CVE-2004-0189

The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass urlregex ACLs via a URL with a NULL "%00" character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists...

CVE-2004-0011

Buffer overflow in fsp before 2.81.b18 allows remote users to execute arbitrary code...

CVE-2004-0356

Stack-based buffer overflow in Supervisor Report Center in SL Mail Pro 2.0.9 and earlier allows remote attackers to execute arbitrary code via an HTTP request with a long HTTP sub-version...

CVE-2004-0121

Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs...

CVE-2004-0044

Cisco Personal Assistant 1.41 and 1.42 disables password authentication when "Allow Only Cisco CallManager Users" is enabled and the Corporate Directory settings refer to the directory service being used by Cisco CallManager, which allows remote attackers to gain access with a valid username...

CVE-2004-0113

Memory leak in sslengineio.c for modssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service memory consumption via plain HTTP requests to the SSL port of an SSL-enabled server...

CVE-2004-0080

The CVE-2004-0080 issue affects util-linux login (v2.11 and earlier) where a pointer after free is used, enabling potential leakage of sensitive data. Public references in the connected documents confirm an information-leak vulnerability in login and identify affected package families (util-linux...

CVE-2004-0001

The CVE-2004-0001 issue is described across multiple advisories as a local privilege escalation in the AMD64 Linux kernel ptrace emulation, due to incorrect eflags handling in 32-bit ptrace. Affected: AMD64 Linux kernels; root cause: eflags processing in the ptrace emulation path; impact: local u...

CVE-2004-0114

The CVE-2004-0114 issue is a reference-count bug in SHMAT (System V Shared Memory) on FreeBSD/NetBSD/OpenBSD where shmat(2) increments the vm_object reference count and then calls vm_map_find; if vm_map_find fails, the reference count is not decremented. This can allow local attackers to gain rea...

CVE-2004-0128

CVE-2004-0128 affects PhpGedView (GEDCOM configuration script) up to version 2.65.1. The vulnerability arises when PGV_BASE_DIRECTORY is set to reference a URL on a remote server, allowing remote attackers to execute arbitrary PHP code by loading a malicious theme.php. The connected records corro...

CVE-2004-0131

The CVE refers to GNU Radius radiusd (daemon) prior to 1.2. The vulnerability is triggered by a UDP packet containing an Acct-Status-Type attribute without a value and without an Acct-Session-Id attribute, causing a null dereference and a denial of service. Affected component: logger.c in rad_pri...

CVE-2004-0167

CVE-2004-0167 affects Apple Mac OS X DiskArbitration for 10.2.8 and 10.3.2, where DiskArbitration does not properly initialize writable removable media. The vulnerability is tied to initialization of writable media (e.g., CD-RW/DVD media) and has been addressed by a vendor patch in Apple Security...

CVE-2004-0148

CVE-2004-0148 affects wu-ftpd 2.6.2 and older when the restricted-gid option is enabled, allowing a local user to bypass access restrictions and cause the FTP server to treat the root directory as the user’s home. The underlying cause is a missing check for a restricted user in a code path execut...

CVE-2004-0070

CVE-2004-0070 describes a remote code execution vulnerability in the ezContents package, specifically in the module.php game that handles a link parameter. The OpenVAS entry for this CVE notes that ezContents can be forced to include an external PHP file, causing the remote attacker’s code to be ...

CVE-2004-0035

CVE-2004-0035 affects Phorum 3.4.5 and earlier, where register.php is vulnerable to SQL injection via the hide_email parameter. The underlying issue is an improper handling of user-supplied input, enabling remote attackers to execute arbitrary SQL commands. The provided documents do not specify a...

CVE-2004-0274

The vulnerability CVE-2004-0274 affects Eggdrops Eggheads bot, specifically Share.mod. It arises when the Share.mod component can mistakenly assign STAT_OFFERED to a bot that is not a sharebot, enabling remote attackers to promote a non-sharebot into a sharebot and perform unauthorized activities...

CVE-2004-0015

vbox3 0.1.8 and earlier does not properly drop privileges before executing a user-provided TCL script, which allows local users to gain privileges...

CVE-2004-0131

The radprintrequest function in logger.c for GNU Radius daemon radiusd before 1.2 allows remote attackers to cause a denial of service crash via a UDP packet with an Acct-Status-Type attribute without a value and no Acct-Session-Id attribute, which causes a null dereference...

CVE-2004-0015

The CVE concerns vbox3:0.1.8 and earlier where root privileges were not properly relinquished before executing a user-supplied TCL script, enabling a local user to gain privileges. Affected: vbox3 (ISDN4Linux vocal system); root privilege leak via privilege drop failure. Debian DSAs confirm fixes...

CVE-2004-0013

jabber 1.4.2, 1.4.2a, and possibly earlier versions, does not properly handle SSL connections, which allows remote attackers to cause a denial of service crash...