Propack

CVEs (54)

• CVE-2004-0079HigNov 23, 2004
  OpenSSL Project

  OpenSSL
  risk 0.50cvss 7.5epss 0.10

  The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.

• CVE-2004-0519Aug 18, 2004
  SquirrelMail

  Squirrelmail
  risk 0.05cvss —epss 0.23

  Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.

• CVE-2004-0110Mar 15, 2004
  Xmlsoft

  Libxml2
  risk 0.05cvss —epss 0.24

  Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL.

• CVE-2004-0104Mar 3, 2004
  Metamail Corporation

  Metamail
  risk 0.05cvss —epss 0.26

  Multiple format string vulnerabilities in Metamail 2.7 and earlier allow remote attackers to execute arbitrary code.

• CVE-2004-1471Dec 31, 2004
  Nongnu

  Cvs
  risk 0.04cvss —epss 0.08

  Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper…

• CVE-2004-0520Aug 18, 2004
  SquirrelMail

  Squirrelmail
  risk 0.04cvss —epss 0.07

  Cross-site scripting (XSS) vulnerability in mime.php for SquirrelMail before 1.4.3 allows remote attackers to insert arbitrary HTML and script via the content-type mail header, as demonstrated using read_body.php.

• CVE-2004-0416Aug 6, 2004
  Nongnu

  Cvs
  risk 0.04cvss —epss 0.13

  Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.

• CVE-2003-0795Dec 15, 2003
  GNU

  Zebra
  risk 0.04cvss —epss 0.08

  The vty layer in Quagga before 0.96.4, and Zebra 0.93b and earlier, does not verify that sub-negotiation is taking place when processing the SE marker, which allows remote attackers to cause a denial of service (crash) via a malformed telnet command to the telnet CLI port, which…

• CVE-2005-0156Feb 7, 2005
  Larry Wall

  Perl
  risk 0.03cvss —epss 0.01

  Buffer overflow in the PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to execute arbitrary code by setting the PERLIO_DEBUG variable and executing a Perl script whose full pathname contains a long directory tree.

• CVE-2004-0233Aug 18, 2004
  Utempter

  Utempter
  risk 0.03cvss —epss 0.01

  Utempter allows device names that contain .. (dot dot) directory traversal sequences, which allows local users to overwrite arbitrary files via a symlink attack on device names in combination with an application that trusts the utmp or wtmp files.

• CVE-2004-0492Aug 6, 2004
  Apache

  HTTP Server
  risk 0.03cvss —epss 0.34

  Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be…

• CVE-2004-0639Aug 6, 2004
  SquirrelMail

  Squirrelmail
  risk 0.03cvss —epss 0.06

  Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in read_body.php, (2) the $senderNames_part variable in mailbox_display.php, and possibly other vectors…

• CVE-2004-0424Jul 7, 2004
  Linux

  Kernel
  risk 0.03cvss —epss 0.01

  Integer overflow in the ip_setsockopt function in Linux kernel 2.4.22 through 2.4.25 and 2.6.1 through 2.6.3 allows local users to cause a denial of service (crash) or execute arbitrary code via the MCAST_MSFILTER socket option.

• CVE-2004-1307Dec 21, 2004
  LibTIFF

  Libtiff
  risk 0.01cvss —epss 0.06

  Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips, which causes a zero byte buffer to be allocated and leads to a…

• CVE-2004-0081Nov 23, 2004
  OpenSSL Project

  OpenSSL
  risk 0.01cvss —epss 0.07

  OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool.

• CVE-2004-0112Nov 23, 2004
  OpenSSL Project

  OpenSSL
  risk 0.01cvss —epss 0.10

  The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake…

• CVE-2004-0234Aug 18, 2004
  LHA

  LHA
  risk 0.01cvss —epss 0.10

  Multiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14, as used in products such as Barracuda Spam Firewall, allow remote attackers or local users to execute arbitrary code via long directory or file names in an LHA archive, which triggers the…

• CVE-2004-0523Aug 18, 2004
  Mit

  Kerberos
  risk 0.01cvss —epss 0.12

  Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.

• CVE-2004-0507Aug 18, 2004
  Ethereal Group

  Ethereal
  risk 0.01cvss —epss 0.08

  Buffer overflow in the MMSE dissector for Ethereal 0.10.1 to 0.10.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code.

• CVE-2004-0105Mar 3, 2004
  Metamail Corporation

  Metamail
  risk 0.01cvss —epss 0.08

  Multiple buffer overflows in Metamail 2.7 and earlier allow remote attackers to execute arbitrary code.