CVE-2004-0618

The provided records identify CVE-2004-0618 as a local-denial-of-service flaw in FreeBSD 5.1 for the Alpha processor. The vulnerability arises when a local user invokes execve with an unaligned memory address as an argument, causing a crash. No remediation or patch details are included in the sup...

CVE-2004-0615

Cross-site scripting XSS vulnerability in D-Link DI-614+ SOHO router running firmware 2.30, and DI-704 SOHO router running firmware 2.60B2, and DI-624, allows remote attackers to inject arbitrary script or HTML via the DHCP HOSTNAME option in a DHCP request...

CVE-2004-0621

The CVE-2004-0621 entry affects Newsletter ZWS (admin.php) where a remote attacker can gain administrative privileges via a list_user operation with ulevel=1, which exposes all users and their passwords. According to NVD, the impact is complete confidentiality, integrity, and availability, with a...

CVE-2004-0625

SQL injection vulnerability in Infinity WEB 1.0 allows remote attackers to bypass authentication and gain privileges via the login page. Based on CVE-2004-0625 details, the issue enables partial confidentiality/integrity/availability impact (per CVSSv2: AV:N/AC:L/Au:N/C:P/I:P/A:P). Exploitation s...

CVE-2004-0610

CVE-2004-0610 affects the Web administration interface of the Microsoft MN-500 Wireless Router. The issue allows remote attackers to cause a denial of service (connection refusals) by establishing a large number of open HTTP connections. The available documents do not specify the underlying cause...

CVE-2004-0621

admin.php in Newsletter ZWS allows remote attackers to gain administrative privileges via a listuser operation with the ulevel parameter set to 1 administrator level, which lists all users and their passwords...

CVE-2004-0451

Multiple format string vulnerabilities in the 1 logquit, 2 logerr, or 3 loginfo functions in Software Upgrade Protocol SUP allows remote attackers to execute arbitrary code via format string specifiers in messages that are logged by syslog...

CVE-2004-0393

Format string vulnerability in the msg function for rlpr daemon rlprd 2.0.4 allows remote attackers to execute arbitrary code via format string specifiers in a buffer that can not be resolved, which is provided to the syslog function...

CVE-2004-0590

The CVE-2004-0590 entry affects FreeS/WAN and related IPsec implementations (OpenS/WAN, FreeS/WAN derivatives, Super-FreeS/WAN, and strongSwan). The root cause described across connected docs is bugs in the verify_x509cert() certificate validation, allowing remote attackers to authenticate using ...

CVE-2004-0603

gzexe in gzip 1.3.3 and earlier will execute an argument when the creation of a temp file fails instead of exiting the program, which could allow remote attackers or local users to execute arbitrary commands, a different vulnerability than CVE-1999-1332...

CVE-2004-0609

CVE-2004-0609 affects the rssh project (versions 2.0 through 2.1.x), where command-line arguments are expanded before entering a chroot jail. This behavior lets remote authenticated users determine the existence of files in directories outside the jail (file-name disclosure). The root cause is ar...

CVE-2004-0455

CVE-2004-0455 describes a local buffer overflow in www-sql (cgi.c) that allows local users to execute arbitrary code via a crafted web page processed by www-sql. The issue affects www-sql versions prior to 0.5.7. Debian’s DSA-523-1 fixes the vulnerability in version 0.5.7-17woody1, with reference...

CVE-2004-0611

The CVE-2004-0611 issue affects Netgear FVS318 VPN Router. The Web-Based Administration component is vulnerable to a denial of service when an attacker opens a large number of HTTP connections, rendering the device unable to accept new connections (availability impact). The referenced documents d...

CVE-2004-0605

The CVE-2004-0605 entry applies to IRC daemons that fail to rate-limit non-registered users, causing a Denial of Service. Affected: ircd-hybrid <= 7.0.1, ircd-ratbox

CVE-2004-0605

Non-registered IRC users using 1 ircd-hybrid 7.0.1 and earlier, 2 ircd-ratbox 1.5.1 and earlier, or 3 ircd-ratbox 2.0rc6 and earlier do not have a rate-limit imposed, which could allow remote attackers to cause a denial of service by repeatedly making requests, which are slowly dequeued...

CVE-2004-0493

The CVE-2004-0493 entry relates to Apache httpd 2.0.x prior to 2.0.50, where long MIME header lines with excessive spaces/tabs can cause memory exhaustion and, on 64-bit systems, a potential heap-based buffer overflow. Connected advisories confirm DoS concerns across Apache 2.0.x and related modu...

CVE-2004-0619

CVE-2004-0619 involves an integer overflow in the ubsec_keysetup function of the Broadcom 5820 cryptonet driver used with Linux. The issue allows a local attacker to cause a denial of service (crash) and potentially gain code execution via a negative add_dsa_buf_bytes, resulting in a buffer overf...

CVE-2004-0576

The radius daemon radiusd for GNU Radius 1.1, when compiled with the -enable-snmp option, allows remote attackers to cause a denial of service server crash via malformed SNMP messages containing an invalid OID...

CVE-2004-0617

Cross-site scripting XSS vulnerability in ArbitroWeb 0.6 allows remote attackers to inject arbitrary script or HTML via the rawURL parameter...

CVE-2004-0480

Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via a notes: URI that uses a UNC network share pathname to provide an alternate notes.ini configuration file to notes.exe...