CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In September 2004 (CVSS score >= 5)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2004-1699 DoS 2004-09-21 2017-07-11
5.0
 None Remote Low Not required None None Partial
SettingsBase.php in Pinnacle ShowCenter 1.51 allows remote attackers to cause a denial of service (web interface errors) via an invalid Skin parameter.
2 CVE-2004-1698 DoS 2004-09-24 2017-07-11
5.0
 None Remote Low Not required None None Partial
The Base64 function in PopMessenger 1.60 (before 20 Sep 2004) and earlier allows remote attackers to cause a denial of service (application crash) via invalid characters in a message, which causes several alert dialogs to be displayed and leads to a crash.
3 CVE-2004-1697 2004-09-21 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
The "Forgot your Password" link in Computer Associates (CA) Unicenter Management Portal 2.0 and 3.1 displays different error messages for users that exist and users that do not exist, which could allow remote attackers to guess valid usernames.
4 CVE-2004-1696 DoS 2004-09-21 2017-07-11
5.0
 None Remote Low Not required None None Partial
EmuLive Server4 Commerce Edition Build 7560 allows remote attackers to cause a denial of service (application crash) via a sequence of carriage returns sent to TCP port 66.
5 CVE-2004-1695 Bypass 2004-09-20 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
EmuLive Server4 Commerce Edition Build 7560 allows remote attackers to bypass authentication for the remote administration feature via a URL that contains an extra leading / (slash).
6 CVE-2004-1694 2004-09-21 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Symantec ON Command CCM 5.4.x and iCommand 3.0.x has four default usernames and passwords, one of which is hardcoded, which allows remote attackers to gain unauthorized access.
7 CVE-2004-1693 Exec Code File Inclusion 2004-09-18 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in Function.php in Mambo 4.5 (1.0.9) allows remote attackers to execute arbitrary PHP code by modifying the mosConfig_absolute_path parameter to reference a URL on a remote web server that contains the code.
8 CVE-2004-1691 DoS 2004-09-18 2017-07-11
5.0
 None Remote Low Not required None None Partial
The Web Server in DNS4Me 3.0.0.4 allows remote attackers to cause a denial of service (CPU consumption and crash) via a large amount of data.
9 CVE-2004-1688 DoS 2004-09-16 2017-07-11
5.0
 None Remote Low Not required None None Partial
Pigeon Server 3.02.0143 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a long login name sent to port 3103.
10 CVE-2004-1687 Http R.Spl. 2004-09-16 2017-07-11
5.0
 None Remote Low Not required None Partial None
CRLF injection vulnerability in down.asp for Snitz Forums 2000 3.4.04 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the location parameter.
11 CVE-2004-1686 Bypass 2004-09-15 2017-07-11
5.0
 None Remote Low Not required None Partial None
Internet Explorer 6.0 in Windows XP SP2 allows remote attackers to bypass the Information Bar prompt for ActiveX and Javascript via an XHTML page that contains an Internet Explorer formatted comment between the DOCTYPE tag and the HTML tag, as demonstrated using the DesignScience MathPlayer ActiveX plugin.
12 CVE-2004-1685 Bypass 2004-09-15 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
SMC routers SMC7004VWBR running firmware 1.00.014 and SMC7008ABR EU running firmware 1.42.003 allow remote attackers to bypass authentication by connecting to it from the same IP address as the administrator who is logged in, then accessing the setup_status.htm or status.HTM pages.
13 CVE-2004-1684 +Info 2004-09-13 2017-07-11
5.0
 None Remote Low Not required Partial None None
Zyxel P681 running ZyNOS Vt020225a contains portions of memory in an ARP request, which allows remote attackers to obtain sensitive information by sniffing the network.
14 CVE-2004-1680 DoS Overflow 2004-09-13 2017-07-11
5.0
 None Remote Low Not required None None Partial
application.cgi in the Pingtel Xpressa handset running firmware 2.1.11.24 allows remote authenticated users to cause a denial of service (VxWorks OS crash) via a long HTTP GET request, possibly triggering a buffer overflow.
15 CVE-2004-1678 Dir. Trav. 2004-09-13 2017-07-11
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in pdesk.cgi in PerlDesk allows remote attackers to read portions of arbitrary files and possibly execute arbitrary Perl modules via ".." sequences terminated by a %00 (null) character in the lang parameter, which can leak portions of the requested files if a compilation error message occurs.
16 CVE-2004-1677 2004-09-12 2017-07-11
5.0
 None Remote Low Not required Partial None None
pdesk.cgi in PerlDesk allows remote attackers to gain sensitive information via an invalid lang parameter, which includes pathname information in an error message.
17 CVE-2004-1676 Exec Code Overflow 2004-09-12 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the image sending feature in Gadu-Gadu 6.0 build 149 allows remote attackers to execute arbitrary code via a crafted GG_MSG_IMAGE_REPLY message.
18 CVE-2004-1675 20 DoS 2004-09-11 2020-07-28
5.0
 None Remote Low Not required None None Partial
Serv-U FTP server 4.x and 5.x allows remote attackers to cause a denial of service (application crash) via a STORE UNIQUE (STOU) command with an MS-DOS device name argument such as (1) COM1, (2) LPT1, (3) PRN, or (4) AUX.
19 CVE-2004-1670 Dir. Trav. 2004-09-10 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Multiple directory traversal vulnerabilities Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7, and possibly other versions, allow remote attackers to (1) create arbitrary directories via a .. (dot dot) in the user parameter to viewaction.html or (2) rename arbitrary files via a ....// (doubled dot dot) in the folderold or folder parameters to folders.html.
20 CVE-2004-1668 Exec Code Sql 2004-09-10 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in index.php in Subjects 2.0 Postnuke module allow remote attackers to execute arbitrary SQL commands via the (1) pageid, (2) subid, or (3) catid parameters.
21 CVE-2004-1667 DoS 2004-09-09 2017-07-11
5.0
 None Remote Low Not required None None Partial
Off-by-one error in Halo Combat Evolved 1.04 and earlier allows remote attackers to cause a denial of service (server crash) via a long client response.
22 CVE-2004-1664 DoS Overflow 2004-09-05 2017-07-11
5.0
 None Remote Low Not required None None Partial
Call of Duty 1.4 and earlier allows remote attackers to cause a denial of service (game end) via a large (1) query or (2) reply packet, which is not properly handled by the buffer overflow protection mechanism. NOTE: this issue might overlap CVE-2005-0430.
23 CVE-2004-1663 DoS 2004-09-04 2021-06-22
5.0
 None Remote Low Not required None None Partial
Engenio/LSI Logic storage controllers, as used in products such as Storagetek D280, and IBM DS4100 (formerly FastT 100) and Brocade SilkWorm Switches, allow remote attackers to cause a denial of service (freeze and possible data corruption) via crafted TCP packets.
24 CVE-2004-1661 +Priv Bypass 2004-09-02 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
MailWorks Professional allows remote attackers to bypass authentication and gain privileges via a cookie that contains "auth=1" and "uId=1."
25 CVE-2004-1656 Http R.Spl. 2004-09-01 2017-07-11
5.0
 None Remote Low Not required None Partial None
CRLF injection vulnerability in Comersus Shopping Cart 5.0991 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the redirecturl parameter.
26 CVE-2004-1654 Exec Code Sql 2004-09-01 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the calendar module in phpWebsite 0.9.3-4 and earlier allows remote attackers to execute arbitrary SQL commands via cal_template.
27 CVE-2004-1604 2004-09-30 2016-10-18
5.0
 None Remote Low Not required None Partial None
cPanel 9.9.1-RELEASE-3 allows remote authenticated users to chmod arbitrary files via a symlink attack on the _private directory, which is created when Front Page extensions are enabled.
28 CVE-2004-1379 Exec Code Overflow 2004-09-16 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the DVD subpicture decoder in xine xine-lib 1-rc5 and earlier allows remote attackers to execute arbitrary code via a (1) DVD or (2) MPEG subpicture header where the second field reuses RLE data from the end of the first field.
29 CVE-2004-1378 DoS 2004-09-21 2017-07-11
5.0
 None Remote Low Not required None None Partial
The expat XML parser code, as used in the open source Jabber (jabberd) 1.4.3 and earlier, jadc2s 0.9.0 and earlier, and possibly other packages, allows remote attackers to cause a denial of service (application crash) via a malformed packet to a socket that accepts XML connections.
30 CVE-2004-1372 Exec Code Overflow 2004-09-01 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
Multiple stack-based buffer overflows in IBM DB2 7.x and 8.1 allow local users to execute arbitrary code via (1) a long third argument to the rec2xml function or (2) a long filename argument to the generate_distfile procedure.
31 CVE-2004-1348 DoS 2004-09-06 2018-10-30
5.0
 None Remote Low Not required None None Partial
Unknown vulnerability in in.named on Solaris 8 allows remote attackers to cause a denial of service (process crash).
32 CVE-2004-0872 669 2004-09-16 2022-02-28
5.0
 None Remote Low Not required Partial None None
Opera does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka "Cross Security Boundary Cookie Injection."
33 CVE-2004-0871 2004-09-16 2017-07-11
5.0
 None Remote Low Not required Partial None None
Mozilla does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka "Cross Security Boundary Cookie Injection."
34 CVE-2004-0870 2004-09-16 2017-07-11
5.0
 None Remote Low Not required Partial None None
KDE Konqueror does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka "Cross Security Boundary Cookie Injection."
35 CVE-2004-0869 2004-09-16 2017-07-11
5.0
 None Remote Low Not required Partial None None
Internet Explorer does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka "Cross Security Boundary Cookie Injection."
36 CVE-2004-0866 2004-09-16 2021-07-23
7.5
 None Remote Low Not required Partial Partial Partial
Internet Explorer 6.0 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk, and .sch.uk, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session.
37 CVE-2004-0831 +Priv 2004-09-14 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
McAfee VirusScan 4.5.1 does not drop SYSTEM privileges before allowing users to browse for files via the "System Scan" properties of the System Tray applet, which could allow local users to gain privileges.
38 CVE-2004-0830 DoS 2004-09-09 2017-07-11
5.0
 None Remote Low Not required None None Partial
The Content Scanner Server in F-Secure Anti-Virus for Microsoft Exchange 6.21 and earlier, F-Secure Anti-Virus for Microsoft Exchange 6.01 and earlier, and F-Secure Internet Gatekeeper 6.32 and earlier allow remote attackers to cause a denial of service (service crash due to unhandled exception) via a certain malformed packet.
39 CVE-2004-0827 DoS Exec Code Overflow 2004-09-16 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in the ImageMagick graphics library 5.x before 5.4.4, and 6.x before 6.0.6.2, allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via malformed (1) AVI, (2) BMP, or (3) DIB files.
40 CVE-2004-0823 2004-09-07 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
OpenLDAP 1.0 through 2.1.19, as used in Apple Mac OS 10.3.4 and 10.3.5 and possibly other operating systems, may allow certain authentication schemes to use hashed (crypt) passwords in the userPassword attribute as if they were plaintext passwords, which allows remote attackers to re-use hashed passwords without decrypting them.
41 CVE-2004-0822 Exec Code Overflow 2004-09-07 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in The Core Foundation framework (CoreFoundation.framework) in Mac OS X 10.2.8, 10.3.4, and 10.3.5 allows local users to execute arbitrary code via a certain environment variable.
42 CVE-2004-0809 DoS 2004-09-16 2021-06-06
5.0
 None Remote Low Not required None None Partial
The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK requests for a location that allows WebDAV authoring access.
43 CVE-2004-0807 DoS 2004-09-13 2017-10-11
5.0
 None Remote Low Not required None None Partial
Samba 3.0.6 and earlier allows remote attackers to cause a denial of service (infinite loop and memory exhaustion) via certain malformed requests that cause new processes to be spawned and enter an infinite loop.
44 CVE-2004-0801 Exec Code 2004-09-16 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Unknown vulnerability in foomatic-rip in Foomatic before 3.0.2 allows local users or remote attackers with access to CUPS to execute arbitrary commands.
45 CVE-2004-0745 Exec Code 2004-09-28 2017-10-11
10.0
 None Remote Low Not required Complete Complete Complete
LHA 1.14 and earlier allows attackers to execute arbitrary commands via a directory with shell metacharacters in its name.
46 CVE-2004-0699 Exec Code Overflow 2004-09-28 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in ASN.1 decoding library in Check Point VPN-1 products, when Aggressive Mode IKE is implemented, allows remote attackers to execute arbitrary code by initiating an IKE negotiation and then sending an IKE packet with malformed ASN.1 data.
47 CVE-2004-0693 DoS 2004-09-28 2017-10-11
5.0
 None Remote Low Not required None None Partial
The GIF parser in the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (application crash) via a malformed image file that triggers a null dereference, a different vulnerability than CVE-2004-0692.
48 CVE-2004-0692 DoS 2004-09-28 2017-10-11
5.0
 None Remote Low Not required None None Partial
The XPM parser in the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (application crash) via a malformed image file that triggers a null dereference, a different vulnerability than CVE-2004-0693.
49 CVE-2004-0691 DoS Exec Code Overflow 2004-09-28 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the BMP image format parser for the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code.
50 CVE-2004-0644 DoS 2004-09-28 2020-01-21
5.0
 None Remote Low Not required None None Partial
The asn1buf_skiptail function in the ASN.1 decoder library for MIT Kerberos 5 (krb5) 1.2.2 through 1.3.4 allows remote attackers to cause a denial of service (infinite loop) via a certain BER encoding.
Total number of vulnerabilities : 70   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.