# CVEs published 2004-11-19 26 CVEs were published on November 19, 2004: 0 critical, 0 high. Days are UTC. - [CVE-2004-0563](https://cve.now/CVE-2004-0563.md): The tspc.conf configuration file in freenet6 before 0.9.6 and before 1.0 on Debian Linux has world readable permissions, which could allow l (no CVSS) - [CVE-2004-0564](https://cve.now/CVE-2004-0564.md): Roaring Penguin pppoe (rp-ppoe), if installed or configured to run setuid root contrary to its design, allows local users to overwrite arbit (no CVSS) - [CVE-2004-0601](https://cve.now/CVE-2004-0601.md): distcc before 2.16, when running on 64-bit platforms, does not interpret IP-based access control rules correctly, which could allow remote a (no CVSS) - [CVE-2004-0646](https://cve.now/CVE-2004-0646.md): Buffer overflow in the WriteToLog function for JRun 3.0 through 4.0 web server connectors, such as (1) mod\_jrun and (2) mod\_jrun20 for Apach (no CVSS) - [CVE-2004-0749](https://cve.now/CVE-2004-0749.md): The mod\_authz\_svn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on unreadable paths, which could (no CVSS) - [CVE-2004-0833](https://cve.now/CVE-2004-0833.md): Sendmail before 8.12.3 on Debian GNU/Linux, when using sasl and sasl-bin, uses a Sendmail configuration script with a fixed username and pas (no CVSS) - [CVE-2004-0882](https://cve.now/CVE-2004-0882.md): Buffer overflow in the QFILEPATHINFO request handler in Samba 3.0.x through 3.0.7 may allow remote attackers to execute arbitrary code via a (no CVSS) - [CVE-2004-0916](https://cve.now/CVE-2004-0916.md): Directory traversal vulnerability in cabextract before 1.1 allows remote attackers to overwrite arbitrary files via a cabinet file containin (no CVSS) - [CVE-2004-0917](https://cve.now/CVE-2004-0917.md): The default installation of Vignette Application Portal installs the diagnostic utility without authentication requirements, which allows re (no CVSS) - [CVE-2004-0930](https://cve.now/CVE-2004-0930.md): The ms\_fnmatch function in Samba 3.0.4 and 3.0.7 and possibly other versions allows remote authenticated users to cause a denial of service (no CVSS) - [CVE-2004-0932](https://cve.now/CVE-2004-0932.md): McAfee Anti-Virus Engine DATS drivers before 4398 released on Oct 13th 2004 and DATS Driver before 4397 October 6th 2004 allows remote attac (no CVSS) - [CVE-2004-0933](https://cve.now/CVE-2004-0933.md): Computer Associates (CA) InoculateIT 6.0, eTrust Antivirus r6.0 through r7.1, eTrust Antivirus for the Gateway r7.0 and r7.1, eTrust Secure (no CVSS) - [CVE-2004-0934](https://cve.now/CVE-2004-0934.md): Kaspersky 3.x to 4.x allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to (no CVSS) - [CVE-2004-0935](https://cve.now/CVE-2004-0935.md): Eset Anti-Virus before 1.020 (16th September 2004) allows remote attackers to bypass antivirus protection via a compressed file with both lo (no CVSS) - [CVE-2004-0936](https://cve.now/CVE-2004-0936.md): RAV antivirus allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, w (no CVSS) - [CVE-2004-0937](https://cve.now/CVE-2004-0937.md): Sophos Anti-Virus before 3.87.0, and Sophos Anti-Virus for Windows 95, 98, and Me before 3.88.0, allows remote attackers to bypass antivirus (no CVSS) - [CVE-2004-0939](https://cve.now/CVE-2004-0939.md): changepassword.cgi in Neoteris Instant Virtual Extranet (IVE) 3.x and 4.x, with LDAP authentication or NT domain authentication enabled, doe (no CVSS) - [CVE-2004-0941](https://cve.now/CVE-2004-0941.md): Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via mal (no CVSS) - [CVE-2004-0980](https://cve.now/CVE-2004-0980.md): Format string vulnerability in ez-ipupdate.c for ez-ipupdate 3.0.10 through 3.0.11b8, when running in daemon mode with certain service types (no CVSS) - [CVE-2004-0981](https://cve.now/CVE-2004-0981.md): Buffer overflow in the EXIF parsing routine in ImageMagick before 6.1.0 allows remote attackers to execute arbitrary code via a certain imag (no CVSS) - [CVE-2004-0982](https://cve.now/CVE-2004-0982.md): Buffer overflow in the getauthfromURL function in httpget.c in mpg123 pre0.59s and mpg123 0.59r could allow remote attackers or local users (no CVSS) - [CVE-2004-0983](https://cve.now/CVE-2004-0983.md): The CGI module in Ruby 1.6 before 1.6.8, and 1.8 before 1.8.2, allows remote attackers to cause a denial of service (infinite loop and CPU c (no CVSS) - [CVE-2004-0986](https://cve.now/CVE-2004-0986.md): Iptables before 1.2.11, under certain conditions, does not properly load the required modules at system startup, which causes the firewall r (no CVSS) - [CVE-2004-0992](https://cve.now/CVE-2004-0992.md): Format string vulnerability in the -a option (daemon mode) in Proxytunnel before 1.2.3 allows remote attackers to execute arbitrary code via (no CVSS) - [CVE-2004-1006](https://cve.now/CVE-2004-1006.md): Format string vulnerability in the log functions in dhcpd for dhcp 2.x allows remote DNS servers to execute arbitrary code via certain DNS m (no CVSS) - [CVE-2004-1037](https://cve.now/CVE-2004-1037.md): The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2004-11-19 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.