CVE-2004-1170

CVE-2004-1170 affects a2ps 4.13, where remote attackers could cause arbitrary command execution by supplying shell metacharacters in a filename. The vulnerability stems from insecure handling of filenames, enabling code execution with the privileges of the invoking user. Several connected advisor...

CVE-2004-1156

CVE-2004-1156 is a window-injection vulnerability in Mozilla/Firefox prior to versions cited in the advisory. The issue allows remote spoofing by injecting content from one window into a target window in another domain, enabling a malicious site to impersonate a trusted one. The problem affects M...

CVE-2004-1157

Opera 7.x up to 7.54, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window...

CVE-2004-1155

The CVE-2004-1155 entry describes a window-injection flaw in multiple browsers where a malicious site can replace content in a popup window opened from a trusted site by referencing the popup’s known name across domains. Connected advisories (CPAI-2004-205) explain that the vulnerability arises f...

CVE-2004-1067

CVE-2004-1067 affects Cyrus IMAP Server 2.2.9 and earlier due to an off-by-one error in mysasl_canon_user, causing a buffer overflow that could allow remote code execution via the username. Multiple connected advisories confirm the issue and indicate mitigation via updates; OpenVAS notes Cyrus IM...

CVE-2004-1026

CVE-2004-1026 involves multiple integer overflows in the image handler of the imlib library (versions up to 1.9.14 and earlier) that is used by gkrellm and several window managers. The issue, documented across OpenVAS and Gentoo GLSA entries, is rooted in the image processing code and can be trig...

CVE-2004-1170

a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename...

CVE-2004-1169

MaxDB WebTools 7.5.00.18 and earlier are affected. A remote attacker can trigger a denial of service (application crash) by issuing an HTTP GET for a non-existent file followed by two carriage returns, causing a NULL dereference. No remediation details are provided in the connected documents. If ...

CVE-2004-1059

Multiple cross-site scripting XSS vulnerabilities in mnoGoSearch 3.2.26 and earlier allow remote attackers to inject arbitrary HTML and web script via the 1 next and 2 prev result search pages, and the 3 extended and 4 simple search forms...

CVE-2004-1161

Removed by vendor...

CVE-2004-1167

CVE-2004-1167 affects mirrorselect prior to 0.89, which creates temporary files in a world-writable directory with predictable names. This enables symlink attacks to overwrite arbitrary files when mirrorselect runs—potentially gaining the rights of the invoking user (often root). Public sources (...

CVE-2004-1166

CVE-2004-1166 describes a CRLF injection vulnerability in Internet Explorer 6.0.2800.1106 and earlier where an ftp:// URL containing a URL-encoded newline ("%0a") before the FTP command can cause the FTP commands to be injected into the session (e.g., via PORT). The connected MS06-042 bulletin do...

CVE-2004-1157

CVE-2004-1157 affects Opera 7.x up to 7.54 (and possibly other versions). The issue allows remote spoofing of arbitrary websites by injecting content from one window into a target window that has a known name but resides in a different domain (a window-injection vulnerability). The impact is cont...

CVE-2004-1169

MaxDB WebTools 7.5.00.18 and earlier allows remote attackers to cause a denial of service application crash via an HTTP GET request for a file that does not exist, followed by two carriage returns, which causes a NULL dereference...

CVE-2004-1165

Konqueror 3.3.1 allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline "%0a" before the FTP command, which causes the commands to be inserted into the resulting FTP session, as demonstrated using a PORT command...

CVE-2004-1163

Cisco CNS Network Registrar Central Configuration Management CCM server 6.0 through 6.1.1.3 allows remote attackers to cause a denial of service CPU consumption by ending a connection after sending a certain sequence of packets...

CVE-2004-1166

CRLF injection vulnerability in Microsoft Internet Explorer 6.0.2800.1106 and earlier allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline "%0a" before the FTP command, which causes the commands to be inserted into the resulting FTP...

CVE-2004-0993

CVE-2004-0993 concerns hpsockd before 0.6, where a buffer overflow may allow a remote attacker to crash the application or potentially execute arbitrary code. Public references in Debian’s DSA-604-1 confirm this was fixed in hpsockd 0.6.woody1 for Woody and in 0.14 for Sid, addressing the vulnera...

CVE-2004-0993

Buffer overflow in hpsockd before 0.6 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code...

Fedora Core 2 : mysql-3.23.58-9.1 (2004-530)

" - Tue Oct 12 2004 Tom Lane 3.23.58-9.1 - fix security issues CVE-2004-0835, CVE-2004-0836, CVE-2004-0837 bugs 135372, 135375, 135387 - fix privilege escalation on GRANT ALL ON Foo\Bar CVE-2004-0957 - fix multilib problem with mysqlbug and mysqlconfig - adjust chkconfig priority per bug 128852 -...