CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2004

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
101 CVE-2004-0671 2004-08-06 2017-07-11
5.0
 None Remote Low Not required Partial None None
Brightmail Spamfilter 6.0 and earlier beta releases allows remote attackers to read mail from other users by modifying the id parameter in a viewMsgDetails.do request.
102 CVE-2004-0670 DoS 2004-08-06 2017-07-11
5.0
 None Remote Low Not required None None Partial
Prestige 650HW-31 running Rompager 4.7 software allows remote attackers to cause a denial of service (device reboot) via a long password.
103 CVE-2004-0669 2004-08-06 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Lotus Domino 6.5.0 and 6.5.1, with IMAP enabled, allows remote authenticated users to change their quota by using the IMAP setquota command.
104 CVE-2004-0668 DoS 2004-08-06 2017-07-11
5.0
 None Remote Low Not required None None Partial
Web Access in Lotus Domino 6.5.1 allows remote attackers to cause a denial of service (server crash) via a large e-mail message, as demonstrated using a large image attachment.
105 CVE-2004-0667 +Priv 2004-08-06 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
Rule Set Based Access Control (RSBAC) 1.2.2 through 1.2.3 allows access to sys_creat, sys_open, and sys_mknod inside jails, which could allow local users to gain elevated privileges.
106 CVE-2004-0666 DoS Overflow 2004-08-06 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Off-by-one error in the POP3_readmsg function in popclient 3.0b6 allows remote attackers to cause a denial of service (application crash) via an e-mail message with a certain line length, which leads to a buffer overflow.
107 CVE-2004-0665 2004-08-06 2017-07-11
5.0
 None Remote Low Not required Partial None None
csFAQ.cgi in csFAQ allows remote attackers to gain sensitive information via an invalid database parameter, which reveals the path to the web server in an error message.
108 CVE-2004-0664 Dir. Trav. 2004-08-06 2017-07-11
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in modules.php in PowerPortal 1.x allows remote attackers to list arbitrary directories via a .. (dot dot) in the files parameter.
109 CVE-2004-0663 XSS 2004-08-06 2017-07-11
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in modules.php in PowerPortal 1.x allows remote attackers to inject arbitrary script or HTML via the (1) id parameter to the (a) private_messages module; (2) search parameter to the (b) links and (c) content modules; and (3) files parameter to the gallery module.
110 CVE-2004-0662 2004-08-06 2017-07-11
5.0
 None Remote Low Not required Partial None None
PowerPortal 1.x allows remote attackers to gain sensitive information via invalid or missing parameters in HTTP requests to (1) resize.php or (2) modules.php, which reveals the path in an error message.
111 CVE-2004-0661 DoS 2004-08-06 2017-07-11
5.0
 None Remote Low Not required None None Partial
Integer signedness error in D-Link AirPlus DI-614+ running firmware 2.30 and earlier allows remote attackers to cause a denial of service (IP lease depletion) via a DHCP request with the LEASETIME option set to -1, which makes the DHCP lease valid for thirteen or more years.
112 CVE-2004-0660 XSS 2004-08-06 2017-07-11
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in (1) show_archives.php, (2) show_news.php, and possibly other php files in CuteNews 1.3.1 allows remote attackers to inject arbitrary script or HTML via the id parameter.
113 CVE-2004-0659 Exec Code Overflow 2004-08-06 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in TranslateFilename for common.c in MPlayer 1.0pre4 allows remote attackers to execute arbitrary code via a long file name.
114 CVE-2004-0658 DoS Exec Code Overflow 2004-08-06 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
Integer overflow in the hpsb_alloc_packet function (incorrectly reported as alloc_hpsb_packet) in IEEE 1394 (Firewire) driver 2.4 and 2.6 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via the functions (1) raw1394_write, (2) state_connected, (3) handle_remote_request, or (4) hpsb_make_writebpacket.
115 CVE-2004-0657 190 Overflow 2004-08-06 2020-06-18
5.0
 None Remote Low Not required None Partial None
Integer overflow in the NTP daemon (NTPd) before 4.0 causes the NTP server to return the wrong date/time offset when a client requests a date/time that is more than 34 years away from the server's time.
116 CVE-2004-0656 DoS 2004-08-06 2017-07-11
5.0
 None Remote Low Not required None None Partial
The accept_client function in PureFTPd 1.0.18 and earlier allows remote attackers to cause a denial of service by exceeding the maximum number of connections.
117 CVE-2004-0655 2004-08-06 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
eupdatedb in esearch 0.6.1 and earlier allows local users to create arbitrary files via a symlink attack on the esearchdb.py.tmp temporary file.
118 CVE-2004-0654 DoS 2004-08-06 2018-10-30
2.1
 None Local Low Not required None None Partial
Unknown vulnerability in the Basic Security Module (BSM), when configured to audit either the Administrative (ad) or the System-Wide Administration (as) audit class in Solaris 7, 8, and 9, allows local users to cause a denial of service (kernel panic).
119 CVE-2004-0653 2004-08-06 2017-10-11
2.1
 None Local Low Not required Partial None None
Solaris 9, when configured as a Kerberos client with patch 112908-12 or 115168-03 and using pam_krb5 as an "auth" module with the debug feature enabled, records passwords in plaintext, which could allow local users to gain other user's passwords by reading log files.
120 CVE-2004-0652 2004-08-06 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods.
121 CVE-2004-0651 DoS 2004-08-06 2018-10-30
5.0
 None Remote Low Not required None None Partial
Unknown vulnerability in Sun Java Runtime Environment (JRE) 1.4.2 through 1.4.2_03 allows remote attackers to cause a denial of service (virtual machine hang).
122 CVE-2004-0650 2004-08-06 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
UploadServlet in Cisco Collaboration Server (CCS) running ServletExec before 3.0E allows remote attackers to upload and execute arbitrary files via a direct call to the UploadServlet URL.
123 CVE-2004-0649 Exec Code Overflow 2004-08-06 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in write_packet in control.c for l2tpd may allow remote attackers to execute arbitrary code.
124 CVE-2004-0648 2004-08-06 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Mozilla (Suite) before 1.7.1, Firefox before 0.9.2, and Thunderbird before 0.7.2 allow remote attackers to launch arbitrary programs via a URI referencing the shell: protocol.
125 CVE-2004-0647 2004-08-06 2017-07-11
4.6
 None Local Low Not required Partial Partial Partial
shorewall 1.4.10c and earlier, and 2.0.x before 2.0.3a, allows local users to overwrite arbitrary files via a symlink attack on the chains-$$ temporary file.
126 CVE-2004-0645 Exec Code Overflow 2004-08-06 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the wvHandleDateTimePicture function in wv library (wvWare) 0.7.4 through 0.7.6 and 1.0.0 allows remote attackers to execute arbitrary code via a document with a long DateTime field.
127 CVE-2004-0641 2004-08-05 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Thomson SpeedTouch 510 ADSL Router with firmware GV8BAA3.270, and possibly earlier versions, generates predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoof or hijack TCP connections.
128 CVE-2004-0640 Exec Code 2004-08-06 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Format string vulnerability in the SSL_set_verify function in telnetd.c for SSLtelnet daemon (SSLtelnetd) 0.13 allows remote attackers to execute arbitrary code.
129 CVE-2004-0639 XSS 2004-08-06 2017-07-11
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in read_body.php, (2) the $senderNames_part variable in mailbox_display.php, and possibly other vectors including (3) the $event_title variable or (4) the $event_text variable.
130 CVE-2004-0631 Exec Code Overflow 2004-08-18 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the uudecoding feature for Adobe Acrobat Reader 5.0.5 and 5.0.6 for Unix and Linux, and possibly other versions including those before 5.0.9, allows remote attackers to execute arbitrary code via a long filename for the PDF file that is provided to the uudecode command.
131 CVE-2004-0630 Exec Code 2004-08-18 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
The uudecoding feature in Adobe Acrobat Reader 5.0.5 and 5.0.6 for Unix and Linux, and possibly other versions including those before 5.0.9, allows remote attackers to execute arbitrary code via shell metacharacters ("`" or backtick) in the filename of the PDF file that is provided to the uudecode command.
132 CVE-2004-0596 DoS 2004-08-06 2017-07-11
2.1
 None Local Low Not required None None Partial
The Equalizer Load-balancer for serial network interfaces (eql.c) in Linux kernel 2.6.x up to 2.6.7 allows local users to cause a denial of service via a non-existent device name that triggers a null dereference.
133 CVE-2004-0591 XSS 2004-08-06 2017-07-11
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in the print_header_uc function for SqWebMail 4.0.4 and earlier, and possibly 3.x, allows remote attackers to inject arbitrary web script or HRML via (1) e-mail headers or (2) a message with a "message/delivery-status" MIME Content-Type.
134 CVE-2004-0589 DoS 2004-08-06 2017-10-11
5.0
 None Remote Low Not required None None Partial
Cisco IOS 11.1(x) through 11.3(x) and 12.0(x) through 12.2(x), when configured for BGP routing, allows remote attackers to cause a denial of service (device reload) via malformed BGP (1) OPEN or (2) UPDATE messages.
135 CVE-2004-0588 XSS 2004-08-06 2017-07-11
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in the web mail module for Usermin 1.070 allows remote attackers to insert arbitrary HTML and script via e-mail messages.
136 CVE-2004-0587 DoS 2004-08-06 2017-10-11
2.1
 None Local Low Not required None None Partial
Insecure permissions for the /proc/scsi/qla2300/HbaApiNode file in Linux allows local users to cause a denial of service.
137 CVE-2004-0586 Exec Code 2004-08-06 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
acpRunner ActiveX 1.2.5.0 allows remote attackers to execute arbitrary code via the (1) DownLoadURL, (2) SaveFilePath, and (3) Download ActiveX methods.
138 CVE-2004-0584 XSS 2004-08-06 2017-07-11
6.8
 None Remote Medium Not required Partial Partial Partial
Unknown vulnerability in Horde IMP 3.2.3 and earlier, before a "security fix," does not properly validate input, which allows remote attackers to execute arbitrary script as other users via script or HTML in an e-mail message, possibly triggering a cross-site scripting (XSS) vulnerability.
139 CVE-2004-0583 2004-08-06 2017-07-11
5.0
 None Remote Low Not required Partial None None
The account lockout functionality in (1) Webmin 1.140 and (2) Usermin 1.070 does not parse certain character strings, which allows remote attackers to conduct a brute force attack to guess user IDs and passwords.
140 CVE-2004-0582 Bypass 2004-08-06 2017-07-11
5.0
 None Remote Low Not required Partial None None
Unknown vulnerability in Webmin 1.140 allows remote attackers to bypass access control rules and gain read access to configuration information for a module.
141 CVE-2004-0581 2004-08-06 2017-07-11
4.6
 None Local Low Not required Partial Partial Partial
ksymoops-gznm script in Mandrake Linux 9.1 through 10.0, and Corporate Server 2.1, allows local users to delete arbitrary files via a symlink attack on files in /tmp.
142 CVE-2004-0580 +Info 2004-08-06 2018-08-13
5.0
 None Remote Low Not required Partial None None
DHCP on Linksys BEFSR11, BEFSR41, BEFSR81, and BEFSRU31 Cable/DSL Routers, firmware version 1.45.7, does not properly clear previously used buffer contents in a BOOTP reply packet, which allows remote attackers to obtain sensitive information.
143 CVE-2004-0579 Exec Code 2004-08-06 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
Format string vulnerability in super before 3.23 allows local users to execute arbitrary code as root.
144 CVE-2004-0557 Exec Code Overflow 2004-08-06 2017-10-11
10.0
 None Remote Low Not required Complete Complete Complete
Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute arbitrary code via certain WAV file header fields.
145 CVE-2004-0554 DoS 2004-08-06 2017-10-11
2.1
 None Local Low Not required None None Partial
Linux kernel 2.4.x and 2.6.x for x86 allows local users to cause a denial of service (system crash), possibly via an infinite loop that triggers a signal handler with a certain sequence of fsave and frstor instructions, as originally demonstrated using a "crash.c" program.
146 CVE-2004-0551 DoS 2004-08-06 2017-07-11
5.0
 None Remote Low Not required None None Partial
Cisco CatOS 5.x before 5.5(20) through 8.x before 8.2(2) and 8.3(2)GLX, as used in Catalyst switches, allows remote attackers to cause a denial of service (system crash and reload) by sending invalid packets instead of the final ACK portion of the three-way handshake to the (1) Telnet, (2) HTTP, or (3) SSH services, aka "TCP-ACK DoS attack."
147 CVE-2004-0550 Exec Code Overflow 2004-08-06 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Real Networks RealPlayer 10 allows remote attackers to execute arbitrary code via a URL with a large number of "." (period) characters.
148 CVE-2004-0549 Exec Code 2004-08-06 2021-07-23
10.0
 None Remote Low Not required Complete Complete Complete
The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object.
149 CVE-2004-0548 Exec Code Overflow 2004-08-06 2016-11-28
7.2
 None Local Low Not required Complete Complete Complete
Multiple stack-based buffer overflows in the word-list-compress functionality in compress.c for Aspell allow local users to execute arbitrary code via a long entry in the wordlist that is not properly handled when using the (1) "c" compress option or (2) "d" decompress option.
150 CVE-2004-0547 DoS Overflow 2004-08-06 2017-07-11
5.0
 None Remote Low Not required None None Partial
Buffer overflow in the ODBC driver for PostgreSQL before 7.2.1 allows remote attackers to cause a denial of service (crash).
Total number of vulnerabilities : 240   Page : 1 2 3 (This Page)4 5
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.