CVE-2004-1324

The Microsoft Windows Media Player 9.0 ActiveX control may allow remote attackers to execute arbitrary web script in the Local computer zone via the 1 artist or 2 song fields of a music file, if the file is processed using Internet Explorer...

RHEL 2.1 / 3 : zip (RHSA-2004:634)

An updated zip package that fixes a buffer overflow vulnerability is now available. The zip program is an archiving utility which can create ZIP-compatible archives. A buffer overflow bug has been discovered in zip when handling long file names. An attacker could create a specially crafted path...

RHEL 2.1 / 3 : libxml (RHSA-2004:650)

An updated libxml package that fixes multiple buffer overflows is now available. Updated 24 May 2005 Multilib packages have been added to this advisory The libxml package contains a library for manipulating XML files. Multiple buffer overflow bugs have been found in libxml versions prior to 2.6.1...

CVE-2004-1323

Multiple syscalls in the compat subsystem for NetBSD before 2.0 allow local users to cause a denial of service kernel crash via a large signal number to 1 xxxsyskill, 2 xxxsyssigaction, and possibly other translation functions...

phpGroupWare <= 0.9.16.003 Multiple Vulnerabilities

The remote host seems to be running PhpGroupWare, a multi-user groupware suite written in PHP. The remote version of this software is vulnerable to multiple issues : - A cross-site scripting issue may allow an attacker to steal the credentials of third-party users of the remote host. CVE-2004-138...

CVE-2004-1023

Kerio Winroute Firewall before 6.0.9, ServerFirewall before 1.0.1, and MailServer before 6.0.5, when installed on Windows based systems, do not modify the ACLs for critical files, which allows local users with Power Users privileges to modify programs, install malicious DLLs in the plug-ins folde...

CVE-2004-0571

CVE-2004-0571 describes a remote code execution vulnerability in the Word for Windows 6.0 Converter used by WordPad. A crafted Word 6.0 document could trigger an unchecked data length/buffer handling in the converter, enabling an attacker to execute arbitrary code on a vulnerable system when the ...

CVE-2004-1209

Verisign Payflow Link, when running with empty Accepted URL fields, does not properly verify the data in the hidden AMOUNT field, which allows remote attackers to modify the price of the items that they purchase...

CVE-2004-1218

CVE-2004-1218 relates to the Remote Execute 2.30 product, where remote attackers can cause an application crash (DoS) by establishing 7 simultaneous connections. The provided documents do not specify affected platforms, software versions beyond 2.30, root cause details, concrete exploit steps, or...

CVE-2004-1220

Battlefield 1942 1.6.19 and earlier, and Battlefield Vietnam 1.2 and earlier, allows a remote master server to cause a denial of service client crash via a server reply that contains a large numplayers value, which triggers a null dereference...

CVE-2004-1232

Gauging from the provided sources, CVE-2004-1232 affects the Gadu-Gadu client’s image-sending path. The vulnerability is a stack-based buffer overflow triggered by a large image filename, enabling remote code execution. No specific exploit details or patch/version information are provided in the ...

CVE-2004-1022

Kerio Winroute Firewall before 6.0.7, ServerFirewall before 1.0.1, and MailServer before 6.0.5 use symmetric encryption for user passwords, which allows attackers to decrypt the user database and obtain the passwords by extracting the secret key from within the software...

CVE-2004-1223

The Management Agent in F-Secure Policy Manager 5.11.2810 allows remote attackers to gain sensitive information, such as the absolute path for the web server, via an HTTP request to fsmsh.dll without any parameters...

CVE-2004-1016

CVE-2004-1016 affects the Linux kernel (2.4.x up to 2.4.28 and 2.6.x up to 2.6.9) where the scm_send function in the kernel SCM layer can be triggered by local users. By crafting auxiliary messages passed to sendmsg, this can lead to a deadlock and a system hang (denial of service). Public record...

CVE-2004-1222

Summary: CVE-2004-1222 affects weblibs.pl in WebLibs 1.0, where the TextFile parameter can be abused with shell metacharacters to execute arbitrary commands on the remote system. The vulnerability is caused by improper handling of input in weblibs.pl, leading to remote command execution with high...

CVE-2004-1208

CVE-2004-1208 affects Orbz (versions 2.10 and earlier). The root cause is a buffer overflow in the password field of a join request, leading to remote denial of service (application crash) and potentially arbitrary code execution. The available documents confirm the vulnerability details but do n...

CVE-2004-1206

CVE-2004-1206 affects pnTresMailer 6.0.3 in codebrowserpntm.php, where a directory traversal via .. in the filetodownload parameter enables reading arbitrary server files. Impact described as read access with web server privileges; remediation guidance in connected reports is to upgrade to the la...

CVE-2004-1230

CVE-2004-1230 pertains to the Gadu-Gadu client. A remote attacker can exploit a DCC connection and a CTCP packet with type=1, subtype=4 to read files from another user’s _cache directory and obtain sensitive information. The vulnerability affects Gadu-Gadu as described in public records; the core...

CVE-2004-1196

CVE-2004-1196 affects Insite Inmail’s inmail.pl script (parameter acao) and is described as a cross-site scripting (XSS) vulnerability allowing remote injection of script/HTML. Connected documents corroborate a vulnerability in InMail/InShop web apps written in Perl and specify the acao parameter...

CVE-2004-1201

CVE-2004-1201 affects Opera 7.54 and describes a denial-of-service condition caused by a memory-exhaustion scenario triggered by JavaScript that repeatedly creates nested arrays and sorts them. The issue leads to an application crash. This summary reflects information from the NVD/NVD-family reco...