Partial None
cgiemail allows remote attackers to use cgiemail as a spam proxy via CRLF injection of encoded newline (%0a) characters in parameters such as "required-subject," which can be used to modify the CC, BCC, and other header fields in the generated email message.
7 CVE-2002-1576 +Priv 2004-04-15 2017-07-11
7.2
None Local Low Not required Complete Complete Complete
lserver in SAP DB 7.3 and earlier uses the current working directory to find and execute the lserversrv program, which allows local users to gain privileges with a malicious lserversrv that is called from a directory that has a symlink to the lserver program.
8 CVE-2002-1577 +Priv 2004-04-15 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
SAP R/3 2.0B to 4.6D installs several clients with default users and passwords, which allows remote attackers to gain privileges via the (1) SAP*, (2) SAPCPIC, (3) DDIC, (4) EARLYWATCH, or (5) TMSADM accounts.
9 CVE-2002-1578 2004-04-15 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
The default installation of SAP R/3, when using Oracle and SQL*net V2 3.x, 4.x, and 6.10, allows remote attackers to obtain arbitrary, sensitive SAP data by directly connecting to the Oracle database and executing queries against the database, which is not password-protected.
10 CVE-2002-1579 DoS 2004-04-15 2017-07-11
5.0
None Remote Low Not required None None Partial
SAP GUI (Sapgui) 4.6D allows remote attackers to cause a denial of service (crash) via a connection to a high-numbered port, which generates an "unknown connection data" error.
11 CVE-2002-1580 Exec Code Overflow 2004-06-14 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Integer overflow in imapparse.c for Cyrus IMAP server 1.4 and 2.1.10 allows remote attackers to execute arbitrary code via a large length value that facilitates a buffer overflow attack, a different vulnerability than CVE-2002-1347.
12 CVE-2002-1581 Dir. Trav. 2004-12-06 2011-03-08
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in nph-mr.cgi in Mailreader.com 2.3.20 through 2.3.31 allows remote attackers to view arbitrary files via .. (dot dot) sequences and a null byte (%00) in the configLanguage parameter.
13 CVE-2002-1582 Exec Code 2004-12-06 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
compose.cgi in Mailreader.com 2.3.30 and 2.3.31, when using Sendmail as the Mail Transfer Agent, allows remote attackers to execute arbitrary commands via shell metacharacters in the RealEmail configuration variable, which is used to call Sendmail in network.cgi.
14 CVE-2002-1583 Exec Code Overflow 2004-09-28 2008-09-05
7.2
None Local Low Not required Complete Complete Complete
Buffer overflow in sqllib/security/db2ckpw for IBM DB2 Universal Database 6.0 and 7.0 allows local users to execute arbitrary code via a long username that is read from a file descriptor argument.
15 CVE-2003-0105 2004-09-28 2017-07-11
5.0
None Remote Low Not required Partial None None
ServerMask 2.2 and earlier does not obfuscate (1) ETag, (2) HTTP Status Message, or (3) Allow HTTP responses, which could tell remote attackers that the web server is an IIS server.
16 CVE-2003-0119 2004-02-03 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
The secldapclntd daemon in AIX 4.3, 5.1 and 5.2 uses an Internet socket when communicating with the loadmodule, which allows remote attackers to directly connect to the daemon and conduct unauthorized activities.
17 CVE-2003-0170 +Priv 2004-03-29 2017-07-11
10.0
None Remote Low Not required Complete Complete Complete
Unknown vulnerability in ftpd in IBM AIX 5.2, when configured to use Kerberos 5 for authentication, allows remote attackers to gain privileges via unknown attack vectors.
18 CVE-2003-0175 DoS 2004-02-03 2017-07-11
2.1
None Local Low Not required None None Partial
SGI IRIX before 6.5.21 allows local users to cause a denial of service (kernel panic) via a certain call to the PIOCSWATCH ioctl.
19 CVE-2003-0193 2004-08-18 2017-07-11
2.1
None Local Low Not required None Partial None
msxlsview.sh in xlsview for catdoc 0.91 and earlier allows local users to overwrite arbitrary files via a symlink attack on predictable temporary file names ("word$$.html").
20 CVE-2003-0202 2004-04-15 2017-07-11
4.6
None Local Low Not required Partial Partial Partial
The (1) halstead and (2) gather_stats scripts in metrics 1.0 allow local users to overwrite arbitrary files via a symlink attack on temporary files.
21 CVE-2003-0257 +Priv 2004-04-15 2017-07-11
7.2
None Local Low Not required Complete Complete Complete
Format string vulnerability in the printer capability for IBM AIX .3, 5.1, and 5.2 allows local users to gain printq or root privileges.
22 CVE-2003-0368 20 DoS 2004-02-03 2017-07-11
5.0
None Remote Low Not required None None Partial
Nokia Gateway GPRS support node (GGSN) allows remote attackers to cause a denial of service (kernel panic) via a malformed IP packet with a 0xFF TCP option.
23 CVE-2003-0441 Overflow +Priv 2004-03-03 2017-07-11
7.2
None Local Low Not required Complete Complete Complete
Multiple buffer overflows in Orville Write (orville-write) 2.53 and earlier allow local users to gain privileges.
24 CVE-2003-0444 Exec Code Overflow 2004-03-29 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in GTKSee 0.5 and 0.5.1 allows remote attackers to execute arbitrary code via a PNG image of certain color depths.
25 CVE-2003-0513 Dir. Trav. Bypass 2004-04-15 2021-07-23
7.5
None Remote Low Not required Partial Partial Partial
Microsoft Internet Explorer allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Internet Explorer to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
26 CVE-2003-0514 Dir. Trav. Bypass 2004-04-15 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
Apple Safari allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Safari to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
27 CVE-2003-0533 Exec Code Overflow 2004-06-01 2018-10-12
7.5
None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm.
28 CVE-2003-0592 Dir. Trav. Bypass 2004-04-15 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
29 CVE-2003-0593 22 Dir. Trav. Bypass 2004-04-15 2022-03-01
7.5
None Remote Low Not required Partial Partial Partial
Opera allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Opera to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
30 CVE-2003-0594 Dir. Trav. Bypass 2004-04-15 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
Mozilla allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Mozilla to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
31 CVE-2003-0601 2004-03-29 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Workgroup Manager in Apple Mac OS X Server 10.2 through 10.2.6 does not disable a password for a new account before it is saved for the first time, which allows remote attackers to gain unauthorized access via the new account before it is saved.
32 CVE-2003-0607 Overflow 2004-03-29 2017-07-11
4.6
None Local Low Not required Partial Partial Partial
Buffer overflow in xconq 7.4.1 allows local users to become part of the "games" group via the (1) USER or (2) DISPLAY environment variables.
33 CVE-2003-0612 Overflow +Priv 2004-03-29 2017-07-11
4.6
None Local Low Not required Partial Partial Partial
Multiple buffer overflows in main.c for Crafty 19.3 allow local users to gain group "games" privileges via long command line arguments to crafty.bin.
34 CVE-2003-0618 +Info 2004-05-04 2017-07-11
2.1
None Local Low Not required Partial None None
Multiple vulnerabilities in suidperl 5.6.1 and earlier allow a local user to obtain sensitive information about files for which the user does not have appropriate permissions.
35 CVE-2003-0648 Exec Code Overflow 2004-05-04 2017-07-11
10.0
None Remote Low Not required Complete Complete Complete
Multiple buffer overflows in vfte, based on FTE, before 0.50, allow local users to execute arbitrary code.
36 CVE-2003-0663 DoS 2004-06-01 2018-10-12
5.0
None Remote Low Not required None None Partial
Unknown vulnerability in the Local Security Authority Subsystem Service (LSASS) in Windows 2000 domain controllers allows remote attackers to cause a denial of service via a crafted LDAP message.
37 CVE-2003-0696 DoS 2004-01-20 2017-07-11
5.0
None Remote Low Not required None None Partial
The getipnodebyname() API in AIX 5.1 and 5.2 does not properly close sockets, which allows attackers to cause a denial of service (resource exhaustion).
38 CVE-2003-0700 2004-02-17 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
The C-Media PCI sound driver in Linux before 2.4.22 does not use the get_user function to access userspace in certain conditions, which crosses security boundaries and may facilitate the exploitation of vulnerabilities, a different vulnerability than CVE-2003-0699.
39 CVE-2003-0718 DoS 2004-11-03 2020-11-23
5.0
None Remote Low Not required None None Partial
The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND request with an XML message containing XML elements with a large number of attributes.
40 CVE-2003-0719 Exec Code Overflow 2004-06-01 2018-10-12
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets.
41 CVE-2003-0781 2004-05-04 2017-07-11
10.0
None Remote Low Not required Complete Complete Complete
Unknown vulnerability in ecartis before 1.0.0 does not properly validate user input, which allows attackers to obtain mailing list passwords.
42 CVE-2003-0782 DoS Exec Code Overflow 2004-05-04 2017-07-11
10.0
None Remote Low Not required Complete Complete Complete
Multiple buffer overflows in ecartis before 1.0.0 allow attackers to cause a denial of service and possibly execute arbitrary code.
43 CVE-2003-0796 2004-03-29 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Unknown vulnerability in rpc.mountd SGI IRIX 6.5.18 through 6.5.22 allows remote attackers to mount from unprivileged ports even with the -n option disabled.
44 CVE-2003-0797 DoS 2004-03-29 2017-07-11
5.0
None Remote Low Not required None None Partial
Unknown vulnerability in rpc.mountd in SGI IRIX 6.5 through 6.5.22 allows remote attackers to cause a denial of service (process death) via unknown attack vectors.
45 CVE-2003-0806 Exec Code Overflow 2004-06-01 2018-10-12
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the Windows logon process (winlogon) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1, when a member of a domain, allows remote attackers to execute arbitrary code.
46 CVE-2003-0807 DoS Overflow 2004-06-01 2018-10-12
5.0
None Remote Low Not required None None Partial
Buffer overflow in the COM Internet Services and in the RPC over HTTP Proxy components for Microsoft Windows NT Server 4.0, NT 4.0 Terminal Server Edition, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service via a crafted request.
47 CVE-2003-0814 Exec Code Bypass 2004-02-03 2021-07-23
7.5
None Remote Low Not required Partial Partial Partial
Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability.
48 CVE-2003-0815 Bypass 2004-02-03 2021-07-23
7.5
None Remote Low Not required Partial Partial Partial
Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability.
49 CVE-2003-0816 Bypass 2004-02-03 2021-07-23
7.5
None Remote Low Not required Partial Partial Partial
Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability.
50 CVE-2003-0817 Bypass 2004-02-03 2021-07-23
7.5
None Remote Low Not required Partial Partial Partial
Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object.
Total number of vulnerabilities : 2451   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.