CVE-2004-1320

CVE-2004-1320 affects Asante FM2008 running firmware 1.06, where a default username and password can let remote attackers gain unauthorized access. The available documents confirm the affected product/firmware and the credential-based access issue, but do not provide a dedicated patch version or ...

CVE-2004-1325

The CVE-2004-1325 entry concerns the ActiveX control used by Windows Media Player 9.0. The getItemInfoByAtom function returns 0 if a target file does not exist, or the file size if it exists, enabling remote attackers to determine whether files exist on the local system. The description focuses o...

CVE-2004-1312

A bug in the HTML parser in a certain Microsoft HTML library, as used in various third party products, may allow remote attackers to cause a denial of service via certain strings, as reported in GFI MailEssentials for Exchange 9 and 10, and GFI MailSecurity for Exchange 8, which causes emails to...

CVE-2004-1318

Cross-site scripting XSS vulnerability in namazu.cgi for Namazu 2.0.13 and earlier allows remote attackers to inject arbitrary HTML and web script via a query that starts with a tab "%09" character, which prevents the rest of the query from being properly sanitized...

CVE-2004-1330

CVE-2004-1330 describes a buffer overflow in the paginit component of AIX versions 5.1 through 5.3, exploitable by an attacker with local access through a long username. The vulnerability allows local users to execute arbitrary code with the privileges of the affected system. The provided documen...

CVE-2004-1339

SQL injection vulnerability in the 1 MDSYS.SDOGEOMTRIGINS1 and 2 MDSYS.SDOLRSTRIGINS default triggers in Oracle 9i and 10g allows remote attackers to execute arbitrary SQL commands via the new.tablename or new.columnname parameters...

CVE-2004-1236

The CVE-2004-1236 entry describes a buffer overflow in the LDAP component of Netscape Directory Server (NDS) 3.6 on HP-UX and other OSes, leading to remote code execution. Connected sources confirm a broader class of LDAP buffer-overflow issues across multiple vendors (e.g., HP, Netscape, Hitachi...

CVE-2004-1323

Multiple syscalls in the compat subsystem for NetBSD before 2.0 allow local users to cause a denial of service kernel crash via a large signal number to 1 xxxsyskill, 2 xxxsyssigaction, and possibly other translation functions...

CVE-2004-1323

CVE-2004-1323 affects NetBSD prior to 2.0. The issue arises in the compat subsystem where multiple syscalls (notably xxx_sys_kill and xxx_sys_sigaction) can be misused by passing a large signal number, potentially triggering a kernel crash and denial of service. The available documents consistent...

RHEL 2.1 : samba (RHSA-2005:020)

Updated samba packages that fix an integer overflow vulnerability are now available for Red Hat Enterprise Linux 2.1. Samba provides file and printer sharing services to SMB/CIFS clients. Greg MacManus of iDEFENSE Labs discovered an integer overflow bug in Samba versions prior to 3.0.10. An...

Debian DSA-627-1 : namazu2 - unsanitised input

A cross-site scripting vulnerability has been discovered in namazu2, a full text search engine. An attacker could prepare specially crafted input that would not be sanitised by namazu2 and hence displayed verbatim for the victim. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...

Debian DSA-624-1 : zip - buffer overflow

A buffer overflow has been discovered in zip, the archiver for .zip files. When doing recursive folder compression the program did not check the resulting path length, which would lead to memory being overwritten. A malicious person could convince a user to create an archive containing a speciall...

[SECURITY] [DSA 625-1] New pcal packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 625-1 [email protected] http://www.debian.org/security/ Martin Schulze January 5th, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 623-1] New nasm packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 623-1 [email protected] http://www.debian.org/security/ Martin Schulze January 4th, 2004 http://www.debian.org/security/faq -...

CVE-2004-1061

Cross-site scripting XSS vulnerability in Bugzilla before 2.18, including 2.16.x before 2.16.11, allows remote attackers to inject arbitrary HTML and web script via forced error messages, as demonstrated using the action parameter...

CVE-2004-1061

Cross-site scripting XSS vulnerability in Bugzilla before 2.18, including 2.16.x before 2.16.11, allows remote attackers to inject arbitrary HTML and web script via forced error messages, as demonstrated using the action parameter...

Debian DSA-623-1 : nasm - buffer overflow

Jonathan Rockway discovered a buffer overflow in nasm, the general-purpose x86 assembler, which could lead to the execution of arbitrary code when compiling a maliciously crafted assembler source file. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Fedora Core 2 : tetex-2.0.2-14FC2.1 / tetex-2.0.2-14FC2.1 (2004-584)

The remote Fedora Core host is missing one or more security updates : tetex-2.0.2-14FC2.1 : The updated tetex package fixes a buffer overflow which allows attackers to cause the internal xpdf library used by applications in tetex to crash, and possibly to execute arbitrary code. The Common...

Fedora Core 3 : tetex-2.0.2-21.2 (2004-585)

The updated tetex package fixes a buffer overflow which allows attackers to cause the internal xpdf library used by applications in tetex to crash, and possibly to execute arbitrary code. The Common Vulnerabilities and Exposures projects cve.mitre.org has assigned the name CVE-2004-1125 to this...

ArGoSoft FTP Server USER Command Account Enumeration

The remote host is running the ArGoSoft FTP Server. The remote version of this software returns different error messages when a user attempts to log in using a nonexistent username or a bad password. An attacker may exploit this flaw to launch a dictionary attack against the remote host in order ...