CVE-2004-1702

The AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 does not properly check the return value of the ReceiveTransaction function, which leads to a failed malloc call and triggers to a null dereference, which allows remote attackers to cause a denial of service crash...

4D WebSTAR Symlink Privilege Escalation

The remote server is running 4D WebStar FTP Server. The version of 4D WebStar FTP Server on the remote host is reportedly affected by a local symbolic link vulnerability caused by the application opening files without properly verifying their existence or their absolute location. Successful...

CVE-2004-0662

PowerPortal 1.x allows remote attackers to gain sensitive information via invalid or missing parameters in HTTP requests to 1 resize.php or 2 modules.php, which reveals the path in an error message...

CVE-2004-0536

Format string vulnerability in Tripwire commercial 4.0.1 and earlier, including 2.4, and open source 2.3.1 and earlier, allows local users to gain privileges via format string specifiers in a file name, which is used in the generation of an email report...

CVE-2004-0416

Double free vulnerability for the errorprogname string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code...

CVE-2004-0414

CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service crash, modification of critical program data, or arbitrary code execution...

CVE-2004-0554

Linux kernel 2.4.x and 2.6.x for x86 allows local users to cause a denial of service system crash, possibly via an infinite loop that triggers a signal handler with a certain sequence of fsave and frstor instructions, as originally demonstrated using a "crash.c" program...

CVE-2004-0541

Buffer overflow in the ntlmcheckauth NTLM authentication function for Squid Web Proxy Cache 2.5.x and 3.x, when compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password "pass" variable...

CVE-2004-0591

Cross-site scripting XSS vulnerability in the printheaderuc function for SqWebMail 4.0.4 and earlier, and possibly 3.x, allows remote attackers to inject arbitrary web script or HRML via 1 e-mail headers or 2 a message with a "message/delivery-status" MIME Content-Type...

CVE-2004-0136

The mapelf32exec function call in IRIX 6.5.20 through 6.5.24 allows local users to cause a denial of service system crash via a "corrupted binary."...

CVE-2004-0204

Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers ...

CVE-2004-0210

The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by modifying message length values and causing a buffer overflow...

CVE-2004-0212

Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an...

CVE-2004-0460

Buffer overflow in the logging capability for the DHCP daemon DHCPD for ISC DHCP 3.0.1rc12 and 3.0.1rc13 allows remote attackers to cause a denial of service server crash and possibly execute arbitrary code via multiple hostname options in 1 DISCOVER, 2 OFFER, 3 REQUEST, 4 ACK, or 5 NAK messages,...

CVE-2004-0537

Opera 7.50 and earlier allows remote web sites to provide a "Shortcut Icon" favicon that is wider than expected, which could allow the web sites to spoof a trusted domain and facilitate phishing attacks using a wide icon and extra spaces...

CVE-2004-0549

The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine MSHTML, as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript,...

CVE-2004-0583

The account lockout functionality in 1 Webmin 1.140 and 2 Usermin 1.070 does not parse certain character strings, which allows remote attackers to conduct a brute force attack to guess user IDs and passwords...

CVE-2004-0649

Buffer overflow in writepacket in control.c for l2tpd may allow remote attackers to execute arbitrary code...

CVE-2004-0668

Web Access in Lotus Domino 6.5.1 allows remote attackers to cause a denial of service server crash via a large e-mail message, as demonstrated using a large image attachment...

CVE-2004-0529

The modified suexec program in cPanel, when configured for modphp and compiled for Apache 1.3.31 and earlier without modphpsuexec, allows local users to execute untrusted shared scripts and gain privileges, as demonstrated using untainted scripts such as 1 proftpdvhosts or 2 addalink.cgi, a...