PUBLIÉES EN

décembre 2004

113 CVE, des plus récentes aux plus anciennes.

← novembre 2004 janvier 2005 →

CVE-2004-2759Shared Sun StorEdge QFS and SAM-QFS file systems, as used in Utilization Suite 4.0 through 4.1 and Performance Suite 4.0 through 4.1, might allow local users to read portions of de… 2.1 FAIBLE

CVE-2004-2728Buffer overflow in the FTP server of Hummingbird Connectivity 7.1 and 9.0 allows remote, authenticated users to cause a denial of service (application crash) via a long argument to… 3.5 FAIBLE

CVE-2004-2723NessusWX 1.4.4 stores account passwords in plaintext in .session files, which allows local users to obtain passwords. 2.1 FAIBLE

CVE-2004-2722Nessus 2.0.10a stores account passwords in plaintext in .nessusrc files, which allows local users to obtain passwords. NOTE: the original researcher reports that the vendor has di… 2.1 FAIBLE

CVE-2004-2717Multiple directory traversal vulnerabilities in admin.php3 in PHPMyChat 0.14.5 allow remote attackers with administrative privileges to read arbitrary files via a .. (dot dot) in t… 2.6 FAIBLE

CVE-2004-2713Zone Alarm Pro 1.0 through 5.1 gives full access to %windir%\Internet Logs\* to the EVERYONE group, which allows local users to cause a denial of service by modifying the folder co… 1.9 FAIBLE

CVE-2004-2684Unspecified vulnerability in the %template package in InterSystems Cache' 5.0 allows attackers to access certain files on a server, including (1) cache.key and (2) cache.dat, relat… 2.1 FAIBLE

CVE-2004-2683Unspecified vulnerability in the %XML.Utils.SchemaServer class in InterSystems Cache' 5.0 allows attackers to access arbitrary files on a server. 2.1 FAIBLE

CVE-2004-2658resmgr in SUSE CORE 9 does not properly identify terminal names, which allows local users to spoof terminals and login types. 2.1 FAIBLE

CVE-2004-2657Mozilla Firefox 1.5.0.1, and possibly other versions, preserves some records of user activity even after uninstalling, which allows local users who share a Windows profile to view … 1.7 FAIBLE

CVE-2004-2648FreezeX 1.00.100.0666 allows local users with administrator privileges to cause a denial of service (FreezeX application) by overwriting the db.fzx file. 1.0 FAIBLE

CVE-2004-2643Directory traversal vulnerability in Microsoft cabarc allows remote attackers to overwrite files via "../" sequences in file names in a CAB archive. 3.7 FAIBLE

CVE-2004-2626GUI overlay vulnerability in the Java API in Siemens S55 cellular phones allows remote attackers to send unauthorized SMS messages by overlaying a confirmation message with a malic… 3.7 FAIBLE

CVE-2004-2609The stuffit.com executable on Symantec PowerQuest DeployCenter 5.5 boot disks allows local users to obtain sensitive information (an unencrypted password for a Windows domain accou… 2.1 FAIBLE

CVE-2004-2607A numeric casting discrepancy in sdla_xfer in Linux kernel 2.6.x up to 2.6.5 and 2.4 up to 2.4.29-rc1 allows local users to read portions of kernel memory via a large len argument,… 2.1 FAIBLE

CVE-2004-2605aStats 1.6.5 allows local users to overwrite arbitrary files via a symlink attack on (1) the aStats-Graphic-Signature-Generation file and (2) certain PNG image files. 2.1 FAIBLE

CVE-2004-2599Multiple buffer overflows in Quake II server before R1Q2, as used in multiple products, allow local users to cause a denial of service (application crash) via the server console or… 2.1 FAIBLE

CVE-2004-2591The data-overwrite capability of ButtUglySoftware CleanCache 2.19 does not properly overwrite data in files, which allows attackers to recover the data. 2.1 FAIBLE

CVE-2004-2569ipmenu 0.0.3 before Debian GNU/Linux ipmenu_0.0.3-5 allows local users to overwrite arbitrary files via a symlink attack on the ipmenu.log temporary file. 2.1 FAIBLE

CVE-2004-2555Riverdeep FoolProof Security 3.9.x on Windows 98 and Windows ME uses weak cryptography (arithmetic and XOR operations) to relate the Control password to the Administrator password,… 2.1 FAIBLE

CVE-2004-2547NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to obtain sensitive information via HTTP requests that (a) specify the / URI, (b) specify the /scripts/ URI,… 2.6 FAIBLE

CVE-2004-2544Admin Console in Secure Computing Corporation Sidewinder G2 6.1.0.01 exports private keys when exporting firewall certificates, which might allow attackers to obtain sensitive info… 2.1 FAIBLE

CVE-2004-2530Visual truncation vulnerability in Gadu-Gadu allows remote attackers to spoof the file extension on transmitted files via a filename with a large number of spaces followed by the r… 2.6 FAIBLE

CVE-2004-2502im-switch before 11.4-46.1 in Fedora Core 2 allows local users to overwrite arbitrary files via a symlink attack on the imswitcher[PID] temporary file. 2.1 FAIBLE

CVE-2004-2491A race condition in Opera web browser 7.53 Build 3850 causes Opera to fill in the address bar before the page has been loaded, which allows remote attackers to spoof the URL in the… 2.6 FAIBLE

CVE-2004-2477DiamondCS Process Guard Free 2.000 allows local users to disable the process guard protection system by overwriting the current Service Descriptor Table (SDT) in \device\physicalme… 2.1 FAIBLE

CVE-2004-2476Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (infinite loop and crash) via an IFRAME with "?" as the file source. 2.6 FAIBLE

CVE-2004-2473wmFrog weather monitor 0.1.6 and other versions before 0.2.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files. 1.2 FAIBLE

CVE-2004-2459Unknown vulnerability in gnubiff 1.2.0 and earlier allows local users to obtain passwords, related to the password table. 2.1 FAIBLE

CVE-2004-2454aMSN 0.90 for Microsoft Windows allows local users to obtain sensitive information such as hashed passwords from (1) hotlog.htm and (2) config.xml. 2.1 FAIBLE

CVE-2004-2440Unspecified vulnerability in cmdline.c in proxytunnel 1.1.3 and earlier allows local users to obtain proxy credentials (username or password) of other users. 2.1 FAIBLE

CVE-2004-2436Computer Associates Unicenter Common Services 3.0 and earlier stores the database "SA" password in cleartext in the TndAddNspTmp.bat file, which could allow local users to gain pri… 2.1 FAIBLE

CVE-2004-2419Keene Digital Media Server 1.0.2 allows local users to obtain usernames and passwords by reading the dmscore.db file on the local system. 2.1 FAIBLE

CVE-2004-2414Novell NetWare 6.5 SP 1.1, when installing or upgrading using the Overlay CDs and performing a custom installation with OpenSSH, includes sensitive password information in the (1) … 2.1 FAIBLE

CVE-2004-2410Unknown vulnerability in sh_hash_compdata for Samhain 1.8.9 through 2.0.1 might allow attackers to cause a denial of service (null pointer dereference). 2.1 FAIBLE

CVE-2004-2408Linux VServer 1.27 and earlier, 1.3.9 and earlier, and 1.9.1 and earlier shares /proc permissions across all virtual and host servers, which allows local users with the ability to … 3.6 FAIBLE

CVE-2004-2400WinFTP Server 1.6 stores username and password credentials in plaintext in the data\user.wfd file, which allows local users to gain access to the credentials. 2.1 FAIBLE

CVE-2004-2398Netenberg Fantastico De Luxe 2.8 uses database file names that contain the associated usernames, which allows local users to determine valid usernames and conduct brute force attac… 2.1 FAIBLE

CVE-2004-2395Memory leak in passwd 0.68 allows local users to cause a denial of service (memory consumption) via a large number of failed read attempts from the password buffer. 2.1 FAIBLE

CVE-2004-2394Off-by-one error in passwd 0.68 and earlier, when using the --stdin option, causes passwd to use the first 78 characters of a password instead of the first 79, which results in a s… 2.1 FAIBLE

CVE-2004-2365Memory leak in Microsoft Windows XP and Windows Server 2003 allows local users to cause a denial of service (memory exhaustion) by repeatedly creating and deleting directories usin… 2.1 FAIBLE

CVE-2004-2337The /.inlook/.crypt file for inlook 0.7.3 and earlier is installed with world readable permissions, which allows local users to obtain user POP3 credentials. 2.1 FAIBLE

CVE-2004-2321BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including (1) ServerStartMBean.P… 2.1 FAIBLE

CVE-2004-2319IBM Informix Dynamic Server (IDS) before 9.40.xC3 allows local users to (1) create or overwrite files via the /001 log file to onedcu or (2) read arbitrary files via a symlink atta… 3.6 FAIBLE

CVE-2004-2311Directory traversal vulnerability in webadmin.nsf in Lotus Domino R6 6.5.1 allows local users to create folders or determine the existence of files via a .. (dot dot) in the new fo… 3.6 FAIBLE

CVE-2004-2309Directory traversal vulnerability in Crob FTP Server 3.5.1 allows local users to browse outside the FTP root via multiple ../ (dot dot slash) in the DIR command. 2.1 FAIBLE

CVE-2004-2303MTools Mformat before 3.9.9, when installed setuid root, creates files with world-readable and world-writable permissions, which allows local users to read and overwrite files. 3.6 FAIBLE

CVE-2004-2302Race condition in the sysfs_read_file and sysfs_write_file functions in Linux kernel before 2.6.10 allows local users to read kernel memory and cause a denial of service (crash) vi… 2.6 FAIBLE

CVE-2004-2276F-Secure Anti-Virus 5.41 and 5.42 on Windows, Client Security 5.50 and 5.52, 4.60 for Samba Servers, and 4.52 and earlier for Linux does not properly detect certain viruses in a PK… 2.1 FAIBLE

CVE-2004-2258Xconfig in Hummingbird Exceed before 9.0.0.1, when the Screen Definition is password-protected, allows local users to access certain options by switching to another tab, then switc… 2.1 FAIBLE