CVE-2004-1033

CVE-2004-1033 concerns Fcron versions 2.0.1, 2.9.4 (and possibly earlier) leaking file descriptors for open files, enabling a local user to bypass access restrictions and read the files fcron.allow and fcron.deny via the EDITOR environment variable. The available connected documents confirm the a...

CVE-2004-0947

Buffer overflow in unarj before 2.63a-r2 allows remote attackers to execute arbitrary code via an arj archive that contains long filenames...

CVE-2004-1053

CVE-2004-1053 is an integer overflow in FreeBSD's fetch(1) utility (affecting 4.1–5.3) that allows a remote attacker to execute arbitrary code by crafting HTTP headers in a response, triggering a buffer overflow. The issue is caused during HTTP header processing and can enable code execution on t...

Debian DSA-596-2 : sudo - missing input sanitising

Liam Helmer noticed that sudo, a program that provides limited super user privileges to specific users, does not clean the environment sufficiently. Bash functions and the CDPATH variable are still passed through to the program running as privileged user, leaving possibilities to overload system...

Security fix for the ALT Linux 8 package cyrus-imapd version 2.2.10-alt1

Nov. 24, 2004 Alexei Takaseev 2.2.10-alt1 - 2.2.10 - CAN-2004-1015...

CVE-2004-0251

Cross-site scripting XSS vulnerability in rxgoogle.cgi allows remote attackers to execute arbitrary script as other users via the query parameter...

CVE-2004-0253

IBM Cloudscape 5.1 running jdk 1.4.203 allows remote attackers to execute arbitrary programs or cause a denial of service via certain SQL code, possibly due to a SQL injection vulnerability...

CVE-2004-0258

Multiple buffer overflows in RealOne Player, RealOne Player 2.0, RealOne Enterprise Desktop, and RealPlayer Enterprise allow remote attackers to execute arbitrary code via malformed 1 .RP, 2 .RT, 3 .RAM, 4 .RPM or 5 .SMIL files...

CVE-2004-0285

PHP remote file inclusion vulnerabilities in include/footer.inc.php in 1 AllMyVisitors, 2 AllMyLinks, and 3 AllMyGuests allow remote attackers to execute arbitrary PHP code via a URL in the AMVconfigcfgserverpath parameter...

CVE-2004-0335

LAN SUITE Web Mail 602Pro, when configured to use the "Directory browsing" feature, allows remote attackers to obtain a directory listing via an HTTP request to 1 index.html, 2 cgi-bin/, or 3 users/...

CVE-2004-0349

Directory traversal vulnerability in GWeb HTTP Server 0.6 allows remote attackers to view arbitrary files via a .. dot dot in the URL...

CVE-2004-0636

Buffer overflow in the goaway function in the aim:goaway URI handler for AOL Instant Messenger AIM 5.5, including 5.5.3595, allows remote attackers to execute arbitrary code via a long Away message...

CVE-2004-0269

SQL injection vulnerability in PHP-Nuke 6.9 and earlier, and possibly 7.x, allows remote attackers to inject arbitrary SQL code and gain sensitive information via 1 the category variable in the Search module or 2 the admin variable in the WebLinks module...

CVE-2004-0284

Microsoft Internet Explorer 6.0, Outlook 2002, and Outlook 2003 allow remote attackers to cause a denial of service CPU consumption, if "Do not save encrypted pages to disk" is disabled, via a web site or HTML e-mail that contains two null characters %00 after the host name...

CVE-2004-0295

TsFtpSrv.exe in Broker FTP 6.1.0.0 allows remote attackers to cause a denial of service CPU consumption via an open idle connection...

CVE-2004-0318

Load Sharing Facility LSF 4.x, 5.x, and 6.x uses the LSFEAUTHUID environment variable, if it exists, instead of the real UID of the user, which could allow remote attackers within the local cluster to gain privileges...

CVE-2004-0267

The 1 inoregupdate, 2 uniftest, or 3 unimove scripts in eTrust InoculateIT for Linux 6.0 allow local users to overwrite arbitrary files via a symlink attack on files in /tmp...

CVE-2004-0278

Ratbag game engine, as used in products such as Dirt Track Racing, Leadfoot, and World of Outlaws Spring Cars, allows remote attackers to cause a denial of service CPU consumption via a TCP packet that specifies the length of data to read and then sends a second TCP packet that contains less data...

CVE-2004-0287

Xlight FTP server 1.52 allows remote authenticated users to cause a denial of service crash via a RETR command with a long argument containing a large number of / slash characters, possibly triggering a buffer overflow...

CVE-2004-0302

Directory traversal vulnerability in OWLS 1.0 allows remote attackers to read arbitrary files via a .. dot dot in the 1 file parameter in index.php, 2 editfile in glossary.php, or 3 editfile in newmultiplechoice.php...