# CVEs published 2004-07-13

39 CVEs were published on July 13, 2004: 0 critical, 0 high. Days are UTC.

- [CVE-2004-0645](https://cve.now/CVE-2004-0645.md): Buffer overflow in the wvHandleDateTimePicture function in wv library (wvWare) 0.7.4 through 0.7.6 and 1.0.0 allows remote attackers to exec (no CVSS)
- [CVE-2004-0647](https://cve.now/CVE-2004-0647.md): shorewall 1.4.10c and earlier, and 2.0.x before 2.0.3a, allows local users to overwrite arbitrary files via a symlink attack on the chains-$ (no CVSS)
- [CVE-2004-0648](https://cve.now/CVE-2004-0648.md): Mozilla (Suite) before 1.7.1, Firefox before 0.9.2, and Thunderbird before 0.7.2 allow remote attackers to launch arbitrary programs via a U (no CVSS)
- [CVE-2004-0649](https://cve.now/CVE-2004-0649.md): Buffer overflow in write\_packet in control.c for l2tpd may allow remote attackers to execute arbitrary code. (no CVSS)
- [CVE-2004-0650](https://cve.now/CVE-2004-0650.md): UploadServlet in Cisco Collaboration Server (CCS) running ServletExec before 3.0E allows remote attackers to upload and execute arbitrary fi (no CVSS)
- [CVE-2004-0651](https://cve.now/CVE-2004-0651.md): Unknown vulnerability in Sun Java Runtime Environment (JRE) 1.4.2 through 1.4.2\_03 allows remote attackers to cause a denial of service (vir (no CVSS)
- [CVE-2004-0652](https://cve.now/CVE-2004-0652.md): BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the (no CVSS)
- [CVE-2004-0653](https://cve.now/CVE-2004-0653.md): Solaris 9, when configured as a Kerberos client with patch 112908-12 or 115168-03 and using pam\_krb5 as an "auth" module with the debug feat (no CVSS)
- [CVE-2004-0654](https://cve.now/CVE-2004-0654.md): Unknown vulnerability in the Basic Security Module (BSM), when configured to audit either the Administrative (ad) or the System-Wide Adminis (no CVSS)
- [CVE-2004-0655](https://cve.now/CVE-2004-0655.md): eupdatedb in esearch 0.6.1 and earlier allows local users to create arbitrary files via a symlink attack on the esearchdb.py.tmp temporary f (no CVSS)
- [CVE-2004-0656](https://cve.now/CVE-2004-0656.md): The accept\_client function in PureFTPd 1.0.18 and earlier allows remote attackers to cause a denial of service by exceeding the maximum numb (no CVSS)
- [CVE-2004-0657](https://cve.now/CVE-2004-0657.md): Integer overflow in the NTP daemon (NTPd) before 4.0 causes the NTP server to return the wrong date/time offset when a client requests a dat (no CVSS)
- [CVE-2004-0658](https://cve.now/CVE-2004-0658.md): Integer overflow in the hpsb\_alloc\_packet function (incorrectly reported as alloc\_hpsb\_packet) in IEEE 1394 (Firewire) driver 2.4 and 2.6 al (no CVSS)
- [CVE-2004-0659](https://cve.now/CVE-2004-0659.md): Buffer overflow in TranslateFilename for common.c in MPlayer 1.0pre4 allows remote attackers to execute arbitrary code via a long file name. (no CVSS)
- [CVE-2004-0660](https://cve.now/CVE-2004-0660.md): Cross-site scripting (XSS) vulnerability in (1) show\_archives.php, (2) show\_news.php, and possibly other php files in CuteNews 1.3.1 allows (no CVSS)
- [CVE-2004-0661](https://cve.now/CVE-2004-0661.md): Integer signedness error in D-Link AirPlus DI-614+ running firmware 2.30 and earlier allows remote attackers to cause a denial of service (I (no CVSS)
- [CVE-2004-0662](https://cve.now/CVE-2004-0662.md): PowerPortal 1.x allows remote attackers to gain sensitive information via invalid or missing parameters in HTTP requests to (1) resize.php o (no CVSS)
- [CVE-2004-0663](https://cve.now/CVE-2004-0663.md): Cross-site scripting (XSS) vulnerability in modules.php in PowerPortal 1.x allows remote attackers to inject arbitrary script or HTML via th (no CVSS)
- [CVE-2004-0664](https://cve.now/CVE-2004-0664.md): Directory traversal vulnerability in modules.php in PowerPortal 1.x allows remote attackers to list arbitrary directories via a .. (no CVSS)
- [CVE-2004-0665](https://cve.now/CVE-2004-0665.md): csFAQ.cgi in csFAQ allows remote attackers to gain sensitive information via an invalid database parameter, which reveals the path to the we (no CVSS)
- [CVE-2004-0666](https://cve.now/CVE-2004-0666.md): Off-by-one error in the POP3\_readmsg function in popclient 3.0b6 allows remote attackers to cause a denial of service (application crash) vi (no CVSS)
- [CVE-2004-0667](https://cve.now/CVE-2004-0667.md): Rule Set Based Access Control (RSBAC) 1.2.2 through 1.2.3 allows access to sys\_creat, sys\_open, and sys\_mknod inside jails, which could allo (no CVSS)
- [CVE-2004-0668](https://cve.now/CVE-2004-0668.md): Web Access in Lotus Domino 6.5.1 allows remote attackers to cause a denial of service (server crash) via a large e-mail message, as demonstr (no CVSS)
- [CVE-2004-0669](https://cve.now/CVE-2004-0669.md): Lotus Domino 6.5.0 and 6.5.1, with IMAP enabled, allows remote authenticated users to change their quota by using the IMAP setquota command. (no CVSS)
- [CVE-2004-0670](https://cve.now/CVE-2004-0670.md): Prestige 650HW-31 running Rompager 4.7 software allows remote attackers to cause a denial of service (device reboot) via a long password. (no CVSS)
- [CVE-2004-0671](https://cve.now/CVE-2004-0671.md): Brightmail Spamfilter 6.0 and earlier beta releases allows remote attackers to read mail from other users by modifying the id parameter in a (no CVSS)
- [CVE-2004-0672](https://cve.now/CVE-2004-0672.md): Multiple cross-site scripting (XSS) vulnerabilities in the primary and management web interfaces in Netegrity IdentityMinder Web Edition 5.6 (no CVSS)
- [CVE-2004-0673](https://cve.now/CVE-2004-0673.md): Cross-site scripting (XSS) vulnerability in SCI Photo Chat Server 3.4.9 allows remote attackers to execute arbitrary web script as other use (no CVSS)
- [CVE-2004-0674](https://cve.now/CVE-2004-0674.md): Enterasys XSR-1800 series Security Routers, when running firmware 7.0.0.0 and using Policy-Based Routing, allow remote attackers to cause a (no CVSS)
- [CVE-2004-0675](https://cve.now/CVE-2004-0675.md): Cross-site scripting (XSS) vulnerability in (1) cart32.exe or (2) c32web.exe in Cart32 shopping cart allows remote attackers to execute arbi (no CVSS)
- [CVE-2004-0676](https://cve.now/CVE-2004-0676.md): Directory traversal vulnerability in Fastream NETFile FTP/Web Server 6.7.2.1085 and earlier allows remote attackers to create or delete arbi (no CVSS)
- [CVE-2004-0677](https://cve.now/CVE-2004-0677.md): Fastream NETFile FTP Server 6.7.2.1085 and earlier allows remote attackers to cause a denial of service (temporary hang) via the cd command (no CVSS)
- [CVE-2004-0678](https://cve.now/CVE-2004-0678.md): Cross-site scripting (XSS) in one2planet.infolet.InfoServlet in 12Planet Chat Server 2.9 allows remote attackers to execute arbitrary script (no CVSS)
- [CVE-2004-0679](https://cve.now/CVE-2004-0679.md): The IP cloaking feature (cloak.c) in UnrealIRCd 3.2, and possibly other versions, uses a weak hashing scheme to hide IP addresses, which cou (no CVSS)
- [CVE-2004-0680](https://cve.now/CVE-2004-0680.md): Zoom X3 ADSL modem has a terminal running on port 254 that can be accessed using the default HTML management password, even if the password (no CVSS)
- [CVE-2004-0681](https://cve.now/CVE-2004-0681.md): Multiple cross-site scripting (XSS) vulnerabilities in (1) comersus\_customerAuthenticateForm.asp, (2) comersus\_backoffice\_message.asp, (3) c (no CVSS)
- [CVE-2004-0682](https://cve.now/CVE-2004-0682.md): comersus\_gatewayPayPal.asp in Comersus Cart 5.09, and possibly other versions before 5.098, allows remote attackers to change the prices of (no CVSS)
- [CVE-2004-0683](https://cve.now/CVE-2004-0683.md): Symantec Norton AntiVirus 2002 and 2003 allows remote attackers to cause a denial of service (CPU consumption) via a compressed archive that (no CVSS)
- [CVE-2004-0684](https://cve.now/CVE-2004-0684.md): WebSphere Edge Component Caching Proxy in WebSphere Edge Server 5.02, with the JunctionRewrite directive enabled, allows remote attackers to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2004-07-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.