CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2004(Execute Code)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2005-0441 Exec Code Overflow 2004-12-22 2017-07-10
10.0
 Admin Remote Low Not required Complete Complete Complete
Multiple stack-based buffer overflows in Sybase Adaptive Server Enterprise (ASE) 12.x before 12.5.3 ESD#1 allow remote authenticated users to execute arbitrary code via the (1) attrib_valid function, (2) covert function, (3) declare statement, or (4) a crafted query plan, or remote authenticated users with database owner or "sa" role privileges to execute arbitrary code via (5) a crafted install java statement.
2 CVE-2005-0373 Exec Code Overflow 2004-10-07 2017-07-10
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in digestmd5.c CVS release 1.170 (also referred to as digestmda5.c), as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows remote attackers to execute arbitrary code.
3 CVE-2005-0189 Exec Code Overflow 2004-10-06 2017-11-16
7.5
 User Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the HandleAction function in RealPlayer 10.5 (6.0.12.1040) and earlier allows remote attackers to execute arbitrary code via a long ShowPreferences argument.
4 CVE-2005-0188 Exec Code 2004-10-06 2017-07-10
7.5
 User Remote Low Not required Partial Partial Partial
Format string vulnerability in the SetBaseURL function in AtHoc toolbar allows remote attackers to execute arbitrary code via format string specifiers in an invalid URL that is recorded in the debug log.
5 CVE-2004-2754 89 Exec Code Sql 2004-12-31 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the ID_MEMBER parameter to the (1) recentTopics and (2) welcome functions.
6 CVE-2004-2751 89 Exec Code Sql 2004-12-31 2017-07-28
6.8
 None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in the members_list module in PostNuke 0.726, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the sortby parameter.
7 CVE-2004-2746 89 Exec Code Sql 2004-12-31 2018-10-19
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in adminlogin.asp in XTREME ASP Photo Gallery 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
8 CVE-2004-2737 89 Exec Code Sql 2004-12-31 2017-07-28
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in problist.asp in NetSupport DNA HelpDesk 1.01 allows remote attackers to execute arbitrary SQL commands via the where parameter.
9 CVE-2004-2731 189 Exec Code Overflow 2004-12-31 2008-09-05
4.4
 None Local Medium Not required Partial Partial Partial
Multiple integer overflows in Sbus PROM driver (drivers/sbus/char/openprom.c) for the Linux kernel 2.4.x up to 2.4.27, 2.6.x up to 2.6.7, and possibly later versions, allow local users to execute arbitrary code by specifying (1) a small buffer size to the copyin_string function or (2) a negative buffer size to the copyin function.
10 CVE-2004-2729 264 Exec Code 2004-12-31 2017-07-28
4.4
 None Local Medium Not required Partial Partial Partial
Inetd32 Administration Tool of Hummingbird Connectivity 7.1 and 9.0 allows local users to execute arbitrary code by changing the program for handling incoming connections.
11 CVE-2004-2719 119 Exec Code Overflow 2004-12-31 2017-10-10
6.8
 None Remote Medium Not required Partial Partial Partial
Buffer overflow in the UrlToLocal function in PunyLib.dll of Foxmail 5.0.300 allows remote attackers to execute arbitrary code via a mail message with a long From field, a different issue than CVE-2005-0339.
12 CVE-2004-2716 89 Exec Code Sql 2004-12-31 2017-07-28
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in usersL.php3 in PHPMyChat 0.14.5 allow remote attackers to execute arbitrary SQL commands via the (1) sortBy, (2) sortOrder, (3) startReg, (4) U, (5) LastCheck , and (6) R parameters.
13 CVE-2004-2711 119 DoS Exec Code Overflow 2004-12-31 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in Gyach Enhanced (Gyach-E) before 1.0.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to "avatar retrieval."
14 CVE-2004-2710 119 DoS Exec Code Overflow 2004-12-31 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in Gyach Enhanced (Gyach-E) before 1.0.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to (1) sending certain typing statuses or (2) setting the chat room status bar to the current chat room name.
15 CVE-2004-2709 119 DoS Exec Code Overflow 2004-12-31 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the strip_html_tags method for Gyach Enhanced (Gyach-E) before 1.0.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via unknown vectors involving HTML tags.
16 CVE-2004-2695 89 Exec Code Sql 2004-12-31 2017-07-28
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Authorize.net callback code (subscriptions/authorize.php) in Jelsoft vBulletin 3.0 through 3.0.3 allows remote attackers to execute arbitrary SQL statements via the x_invoice_num parameter. NOTE: this issue might be related to CVE-2006-4267.
17 CVE-2004-2692 264 Exec Code Bypass 2004-12-31 2017-07-28
9.3
 None Remote Medium Not required Complete Complete Complete
The exec_dir PHP patch (php-exec-dir) 4.3.2 through 4.3.7 with safe mode disabled allows remote attackers to bypass restrictions and execute arbitrary commands via a backtick operator, which is not handled using the php_escape_shell_cmd function.
18 CVE-2004-2690 Exec Code 2004-12-31 2017-07-28
8.5
 None Remote Medium Single system Complete Complete Complete
Unrestricted file upload vulnerability in the Administration Panel for NewsPHP allows remote authenticated administrators to upload and execute arbitrary code instead of video files.
19 CVE-2004-2687 16 Exec Code 2004-12-31 2008-09-05
9.3
 Admin Remote Medium Not required Complete Complete Complete
distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.
20 CVE-2004-2685 119 Exec Code Overflow 2004-12-31 2017-10-10
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long address in a ping (p) command to the Telnet proxy service, a different vector than CVE-2004-2416.
21 CVE-2004-2677 Exec Code 2004-12-31 2018-10-19
7.5
 User Remote Low Not required Partial Partial Partial
Format string vulnerability in qwik-smtpd.c in QwikMail SMTP (qwik-smtpd) 0.3 and earlier allows remote attackers to execute arbitrary code via format specifiers in the (1) clientRcptTo array, and the (2) Received and (3) messageID variables, possibly involving HELO and hostname arguments.
22 CVE-2004-2673 DoS Exec Code Overflow 2004-12-31 2017-07-28
9.0
 None Remote Low Single system Complete Complete Complete
Multiple buffer overflows in ArGoSoft FTP Server before 1.4.1.6 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code via (1) a SITE ZIP command with a long first or second argument, or (2) a SITE COPY with a long argument.
23 CVE-2004-2669 Exec Code Sql 2004-12-31 2017-07-28
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Land Down Under (LDU) v701 allow remote attackers to execute arbitrary SQL commands or obtain the installation path via parameters including (1) s, w, and d in users.php, (2) id in comments.php, (3) rusername in auth.php, or (4) h in plug.php.
24 CVE-2004-2668 Exec Code Sql 2004-12-31 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Interchange before 4.8.9 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
25 CVE-2004-2631 Exec Code 2004-12-31 2017-07-19
7.5
 User Remote Low Not required Partial Partial Partial
Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name.
26 CVE-2004-2630 Exec Code 2004-12-31 2017-07-19
7.5
 User Remote Low Not required Partial Partial Partial
The MIME transformation system (transformations/text_plain__external.inc.php) in phpMyAdmin 2.5.0 up to 2.6.0-pl1 allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
27 CVE-2004-2627 Exec Code 2004-12-31 2017-07-19
10.0
 Admin Remote Low Not required Complete Complete Complete
Java 2 Micro Edition (J2ME) does not properly validate bytecode, which allows remote attackers to escape the Kilobyte Virtual Machine (KVM) sandbox and execute arbitrary code.
28 CVE-2004-2614 DoS Exec Code Overflow 2004-12-31 2017-07-19
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in MyWeb 3.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.
29 CVE-2004-2602 Exec Code File Inclusion 2004-12-31 2017-07-10
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in UberTec Help Center Live (HCL) before 1.2.7 allows remote attackers to execute arbitrary PHP code via a URL in the HCL_path parameter to pipe.php.
30 CVE-2004-2601 Exec Code File Inclusion 2004-12-31 2017-07-10
6.4
 None Remote Low Not required Partial Partial None
PHP remote file inclusion vulnerability in UberTec Help Center Live (HCL) allows remote attackers to read local files and possibly execute PHP code via a URL in the SKIN_inner parameter to inc/skin.php.
31 CVE-2004-2593 DoS Exec Code Overflow 2004-12-31 2017-07-10
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in command-packet processing of Quake II server before R1Q2, as used in multiple products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a packet with a long cmd_args buffer.
32 CVE-2004-2573 Exec Code File Inclusion 2004-12-31 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in tables_update.inc.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to execute arbitrary PHP code via an external URL in the appdir parameter.
33 CVE-2004-2571 Exec Code Overflow 2004-12-31 2017-07-10
7.5
 User Remote Low Not required Partial Partial Partial
Multiple buffer overflows in EnderUNIX isoqlog 2.1.1 allow remote attackers to execute arbitrary code via the (1) parseQmailFromBytesLine, (2) parseQmailToRemoteLine, (3) parseQmailToLocalLine, (4) parseSendmailFromBytesLine, (5) parseSendmailToLine, (6) parseEximFromBytesLine, and (7) parseEximToLine functions in Parser.c; allow local users to execute arbitrary code via the (8) lowercase and (9) check_syslog_date functions in Parser.c, and (10) unspecified functions in Dir.c; and allow unspecified attackers to execute arbitrary code via the (11) loadconfig and (12) removespaces functions in loadconfig.c, the (13) loadLang function in LangCfg.c, and (14) unspecified functions in Html.c.
34 CVE-2004-2567 Exec Code Sql 2004-12-31 2017-07-10
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in ReciPants 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) user id, (2) recipe id, (3) category id, and (4) other ID number fields.
35 CVE-2004-2562 Exec Code Sql 2004-12-31 2017-07-10
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in jobedit.asp in Leigh Business Enterprises (LBE) Web Helpdesk before 4.0.0.81 allows remote attackers to execute arbitrary SQL commands via the id parameter.
36 CVE-2004-2561 Exec Code Sql 2004-12-31 2017-07-10
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Internet Software Sciences Web+Center 4.0.1 allow remote attackers to execute arbitrary SQL commands via (1) the ISS_TECH_CENTER_LOGIN cookie in search.asp and (2) one or more cookies in DoCustomerOptions.asp.
37 CVE-2004-2560 Exec Code 2004-12-31 2017-07-10
7.5
 User Remote Low Not required Partial Partial Partial
DokuWiki before 2004-10-19, when used on a web server that permits execution based on file extension, allows remote attackers to execute arbitrary code by uploading a file with an appropriate extension such as ".php" or ".cgi".
38 CVE-2004-2554 Exec Code 2004-12-31 2017-07-10
7.2
 Admin Local Low Not required Complete Complete Complete
Novell Client Firewall (NCF) 2.0, as based on the Agnitum Outpost Firewall, allows local users to execute arbitrary code with SYSTEM privileges by opening the NCF tray icon and using the Help functionality to launch programs with SYSTEM privileges.
39 CVE-2004-2552 Exec Code Overflow 2004-12-31 2017-07-10
4.6
 User Local Low Not required Partial Partial Partial
Buffer overflow in XBoard 4.2.7 and earlier might allow local users to execute arbitrary code via a long -icshost command line argument. NOTE: since the program is not setuid and not normally called from remote programs, there may not be a typical attack vector for the issue that crosses privilege boundaries. Therefore this may not be a vulnerability.
40 CVE-2004-2551 Exec Code Sql 2004-12-31 2017-07-10
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Layton HelpBox 3.0.1 allow remote attackers to execute arbitrary SQL commands via (1) the sys_comment_id parameter in editcommentenduser.asp, (2) the sys_suspend_id parameter in editsuspensionuser.asp, (3) the table parameter in export_data.asp, (4) the sys_analgroup parameter in manageanalgrouppreference.asp, (5) the sys_asset_id parameter in quickinfoassetrequests.asp, (6) the sys_eusername parameter in quickinfoenduserrequests.asp, and the sys_request_id parameter in (7) requestauditlog.asp, (8) requestcommentsenduser.asp, (9) selectrequestapplytemplate.asp, and (10) selectrequestlink.asp, resulting in an ability to create a new HelpBox user account and read, modify, or delete data from the backend database.
41 CVE-2004-2542 DoS Exec Code Sql Bypass 2004-12-31 2017-07-10
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Dynix (formerly known as epixtech) WebPAC allow remote attackers to execute arbitrary SQL commands via unknown attack vectors, resulting in an ability to execute stored procedures, bypass login authentication, and cause an unspecified denial of service to backend databases.
42 CVE-2004-2541 119 Exec Code Overflow 2004-12-31 2017-10-10
6.9
 None Local Medium Not required Complete Complete Complete
Buffer overflow in Cscope 15.5, and possibly multiple overflows, allows remote attackers to execute arbitrary code via a C file with a long #include line that is later browsed by the target.
43 CVE-2004-2538 Exec Code 2004-12-31 2017-07-10
6.5
 User Remote Low Single system Partial Partial Partial
Direct static code injection vulnerability in the PCG simple application generation in phpCodeGenie before 3.0.2 allows remote authenticated users to execute arbitrary code via the (1) header or (2) footer.
44 CVE-2004-2532 255 Exec Code 2004-12-31 2017-07-10
10.0
 Admin Remote Low Not required Complete Complete Complete
Serv-U FTP server before 5.1.0.0 has a default account and password for local administration, which allows local users to execute arbitrary commands by connecting to the server using the default administrator account, creating a new user, logging in as that new user, and then using the SITE EXEC command.
45 CVE-2004-2523 Exec Code 2004-12-31 2017-07-10
6.5
 User Remote Low Single system Partial Partial Partial
Format string vulnerability in the msg command (cat_message function in msg.c) in OpenFTPD 0.30.2 and earlier allows remote authenticated users to execute arbitrary code via format string specifiers in the message argument.
46 CVE-2004-2515 Exec Code 2004-12-31 2017-07-10
7.2
 Admin Local Low Not required Complete Complete Complete
Format string vulnerability in VMware Workstation 4.5.2 build-8848, if running with elevated privileges, might allow local users to execute arbitrary code via format string specifiers in command line arguments. NOTE: it is not clear if there are any default or typical circumstances under which VMware would be running with privileges beyond those already available to the attackers, so this might not be a vulnerability.
47 CVE-2004-2513 Exec Code Overflow 2004-12-31 2017-10-18
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in the IMAP service of Mercury (Pegasus) Mail 4.01 allows remote attackers to execute arbitrary code via a long SELECT command.
48 CVE-2004-2501 Exec Code Overflow 2004-12-31 2017-07-10
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in the IMAP service of MailEnable Professional Edition 1.52 and Enterprise Edition 1.01 allows remote attackers to execute arbitrary code via (1) a long command string or (2) a long string to the MEIMAP service and then terminating the connection.
49 CVE-2004-2490 Exec Code Overflow 2004-12-31 2017-07-10
4.6
 User Local Low Not required Partial Partial Partial
Buffer overflow in IBM Informix Dynamic Server (IDS) 9.40.xC1 and 9.40.xC2 allows local users to execute arbitrary code via a long GL_PATH environment variable.
50 CVE-2004-2489 Exec Code 2004-12-31 2017-07-10
4.6
 User Local Low Not required Partial Partial Partial
Format string vulnerability in IBM Informix Dynamic Server (IDS) before 9.40.xC3 allows local users to execute arbitrary code via a modified INFORMIXDIR environment variable that points to a file with format string specifiers in the filename.
Total number of vulnerabilities : 614   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.