CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2004

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2003-0193 2004-08-18 2017-07-11
2.1
 None Local Low Not required None Partial None
msxlsview.sh in xlsview for catdoc 0.91 and earlier allows local users to overwrite arbitrary files via a symlink attack on predictable temporary file names ("word$$.html").
2 CVE-2003-1042 Sql 2004-08-18 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
SQL injection vulnerability in collectstats.pl for Bugzilla 2.16.3 and earlier allows remote authenticated users with editproducts privileges to execute arbitrary SQL via the product name.
3 CVE-2003-1043 Sql 2004-08-18 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
SQL injection vulnerability in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote authenticated users with editkeywords privileges to execute arbitrary SQL via the id parameter to editkeywords.cgi.
4 CVE-2003-1044 2004-08-18 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
editproducts.cgi in Bugzilla 2.16.3 and earlier, when usebuggroups is enabled, does not properly remove group add privileges from a group that is being deleted, which allows users with those privileges to perform unauthorized additions to the next group that is assigned with the original group ID.
5 CVE-2003-1045 2004-08-18 2017-07-11
5.0
 None Remote Low Not required Partial None None
votes.cgi in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote attackers to read a user's voting page when that user has voted on a restricted bug, which allows remote attackers to read potentially sensitive voting information by modifying the who parameter.
6 CVE-2003-1046 2004-08-18 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
describecomponents.cgi in Bugzilla 2.17.3 and 2.17.4 does not properly verify group membership when bug entry groups are used, which allows remote attackers to list component descriptions for otherwise restricted products.
7 CVE-2004-0125 2004-08-06 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
The jail system call in FreeBSD 4.x before 4.10-RELEASE does not verify that an attempt to manipulate routing tables originated from a non-jailed process, which could allow local users to modify the routing table.
8 CVE-2004-0134 +Priv 2004-08-18 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
cpr (libcpr) in SGI IRIX before 6.5.25 allows local users to gain privileges by loading a user provided library while restarting the checkpointed process.
9 CVE-2004-0135 +Priv 2004-08-06 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
The syssgi SGI_IOPROBE system call in IRIX 6.5.20 through 6.5.24 allows local users to gain privileges by reading and writing to kernel memory.
10 CVE-2004-0136 DoS 2004-08-06 2017-07-11
2.1
 None Local Low Not required None None Partial
The mapelf32exec function call in IRIX 6.5.20 through 6.5.24 allows local users to cause a denial of service (system crash) via a "corrupted binary."
11 CVE-2004-0137 DoS 2004-08-06 2017-07-11
2.1
 None Local Low Not required None None Partial
Unknown vulnerability in init for IRIX 6.5.20 through 6.5.24 allows local users to cause a denial of service (system panic) as a result of "page invalidation issues."
12 CVE-2004-0175 22 Dir. Trav. 2004-08-18 2017-10-11
4.3
 None Remote Medium Not required None Partial None
Directory traversal vulnerability in scp for OpenSSH before 3.4p1 allows remote malicious servers to overwrite arbitrary files. NOTE: this may be a rediscovery of CVE-2000-0992.
13 CVE-2004-0201 Exec Code Overflow 2004-08-06 2019-04-30
10.0
 None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CVE-2003-1041.
14 CVE-2004-0202 DoS 2004-08-06 2019-04-30
5.0
 None Remote Low Not required None None Partial
IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet.
15 CVE-2004-0204 Dir. Trav. 2004-08-06 2018-10-12
7.5
 None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx.
16 CVE-2004-0205 Exec Code Overflow 2004-08-06 2018-10-12
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arbitrary code via the redirect function.
17 CVE-2004-0210 Exec Code Overflow 2004-08-06 2019-04-30
7.2
 None Local Low Not required Complete Complete Complete
The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by modifying message length values and causing a buffer overflow.
18 CVE-2004-0212 Exec Code Overflow 2004-08-06 2019-04-30
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an anonymous share.
19 CVE-2004-0213 +Priv Bypass 2004-08-06 2019-04-30
7.2
 None Local Low Not required Complete Complete Complete
Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly accessing the context sensitive help and bypassing the GUI, then sending another message to winhlp32 in order to open a user-selected file, a different vulnerability than CVE-2003-0908.
20 CVE-2004-0215 DoS 2004-08-06 2018-10-12
5.0
 None Remote Low Not required None None Partial
Microsoft Outlook Express 5.5 and 6 allows attackers to cause a denial of service (application crash) via a malformed e-mail header.
21 CVE-2004-0226 DoS Exec Code Overflow 2004-08-18 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Multiple buffer overflows in Midnight Commander (mc) before 4.6.0 may allow attackers to cause a denial of service or execute arbitrary code.
22 CVE-2004-0228 +Priv 2004-08-18 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
Integer signedness error in the cpufreq proc handler (cpufreq_procctl) in Linux kernel 2.6 allows local users to gain privileges.
23 CVE-2004-0229 2004-08-18 2017-07-11
4.6
 None Local Low Not required Partial Partial Partial
The framebuffer driver in Linux kernel 2.6.x does not properly use the fb_copy_cmap function, with unknown impact.
24 CVE-2004-0230 DoS 2004-08-18 2018-10-19
5.0
 None Remote Low Not required None None Partial
TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP.
25 CVE-2004-0231 2004-08-18 2017-07-11
2.1
 None Local Low Not required None Partial None
Multiple vulnerabilities in Midnight Commander (mc) before 4.6.0, with unknown impact, related to "Insecure temporary file and directory creations."
26 CVE-2004-0232 DoS Exec Code 2004-08-18 2017-07-11
5.0
 None Remote Low Not required None None Partial
Multiple format string vulnerabilities in Midnight Commander (mc) before 4.6.0 may allow attackers to cause a denial of service or execute arbitrary code.
27 CVE-2004-0233 Dir. Trav. 2004-08-18 2017-10-11
2.1
 None Local Low Not required None Partial None
Utempter allows device names that contain .. (dot dot) directory traversal sequences, which allows local users to overwrite arbitrary files via a symlink attack on device names in combination with an application that trusts the utmp or wtmp files.
28 CVE-2004-0234 119 Exec Code Overflow 2004-08-18 2017-10-11
10.0
 None Remote Low Not required Complete Complete Complete
Multiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14, as used in products such as Barracuda Spam Firewall, allow remote attackers or local users to execute arbitrary code via long directory or file names in an LHA archive, which triggers the overflow when testing or extracting the archive.
29 CVE-2004-0235 Dir. Trav. 2004-08-18 2017-10-11
6.4
 None Remote Low Not required Partial Partial None
Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with (1) .. sequences or (2) absolute pathnames with double leading slashes ("//absolute/path").
30 CVE-2004-0375 DoS 2004-08-18 2017-07-11
5.0
 None Remote Low Not required None None Partial
SYMNDIS.SYS in Symantec Norton Internet Security 2003 and 2004, Norton Personal Firewall 2003 and 2004, Client Firewall 5.01 and 5.1.1, and Client Security 1.0 and 1.1 allow remote attackers to cause a denial of service (infinite loop) via a TCP packet with (1) SACK option or (2) Alternate Checksum Data option followed by a length of zero.
31 CVE-2004-0394 Overflow 2004-08-18 2017-07-11
2.1
 None Local Low Not required Partial None None
A "potential" buffer overflow exists in the panic() function in Linux 2.4.x, although it may not be exploitable due to the functionality of panic.
32 CVE-2004-0412 2004-08-18 2017-07-11
5.0
 None Remote Low Not required Partial None None
Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server.
33 CVE-2004-0413 DoS Exec Code Overflow 2004-08-06 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
libsvn_ra_svn in Subversion 1.0.4 trusts the length field of (1) svn://, (2) svn+ssh://, and (3) other svn protocol URL strings, which allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via an integer overflow that leads to a heap-based buffer overflow.
34 CVE-2004-0414 DoS Exec Code 2004-08-06 2018-05-03
10.0
 None Remote Low Not required Complete Complete Complete
CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution.
35 CVE-2004-0416 119 Exec Code Overflow 2004-08-06 2018-05-03
10.0
 None Remote Low Not required Complete Complete Complete
Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.
36 CVE-2004-0417 Overflow 2004-08-06 2018-05-03
5.0
 None Remote Low Not required None None Partial
Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space.
37 CVE-2004-0418 Exec Code 2004-08-06 2018-05-03
10.0
 None Remote Low Not required Complete Complete Complete
serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data.
38 CVE-2004-0419 2004-08-18 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
XDM in XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0, which could allow remote attackers to connect to the port, in violation of the intended restrictions.
39 CVE-2004-0421 DoS 2004-08-18 2017-10-11
5.0
 None Remote Low Not required None None Partial
The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message.
40 CVE-2004-0425 Exec Code Overflow 2004-08-18 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in SiteMinder Affiliate Agent 4.x allows remote attackers to execute arbitrary code via a large SMPROFILE cookie.
41 CVE-2004-0432 Bypass 2004-08-18 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
ProFTPD 1.2.9 treats the Allow and Deny directives for CIDR based ACL entries as if they were AllowAll, which could allow FTP clients to bypass intended access restrictions.
42 CVE-2004-0433 DoS Exec Code Overflow 2004-08-18 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Multiple buffer overflows in the Real-Time Streaming Protocol (RTSP) client for (1) MPlayer before 1.0pre4 and (2) xine lib (xine-lib) before 1-rc4, when playing Real RTSP (realrtsp) streams, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (a) long URLs, (b) long Real server responses, or (c) long Real Data Transport (RDT) packets.
43 CVE-2004-0435 2004-08-18 2017-07-11
3.6
 None Local Low Not required None Partial Partial
Certain "programming errors" in the msync system call for FreeBSD 5.2.1 and earlier, and 4.10 and earlier, do not properly handle the MS_INVALIDATE operation, which leads to cache consistency problems that allow a local user to prevent certain changes to files from being committed to disk.
44 CVE-2004-0447 DoS 2004-08-06 2017-10-11
7.2
 None Local Low Not required Complete Complete Complete
Unknown vulnerability in Linux before 2.4.26 for IA64 allows local users to cause a denial of service, with unknown impact. NOTE: due to a typo, this issue was accidentally assigned CVE-2004-0477. This is the proper candidate to use for the Linux local DoS.
45 CVE-2004-0450 Exec Code 2004-08-06 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Format string vulnerability in the printlog function in log2mail before 0.2.5.2 allows local users or remote attackers to execute arbitrary code via format string specifiers in a logfile monitored by log2mail.
46 CVE-2004-0453 DoS Exec Code 2004-08-06 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
Format string vulnerability in the monitor "memory dump" command in VICE 1.6 to 1.14 allows local users to cause a denial of service (emulator crash) and possibly execute arbitrary code via format string specifiers in an output string.
47 CVE-2004-0460 DoS Exec Code Overflow 2004-08-06 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the logging capability for the DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via multiple hostname options in (1) DISCOVER, (2) OFFER, (3) REQUEST, (4) ACK, or (5) NAK messages, which can generate a long string when writing to a log file.
48 CVE-2004-0461 DoS Exec Code Overflow 2004-08-06 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
The DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13, when compiled in environments that do not provide the vsnprintf function, uses C include files that define vsnprintf to use the less safe vsprintf function, which can lead to buffer overflow vulnerabilities that enable a denial of service (server crash) and possibly execute arbitrary code.
49 CVE-2004-0476 DoS Overflow 2004-08-18 2017-07-11
5.0
 None Remote Low Not required None None Partial
Buffer overflow in 3Com OfficeConnect Remote 812 ADSL Router 1.1.9.4 allows remote attackers to cause a denial of service (reboot or packet loss) via a long string containing Telnet escape characters to the Telnet port.
50 CVE-2004-0487 DoS 2004-08-18 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
A certain ActiveX control in Symantec Norton AntiVirus 2004 allows remote attackers to cause a denial of service (resource consumption) and possibly execute arbitrary programs.
Total number of vulnerabilities : 240   Page : 1 (This Page)2 3 4 5
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.