Scalable OGo (SOGo) 1.0 allows remote authenticated users to bypass intended permissions and view private appointments of other users.
Max CVSS
5.0
EPSS Score
0.33%
Published
2004-11-30
Updated
2017-07-11
The execCommand method in Microsoft Internet Explorer 6.0 SP2 allows remote attackers to bypass the "File Download - Security Warning" dialog and save arbitrary files with arbitrary extensions via the SaveAs command.
Max CVSS
2.6
EPSS Score
88.67%
Published
2004-11-16
Updated
2021-07-23

CVE-2004-1315

Public exploit
viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm.
Max CVSS
7.5
EPSS Score
96.27%
Published
2004-11-12
Updated
2017-07-11
Apple Safari 1.0 through 1.2.3 allows remote attackers to spoof the URL displayed in the status bar via TABLE tags.
Max CVSS
5.0
EPSS Score
6.18%
Published
2004-11-01
Updated
2017-07-11
rfc1867.c in PHP before 5.0.2 allows local users to upload files to arbitrary locations via a PHP script with a certain MIME header that causes the "$_FILES" array to be modified.
Max CVSS
2.1
EPSS Score
0.05%
Published
2004-11-03
Updated
2017-10-11
php_variables.c in PHP before 5.0.2 allows remote attackers to read sensitive memory contents via (1) GET, (2) POST, or (3) COOKIE GPC variables that end in an open bracket character, which causes PHP to calculate an incorrect string length.
Max CVSS
5.0
EPSS Score
3.03%
Published
2004-11-03
Updated
2017-10-11
FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (server crash) by sending an Ascend-Send-Secret attribute without the required leading packet.
Max CVSS
5.0
EPSS Score
93.25%
Published
2004-11-03
Updated
2017-10-11
Symantec Norton AntiVirus 2004, and earlier versions, allows a virus or other malicious code to avoid detection or cause a denial of service (application crash) using a filename containing an MS-DOS device name.
Max CVSS
5.0
EPSS Score
0.11%
Published
2004-11-03
Updated
2017-07-11
telnetd for netkit 0.17 and earlier, and possibly other versions, on Debian GNU/Linux allows remote attackers to cause a denial of service (free of an invalid pointer), a different vulnerability than CVE-2001-0554.
Max CVSS
5.0
EPSS Score
0.70%
Published
2004-11-03
Updated
2017-07-11
The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.
Max CVSS
7.5
EPSS Score
0.18%
Published
2004-11-03
Updated
2021-06-06
The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability."
Max CVSS
9.8
EPSS Score
93.98%
Published
2004-11-03
Updated
2018-10-12
Unknown vulnerability in Microsoft Excel 2000, 2002, 2001 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via a malicious file containing certain parameters that are not properly validated.
Max CVSS
7.5
EPSS Score
72.43%
Published
2004-11-03
Updated
2018-10-12
Internet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site.
Max CVSS
6.4
EPSS Score
0.80%
Published
2004-11-03
Updated
2021-07-23
Internet Explorer 6 on Double Byte Character Set (DBCS) systems allows remote attackers to alter displayed address bars and spoof web pages via a URL containing special characters, facilitating phishing attacks, aka the "Address Bar Spoofing on Double Byte Character Set Systems Vulnerability."
Max CVSS
5.0
EPSS Score
94.55%
Published
2004-11-03
Updated
2018-10-12
Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability."
Max CVSS
5.0
EPSS Score
1.48%
Published
2004-11-03
Updated
2021-07-23
The SMTP (Simple Mail Transfer Protocol) component of Microsoft Windows XP 64-bit Edition, Windows Server 2003, Windows Server 2003 64-bit Edition, and the Exchange Routing Engine component of Exchange Server 2003, allows remote attackers to execute arbitrary code via a malicious DNS response message containing length values that are not properly validated.
Max CVSS
10.0
EPSS Score
89.07%
Published
2004-11-03
Updated
2020-04-09
MySQL 4.x before 4.0.21, and 3.x before 3.23.49, allows attackers to cause a denial of service (crash or hang) via multiple threads that simultaneously alter MERGE table UNIONs.
Max CVSS
2.6
EPSS Score
0.33%
Published
2004-11-03
Updated
2019-12-17
Buffer overflow in the mysql_real_connect function in MySQL 4.x before 4.0.21, and 3.x before 3.23.49, allows remote DNS servers to cause a denial of service and possibly execute arbitrary code via a DNS response with a large address length (h_length).
Max CVSS
10.0
EPSS Score
0.68%
Published
2004-11-03
Updated
2019-12-17
MySQL 3.x before 3.23.59, 4.x before 4.0.19, 4.1.x before 4.1.2, and 5.x before 5.0.1, checks the CREATE/INSERT rights of the original table instead of the target table in an ALTER TABLE RENAME operation, which could allow attackers to conduct unauthorized activities.
Max CVSS
7.5
EPSS Score
0.87%
Published
2004-11-03
Updated
2019-10-07
The (1) ntlm_fetch_string and (2) ntlm_get_string functions in Squid 2.5.6 and earlier, with NTLM authentication enabled, allow remote attackers to cause a denial of service (application crash) via an NTLMSSP packet that causes a negative value to be passed to memcpy.
Max CVSS
5.0
EPSS Score
3.57%
Published
2004-11-03
Updated
2017-10-11
The ctstrtcasd program in RSCT 2.3.0.0 and earlier on IBM AIX 5.2 and 5.3 does not properly drop privileges before executing the -f option, which allows local users to modify or create arbitrary files.
Max CVSS
2.1
EPSS Score
0.04%
Published
2004-11-03
Updated
2017-07-11
The unix_clean_name function in Samba 2.2.x through 2.2.11, and 3.0.x before 3.0.2a, trims certain directory names down to absolute paths, which could allow remote attackers to bypass the specified share restrictions and read, write, or list arbitrary files via "/.////" style sequences in pathnames.
Max CVSS
7.5
EPSS Score
86.50%
Published
2004-11-03
Updated
2018-10-30
Vulnerability in tif_dirread.c for libtiff allows remote attackers to cause a denial of service (application crash) via a TIFF image that causes a divide-by-zero error when the number of row bytes is zero, a different vulnerability than CVE-2005-2452.
Max CVSS
4.3
EPSS Score
1.46%
Published
2004-11-03
Updated
2019-12-31
RealNetworks Helix Universal Server 9.0.2 for Linux and 9.0.3 for Windows allows remote attackers to cause a denial of service (CPU and memory exhaustion) via a POST request with a Content-Length header set to -1.
Max CVSS
7.8
EPSS Score
0.33%
Published
2004-11-03
Updated
2017-07-11
Buffer overflow in the extract_one function from lhext.c in LHA may allow attackers to execute arbitrary code via a long w (working directory) command line option, a different issue than CVE-2004-0769. NOTE: this issue may be REJECTED if there are not any cases in which LHA is setuid or is otherwise used across security boundaries.
Max CVSS
10.0
EPSS Score
2.13%
Published
2004-11-23
Updated
2017-10-11
172 vulnerabilities found
1 2 3 4 5 6 7
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!