CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2004 (CVSS score >= 4)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1751 CVE-2004-0425 Exec Code Overflow 2004-08-18 2017-07-11
10.0
None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in SiteMinder Affiliate Agent 4.x allows remote attackers to execute arbitrary code via a large SMPROFILE cookie.
1752 CVE-2004-0424 DoS Exec Code Overflow 2004-07-07 2018-05-03
7.2
None Local Low Not required Complete Complete Complete
Integer overflow in the ip_setsockopt function in Linux kernel 2.4.22 through 2.4.25 and 2.6.1 through 2.6.3 allows local users to cause a denial of service (crash) or execute arbitrary code via the MCAST_MSFILTER socket option.
1753 CVE-2004-0421 DoS 2004-08-18 2017-10-11
5.0
None Remote Low Not required None None Partial
The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message.
1754 CVE-2004-0420 Exec Code 2004-07-07 2021-07-23
10.0
None Remote Low Not required Complete Complete Complete
The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.
1755 CVE-2004-0419 2004-08-18 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
XDM in XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0, which could allow remote attackers to connect to the port, in violation of the intended restrictions.
1756 CVE-2004-0418 Exec Code 2004-08-06 2018-05-03
10.0
None Remote Low Not required Complete Complete Complete
serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data.
1757 CVE-2004-0417 Overflow 2004-08-06 2018-05-03
5.0
None Remote Low Not required None None Partial
Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space.
1758 CVE-2004-0416 119 Exec Code Overflow 2004-08-06 2018-05-03
10.0
None Remote Low Not required Complete Complete Complete
Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.
1759 CVE-2004-0414 DoS Exec Code 2004-08-06 2018-05-03
10.0
None Remote Low Not required Complete Complete Complete
CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution.
1760 CVE-2004-0413 DoS Exec Code Overflow 2004-08-06 2017-07-11
10.0
None Remote Low Not required Complete Complete Complete
libsvn_ra_svn in Subversion 1.0.4 trusts the length field of (1) svn://, (2) svn+ssh://, and (3) other svn protocol URL strings, which allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via an integer overflow that leads to a heap-based buffer overflow.
1761 CVE-2004-0412 2004-08-18 2017-07-11
5.0
None Remote Low Not required Partial None None
Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server.
1762 CVE-2004-0411 20 Exec Code 2004-07-07 2022-02-28
7.5
None Remote Low Not required Partial Partial Partial
The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code.
1763 CVE-2004-0409 Exec Code Overflow 2004-06-01 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the Socks-5 proxy code for XChat 1.8.0 to 2.0.8, with socks5 traversal enabled, allows remote attackers to execute arbitrary code.
1764 CVE-2004-0408 Exec Code Overflow 2004-09-28 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the child_service function in the ident2 ident daemon allows remote attackers to execute arbitrary code.
1765 CVE-2004-0405 2004-06-01 2017-10-11
5.0
None Remote Low Not required Partial None None
CVS before 1.11 allows CVS clients to read arbitrary files via .. (dot dot) sequences in filenames via CVS client requests, a different vulnerability than CVE-2004-0180.
1766 CVE-2004-0403 DoS 2004-06-01 2017-10-11
5.0
None Remote Low Not required None None Partial
Racoon before 20040408a allows remote attackers to cause a denial of service (memory consumption) via an ISAKMP packet with a large length field.
1767 CVE-2004-0402 Exec Code Overflow 2004-07-07 2017-07-11
4.6
None Local Low Not required Partial Partial Partial
Buffer overflow in xpcd-svga in xpcd before 2.08, and possibly other versions, may allow local users to execute arbitrary code.
1768 CVE-2004-0401 2004-07-07 2017-07-11
10.0
None Remote Low Not required Complete Complete Complete
Unknown vulnerability in libtasn1 0.1.x before 0.1.2, and 0.2.x before 0.2.7, related to the DER parsing functions.
1769 CVE-2004-0400 DoS Exec Code Overflow 2004-07-07 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code during the header check.
1770 CVE-2004-0399 DoS Exec Code Overflow 2004-07-07 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify option is true, allows remote attackers to cause a denial of service and possibly execute arbitrary code during sender verification.
1771 CVE-2004-0398 787 Exec Code Overflow 2004-07-07 2020-10-09
7.5
None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library (libneon) 0.24.5 and earlier, as used by cadaver before 0.22, allows remote WebDAV servers to execute arbitrary code on the client.
1772 CVE-2004-0397 Exec Code Overflow 2004-07-07 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.
1773 CVE-2004-0396 Exec Code Overflow 2004-06-14 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines.
1774 CVE-2004-0395 Exec Code 2004-12-06 2017-07-11
7.2
None Local Low Not required Complete Complete Complete
The xatitv program in the gatos package does not properly drop root privileges when the configuration file does not exist, which allows local users to execute arbitrary commands via shell metacharacters in a system call.
1775 CVE-2004-0393 Exec Code 2004-12-06 2017-07-11
10.0
None Remote Low Not required Complete Complete Complete
Format string vulnerability in the msg function for rlpr daemon (rlprd) 2.0.4 allows remote attackers to execute arbitrary code via format string specifiers in a buffer that can not be resolved, which is provided to the syslog function.
1776 CVE-2004-0392 DoS 2004-06-14 2017-07-11
5.0
None Remote Low Not required None None Partial
racoon before 20040407b allows remote attackers to cause a denial of service (infinite loop and dropped connections) via an IKE message with a malformed Generic Payload Header containing invalid (1) "Security Association Next Payload" and (2) "RESERVED" fields.
1777 CVE-2004-0391 2004-06-01 2017-07-11
10.0
None Remote Low Not required Complete Complete Complete
Cisco Wireless LAN Solution Engine (WLSE) 2.0 through 2.5 and Hosting Solution Engine (HSE) 1.7 through 1.7.3 have a hardcoded username and password, which allows remote attackers to add new users, modify existing users, and change configuration.
1778 CVE-2004-0390 2004-12-31 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
SCO OpenServer 5.0.5 through 5.0.7 only supports Xauthority style access control when users log in using scologin, which allows remote attackers to gain unauthorized access to an X session via other X login methods.
1779 CVE-2004-0389 DoS 2004-06-01 2017-07-11
7.8
None Remote Low Not required None None Complete
RealNetworks Helix Universal Server 9.0.1 and 9.0.2 allows remote attackers to cause a denial of service (crash) via malformed requests that trigger a null dereference, as demonstrated using (1) GET_PARAMETER or (2) DESCRIBE requests.
1780 CVE-2004-0387 Exec Code Overflow 2004-06-01 2017-07-11
5.1
None Remote High Not required Partial Partial Partial
Stack-based buffer overflow in the RT3 plugin, as used in RealPlayer 8, RealOne Player, RealOne Player 10 beta, and RealOne Player Enterprise, allows remote attackers to execute arbitrary code via a malformed .R3T file.
1781 CVE-2004-0386 Exec Code Overflow 2004-05-04 2017-07-11
10.0
None Remote Low Not required Complete Complete Complete
Buffer overflow in the HTTP parser for MPlayer 1.0pre3 and earlier, 0.90, and 0.91 allows remote attackers to execute arbitrary code via a long Location header.
1782 CVE-2004-0385 Exec Code Overflow 2004-06-01 2017-07-11
10.0
None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in Oracle 9i Application Server Web Cache 9.0.4.0.0, 9.0.3.1.0, 9.0.2.3.0, and 9.0.0.4.0 allows remote attackers to execute arbitrary code via a long HTTP request method header to the Web Cache listener. NOTE: due to the vagueness of the Oracle advisory, it is not clear whether there are additional issues besides this overflow, although the advisory alludes to multiple "vulnerabilities."
1783 CVE-2004-0383 2004-05-04 2017-07-11
7.2
None Local Low Not required Complete Complete Complete
Unknown vulnerability in Mail for Mac OS X 10.3.3 and 10.2.8, with unknown impact, related to "the handling of HTML-formatted email."
1784 CVE-2004-0382 2004-05-04 2017-07-11
7.2
None Local Low Not required Complete Complete Complete
Unknown vulnerability in the CUPS printing system in Mac OS X 10.3.3 and Mac OS X 10.2.8 with unknown impact, possibly related to a configuration file setting.
1785 CVE-2004-0380 Exec Code Bypass 2004-05-04 2018-10-12
10.0
None Remote Low Not required Complete Complete Complete
The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."
1786 CVE-2004-0379 XSS 2004-05-04 2017-07-11
6.8
None Remote Medium Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in Microsoft SharePoint Portal Server 2001 allow remote attackers to process arbitrary web content and steal cookies via certain server scripts.
1787 CVE-2004-0377 Exec Code Overflow 2004-05-04 2017-07-11
10.0
None Remote Low Not required Complete Complete Complete
Buffer overflow in the win32_stat function for (1) ActiveState's ActivePerl and (2) Larry Wall's Perl before 5.8.3 allows local or remote attackers to execute arbitrary commands via filenames that end in a backslash character.
1788 CVE-2004-0376 DoS 2004-05-04 2017-07-11
5.0
None Remote Low Not required None None Partial
oftpd 0.3.6 and earlier allows remote attackers to cause a denial of service (crash) via a PORT command with a large value.
1789 CVE-2004-0375 DoS 2004-08-18 2017-07-11
5.0
None Remote Low Not required None None Partial
SYMNDIS.SYS in Symantec Norton Internet Security 2003 and 2004, Norton Personal Firewall 2003 and 2004, Client Firewall 5.01 and 5.1.1, and Client Security 1.0 and 1.1 allow remote attackers to cause a denial of service (infinite loop) via a TCP packet with (1) SACK option or (2) Alternate Checksum Data option followed by a length of zero.
1790 CVE-2004-0374 2004-05-04 2017-07-11
6.4
None Remote Low Not required Partial Partial None
Interchange before 5.0.1 allows remote attackers to "expose the content of arbitrary variables" and read or modify sensitive SQL information via an HTTP request ending with the "__SQLUSER__" string.
1791 CVE-2004-0371 2004-05-04 2017-07-11
5.0
None Remote Low Not required None Partial None
Heimdal 0.6.x before 0.6.1 and 0.5.x before 0.5.3 does not properly perform certain consistency checks for cross-realm requests, which allows remote attackers with control of a realm to impersonate others in the cross-realm trust path.
1792 CVE-2004-0369 Exec Code Overflow 2004-12-31 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in Entrust LibKmp ISAKMP library, as used by Symantec Enterprise Firewall 7.0 through 8.0, Gateway Security 5300 1.0, Gateway Security 5400 2.0, and VelociRaptor 1.5, allows remote attackers to execute arbitrary code via a crafted ISAKMP payload.
1793 CVE-2004-0368 119 Exec Code Overflow 2004-05-04 2017-10-11
10.0
None Remote Low Not required Complete Complete Complete
Double free vulnerability in dtlogin in CDE on Solaris, HP-UX, and other operating systems allows remote attackers to execute arbitrary code via a crafted XDMCP packet.
1794 CVE-2004-0367 DoS 2004-05-04 2017-10-11
5.0
None Remote Low Not required None None Partial
Ethereal 0.10.1 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a zero-length Presentation protocol selector.
1795 CVE-2004-0366 Sql 2004-05-04 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the libpam-pgsql library before 0.5.2 allows attackers to execute arbitrary SQL statements.
1796 CVE-2004-0365 DoS 2004-05-04 2017-10-11
5.0
None Remote Low Not required None None Partial
The dissect_attribute_value_pairs function in packet-radius.c for Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference.
1797 CVE-2004-0364 2004-04-15 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
The WrapNISUM ActiveX component (WrapUM.dll) in Norton Internet Security 2004 is marked safe for scripting, which allows remote attackers to execute arbitrary programs via the LaunchURL method.
1798 CVE-2004-0363 Exec Code Overflow 2004-04-15 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the SymSpamHelper ActiveX component (symspam.dll) in Norton AntiSpam 2004, as used in Norton Internet Security 2004, allows remote attackers to execute arbitrary code via a long parameter to the LaunchCustomRuleWizard method.
1799 CVE-2004-0362 Exec Code Overflow 2004-04-15 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRV_MULTI response containing a SRV_USER_ONLINE response packet and a SRV_META_USER response packet with long (1) nickname, (2) firstname, (3) lastname, or (4) email address fields, as exploited by the Witty worm.
1800 CVE-2004-0361 DoS 2004-11-23 2017-07-11
5.0
None Remote Low Not required None None Partial
The Javascript engine in Safari 1.2 and earlier allows remote attackers to cause a denial of service (segmentation fault) by creating a new Array object with a large size value, then writing into that array.
Total number of vulnerabilities : 2243   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 (This Page)37 38 39 40 41 42 43 44 45
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.