CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2004 (CVSS score >= 4)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
2101 CVE-2003-1214 Bypass 2004-02-11 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Unknown vulnerability in the server login for VisualShapers ezContents 2.02 and earlier allows remote attackers to bypass access restrictions and gain access to restricted functions.
2102 CVE-2003-1208 Exec Code Overflow 2004-12-03 2017-07-11
10.0
None Remote Low Not required Complete Complete Complete
Multiple buffer overflows in Oracle 9i 9 before 9.2.0.3 allow local users to execute arbitrary code by (1) setting the TIME_ZONE session parameter to a long value, or providing long parameters to the (2) NUMTOYMINTERVAL, (3) NUMTODSINTERVAL or (4) FROM_TZ functions.
2103 CVE-2003-1207 DoS 2004-02-01 2017-07-11
5.0
None Remote Low Not required None None Partial
Crob FTP Server 3.5.1 allows remote authenticated users to cause a denial of service (crash) via a dir command with a large number of "." characters followed by a "/*" string.
2104 CVE-2003-1199 XSS 2004-03-11 2017-07-11
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in MyProxy 20030629 allows remote attackers to inject arbitrary web script or HTML via the URL.
2105 CVE-2003-1052 +Priv 2004-09-28 2017-07-11
7.2
None Local Low Not required Complete Complete Complete
IBM DB2 7.1 and 8.1 allow the bin user to gain root privileges by modifying the shared libraries that are used in setuid root programs.
2106 CVE-2003-1051 Exec Code 2004-09-28 2017-07-11
7.2
None Local Low Not required Complete Complete Complete
Multiple format string vulnerabilities in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via certain command line arguments to (1) db2start, (2) db2stop, or (3) db2govd.
2107 CVE-2003-1050 Exec Code Overflow 2004-09-28 2017-07-11
7.2
None Local Low Not required Complete Complete Complete
Multiple buffer overflows in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via long command line arguments to (1) db2start, (2) db2stop, or (3) db2govd.
2108 CVE-2003-1049 2004-09-28 2017-07-11
4.6
None Local Low Not required Partial Partial Partial
IBM DB2 Universal Database 7 before FixPak 12 creates certain DMS directories with insecure permissions (777), which allows local users to modify or delete certain DB2 files.
2109 CVE-2003-1048 119 DoS Overflow 2004-07-27 2021-07-23
10.0
None Remote Low Not required Complete Complete Complete
Double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image.
2110 CVE-2003-1046 2004-08-18 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
describecomponents.cgi in Bugzilla 2.17.3 and 2.17.4 does not properly verify group membership when bug entry groups are used, which allows remote attackers to list component descriptions for otherwise restricted products.
2111 CVE-2003-1045 2004-08-18 2017-07-11
5.0
None Remote Low Not required Partial None None
votes.cgi in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote attackers to read a user's voting page when that user has voted on a restricted bug, which allows remote attackers to read potentially sensitive voting information by modifying the who parameter.
2112 CVE-2003-1044 2004-08-18 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
editproducts.cgi in Bugzilla 2.16.3 and earlier, when usebuggroups is enabled, does not properly remove group add privileges from a group that is being deleted, which allows users with those privileges to perform unauthorized additions to the next group that is assigned with the original group ID.
2113 CVE-2003-1043 Sql 2004-08-18 2017-07-11
10.0
None Remote Low Not required Complete Complete Complete
SQL injection vulnerability in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote authenticated users with editkeywords privileges to execute arbitrary SQL via the id parameter to editkeywords.cgi.
2114 CVE-2003-1042 Sql 2004-08-18 2017-07-11
10.0
None Remote Low Not required Complete Complete Complete
SQL injection vulnerability in collectstats.pl for Bugzilla 2.16.3 and earlier allows remote authenticated users with editproducts privileges to execute arbitrary SQL via the product name.
2115 CVE-2003-1041 Dir. Trav. 2004-06-14 2021-07-23
7.5
None Remote Low Not required Partial Partial Partial
Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing ".." (dot dot) sequences and a filename that ends in "::" which is treated as a .chm file even if it does not have a .chm extension. NOTE: this bug may overlap CVE-2004-0475.
2116 CVE-2003-1039 Exec Code Overflow 2004-04-15 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in the mySAP.com architecture for SAP allow remote attackers to execute arbitrary code via a long HTTP Host header to (1) Message Server, (2) Web Dispatcher, or (3) Application Server.
2117 CVE-2003-1038 +Info 2004-04-15 2017-07-11
5.0
None Remote Low Not required Partial None None
The AGate component for SAP Internet Transaction Server (ITS) allows remote attackers to obtain sensitive information via a ~command parameter with an AgateInstallCheck value, which provides a list of installed DLLs and full pathnames.
2118 CVE-2003-1037 Exec Code 2004-04-15 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Format string vulnerability in the WGate component for SAP Internet Transaction Server (ITS) allows remote attackers to execute arbitrary code via a high "trace level."
2119 CVE-2003-1036 Exec Code Overflow 2004-04-15 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in the AGate component for SAP Internet Transaction Server (ITS) allow remote attackers to execute arbitrary code via long (1) ~command, (2) ~runtimemode, or (3) ~session parameters, or (4) a long HTTP Content-Type header.
2120 CVE-2003-1035 Bypass 2004-04-15 2018-10-19
7.5
None Remote Low Not required Partial Partial Partial
The default installation of SAP R/3 46C/D allows remote attackers to bypass account locking by using the RFC API instead of the SAPGUI to conduct a brute force password guessing attack, which does not lock out the account like the SAPGUI does.
2121 CVE-2003-1034 +Priv 2004-04-15 2017-07-11
4.6
None Local Low Not required Partial Partial Partial
The RPM installation of SAP DB 7.x creates the (1) dbmsrv or (2) lserver programs with world-writable permissions, which allows local users to gain privileges by modifying those programs.
2122 CVE-2003-1033 +Priv 2004-04-15 2017-07-11
7.2
None Local Low Not required Complete Complete Complete
The (1) instdbmsrv and (2) instlserver programs in SAP DB Development Tools 7.x trust the user-provided INSTROOT environment variable as a path when assigning setuid permissions to the lserver program, which allows local users to gain root privileges via a modified INSTROOT that points to a malicious dbmsrv or lserver program.
2123 CVE-2003-1032 DoS Overflow 2004-02-17 2016-12-20
5.0
None Remote Low Not required None None Partial
Pi3Web web server 2.0.2 Beta 1, when the Directory Index is configured to use the "Name" column and sort using the column title as a hyperlink, allows remote attackers to cause a denial of service (crash) via a malformed URL to the web server, possibly involving a buffer overflow.
2124 CVE-2003-1031 XSS 2004-02-17 2008-09-05
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in register.php for vBulletin 3.0 Beta 2 allows remote attackers to inject arbitrary HTML or web script via optional fields such as (1) "Interests-Hobbies", (2) "Biography", or (3) "Occupation."
2125 CVE-2003-1030 Exec Code Overflow 2004-02-17 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in DameWare Mini Remote Control before 3.73 allows remote attackers to execute arbitrary code via a long pre-authentication request to TCP port 6129.
2126 CVE-2003-1029 DoS 2004-02-17 2018-10-19
5.0
None Remote Low Not required None None Partial
The L2TP protocol parser in tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (infinite loop and memory consumption) via a packet with invalid data to UDP port 1701, which causes l2tp_avp_print to use a bad length value when calling print_octets.
2127 CVE-2003-1028 Bypass 2004-01-20 2021-07-23
5.0
None Remote Low Not required Partial None None
The download function of Internet Explorer 6 SP1 allows remote attackers to obtain the cache directory name via an HTTP response with an invalid ContentType and a .htm file, which could allow remote attackers to bypass security mechanisms that rely on random names, as demonstrated by threadid10008.
2128 CVE-2003-1027 2004-01-20 2021-07-23
10.0
None Remote Low Not required Complete Complete Complete
Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability."
2129 CVE-2003-1026 264 Bypass 2004-01-20 2021-07-23
9.3
None Remote Medium Not required Complete Complete Complete
Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability."
2130 CVE-2003-1025 20 2004-01-20 2021-07-23
4.3
None Remote Medium Not required None Partial None
Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability."
2131 CVE-2003-1024 +Priv 2004-01-20 2018-10-30
7.2
None Local Low Not required Complete Complete Complete
Unknown vulnerability in the ls-F builtin function in tcsh on Solaris 8 allows local users to create or delete files as other users, and gain privileges.
2132 CVE-2003-1023 Exec Code Overflow 2004-01-20 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in vfs_s_resolve_symlink of vfs/direntry.c for Midnight Commander (mc) 4.6.0 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code during symlink conversion.
2133 CVE-2003-1022 Dir. Trav. 2004-01-20 2017-10-10
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in fsp before 2.81.b18 allows remote users to access files outside the FSP root directory.
2134 CVE-2003-1020 DoS 2004-01-05 2017-07-11
5.0
None Remote Low Not required None None Partial
The format_send_to_gui function in formats.c for irssi before 0.8.9 allows remote IRC users to cause a denial of service (crash).
2135 CVE-2003-1018 +Priv 2004-03-29 2017-07-11
7.2
None Local Low Not required Complete Complete Complete
Format string vulnerability in enq command in AIX 4.3, 5.1, and 5.2 allows local users with rintq group privileges to gain privileges via unknown attack vectors.
2136 CVE-2003-1017 2004-01-05 2017-07-11
5.0
None Remote Low Not required Partial None None
Macromedia Flash Player before 7,0,19,0 stores a Flash data file in a predictable location that is accessible to web browsers such as Internet Explorer and Opera, which allows remote attackers to read restricted files via vulnerabilities in web browsers whose exploits rely on predictable names.
2137 CVE-2003-1016 Bypass 2004-10-20 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use malformed quoting in MIME headers, parameters, and values, including (1) fields that should not be quoted, (2) duplicate quotes, or (3) missing leading or trailing quote characters, which may be interpreted differently by mail clients.
2138 CVE-2003-1015 Bypass 2004-10-20 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use whitespace in an unusual fashion, which may be interpreted differently by mail clients.
2139 CVE-2003-1014 Bypass 2004-10-20 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use multiple MIME fields with the same name, which may be interpreted differently by mail clients.
2140 CVE-2003-1013 DoS 2004-01-05 2017-10-11
5.0
None Remote Low Not required None None Partial
The Q.931 dissector in Ethereal before 0.10.0, and Tethereal, allows remote attackers to cause a denial of service (crash) via a malformed Q.931, which triggers a null dereference.
2141 CVE-2003-1012 DoS 2004-01-05 2017-10-11
5.0
None Remote Low Not required None None Partial
The SMB dissector in Ethereal before 0.10.0 allows remote attackers to cause a denial of service via a malformed SMB packet that triggers a segmentation fault during processing of Selected packets.
2142 CVE-2003-1011 2004-03-29 2017-07-11
7.2
None Local Low Not required Complete Complete Complete
Apple Mac OS X 10.0 through 10.2.8 allows local users with a USB keyboard to gain unauthorized access by holding down the CTRL and C keys when the system is booting, which crashes the init process and leaves the user in a root shell.
2143 CVE-2003-1010 +Priv 2004-03-29 2017-07-11
4.6
None Local Low Not required Partial Partial Partial
Unknown vulnerability in fs_usage in Mac OS X 10.2.8 and 10.3.2 and Mac OS X Server 10.2.8 and 10.3.2 allows local users to gain privileges via unknown attack vectors.
2144 CVE-2003-1009 +Priv 2004-03-29 2017-07-11
10.0
None Remote Low Not required Complete Complete Complete
Directory Services in Apple Mac OS X 10.0.2, 10.0.3, 10.2.8, 10.3.2 and Apple Mac OS X Server 10.2 through 10.3.2 accepts authentication server information from unknown LDAP or NetInfo sources as provided by a malicious DHCP server, which allows remote attackers to gain privileges.
2145 CVE-2003-1008 Bypass 2004-03-29 2017-07-11
4.6
None Local Low Not required Partial Partial Partial
Unknown vulnerability in Mac OS X 10.2.8 and 10.3.2 allows local users to bypass the screen saver login window and write a text clipping to the desktop or another application.
2146 CVE-2003-1007 2004-03-29 2017-07-11
5.0
None Remote Low Not required None None Partial
AppleFileServer (AFS) in Apple Mac OS X 10.2.8 and 10.3.2 does not properly handle certain malformed requests, with unknown impact.
2147 CVE-2003-1006 Exec Code Overflow 2004-03-29 2017-07-11
7.2
None Local Low Not required Complete Complete Complete
Buffer overflow in cd9660.util in Apple Mac OS X 10.0 through 10.3.2 and Apple Mac OS X Server 10.0 through 10.3.2 may allow local users to execute arbitrary code via a long command line parameter.
2148 CVE-2003-1004 DoS 2004-01-05 2018-10-30
5.0
None Remote Low Not required None None Partial
Cisco PIX firewall 6.2.x through 6.2.3, when configured as a VPN Client, allows remote attackers to cause a denial of service (dropped IPSec tunnel connection) via an IKE Phase I negotiation request to the outside interface of the firewall.
2149 CVE-2003-1003 20 DoS 2004-01-05 2018-10-30
7.8
None Remote Low Not required None None Complete
Cisco PIX firewall 5.x.x, and 6.3.1 and earlier, allows remote attackers to cause a denial of service (crash and reload) via an SNMPv3 message when snmp-server is set.
2150 CVE-2003-1002 DoS 2004-01-05 2008-09-10
5.0
None Remote Low Not required None None Partial
Cisco Firewall Services Module (FWSM) in Cisco Catalyst 6500 and 7600 series devices allows remote attackers to cause a denial of service (crash and reload) via an SNMPv3 message when snmp-server is set.
Total number of vulnerabilities : 2243   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 (This Page)44 45
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.