CVE-2004-0167

DiskArbitration in Mac OS X 10.2.8 and 10.3.2 does not properly initialize writeable removable media...

CVE-2004-0188

Heap-based buffer overflow in Calife 2.8.5 and earlier may allow local users to execute arbitrary code via a long password...

CVE-2004-1820

PHP remote file inclusion vulnerability in displaycategory.php in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to execute arbitrary PHP code by modifying the basepath parameter to reference a URL on a remote web server that contains fileFunctions.php...

CVE-2004-1821

SQL injection vulnerability in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to gain privileges or perform unauthorized database operations via the gid parameter...

CVE-2004-0110

Buffer overflow in the 1 nanohttp or 2 nanoftp modules in XMLSoft Libxml 2 Libxml2 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL...

CVE-2004-0110

Buffer overflow in the 1 nanohttp or 2 nanoftp modules in XMLSoft Libxml 2 Libxml2 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL...

CVE-2004-0075

The Vicam USB driver in Linux before 2.4.25 does not use the copyfromuser function when copying data from userspace to kernel space, which crosses security boundaries and allows local users to cause a denial of service...

CVE-2004-0190

Symantec FireWall/VPN Appliance model 200 records a cleartext password for the password administration page, which may be cached on the administrator's local system or in a proxy, which allows attackers to steal the password and gain privileges...

CVE-2004-0191

Mozilla before 1.4.2 executes Javascript events in the context of a new page while it is being loaded, allowing it to interact with the previous page zombie document and enable cross-domain and cross-site scripting XSS attacks, as demonstrated using onmousemove events...

CVE-2004-1818

Cross-site scripting XSS vulnerability in nmimage.php in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to execute arbitrary script as other users by injecting arbitrary script into the z parameter...

CVE-2004-0172

Heap-based buffer overflow in the searchforcommand function of ltrace 0.3.10, if it is installed setuid, could allow local users to execute arbitrary code via a long filename. NOTE: It is unclear whether there are any packages that install ltrace as a setuid program, so this candidate might be...

CVE-2004-1827

Cross-site scripting XSS vulnerability in YaBB 1 GoldSP1.3 and YaBB SE 1.5.1 Final allows remote attackers to inject arbitrary web script via the background:url property in 1 glow or 2 shadow tags...

CVE-2004-0189

The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass urlregex ACLs via a URL with a NULL "%00" character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists...

[SECURITY] [DSA 462-1] New xitalk packages fix local group utmp exploit

-------------------------------------------------------------------------- Debian Security Advisory DSA 462-1 [email protected] http://www.debian.org/security/ Martin Schulze March 12th, 2004 http://www.debian.org/security/faq -...

CVE-2004-1358

The patches 1 114332-08 and 2 114929-06 for Sun Solaris 9 disable the auditing functionality of the Basic Security Module BSM, which allows attackers to avoid having their activity logged...

CVE-2004-0158

CVE-2004-0158 affects the game lbreakout2 via a buffer overflow in its handling of the HOME environment variable, enabling a local attacker to gain the 'games' group privileges by overflowing stack/global buffers while the process copies HOME to various components (editor.c, theme.c, manager.c, c...

CVE-2004-0158

Buffer overflow in lbreakout2 allows local users to gain 'games' group privileges via a large HOME environment variable to 1 editor.c, 2 theme.c, 3 manager.c, 4 config.c, 5 game.c, 6 levels.c, or 7 main.c...

MS04-009: Vulnerability in Outlook could allow code execution (828040)

The remote host is running a version of outlook that could allow Internet Explorer to execute script code in the Local Machine zone and therefore let an attacker execute arbitrary programs on this host. To exploit this bug, an attacker would need to send an special HTML message to a user of this...

MS04-008: Windows Media Services Remote Denial of Service (832359)

The remote host appears to be vulnerable to a remote denial of service attack DoS against the Media Services component. An attacker, in exploiting this bug, would render the Media Services component as unresponsive. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid1209...

CVE-2004-0192

The CVE-2004-0192 entry concerns a Cross-site scripting (XSS) vulnerability in the Management Service of Symantec Gateway Security 2.0. The issue arises when a /sgmi URL contains malicious script that is not quoted in the resulting error page, enabling an attacker to steal cookies and hijack a ma...