CVE-2004-1175

CVE-2004-1175 affects Midnight Commander (mc); the fish protocol handler allows remote code execution via insecure filename quoting, potentially with shell metacharacters. Public advisories (e.g., Debian DSA-639-1, Red Hat RHSA-2005:512, CentOS advisory) describe the issue and list the affected M...

CVE-2004-1737

Summary of CVE-2004-1737 (Cacti) : A SQL injection vulnerability exists in auth_login.php of Cacti 0.8.5a that allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username or password parameters. Multiple connected sources document this, including NVD, Debi...

CVE-2004-0231

CVE-2004-0231 affects Midnight Commander (mc) prior to 4.6.0. The issue is described as insecure temporary file and directory creation in mc. The provided connected documents confirm this CVE against mc, but do not disclose a specific impact assessment or a concrete remediation within the supplie...

CVE-2004-0333

CVE-2004-0333 describes a buffer overflow in the UUDeview component used by WinZip 6.2–8.1 SR-1 (and possibly other packages). The overflow can be triggered by decoding a MIME archive with long MIME parameters, allowing remote code execution. Multiple sources corroborate the same core issue acros...

CVE-2004-0633

The CVE-2004-0633 issue affects Ethereal’s iSNS dissector (versions 0.10.3–0.10.4). A remote, unauthenticated attacker could cause a crash or potentially execute code by sending malformed iSNS packets, per included reports. Impact is a denial of service (partial availability) and possible code ex...

CVE-2004-1055

CVE-2004-1055 covers multiple XSS vulnerabilities in phpMyAdmin 2.6.0-pl2 and earlier. The flaws allow remote attackers to inject arbitrary script/html via (1) PmaAbsoluteUri, (2) the zero_rows parameter in read_dump.php, (3) the confirm form, or (4) an error message generated by the internal php...

CVE-2004-1116

CVE-2004-1116 affects Great Internet Mersenne Prime Search (GIMPS) 23.9 and earlier, where init scripts run user-owned binaries with root privileges. This enables local privilege escalation if a user can modify the programs, as described in NVD, CVE listings, and Gentoo GLSA 200411-26. The OpenVA...

CVE-2004-1452

Tomcat on Gentoo Linux (before 5.0.27-r3) is vulnerable: the init scripts are owned by tomcat:tomcat but run as root, potentially allowing members of the tomcat group to run arbitrary commands as root by modifying the scripts. Affected package: Tomcat init/config scripts. Impact: local privilege ...

CVE-2006-3005

CVE-2006-3005 affects Gentoo Linux’s media-libs/jpeg prior to version 6b-r7, where the JPEG library is built without the -maxmem feature. This could allow a context-dependent attacker to cause a denial of service (memory exhaustion) by sending a crafted JPEG file that exceeds memory limits. Publi...

CVE-2004-0224

CVE-2004-0224 affects Courier-IMAP before 3.0.0, Courier before 0.45, and SqWebMail before 4.0.0. The issue is multiple buffer overflows in the Unicode converters (iso2022jp.c and shiftjis.c) that occur when a character is outside the BMP range, enabling remote code execution as described in the ...

CVE-2010-1159

CVE-2010-1159 affects Aircrack-ng prior to 1.1, with multiple heap-based buffer overflows in EAPOL packet processing. The vulnerability allows remote attackers to trigger a crash (DoS) and may enable arbitrary code execution via (1) a large length value in an EAPOL packet or (2) a long EAPOL pack...

CVE-2013-2032

MediaWiki prior to 1.19.6 and prior to 1.20.5 is vulnerable to bypassing extension-enforced password-change restrictions. The issue arises because the system does not require both Special:PasswordReset and Special:ChangePassword blocks when an extension implements only one, allowing remote attack...

CVE-2004-0229

CVE-2004-0229 affects the Linux kernel 2.6.x framebuffer driver, where the fb_copy_cmap function is not used correctly to copy cmap structures. The impact is listed as unknown in the primary CVE records, with local access required (attack vector: LOCAL, low complexity, no authentication). Connect...

CVE-2004-1033

CVE-2004-1033 concerns Fcron versions 2.0.1, 2.9.4 (and possibly earlier) leaking file descriptors for open files, enabling a local user to bypass access restrictions and read the files fcron.allow and fcron.deny via the EDITOR environment variable. The available connected documents confirm the a...

CVE-2007-1500

CVE-2007-1500 affects the Linux Security Auditing Tool (LSAT). The vulnerability arises from insecure temporary file handling: LSAT creates temporary files in /tmp with a predictable name, enabling a local attacker to exploit a symlink attack to overwrite arbitrary files with the caller’s privile...

CVE-2004-0626

The CVE-2004-0626 issue affects the Linux kernel 2.6 netfilter subsystem when using iptables with TCP options. Affected code path is tcp_find_option; a large option length can produce a negative value after casting to char, causing an infinite loop that consumes CPU and leads to remote DoS. This ...

CVE-2004-0667

RSBAC 1.2.2–1.2.3 allows access to sys_creat, sys_open, and sys_mknod inside jails, enabling local users to gain elevated privileges. The affected component is the system-call access control in RS BAC; root cause is unsafe exposure of these syscalls within jailed environments. Documented impact i...

CVE-2004-0880

CVE-2004-0880 affects getmail 4.x up to version before 4.2.0. When run with root privileges, local users can exploit a symlink attack on an mbox file to overwrite arbitrary files. The risk is described as a local, likely low-severity issue with partial integrity impact; exploitation details are n...

CVE-2004-1009

Summary (CVE-2004-1009) Midnight Commander (mc) versions up to 4.5.55 are affected. The vulnerability allows a remote attacker to trigger a denial of service (infinite loop) via unknown attack vectors. Public sources in the connected documents tie this CVE to multiple advisories (e.g., RHSA-2005:...

CVE-2004-1030

CVE-2004-1030 : In Fcron, the fcronsighup utility (versions including 2.0.1 and 2.9.4; possibly earlier) can be used by a local user to disclose sensitive information by invoking fcronsighup with an arbitrary file, causing contents of that file to be revealed in error messages. This is an informa...

CVE-2004-1117

CVE-2004-1117 affects ChessBrain: init scripts in ChessBrain 20407 and earlier run user-owned binaries with root privileges, enabling local privilege escalation by modifying those programs. Connected advisories (Gentoo GLSA 200411-26) advise upgrading to the latest packages (e.g., chessbrain >...

CVE-2006-1390

CVE-2006-1390 affects NetHack 3.4.3-r1 and earlier, Falcon’s Eye 1.9.4a and earlier, and Slash’EM 0.0.760 and earlier on Gentoo Linux. The connected documents describe a local privilege escalation where a member of the games group can modify saved-game state or create/overwrite save files to exec...

CVE-2004-1034

CVE-2004-1034 describes a buffer overflow in Kaffeine (before 0.5) whose code is also used in gxine (before 0.3.3) triggered by a long Content-Type header for a Real Audio .ram playlist. The overflow occurs in the http_open function and can cause a denial of service (application crash) and potent...

CVE-2004-1093

CVE-2004-1093 affects Midnight Commander (mc) up to version 4.5.55. The issue is a memory-management vulnerability (use-after-free) that can cause a denial of service when a vulnerable file/operation triggers freeing of memory that is subsequently used. Public references in the provided documents...

CVE-2004-1115

The CVE-2004-1115 entry corresponds to a real vulnerability in SETI project 3.08-r3 and earlier where init scripts execute user-owned programs with root privileges, enabling local privilege escalation by modifying those programs. Connected sources provide concrete details: Gentoo GLSA 200411-26 n...

CVE-2006-0071

Pinentry on Gentoo is affected by CVE-2006-0071: the pinentry ebuild before 0.7.2-r2 sets the sgid bit on pinentry binaries, allowing local users to read or overwrite files with gid 0. Affected packages include pinentry, pinentry-curses, pinentry-gtk, and pinentry-gtk. Remediation: upgrade to pin...

CVE-2004-1162

CVE-2004-1162 affects the scponly package (before 4.0) where the unison command does not properly restrict which programs can be run. This can allow remote authenticated users to bypass intended access restrictions and execute arbitrary programs via the -rshcmd or -sshcmd flags. Documented impact...

CVE-2004-1336

The CVE-2004-1336 issue affects tetex-bin 2.0.2, where the xdvizilla script creates temporary files with predictable filenames, enabling a local user to overwrite arbitrary files via a symlink attack. The vulnerability is described consistently across CVE, NVD, and CVE List entries. The available...

CVE-2004-1032

CVE-2004-1032 affects Fcron (notably versions 2.0.1, 2.9.4, and possibly earlier). The issue lies in fcronsighup: when a target filename has a large number of leading slashes, Fcron does not correctly append fcrontab.sig, allowing a local user to delete arbitrary files or create arbitrary empty f...

CVE-2004-1901

Portage (Gentoo) vulnerability CVE-2004-1901: Portage before 2.0.50-r3 allows a local attacker to overwrite arbitrary files via a hard link attack on the lockfiles. This is a local-privilege issue tied to the lockfile handling. Affected software is Portage; the root cause is the hard link attack ...

CVE-2005-0470

The CVE-2005-0470 issue affects wpa_supplicant prior to 0.2.7, where a buffer overflow in handling EAPOL-Key frames can cause a denial of service (segmentation fault) via remote attacker-supplied data. Affected component is the wpa_supplicant software; root cause is improper validation/handling o...

CVE-2007-0476

CVE-2007-0476 : The Gentoo OpenLDAP ebuilds (pre-2.1.30-r10, pre-2.2.28-r7, pre-2.3.30-r2) use gencert.sh and do not securely create temporary directories in /tmp during emerge, allowing a local attacker to create a symlink and overwrite arbitrary files. This is a local vulnerability with potenti...

CVE-2004-1031

CVE-2004-1031 affects Fcron (notably 2.0.1 and 2.9.4) and potentially earlier versions. The issue allows a local user to bypass access restrictions and load an arbitrary fcron configuration file by starting a setuid process and pointing the fcronsighup configuration file at a /proc entry owned by...

CVE-2004-1107

CVE-2004-1107 affects Portage (dispatch-conf) on Gentoo prior to version 2.0.51-r3, where dispatch-conf and Gentoolkit’s qpkg use predictable temporary file names. A local attacker can exploit a symlink to overwrite arbitrary files, with the overwrite occurring under the invoking user’s privilege...

CVE-2004-1983

CVE-2004-1983 involves the arch_get_unmapped_area function in mmap.c within the PaX patches for the Linux kernel 2.6. When ASLR is enabled, it allows local users to trigger a Denial of Service via an infinite loop. Connected sources (Gentoo GLSA 200407-02 and related advisories) confirm the issue...

CVE-2005-0535

MediaWiki is affected by a CSRF vulnerability (CVE-2005-0535) in 1.3.x prior to 1.3.11 and 1.4 beta prior to 1.4 RC1, allowing remote attackers to perform actions as authenticated users. The issue is documented across multiple sources (NVD entry, Gentoo GLSA-200502-33, and related advisories), wi...