Overview 139 matches · 0 in Waratek scope · 0 protected · 2 exploited · 0 CISA KEV · 33 public PoC · 7 EPSS ≥ 0.5
139matches
0in Waratek scope0.0%
0protected0.0%
2exploited1.4%
0CISA KEV0.0%
33public PoC23.7%
7EPSS ≥ 0.55.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
0.7%
Not applicable
138
99.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
139
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 73 / year
20034
Not applicable4
High4
not blocked4
Exploited2
Working exploit published1
No public exploit1
200445
Not applicable45
High25
Medium13
Low7
not blocked45
Working exploit published14
No public exploit31
200573
Outside Waratek scope1
Not applicable72
High37
Medium22
Low14
not blocked73
Working exploit published16
No public exploit57
20063
Not applicable3
Medium3
not blocked3
No public exploit3
20072
Not applicable2
Medium2
not blocked2
No public exploit2
20082
Not applicable2
High1
Low1
not blocked2
No public exploit2
20090
20100
20110
20120
20134
Not applicable4
Medium3
Low1
not blocked4
Working exploit published1
No public exploit3
20141
Not applicable1
Medium1
not blocked1
No public exploit1
20150
20160
20170
20180
20190
20200
20210
20220
20230
20240
20255
Not applicable5
Critical1
High3
Medium1
not blocked5
Proof of concept only5
200320052007200920112013201520172019202120232025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-12084 | Critical | 2025-01-15 | Not applicable | Proof of concept only | A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer. |
| CVE-2024-12088 | High | 2025-01-14 | Not applicable | Proof of concept only | A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory. |
| CVE-2024-12087 | High | 2025-01-14 | Not applicable | Proof of concept only | A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client. |
| CVE-2024-12086 | Medium | 2025-01-14 | Not applicable | Proof of concept only | A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client. |
| CVE-2024-12085 | High | 2025-01-14 | Not applicable | Proof of concept only | A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time. |
| CVE-2014-4909 | Medium | 2014-07-29 | Not applicable | No public exploit | Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted peer message, which triggers an out-of-bounds write. |
| CVE-2013-0348 | Low | 2013-12-13 | Not applicable | No public exploit | thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log, which allows local users to obtain sensitive information by reading the file. |
| CVE-2013-2032 | Medium | 2013-11-18 | Not applicable | No public exploit | MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks. |
| CVE-2013-2031 | Medium | 2013-11-18 | Not applicable | No public exploit | MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox. |
| CVE-2010-1159 | Medium | 2013-10-28 | Not applicable | Working exploit published | Multiple heap-based buffer overflows in Aircrack-ng before 1.1 allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) large length value in an EAPOL packet or (2) long EAPOL packet. |
| CVE-2008-1383 | Low | 2008-03-18 | Not applicable | No public exploit | The docert function in ssl-cert.eclass, when used by src_compile or src_install on Gentoo Linux, stores the SSL key in a binpkg, which allows local users to extract the key from the binpkg, and causes multiple systems that use this binpkg to have the same SSL key and certificate. |
| CVE-2008-1078 | High | 2008-02-29 | Not applicable | No public exploit | expn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows local users to overwrite arbitrary files via a symlink attack on the expn[PID] temporary file. NOTE: this is the same issue as CVE-2003-0308.1. |
| CVE-2007-1500 | Medium | 2007-03-19 | Not applicable | No public exploit | The Linux Security Auditing Tool (LSAT) allows local users to overwrite arbitrary files via a symlink attack on temporary files, as demonstrated using /tmp/lsat1.lsat. |
| CVE-2007-0476 | Medium | 2007-01-25 | Not applicable | No public exploit | The gencert.sh script, when installing OpenLDAP before 2.1.30-r10, 2.2.x before 2.2.28-r7, and 2.3.x before 2.3.30-r2 as an ebuild in Gentoo Linux, does not create temporary directories in /tmp securely during emerge, which allows local users to overwrite arbitrary files via a symlink attack. |
| CVE-2006-3005 | Medium | 2006-06-13 | Not applicable | No public exploit | The JPEG library in media-libs/jpeg before 6b-r7 on Gentoo Linux is built without the -maxmem feature, which could allow context-dependent attackers to cause a denial of service (memory exhaustion) via a crafted JPEG file that exceeds the intended memory limits. |
| CVE-2006-1390 | Medium | 2006-03-25 | Not applicable | No public exploit | The configuration of NetHack 3.4.3-r1 and earlier, Falcon's Eye 1.9.4a and earlier, and Slash'EM 0.0.760 and earlier on Gentoo Linux allows local users in the games group to modify saved games files to execute arbitrary code via buffer overflows and overwrite arbitrary files via symlink attacks. |
| CVE-2006-0071 | Medium | 2006-01-04 | Not applicable | No public exploit | The ebuild for pinentry before 0.7.2-r2 on Gentoo Linux sets setgid bits for pinentry programs, which allows local users to read or overwrite arbitrary files as gid 0. |
| CVE-2005-3626 | Medium | 2005-12-31 | Not applicable | No public exploit | Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference. |
| CVE-2005-3625 | High | 2005-12-31 | Not applicable | No public exploit | Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins." |
| CVE-2005-3624 | Medium | 2005-12-31 | Not applicable | No public exploit | The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows. |
| CVE-2005-3785 | Medium | 2005-11-23 | Not applicable | No public exploit | Second-order symlink vulnerability in eix-sync.in in Ebuild IndeX (eix) before 0.5.0_pre2 allows local users to overwrite arbitrary files via a symlink attack on the exi.X.sync temporary file, which is processed by the diff-eix program. |
| CVE-2005-2557 | Medium | 2005-09-28 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in view_all_set.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the dir parameter, as identified by bug#0005959, and a different vulnerability than CVE-2005-3090. |
| CVE-2005-1267 | Medium | 2005-06-10 | Not applicable | Working exploit published | The bgp_update_print function in tcpdump 3.x does not properly handle a -1 return value from the decode_prefix4 function, which allows remote attackers to cause a denial of service (infinite loop) via a crafted BGP packet. |
| CVE-2005-1707 | Medium | 2005-05-24 | Not applicable | Working exploit published | The fn_show_postinst function in Gentoo webapp-config before 1.10-r14 allows local users to overwrite arbitrary files via a symlink attack on the postinst.txt temporary file. |
| CVE-2005-1121 | Medium | 2005-05-02 | Not applicable | No public exploit | Format string vulnerability in the my_xlog function in lib.c for Oops! Proxy Server 1.5.23 and earlier, as called by the auth functions in the passwd_mysql and passwd_pgsql modules, may allow attackers to execute arbitrary code via a URL. |
| CVE-2005-0988 | Low | 2005-05-02 | Not applicable | No public exploit | Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete. |
| CVE-2005-0077 | Low | 2005-05-02 | Not applicable | No public exploit | The DBI library (libdbi-perl) for Perl allows local users to overwrite arbitrary files via a symlink attack on a temporary PID file. |
| CVE-2005-0005 | High | 2005-05-02 | Not applicable | No public exploit | Heap-based buffer overflow in psd.c for ImageMagick 6.1.0, 6.1.7, and possibly earlier versions allows remote attackers to execute arbitrary code via a .PSD image file with a large number of layers. |
| CVE-2005-0206 | High | 2005-04-27 | Not applicable | No public exploit | The patch for integer overflow vulnerabilities in Xpdf 2.0 and 3.0 (CVE-2004-0888) is incomplete for 64-bit architectures on certain Linux distributions such as Red Hat, which could leave Xpdf users exposed to the original vulnerabilities. |
| CVE-2005-0754 | High | 2005-04-22 | Not applicable | No public exploit | Kommander in KDE 3.2 through KDE 3.4.0 executes data files without confirmation from the user, which allows remote attackers to execute arbitrary code. |
| CVE-2004-1176 | High | 2005-04-14 | Not applicable | No public exploit | Buffer underflow in extfs.c in Midnight Commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code. |
| CVE-2004-1175 | High | 2005-04-14 | Not applicable | No public exploit | fish.c in midnight commander allows remote attackers to execute arbitrary programs via "insecure filename quoting," possibly using shell metacharacters. |
| CVE-2004-1174 | Medium | 2005-04-14 | Not applicable | No public exploit | direntry.c in Midnight Commander (mc) 4.5.55 and earlier allows attackers to cause a denial of service by "manipulating non-existing file handles." |
| CVE-2004-1093 | Medium | 2005-04-14 | Not applicable | No public exploit | Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service via "use of already freed memory." |
| CVE-2004-1092 | Medium | 2005-04-14 | Not applicable | No public exploit | Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service by causing mc to free unallocated memory. |
| CVE-2004-1091 | Medium | 2005-04-14 | Not applicable | No public exploit | Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service by triggering a null dereference. |
| CVE-2004-1090 | Medium | 2005-04-14 | Not applicable | No public exploit | Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service via "a corrupt section header." |
| CVE-2004-1009 | Medium | 2005-04-14 | Not applicable | No public exploit | Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service (infinite loop) via unknown attack vectors. |
| CVE-2004-1005 | High | 2005-04-14 | Not applicable | No public exploit | Multiple buffer overflows in Midnight Commander (mc) 4.5.55 and earlier allow remote attackers to have an unknown impact. |
| CVE-2004-1004 | High | 2005-04-14 | Not applicable | No public exploit | Multiple format string vulnerabilities in Midnight Commander (mc) 4.5.55 and earlier allow remote attackers to have an unknown impact. |
| CVE-2005-0470 | Medium | 2005-03-14 | Not applicable | No public exploit | Buffer overflow in wpa_supplicant before 0.2.7 allows remote attackers to cause a denial of service (segmentation fault) via invalid EAPOL-Key packet data. |
| CVE-2005-0667 | Medium | 2005-03-07 | Not applicable | No public exploit | Buffer overflow in Sylpheed before 1.0.3 and other versions before 1.9.5 allows remote attackers to execute arbitrary code via an e-mail message with certain headers containing non-ASCII characters that are not properly handled when the user replies to the message. |
| CVE-2004-1055 | Medium | 2005-03-01 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PmaAbsoluteUri parameter, (2) the zero_rows parameter in read_dump.php, (3) the confirm form, or (4) an error message generated by the internal phpMyAdmin parser. |
| CVE-2004-1052 | High | 2005-03-01 | Not applicable | No public exploit | Buffer overflow in the getnickuserhost function in BNC 2.8.9, and possibly other versions, allows remote IRC servers to execute arbitrary code via an IRC server response that contains many (1) ! (exclamation) or (2) @ (at sign) characters. |
| CVE-2004-1037 | High | 2005-03-01 | Not applicable | Working exploit published | The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string. |
| CVE-2004-1036 | Medium | 2005-03-01 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the decoding of encoded text in certain headers in mime.php for SquirrelMail 1.4.3a and earlier, and 1.5.1-cvs before 23rd October 2004, allows remote attackers to execute arbitrary web script or HTML. |
| CVE-2004-1034 | High | 2005-03-01 | Not applicable | No public exploit | Buffer overflow in the http_open function in Kaffeine before 0.5, whose code is also used in gxine before 0.3.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long Content-Type header for a Real Audio Media (.ram) playlist file. |
| CVE-2004-1033 | Low | 2005-03-01 | Not applicable | No public exploit | Fcron 2.0.1, 2.9.4, and possibly earlier versions leak file descriptors of open files, which allows local users to bypass access restrictions and read fcron.allow and fcron.deny via the EDITOR environment variable. |
| CVE-2004-1032 | Low | 2005-03-01 | Not applicable | No public exploit | fcronsighup in Fcron 2.0.1, 2.9.4, and possibly earlier versions allows local users to delete arbitrary files or create arbitrary empty files via a target filename with a large number of leading slash (/) characters such that fcronsighup does not properly append the intended fcrontab.sig to the resulting string. |
| CVE-2004-1031 | High | 2005-03-01 | Not applicable | No public exploit | fcronsighup in Fcron 2.0.1, 2.9.4, and possibly earlier versions allows local users to bypass access restrictions and load an arbitrary configuration file by starting an suid process and pointing the fcronsighup configuration file to a /proc entry that is owned by root but modifiable by the user, such as /proc/self/cmdline or /proc/self/environ. |
| CVE-2004-1030 | Low | 2005-03-01 | Not applicable | No public exploit | fcronsighup in Fcron 2.0.1, 2.9.4, and possibly earlier versions allows local users to gain sensitive information by calling fcronsighup with an arbitrary file, which reveals the contents of the file that can not be parsed in an error message. |
| CVE-2004-1029 | High | 2005-03-01 | Outside Waratek scope | Working exploit published | The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages. |
| CVE-2004-1027 | Medium | 2005-03-01 | Not applicable | No public exploit | Directory traversal vulnerability in the -x (extract) command line option in unarj allows remote attackers to overwrite arbitrary files via an arj archive with filenames that contain .. (dot dot) sequences. |
| CVE-2004-0990 | High | 2005-03-01 | Not applicable | Working exploit published | Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function, a different set of vulnerabilities than CVE-2004-0941. |
| CVE-2004-0983 | Medium | 2005-03-01 | Not applicable | No public exploit | The CGI module in Ruby 1.6 before 1.6.8, and 1.8 before 1.8.2, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certain HTTP request. |
| CVE-2005-0535 | High | 2005-02-22 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to perform unauthorized actions as authenticated MediaWiki users. |
| CVE-2004-0981 | High | 2005-02-09 | Not applicable | No public exploit | Buffer overflow in the EXIF parsing routine in ImageMagick before 6.1.0 allows remote attackers to execute arbitrary code via a certain image file. |
| CVE-2004-0980 | High | 2005-02-09 | Not applicable | No public exploit | Format string vulnerability in ez-ipupdate.c for ez-ipupdate 3.0.10 through 3.0.11b8, when running in daemon mode with certain service types in use, allows remote servers to execute arbitrary code. |
| CVE-2004-0975 | Low | 2005-02-09 | Not applicable | No public exploit | The der_chop script in the openssl package in Trustix Secure Linux 1.5 through 2.1 and other operating systems allows local users to overwrite files via a symlink attack on temporary files. |
| CVE-2004-0972 | Low | 2005-02-09 | Not applicable | No public exploit | The lvmcreate_initrd script in the lvm package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files. |
| CVE-2004-0969 | Low | 2005-02-09 | Not applicable | No public exploit | The groffer script in the Groff package 1.18 and later versions, as used in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files. |
| CVE-2004-0947 | High | 2005-02-09 | Not applicable | No public exploit | Buffer overflow in unarj before 2.63a-r2 allows remote attackers to execute arbitrary code via an arj archive that contains long filenames. |
| CVE-2004-0937 | High | 2005-02-09 | Not applicable | Working exploit published | Sophos Anti-Virus before 3.87.0, and Sophos Anti-Virus for Windows 95, 98, and Me before 3.88.0, allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system. |
| CVE-2004-0936 | High | 2005-01-27 | Not applicable | Working exploit published | RAV antivirus allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system. |
| CVE-2004-0935 | High | 2005-01-27 | Not applicable | Working exploit published | Eset Anti-Virus before 1.020 (16th September 2004) allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system. |
| CVE-2004-0934 | High | 2005-01-27 | Not applicable | Working exploit published | Kaspersky 3.x to 4.x allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system. |
| CVE-2004-0933 | High | 2005-01-27 | Not applicable | Working exploit published | Computer Associates (CA) InoculateIT 6.0, eTrust Antivirus r6.0 through r7.1, eTrust Antivirus for the Gateway r7.0 and r7.1, eTrust Secure Content Manager, eTrust Intrusion Detection, EZ-Armor 2.0 through 2.4, and EZ-Antivirus 6.1 through 6.3 allow remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system. |
| CVE-2004-0932 | High | 2005-01-27 | Not applicable | Working exploit published | McAfee Anti-Virus Engine DATS drivers before 4398 released on Oct 13th 2004 and DATS Driver before 4397 October 6th 2004 allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system. |
| CVE-2004-0930 | Medium | 2005-01-27 | Not applicable | No public exploit | The ms_fnmatch function in Samba 3.0.4 and 3.0.7 and possibly other versions allows remote authenticated users to cause a denial of service (CPU consumption) via a SAMBA request that contains multiple * (wildcard) characters. |
| CVE-2004-0918 | Medium | 2005-01-27 | Not applicable | No public exploit | The asn_parse_header function (asn1.c) in the SNMP module for Squid Web Proxy Cache before 2.4.STABLE7 allows remote attackers to cause a denial of service (server restart) via certain SNMP packets with negative length fields that trigger a memory allocation error. |
| CVE-2004-0891 | High | 2005-01-27 | Not applicable | No public exploit | Buffer overflow in the MSN protocol handler for gaim 0.79 to 1.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an "unexpected sequence of MSNSLP messages" that results in an unbounded copy operation that writes to the wrong buffer. |
| CVE-2004-0889 | High | 2005-01-27 | Not applicable | No public exploit | Multiple integer overflows in xpdf 3.0, and other packages that use xpdf code such as CUPS, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0888. |
| CVE-2004-0888 | High | 2005-01-27 | Not applicable | No public exploit | Multiple integer overflows in xpdf 2.0 and 3.0, and other packages that use xpdf code such as CUPS, gpdf, and kdegraphics, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0889. |
| CVE-2004-0881 | Low | 2005-01-27 | Not applicable | No public exploit | getmail 4.x before 4.2.0, and other versions before 3.2.5, when run as root, allows local users to write files in arbitrary directories via a symlink attack on subdirectories in the maildir. |
| CVE-2004-0880 | Low | 2005-01-27 | Not applicable | No public exploit | getmail 4.x before 4.2.0, when run as root, allows local users to overwrite arbitrary files via a symlink attack on an mbox file. |
| CVE-2004-1304 | High | 2005-01-10 | Not applicable | Working exploit published | Stack-based buffer overflow in the ELF header parsing code in file before 4.12 allows attackers to execute arbitrary code via a crafted ELF file. |
| CVE-2004-1162 | High | 2005-01-10 | Not applicable | No public exploit | The unison command in scponly before 4.0 does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended access restrictions and execute arbitrary programs via the (1) -rshcmd or (2) -sshcmd flags. |
| CVE-2004-1161 | High | 2005-01-10 | Not applicable | Working exploit published | rssh 2.2.2 and earlier does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended access restrictions and execute arbitrary programs via (1) rdist -P, (2) rsync, or (3) scp -S. |
| CVE-2004-1117 | High | 2005-01-10 | Not applicable | No public exploit | The init scripts in ChessBrain 20407 and earlier execute user-owned programs with root privileges, which allows local users to gain privileges by modifying the programs. |
| CVE-2004-1116 | High | 2005-01-10 | Not applicable | No public exploit | The init scripts in Great Internet Mersenne Prime Search (GIMPS) 23.9 and earlier execute user-owned programs with root privileges, which allows local users to gain privileges by modifying the programs. |
| CVE-2004-1115 | High | 2005-01-10 | Not applicable | No public exploit | The init scripts in Search for Extraterrestrial Intelligence (SETI) project 3.08-r3 and earlier execute user-owned programs with root privileges, which allows local users to gain privileges by modifying the programs. |
| CVE-2004-1110 | Low | 2005-01-10 | Not applicable | No public exploit | The mtink status monitor before 1.0.5 for Epson printers allows local users to overwrite arbitrary files via a symlink attack on the epson temporary file. |
| CVE-2004-1108 | Low | 2005-01-10 | Not applicable | No public exploit | qpkg in Gentoolkit 0.2.0_pre10 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary directory. |
| CVE-2004-1107 | Low | 2005-01-10 | Not applicable | No public exploit | dispatch-conf in Portage 2.0.51-r2 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files. |
| CVE-2004-1106 | Medium | 2005-01-10 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Gallery 1.4.4-pl3 and earlier allows remote attackers to execute arbitrary web script or HTML via "specially formed URLs," possibly via the include parameter in index.php. |
| CVE-2004-1096 | High | 2005-01-10 | Not applicable | Working exploit published | Archive::Zip Perl module before 1.14, when used by antivirus programs such as amavisd-new, allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system. |
| CVE-2004-1026 | High | 2005-01-10 | Not applicable | No public exploit | Multiple integer overflows in the image handler for imlib 1.9.14 and earlier, which is used by gkrellm and several window managers, allow remote attackers to cause a denial of service (application crash) and execute arbitrary code via certain image files. |
| CVE-2004-1025 | High | 2005-01-10 | Not applicable | No public exploit | Multiple heap-based buffer overflows in imlib 1.9.14 and earlier, which is used by gkrellm and several window managers, allow remote attackers to cause a denial of service (application crash) and execute arbitrary code via certain image files. |
| CVE-2004-0996 | Low | 2005-01-10 | Not applicable | Working exploit published | main.c in cscope 15-4 and 15-5 creates temporary files with predictable filenames, which allows local users to overwrite arbitrary files via a symlink attack. |
| CVE-2004-0914 | High | 2005-01-10 | Not applicable | No public exploit | Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other packages, include (1) multiple integer overflows, (2) out-of-bounds memory accesses, (3) directory traversal, (4) shell metacharacter, (5) endless loops, and (6) memory leaks, which could allow remote attackers to obtain sensitive information, cause a denial of service (application crash), or execute arbitrary code via a certain XPM image file. NOTE: it is highly likely that this candidate will be SPLIT into other candidates in the future, per CVE's content decisions. |
| CVE-2004-1901 | Medium | 2004-12-31 | Not applicable | No public exploit | Portage before 2.0.50-r3 allows local users to overwrite arbitrary files via a hard link attack on the lockfiles. |
| CVE-2004-1491 | Medium | 2004-12-31 | Not applicable | Working exploit published | Opera 7.54 and earlier uses kfmclient exec to handle unknown MIME types, which allows remote attackers to execute arbitrary code via a shortcut or launcher that contains an Exec entry. |
| CVE-2004-1471 | High | 2004-12-31 | Not applicable | Working exploit published | Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line. |
| CVE-2004-1452 | High | 2004-12-31 | Not applicable | No public exploit | Tomcat before 5.0.27-r3 in Gentoo Linux sets the default permissions on the init scripts as tomcat:tomcat, but executes the scripts with root privileges, which could allow local users in the tomcat group to execute arbitrary commands as root by modifying the scripts. |
| CVE-2004-1336 | Low | 2004-12-23 | Not applicable | No public exploit | The xdvizilla script in tetex-bin 2.0.2 creates temporary files with predictable file names, which allows local users to overwrite arbitrary files via a symlink attack. |
| CVE-2004-0834 | High | 2004-12-23 | Not applicable | No public exploit | Format string vulnerability in Speedtouch USB driver before 1.3.1 allows local users to execute arbitrary code via (1) modem_run, (2) pppoa2, or (3) pppoa3. |
| CVE-2004-0749 | Medium | 2004-12-23 | Not applicable | No public exploit | The mod_authz_svn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on unreadable paths, which could allow remote attackers to gain sensitive information via (1) svn log -v, (2) svn propget, or (3) svn blame, and other commands that follow renames. |
| CVE-2004-1307 | High | 2004-12-21 | Not applicable | No public exploit | Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips, which causes a zero byte buffer to be allocated and leads to a heap-based buffer overflow. |
| CVE-2004-0635 | Medium | 2004-12-06 | Not applicable | No public exploit | The SNMP dissector in Ethereal 0.8.15 through 0.10.4 allows remote attackers to cause a denial of service (process crash) via a (1) malformed or (2) missing community string, which causes an out-of-bounds read. |
| CVE-2004-0634 | Medium | 2004-12-06 | Not applicable | No public exploit | The SMB SID snooping capability in Ethereal 0.9.15 to 0.10.4 allows remote attackers to cause a denial of service (process crash) via a handle without a policy name, which causes a null dereference. |