# CVEs published 2004-12-15

61 CVEs were published on December 15, 2004: 0 critical, 0 high. Days are UTC.

- [CVE-2004-0568](https://cve.now/CVE-2004-0568.md): HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a v (no CVSS)
- [CVE-2004-0571](https://cve.now/CVE-2004-0571.md): Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2004-0893](https://cve.now/CVE-2004-0893.md): The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does no (no CVSS)
- [CVE-2004-0894](https://cve.now/CVE-2004-0894.md): LSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection info (no CVSS)
- [CVE-2004-0899](https://cve.now/CVE-2004-0899.md): The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition, with DHCP logging enabled, does not properly valida (no CVSS)
- [CVE-2004-0900](https://cve.now/CVE-2004-0900.md): The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain mes (no CVSS)
- [CVE-2004-0901](https://cve.now/CVE-2004-0901.md): Microsoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows r (no CVSS)
- [CVE-2004-0914](https://cve.now/CVE-2004-0914.md): Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other packages, include (1) multiple integer overflows, (2) (no CVSS)
- [CVE-2004-0994](https://cve.now/CVE-2004-0994.md): Multiple integer overflows in xzgv 0.8 and earlier allow remote attackers to execute arbitrary code via images with large width and height v (no CVSS)
- [CVE-2004-1016](https://cve.now/CVE-2004-1016.md): The scm\_send function in the scm layer for Linux kernel 2.4.x up to 2.4.28, and 2.6.x up to 2.6.9, allows local users to cause a denial of s (no CVSS)
- [CVE-2004-1022](https://cve.now/CVE-2004-1022.md): Kerio Winroute Firewall before 6.0.7, ServerFirewall before 1.0.1, and MailServer before 6.0.5 use symmetric encryption for user passwords, (no CVSS)
- [CVE-2004-1023](https://cve.now/CVE-2004-1023.md): Kerio Winroute Firewall before 6.0.9, ServerFirewall before 1.0.1, and MailServer before 6.0.5, when installed on Windows based systems, do (no CVSS)
- [CVE-2004-1025](https://cve.now/CVE-2004-1025.md): Multiple heap-based buffer overflows in imlib 1.9.14 and earlier, which is used by gkrellm and several window managers, allow remote attacke (no CVSS)
- [CVE-2004-1137](https://cve.now/CVE-2004-1137.md): Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28, and 2.6.x to 2.6.9, allow local and remote attackers t (no CVSS)
- [CVE-2004-1147](https://cve.now/CVE-2004-1147.md): phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary c (no CVSS)
- [CVE-2004-1148](https://cve.now/CVE-2004-1148.md): phpMyAdmin before 2.6.1, when configured with UploadDir functionality, allows remote attackers to read arbitrary files via the sql\_localfile (no CVSS)
- [CVE-2004-1173](https://cve.now/CVE-2004-1173.md): Internet Explorer 6 allows remote attackers to bypass the popup blocker via the document object model (DOM) methods in the DHTML Dynamic HTM (no CVSS)
- [CVE-2004-1190](https://cve.now/CVE-2004-1190.md): SUSE Linux before 9.1 and SUSE Linux Enterprise Server before 9 do not properly check commands sent to CD devices that have been opened read (no CVSS)
- [CVE-2004-1191](https://cve.now/CVE-2004-1191.md): Race condition in SuSE Linux 8.1 through 9.2, when run on SMP systems that have more than 4GB of memory, could allow local users to read una (no CVSS)
- [CVE-2004-1192](https://cve.now/CVE-2004-1192.md): Format string vulnerability in the lprintf function in Citadel/UX 6.27 and earlier allows remote attackers to execute arbitrary code via for (no CVSS)
- [CVE-2004-1193](https://cve.now/CVE-2004-1193.md): Prevx Home 1.0 allows local users with administrator privileges to bypass the intrusion prevention features by directly writing to \\device\\p (no CVSS)
- [CVE-2004-1194](https://cve.now/CVE-2004-1194.md): Buffer overflow in Star Wars Battlefront 1.11 and earlier allows remote attackers to cause a denial of service (application crash) via a lon (no CVSS)
- [CVE-2004-1195](https://cve.now/CVE-2004-1195.md): Star Wars Battlefront 1.11 and earlier allows remote attackers to cause a denial of service (application crash) via a join request that cont (no CVSS)
- [CVE-2004-1196](https://cve.now/CVE-2004-1196.md): Cross-site scripting (XSS) vulnerability in inmail.pl in Insite Inmail allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2004-1197](https://cve.now/CVE-2004-1197.md): Cross-site scripting (XSS) vulnerability in inshop.pl in Insite inShop allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2004-1198](https://cve.now/CVE-2004-1198.md): Microsoft Internet Explorer allows remote attackers to cause a denial of service (application crash from memory consumption), as demonstrate (no CVSS)
- [CVE-2004-1199](https://cve.now/CVE-2004-1199.md): Safari 1.2.4 on Mac OS X 10.3.6 allows remote attackers to cause a denial of service (application crash from memory exhaustion), as demonstr (no CVSS)
- [CVE-2004-1200](https://cve.now/CVE-2004-1200.md): Firefox and Mozilla allow remote attackers to cause a denial of service (application crash from memory consumption), as demonstrated using J (no CVSS)
- [CVE-2004-1201](https://cve.now/CVE-2004-1201.md): Opera 7.54 allows remote attackers to cause a denial of service (application crash from memory exhaustion), as demonstrated using Javascript (no CVSS)
- [CVE-2004-1202](https://cve.now/CVE-2004-1202.md): Cross-site scripting (XSS) vulnerability in parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote (no CVSS)
- [CVE-2004-1203](https://cve.now/CVE-2004-1203.md): parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to gain sensitive information via (no CVSS)
- [CVE-2004-1204](https://cve.now/CVE-2004-1204.md): FluxBox 0.9.10 and earlier versions allows local users to cause a denial of service (application crash) by calling Xman with a long -title v (no CVSS)
- [CVE-2004-1205](https://cve.now/CVE-2004-1205.md): codebrowserpntm.php in PnTresMailer 6.03 allows remote attackers to gain sensitive information via an invalid filetohighlight parameter, whi (no CVSS)
- [CVE-2004-1206](https://cve.now/CVE-2004-1206.md): Directory traversal vulnerability in codebrowserpntm.php in pnTresMailer 6.0.3 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2004-1207](https://cve.now/CVE-2004-1207.md): The Serious engine, as used in (1) Alpha Black Zero Intrepid Protocol 1.04 and earlier, (2) Nitro family, and (3) Serious Sam Second Encount (no CVSS)
- [CVE-2004-1208](https://cve.now/CVE-2004-1208.md): Buffer overflow in Orbz 2.10 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbit (no CVSS)
- [CVE-2004-1209](https://cve.now/CVE-2004-1209.md): Verisign Payflow Link, when running with empty Accepted URL fields, does not properly verify the data in the hidden AMOUNT field, which allo (no CVSS)
- [CVE-2004-1210](https://cve.now/CVE-2004-1210.md): Cross-site scripting (XSS) vulnerability in proxylog.dat in IPCop 1.4.1 and possibly other versions, allows remote attackers to inject arbit (no CVSS)
- [CVE-2004-1211](https://cve.now/CVE-2004-1211.md): Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (application (no CVSS)
- [CVE-2004-1212](https://cve.now/CVE-2004-1212.md): Directory traversal vulnerability in btdownload.php in Blog Torrent preview 0.8 allows remote attackers to download arbitrary files via a .. (no CVSS)
- [CVE-2004-1213](https://cve.now/CVE-2004-1213.md): Cross-site scripting (XSS) vulnerability in index.php in Advanced Guestbook 2.3.1, 2.2, and possibly other versions allows remote attackers (no CVSS)
- [CVE-2004-1214](https://cve.now/CVE-2004-1214.md): Format string vulnerability in Kreed 1.05 and earlier allows remote attackers to execute arbitrary code via format specifiers in (1) a nickn (no CVSS)
- [CVE-2004-1215](https://cve.now/CVE-2004-1215.md): Kreed 1.05 and earlier allows remote attackers to cause a denial of service (server disconnect) via a long UDP packet, which causes a "messa (no CVSS)
- [CVE-2004-1216](https://cve.now/CVE-2004-1216.md): The scripts that handle players in Kreed 1.05 and earlier allow remote attackers to cause a denial of service (server freeze) via a long (1) (no CVSS)
- [CVE-2004-1217](https://cve.now/CVE-2004-1217.md): Hosting Controller 6.1 Hotfix 1.4, and possibly other versions, allows remote attackers to view arbitrary directories by specifying the targ (no CVSS)
- [CVE-2004-1218](https://cve.now/CVE-2004-1218.md): Remote Execute 2.30 allows remote attackers to cause a denial of service (application crash) by making 7 simultaneous connections. (no CVSS)
- [CVE-2004-1219](https://cve.now/CVE-2004-1219.md): paFileDB 3.1, when using sessions authentication and while the administrator logs on, allows remote attackers to read the administrator's pa (no CVSS)
- [CVE-2004-1220](https://cve.now/CVE-2004-1220.md): Battlefield 1942 1.6.19 and earlier, and Battlefield Vietnam 1.2 and earlier, allows a remote master server to cause a denial of service (cl (no CVSS)
- [CVE-2004-1221](https://cve.now/CVE-2004-1221.md): Directory traversal vulnerability in weblibs.pl in WebLibs 1.0 allows remote attackers to read arbitrary files via .. (no CVSS)
- [CVE-2004-1222](https://cve.now/CVE-2004-1222.md): weblibs.pl in WebLibs 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the TextFile parameter. (no CVSS)
- [CVE-2004-1223](https://cve.now/CVE-2004-1223.md): The Management Agent in F-Secure Policy Manager 5.11.2810 allows remote attackers to gain sensitive information, such as the absolute path f (no CVSS)
- [CVE-2004-1224](https://cve.now/CVE-2004-1224.md): Off-by-one error in the mtr\_curses\_keyaction function for mtr 0.55 through 0.65 allows local users to hijack raw sockets, as demonstrated us (no CVSS)
- [CVE-2004-1225](https://cve.now/CVE-2004-1225.md): SQL injection vulnerability in SugarCRM Sugar Sales before 2.0.1a allows remote attackers to execute arbitrary SQL commands and gain privile (no CVSS)
- [CVE-2004-1226](https://cve.now/CVE-2004-1226.md): SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to gain sensitive information via certain requests to scripts that contain i (no CVSS)
- [CVE-2004-1227](https://cve.now/CVE-2004-1227.md): Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to read arbitrary files and possibly ex (no CVSS)
- [CVE-2004-1228](https://cve.now/CVE-2004-1228.md): The install scripts in SugarCRM Sugar Sales 2.0.1c and earlier are not removed after installation, which allows attackers to obtain the MySQ (no CVSS)
- [CVE-2004-1229](https://cve.now/CVE-2004-1229.md): Cross-site scripting vulnerability in the parser for Gadu-Gadu allows remote attackers to inject arbitrary web script or HTML via (1) http:/ (no CVSS)
- [CVE-2004-1230](https://cve.now/CVE-2004-1230.md): Gadu-Gadu allows remote attackers to gain sensitive information and read files from the \_cache directory of other users via a DCC connection (no CVSS)
- [CVE-2004-1231](https://cve.now/CVE-2004-1231.md): Directory traversal vulnerability in Gadu-Gadu allows remote attackers to read arbitrary files via .. (no CVSS)
- [CVE-2004-1232](https://cve.now/CVE-2004-1232.md): Stack-based buffer overflow in the code that sends images in Gadu-Gadu allows remote attackers to execute arbitrary code via a large image f (no CVSS)
- [CVE-2004-1233](https://cve.now/CVE-2004-1233.md): Integer overflow in Gadu-Gadu allows remote attackers to cause a denial of service (disk consumption) via a user packet to the DCC file tran (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2004-12-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.