Security Vulnerabilities Published In 2004 (CVSS score >= 4)

2004 : January February March April May June July August September October November December

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
2201	CVE-2003-0814		Exec Code Bypass	2004-02-03	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability.
2202	CVE-2003-0807		DoS Overflow	2004-06-01	2018-10-12	5.0	None	Remote	Low	Not required	None	None	Partial
Buffer overflow in the COM Internet Services and in the RPC over HTTP Proxy components for Microsoft Windows NT Server 4.0, NT 4.0 Terminal Server Edition, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service via a crafted request.
2203	CVE-2003-0806		Exec Code Overflow	2004-06-01	2018-10-12	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the Windows logon process (winlogon) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1, when a member of a domain, allows remote attackers to execute arbitrary code.
2204	CVE-2003-0797		DoS	2004-03-29	2017-07-11	5.0	None	Remote	Low	Not required	None	None	Partial
Unknown vulnerability in rpc.mountd in SGI IRIX 6.5 through 6.5.22 allows remote attackers to cause a denial of service (process death) via unknown attack vectors.
2205	CVE-2003-0796			2004-03-29	2017-07-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Unknown vulnerability in rpc.mountd SGI IRIX 6.5.18 through 6.5.22 allows remote attackers to mount from unprivileged ports even with the -n option disabled.
2206	CVE-2003-0782		DoS Exec Code Overflow	2004-05-04	2017-07-11	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple buffer overflows in ecartis before 1.0.0 allow attackers to cause a denial of service and possibly execute arbitrary code.
2207	CVE-2003-0781			2004-05-04	2017-07-11	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Unknown vulnerability in ecartis before 1.0.0 does not properly validate user input, which allows attackers to obtain mailing list passwords.
2208	CVE-2003-0719		Exec Code Overflow	2004-06-01	2018-10-12	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets.
2209	CVE-2003-0718		DoS	2004-11-03	2020-11-23	5.0	None	Remote	Low	Not required	None	None	Partial
The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND request with an XML message containing XML elements with a large number of attributes.
2210	CVE-2003-0700			2004-02-17	2017-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The C-Media PCI sound driver in Linux before 2.4.22 does not use the get_user function to access userspace in certain conditions, which crosses security boundaries and may facilitate the exploitation of vulnerabilities, a different vulnerability than CVE-2003-0699.
2211	CVE-2003-0696		DoS	2004-01-20	2017-07-11	5.0	None	Remote	Low	Not required	None	None	Partial
The getipnodebyname() API in AIX 5.1 and 5.2 does not properly close sockets, which allows attackers to cause a denial of service (resource exhaustion).
2212	CVE-2003-0663		DoS	2004-06-01	2018-10-12	5.0	None	Remote	Low	Not required	None	None	Partial
Unknown vulnerability in the Local Security Authority Subsystem Service (LSASS) in Windows 2000 domain controllers allows remote attackers to cause a denial of service via a crafted LDAP message.
2213	CVE-2003-0648		Exec Code Overflow	2004-05-04	2017-07-11	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple buffer overflows in vfte, based on FTE, before 0.50, allow local users to execute arbitrary code.
2214	CVE-2003-0612		Overflow +Priv	2004-03-29	2017-07-11	4.6	None	Local	Low	Not required	Partial	Partial	Partial
Multiple buffer overflows in main.c for Crafty 19.3 allow local users to gain group "games" privileges via long command line arguments to crafty.bin.
2215	CVE-2003-0607		Overflow	2004-03-29	2017-07-11	4.6	None	Local	Low	Not required	Partial	Partial	Partial
Buffer overflow in xconq 7.4.1 allows local users to become part of the "games" group via the (1) USER or (2) DISPLAY environment variables.
2216	CVE-2003-0601			2004-03-29	2017-07-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Workgroup Manager in Apple Mac OS X Server 10.2 through 10.2.6 does not disable a password for a new account before it is saved for the first time, which allows remote attackers to gain unauthorized access via the new account before it is saved.
2217	CVE-2003-0594		Dir. Trav. Bypass	2004-04-15	2017-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Mozilla allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Mozilla to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
2218	CVE-2003-0593	22	Dir. Trav. Bypass	2004-04-15	2022-03-01	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Opera allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Opera to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
2219	CVE-2003-0592		Dir. Trav. Bypass	2004-04-15	2017-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
2220	CVE-2003-0533		Exec Code Overflow	2004-06-01	2018-10-12	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm.
2221	CVE-2003-0514		Dir. Trav. Bypass	2004-04-15	2008-09-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Apple Safari allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Safari to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
2222	CVE-2003-0513		Dir. Trav. Bypass	2004-04-15	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Microsoft Internet Explorer allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Internet Explorer to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
2223	CVE-2003-0444		Exec Code Overflow	2004-03-29	2017-07-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Heap-based buffer overflow in GTKSee 0.5 and 0.5.1 allows remote attackers to execute arbitrary code via a PNG image of certain color depths.
2224	CVE-2003-0441		Overflow +Priv	2004-03-03	2017-07-11	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Multiple buffer overflows in Orville Write (orville-write) 2.53 and earlier allow local users to gain privileges.
2225	CVE-2003-0368	20	DoS	2004-02-03	2017-07-11	5.0	None	Remote	Low	Not required	None	None	Partial
Nokia Gateway GPRS support node (GGSN) allows remote attackers to cause a denial of service (kernel panic) via a malformed IP packet with a 0xFF TCP option.
2226	CVE-2003-0257		+Priv	2004-04-15	2017-07-11	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Format string vulnerability in the printer capability for IBM AIX .3, 5.1, and 5.2 allows local users to gain printq or root privileges.
2227	CVE-2003-0202			2004-04-15	2017-07-11	4.6	None	Local	Low	Not required	Partial	Partial	Partial
The (1) halstead and (2) gather_stats scripts in metrics 1.0 allow local users to overwrite arbitrary files via a symlink attack on temporary files.
2228	CVE-2003-0170		+Priv	2004-03-29	2017-07-11	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Unknown vulnerability in ftpd in IBM AIX 5.2, when configured to use Kerberos 5 for authentication, allows remote attackers to gain privileges via unknown attack vectors.
2229	CVE-2003-0119			2004-02-03	2008-09-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The secldapclntd daemon in AIX 4.3, 5.1 and 5.2 uses an Internet socket when communicating with the loadmodule, which allows remote attackers to directly connect to the daemon and conduct unauthorized activities.
2230	CVE-2003-0105			2004-09-28	2017-07-11	5.0	None	Remote	Low	Not required	Partial	None	None
ServerMask 2.2 and earlier does not obfuscate (1) ETag, (2) HTTP Status Message, or (3) Allow HTTP responses, which could tell remote attackers that the web server is an IIS server.
2231	CVE-2002-1583		Exec Code Overflow	2004-09-28	2008-09-05	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Buffer overflow in sqllib/security/db2ckpw for IBM DB2 Universal Database 6.0 and 7.0 allows local users to execute arbitrary code via a long username that is read from a file descriptor argument.
2232	CVE-2002-1582		Exec Code	2004-12-06	2008-09-05	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
compose.cgi in Mailreader.com 2.3.30 and 2.3.31, when using Sendmail as the Mail Transfer Agent, allows remote attackers to execute arbitrary commands via shell metacharacters in the RealEmail configuration variable, which is used to call Sendmail in network.cgi.
2233	CVE-2002-1581		Dir. Trav.	2004-12-06	2011-03-08	5.0	None	Remote	Low	Not required	Partial	None	None
Directory traversal vulnerability in nph-mr.cgi in Mailreader.com 2.3.20 through 2.3.31 allows remote attackers to view arbitrary files via .. (dot dot) sequences and a null byte (%00) in the configLanguage parameter.
2234	CVE-2002-1580		Exec Code Overflow	2004-06-14	2017-07-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Integer overflow in imapparse.c for Cyrus IMAP server 1.4 and 2.1.10 allows remote attackers to execute arbitrary code via a large length value that facilitates a buffer overflow attack, a different vulnerability than CVE-2002-1347.
2235	CVE-2002-1579		DoS	2004-04-15	2017-07-11	5.0	None	Remote	Low	Not required	None	None	Partial
SAP GUI (Sapgui) 4.6D allows remote attackers to cause a denial of service (crash) via a connection to a high-numbered port, which generates an "unknown connection data" error.
2236	CVE-2002-1578			2004-04-15	2017-07-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The default installation of SAP R/3, when using Oracle and SQL*net V2 3.x, 4.x, and 6.10, allows remote attackers to obtain arbitrary, sensitive SAP data by directly connecting to the Oracle database and executing queries against the database, which is not password-protected.
2237	CVE-2002-1577		+Priv	2004-04-15	2017-07-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SAP R/3 2.0B to 4.6D installs several clients with default users and passwords, which allows remote attackers to gain privileges via the (1) SAP*, (2) SAPCPIC, (3) DDIC, (4) EARLYWATCH, or (5) TMSADM accounts.
2238	CVE-2002-1576		+Priv	2004-04-15	2017-07-11	7.2	None	Local	Low	Not required	Complete	Complete	Complete
lserver in SAP DB 7.3 and earlier uses the current working directory to find and execute the lserversrv program, which allows local users to gain privileges with a malicious lserversrv that is called from a directory that has a symlink to the lserver program.
2239	CVE-2002-1575			2004-03-03	2017-07-11	5.0	None	Remote	Low	Not required	None	Partial	None
cgiemail allows remote attackers to use cgiemail as a spam proxy via CRLF injection of encoded newline (%0a) characters in parameters such as "required-subject," which can be used to modify the CC, BCC, and other header fields in the generated email message.
2240	CVE-2002-1574		Overflow	2004-03-03	2017-10-10	4.6	None	Local	Low	Not required	Partial	Partial	Partial
Buffer overflow in the ixj telephony card driver in Linux before 2.4.20 has unknown impact and attack vectors.
2241	CVE-2002-0385		+Info	2004-06-01	2017-07-11	5.0	None	Remote	Low	Not required	Partial	None	None
Vignette Story Server 4.1 and 6.0 allows remote attackers to obtain sensitive information via a request that contains a large number of '"' (double quote) and and '>' characters, which causes the TCL interpreter to crash and include stack data in the output.
2242	CVE-2002-0034			2004-02-03	2019-04-30	4.6	None	Local	Low	Not required	Partial	Partial	Partial
The Microsoft CONVERT.EXE program, when used on Windows 2000 and Windows XP systems, does not apply the default NTFS permissions when converting a FAT32 file system, which could cause the conversion to produce a file system with less secure permissions than expected.
2243	CVE-2001-1413		Exec Code Overflow	2004-12-23	2017-07-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Stack-based buffer overflow in the comprexx function for ncompress 4.2.4 and earlier, when used in situations that cross security boundaries (such as FTP server), may allow remote attackers to execute arbitrary code via a long filename argument.

Total number of vulnerabilities : 2243 Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 (This Page)