CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2004 (CVSS score >= 4)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
2151 CVE-2003-1001 DoS Overflow 2004-01-05 2008-09-10
5.0
 None Remote Low Not required None None Partial
Buffer overflow in the Cisco Firewall Services Module (FWSM) in Cisco Catalyst 6500 and 7600 series devices allows remote attackers to cause a denial of service (crash and reload) via HTTP auth requests for (1) TACACS+ or (2) RADIUS authentication.
2152 CVE-2003-1000 DoS 2004-01-05 2016-10-18
5.0
 None Remote Low Not required None None Partial
xchat 2.0.6 allows remote attackers to cause a denial of service (crash) via a passive DCC request with an invalid ID number, which causes a null dereference.
2153 CVE-2003-0999 Exec Code 2004-01-05 2018-10-30
7.2
 None Local Low Not required Complete Complete Complete
Unknown multiple vulnerabilities in (1) lpstat and (2) the libprint library in Solaris 2.6 through 9 may allow attackers to execute arbitrary code or read or write arbitrary files.
2154 CVE-2003-0998 +Priv 2004-01-05 2021-04-13
4.6
 None Local Low Not required Partial Partial Partial
Unknown "potential system security vulnerability" in Computer Associates (CA) Unicenter Remote Control 5.0 through 5.2, and ControlIT 5.0 and 5.1, may allow attackers to gain privileges to the local system account.
2155 CVE-2003-0997 DoS 2004-01-05 2021-04-13
5.0
 None Remote Low Not required None None Partial
Unknown "Denial of Service Attack" vulnerability in Computer Associates (CA) Unicenter Remote Control (URC) 6.0 allows attackers to cause a denial of service (CPU consumption in URC host service).
2156 CVE-2003-0996 +Priv 2004-01-05 2021-04-13
4.6
 None Local Low Not required Partial Partial Partial
Unknown "System Security Vulnerability" in Computer Associates (CA) Unicenter Remote Control (URC) 6.0 allows attackers to gain privileges via the help interface.
2157 CVE-2003-0995 DoS Overflow 2004-01-05 2019-04-30
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the Microsoft Message Queue Manager (MSQM) allows remote attackers to cause a denial of service (RPC service crash) via a queue registration request.
2158 CVE-2003-0994 +Priv 2004-02-03 2016-10-18
7.2
 None Local Low Not required Complete Complete Complete
The GUI functionality for an interactive session in Symantec LiveUpdate 1.70.x through 1.90.x, as used in Norton Internet Security 2001 through 2004, SystemWorks 2001 through 2004, and AntiVirus and Norton AntiVirus Pro 2001 through 2004, AntiVirus for Handhelds v3.0, allows local users to gain SYSTEM privileges.
2159 CVE-2003-0993 Bypass 2004-03-29 2021-06-06
7.5
 None Remote Low Not required Partial Partial Partial
mod_access in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions.
2160 CVE-2003-0992 XSS 2004-02-17 2017-10-11
4.3
 None Remote Medium Not required Partial None None
Cross-site scripting (XSS) vulnerability in the create CGI script for Mailman before 2.1.3 allows remote attackers to steal cookies of other users.
2161 CVE-2003-0991 DoS 2004-03-03 2017-10-10
5.0
 None Remote Low Not required None None Partial
Unknown vulnerability in the mail command handler in Mailman before 2.0.14 allows remote attackers to cause a denial of service (crash) via malformed e-mail commands.
2162 CVE-2003-0990 Exec Code 2004-01-20 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
The parseAddress code in (1) SquirrelMail 1.4.0 and (2) GPG Plugin 1.1 allows remote attackers to execute commands via shell metacharacters in the "To:" field.
2163 CVE-2003-0989 DoS 2004-02-17 2018-10-19
7.5
 None Remote Low Not required Partial Partial Partial
tcpdump before 3.8.1 allows remote attackers to cause a denial of service (infinite loop) via certain ISAKMP packets, a different vulnerability than CVE-2004-0057.
2164 CVE-2003-0988 Exec Code Overflow 2004-02-17 2017-10-10
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the VCF file information reader for KDE Personal Information Management (kdepim) suite in KDE 3.1.0 through 3.1.4 allows attackers to execute arbitrary code via a VCF file.
2165 CVE-2003-0987 2004-03-03 2021-06-06
7.5
 None Remote Low Not required Partial Partial Partial
mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret.
2166 CVE-2003-0985 DoS +Priv 2004-01-20 2018-05-03
7.2
 None Local Low Not required Complete Complete Complete
The mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21, and possibly other versions before 2.4.24, does not properly perform bounds checks, which allows local users to cause a denial of service and possibly gain privileges by causing a remapping of a virtual memory area (VMA) to create a zero length VMA, a different vulnerability than CAN-2004-0077.
2167 CVE-2003-0984 2004-01-05 2017-10-11
4.6
 None Local Low Not required Partial Partial Partial
Real time clock (RTC) routines in Linux kernel 2.4.23 and earlier do not properly initialize their structures, which could leak kernel data to user space.
2168 CVE-2003-0983 2004-01-05 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
Cisco Unity on IBM servers is shipped with default settings that should have been disabled by the manufacturer, which allows local or remote attackers to conduct unauthorized activities via (1) a "bubba" local user account, (2) an open TCP port 34571, or (3) when a local DHCP server is unavailable, a DHCP server on the manufacturer's test network.
2169 CVE-2003-0982 Exec Code Overflow 2004-01-05 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the authentication module for Cisco ACNS 4.x before 4.2.11, and 5.x before 5.0.5, allows remote attackers to execute arbitrary code via a long password.
2170 CVE-2003-0981 XSS 2004-01-05 2016-10-18
4.3
 None Remote Medium Not required None Partial None
FreeScripts VisitorBook LE (visitorbook.pl) logs the reverse DNS name of a visiting host, which allows remote attackers to spoof the origin of their incoming requests and facilitate cross-site scripting (XSS) attacks.
2171 CVE-2003-0980 XSS 2004-01-05 2016-10-18
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in FreeScripts VisitorBook LE (visitorbook.pl) allows remote attackers to inject arbitrary HTML or web script via (1) the "do" parameter, (2) via the "user" parameter from a host with a malicious reverse DNS name, (3) via quote marks or ampersands in other parameters.
2172 CVE-2003-0979 2004-01-05 2016-10-18
5.0
 None Remote Low Not required None Partial None
FreeScripts VisitorBook LE (visitorbook.pl) does not properly escape line breaks in input, which allows remote attackers to (1) use VisitorBook as an open mail relay, when $mailuser is 1, via extra headers in the email field, or (2) cause the guestbook database to be deleted via a large number of line breaks that exceeds the $max_posts variable.
2173 CVE-2003-0978 DoS Exec Code 2004-01-05 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Format string vulnerability in gpgkeys_hkp (experimental HKP interface) for the GnuPG (gpg) client 1.2.3 and earlier, and 1.3.3 and earlier, allows remote attackers or a malicious keyserver to cause a denial of service (crash) and possibly execute arbitrary code during key retrieval.
2174 CVE-2003-0977 2004-01-05 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
CVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the file system root directory via malformed module requests.
2175 CVE-2003-0969 Exec Code 2004-01-20 2017-10-10
7.5
 None Remote Low Not required Partial Partial Partial
mpg321 0.2.10 allows remote attackers to overwrite memory and possibly execute arbitrary code via an mp3 file that passes certain strings to the printf function, possibly triggering a format string vulnerability.
2176 CVE-2003-0966 Exec Code Overflow 2004-02-17 2017-10-10
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the frm command in elm 2.5.6 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code via a long Subject line.
2177 CVE-2003-0965 XSS 2004-02-17 2017-10-11
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in the admin CGI script for Mailman before 2.1.4 allows remote attackers to steal session cookies and conduct unauthorized activities.
2178 CVE-2003-0963 Exec Code Overflow 2004-01-05 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflows in (1) try_netscape_proxy and (2) try_squid_eplf for lftp 2.6.9 and earlier allow remote HTTP servers to execute arbitrary code via long directory names that are processed by the ls or rels commands.
2179 CVE-2003-0949 Exec Code 2004-02-03 2017-07-11
4.6
 None Local Low Not required Partial Partial Partial
xsok 1.02 does not properly drop privileges before finding and executing the "gunzip" program, which allows local users to execute arbitrary commands.
2180 CVE-2003-0931 DoS 2004-09-28 2017-07-11
5.0
 None Remote Low Not required None None Partial
Sygate Enforcer 4.0 earlier allows remote attackers to cause a denial of service (service hang) by replaying a malformed discovery packet to UDP port 39999.
2181 CVE-2003-0930 Bypass 2004-09-28 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Clearswift MAILsweeper before 4.3.15 does not properly detect filenames in BinHex (HQX) encoded files, which allows remote attackers to bypass intended policy.
2182 CVE-2003-0929 Bypass 2004-09-28 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Clearswift MAILsweeper before 4.3.15 does not properly detect and filter ZIP 6.0 encoded files, which allows remote attackers to bypass intended policy.
2183 CVE-2003-0928 Bypass 2004-09-28 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Clearswift MAILsweeper before 4.3.15 does not properly detect and filter RAR 3.20 encoded files, which allows remote attackers to bypass intended policy.
2184 CVE-2003-0910 Exec Code 2004-06-01 2018-10-12
7.2
 None Local Low Not required Complete Complete Complete
The NtSetLdtEntries function in the programming interface for the Local Descriptor Table (LDT) in Windows NT 4.0 and Windows 2000 allows local attackers to gain access to kernel memory and execute arbitrary code via an expand-down data segment descriptor descriptor that points to protected memory.
2185 CVE-2003-0909 Exec Code 2004-06-01 2018-10-12
7.2
 None Local Low Not required Complete Complete Complete
Windows XP allows local users to execute arbitrary programs by creating a task at an elevated privilege level through the eventtriggers.exe command-line tool or the Task Scheduler service, aka "Windows Management Vulnerability."
2186 CVE-2003-0908 Exec Code 2004-06-01 2018-10-12
7.2
 None Local Low Not required Complete Complete Complete
The Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges, which allows local users to execute arbitrary code via a "Shatter" style attack using a Windows message that accesses the context sensitive help button in the GUI, as demonstrated using the File Open dialog in the Help window, a different vulnerability than CVE-2004-0213.
2187 CVE-2003-0907 Exec Code 2004-06-01 2018-10-12
5.1
 None Remote High Not required Partial Partial Partial
Help and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code via quotation marks in an hcp:// URL, which are not quoted when constructing the argument list to HelpCtr.exe.
2188 CVE-2003-0906 Exec Code Overflow 2004-06-01 2018-10-12
7.6
 None Remote High Not required Complete Complete Complete
Buffer overflow in the rendering for (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1 allows remote attackers to execute arbitrary code via a malformed WMF or EMF image.
2189 CVE-2003-0905 DoS 2004-04-15 2018-10-12
5.0
 None Remote Low Not required None None Partial
Unknown vulnerability in Windows Media Station Service and Windows Media Monitor Service components of Windows Media Services 4.1 allows remote attackers to cause a denial of service (disallowing new connections) via a certain sequence of TCP/IP packets.
2190 CVE-2003-0904 200 +Info 2004-01-20 2020-04-09
6.0
 None Remote Medium ??? Partial Partial Partial
Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed.
2191 CVE-2003-0903 119 Exec Code Overflow 2004-02-17 2018-10-12
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a malformed UDP response to a broadcast request.
2192 CVE-2003-0902 Exec Code 2004-02-03 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
Unknown vulnerability in minimalist mailing list manager 2.4, 2.2, and possibly other versions, allows remote attackers to execute arbitrary commands.
2193 CVE-2003-0828 Overflow +Priv 2004-03-29 2017-07-11
4.6
 None Local Low Not required Partial Partial Partial
Buffer overflow in freesweep in Debian GNU/Linux 3.0 allows local users to gain "games" group privileges when processing environment variables.
2194 CVE-2003-0825 20 DoS Exec Code 2004-03-03 2019-04-30
9.3
 None Remote Medium Not required Complete Complete Complete
The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets, which allows attackers to cause a denial of service and possibly execute arbitrary code.
2195 CVE-2003-0823 2004-02-03 2021-07-23
7.5
 None Remote Low Not required Partial Partial Partial
Internet Explorer 6 SP1 and earlier allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by calling the window.moveBy method, aka HijackClick, a different vulnerability than CVE-2003-1027.
2196 CVE-2003-0819 119 Exec Code Overflow 2004-02-17 2018-10-12
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the H.323 filter of Microsoft Internet Security and Acceleration Server 2000 allows remote attackers to execute arbitrary code in the Microsoft Firewall Service via certain H.323 traffic, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.
2197 CVE-2003-0818 Exec Code Overflow 2004-03-03 2019-04-30
7.5
 None Remote Low Not required Partial Partial Partial
Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings.
2198 CVE-2003-0817 Bypass 2004-02-03 2021-07-23
7.5
 None Remote Low Not required Partial Partial Partial
Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions and read arbitrary files via an XML object.
2199 CVE-2003-0816 Bypass 2004-02-03 2021-07-23
7.5
 None Remote Low Not required Partial Partial Partial
Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability.
2200 CVE-2003-0815 Bypass 2004-02-03 2021-07-23
7.5
 None Remote Low Not required Partial Partial Partial
Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and read arbitrary files by (1) modifying the createTextRange method and using CreateLink, as demonstrated using LinkillerSaveRef, LinkillerJPU, and Linkiller, or (2) modifying the createRange method and using the FIND dialog to select text, as demonstrated using Findeath, aka the "Function Pointer Override Cross Domain" vulnerability.
Total number of vulnerabilities : 2243   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 (This Page)45
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.