# CVEs published 2005-02-13

74 CVEs were published on February 13, 2005: 0 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2003-1083](https://cve.now/CVE-2003-1083.md): Stack-based buffer overflow in Monit 1.4 to 4.1 allows remote attackers to execute arbitrary code via a long HTTP request. (no CVSS)
- [CVE-2003-1084](https://cve.now/CVE-2003-1084.md): Monit 1.4 to 4.1 allows remote attackers to cause a denial of service (daemon crash) via an HTTP POST request with a negative Content-Length (no CVSS)
- [CVE-2004-0851](https://cve.now/CVE-2004-0851.md): The (1) write\_list and (2) dump\_curr\_list functions in Net-Acct before 0.71 allows local users to overwrite arbitrary files via a symlink at (no CVSS)
- [CVE-2004-0866](https://cve.now/CVE-2004-0866.md): Internet Explorer 6.0 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk, and .sch.uk, which c (no CVSS)
- [CVE-2004-0869](https://cve.now/CVE-2004-0869.md): Internet Explorer does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/S (no CVSS)
- [CVE-2004-0870](https://cve.now/CVE-2004-0870.md): KDE Konqueror does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) (no CVSS)
- [CVE-2004-0871](https://cve.now/CVE-2004-0871.md): Mozilla does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the (no CVSS)
- [CVE-2004-0872](https://cve.now/CVE-2004-0872.md): Opera does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the s (no CVSS)
- [CVE-2004-0919](https://cve.now/CVE-2004-0919.md): The syscons CONS\_SCRSHOT ioctl in FreeBSD 5.x allows local users to read arbitrary kernel memory via (1) negative coordinates or (2) large c (no CVSS)
- [CVE-2004-1432](https://cve.now/CVE-2004-1432.md): Multiple versions of Cisco ONS 15327, ONS 15454, and ONS 15454 SDH, including 4.6(0) and 4.6(1), 4.5(x), 4.1(0) to 4.1(3), 4.0(0) to 4.0(2), (no CVSS)
- [CVE-2004-1433](https://cve.now/CVE-2004-1433.md): Multiple versions of Cisco ONS 15327, ONS 15454, and ONS 15454 SDH, including 4.6(0) and 4.6(1), 4.5(x), 4.1(0) to 4.1(3), 4.0(0) to 4.0(2), (no CVSS)
- [CVE-2004-1434](https://cve.now/CVE-2004-1434.md): Multiple versions of Cisco ONS 15327, ONS 15454, and ONS 15454 SDH, including 4.1(0) to 4.1(2), 4.5(x), 4.0(0) to 4.0(2), and earlier versio (no CVSS)
- [CVE-2004-1435](https://cve.now/CVE-2004-1435.md): Multiple versions of Cisco ONS 15327, ONS 15454, and ONS 15454 SDH, including 4.6(0) and 4.6(1), 4.5(x), 4.1(0) to 4.1(3), 4.0(0) to 4.0(2), (no CVSS)
- [CVE-2004-1436](https://cve.now/CVE-2004-1436.md): The Transaction Language 1 (TL1) login interface in Cisco ONS 15327 4.6(0) and 4.6(1) and 15454 and 15454 SDH 4.6(0) and 4.6(1), when a user (no CVSS)
- [CVE-2004-1437](https://cve.now/CVE-2004-1437.md): Multiple buffer overflows in the digest authentication functionality in Pavuk 0.9.28-r2 and earlier allow remote attackers to execute arbitr (no CVSS)
- [CVE-2004-1438](https://cve.now/CVE-2004-1438.md): The mod\_authz\_svn Apache module for Subversion 1.0.4-r1 and earlier allows remote authenticated users, with write access to the repository, (no CVSS)
- [CVE-2004-1439](https://cve.now/CVE-2004-1439.md): Buffer overflow in BlackJumboDog 3.x allows remote attackers to execute arbitrary code via long FTP commands such as (1) USER, (2) PASS, (3) (no CVSS)
- [CVE-2004-1440](https://cve.now/CVE-2004-1440.md): Multiple heap-based buffer overflows in the modpow function in PuTTY before 0.55 allow (1) remote attackers to execute arbitrary code via an (no CVSS)
- [CVE-2004-1441](https://cve.now/CVE-2004-1441.md): Cross-site scripting (XSS) vulnerability in icq.cgi in Board Power 2.04PF allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2004-1442](https://cve.now/CVE-2004-1442.md): Cross-site scripting (XSS) vulnerability in db2www CGI interpreter in IBM Net.Data 7 and 7.2 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2004-1443](https://cve.now/CVE-2004-1443.md): Cross-site scripting (XSS) vulnerability in the inline MIME viewer in Horde-IMP (Internet Messaging Program) 3.2.4 and earlier, when used wi (no CVSS)
- [CVE-2004-1444](https://cve.now/CVE-2004-1444.md): Directory traversal vulnerability in Roundup 0.6.4 and earlier allows remote attackers to view arbitrary files via .. (no CVSS, roundup)
- [CVE-2004-1445](https://cve.now/CVE-2004-1445.md): A race condition in nessus-adduser in Nessus 2.0.11 and possibly earlier versions, if the TMPDIR environment variable is not set, allows loc (no CVSS)
- [CVE-2004-1446](https://cve.now/CVE-2004-1446.md): Unknown vulnerability in ScreenOS in Juniper Networks NetScreen firewall 3.x through 5.x allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2004-1447](https://cve.now/CVE-2004-1447.md): Jetbox One 2.0.8 and possibly other versions stores passwords in the database in plaintext, which could allow attackers to gain sensitive in (no CVSS)
- [CVE-2004-1448](https://cve.now/CVE-2004-1448.md): Jetbox One 2.0.8 and possibly other versions allow remote attackers with Author privileges in the IMAGES module to upload PHP files and exec (no CVSS)
- [CVE-2004-1449](https://cve.now/CVE-2004-1449.md): Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7 allows remote attackers to determine the location of files on a user's ha (no CVSS)
- [CVE-2004-1450](https://cve.now/CVE-2004-1450.md): Unknown vulnerability in LiveConnect in Mozilla 1.7 beta allows remote attackers to read arbitrary files in known locations. (no CVSS)
- [CVE-2004-1451](https://cve.now/CVE-2004-1451.md): Mozilla before 1.6 does not display the entire URL in the status bar when a link contains %00, which could allow remote attackers to trick u (no CVSS)
- [CVE-2004-1452](https://cve.now/CVE-2004-1452.md): Tomcat before 5.0.27-r3 in Gentoo Linux sets the default permissions on the init scripts as tomcat:tomcat, but executes the scripts with roo (no CVSS)
- [CVE-2004-1453](https://cve.now/CVE-2004-1453.md): GNU glibc 2.3.4 before 2.3.4.20040619, 2.3.3 before 2.3.3.20040420, and 2.3.2 before 2.3.2-r10 does not restrict the use of LD\_DEBUG for a s (no CVSS)
- [CVE-2004-1454](https://cve.now/CVE-2004-1454.md): Cisco IOS 12.0S, 12.2, and 12.3, with Open Shortest Path First (OSPF) enabled, allows remote attackers to cause a denial of service (device (no CVSS)
- [CVE-2004-1455](https://cve.now/CVE-2004-1455.md): Stack-based buffer overflow in Xine-lib-rc5 in xine-lib 1\_rc5-r2 and earlier allows remote attackers to execute arbitrary code via crafted p (no CVSS)
- [CVE-2004-1456](https://cve.now/CVE-2004-1456.md): filediff in CVStrac allows remote attackers to execute arbitrary commands via shell metacharacters in rcsinfo. (no CVSS)
- [CVE-2004-1457](https://cve.now/CVE-2004-1457.md): The Virtual Private Network (VPN) capability in Novell Bordermanager 3.8 allows remote attackers to cause a denial of service (ABEND in IKE. (no CVSS)
- [CVE-2004-1458](https://cve.now/CVE-2004-1458.md): The CSAdmin web administration interface for Cisco Secure Access Control Server (ACS) 3.2(2) build 15 allows remote attackers to cause a den (no CVSS)
- [CVE-2004-1459](https://cve.now/CVE-2004-1459.md): Cisco Secure Access Control Server (ACS) 3.2, when configured as a Light Extensible Authentication Protocol (LEAP) RADIUS proxy, allows remo (no CVSS)
- [CVE-2004-1460](https://cve.now/CVE-2004-1460.md): Cisco Secure Access Control Server (ACS) 3.2(3) and earlier, when configured with an anonymous bind in Novell Directory Services (NDS) and a (no CVSS)
- [CVE-2004-1461](https://cve.now/CVE-2004-1461.md): Cisco Secure Access Control Server (ACS) 3.2(3) and earlier spawns a separate unauthenticated TCP connection on a random port when a user au (no CVSS)
- [CVE-2004-1462](https://cve.now/CVE-2004-1462.md): Unknown vulnerability in MoinMoin 1.2.2 and earlier allows remote attackers to gain unauthorized access to administrator functions such as ( (no CVSS, moin)
- [CVE-2004-1463](https://cve.now/CVE-2004-1463.md): Unknown vulnerability in the PageEditor in MoinMoin 1.2.2 and earlier, related to Access Control Lists (ACL), has unknown impact. (no CVSS, moin)
- [CVE-2004-1464](https://cve.now/CVE-2004-1464.md): Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a craf (CVSS 5.9, KEV)
- [CVE-2004-1465](https://cve.now/CVE-2004-1465.md): Multiple buffer overflows in WinZip 9.0 and earlier may allow attackers to execute arbitrary code via multiple vectors, including the comman (no CVSS)
- [CVE-2004-1466](https://cve.now/CVE-2004-1466.md): The set\_time\_limit function in Gallery before 1.4.4\_p2 deletes non-image files in a temporary directory every 30 seconds after they have bee (no CVSS)
- [CVE-2004-1467](https://cve.now/CVE-2004-1467.md): Multiple cross-site scripting (XSS) vulnerabilities in eGroupWare 1.0.00.003 and earlier allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2004-1468](https://cve.now/CVE-2004-1468.md): The web mail functionality in Usermin 1.x and Webmin 1.x allows remote attackers to execute arbitrary commands via shell metacharacters in a (no CVSS)
- [CVE-2004-1469](https://cve.now/CVE-2004-1469.md): Format string vulnerability in the log function in SUS 2.0.2, and other versions before 2.0.6, allows local users to execute arbitrary code (no CVSS)
- [CVE-2004-1470](https://cve.now/CVE-2004-1470.md): CRLF injection vulnerability in SnipSnap 0.5.2a, and other versions before 1.0b1, allows remote attackers to perform HTTP Response Splitting (no CVSS)
- [CVE-2004-1471](https://cve.now/CVE-2004-1471.md): Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commi (no CVSS)
- [CVE-2004-1472](https://cve.now/CVE-2004-1472.md): Symantec Enterprise Firewall/VPN Appliances 100, 200, and 200R running firmware before 1.63 allow remote attackers to cause a denial of serv (no CVSS)
- [CVE-2004-1473](https://cve.now/CVE-2004-1473.md): Symantec Enterprise Firewall/VPN Appliances 100, 200, and 200R running firmware before 1.63 and Gateway Security 320, 360, and 360R running (no CVSS)
- [CVE-2004-1474](https://cve.now/CVE-2004-1474.md): Symantec Enterprise Firewall/VPN Appliances 100, 200, and 200R running firmware before 1.63 and Gateway Security 320, 360, and 360R running (no CVSS)
- [CVE-2004-1475](https://cve.now/CVE-2004-1475.md): Multiple stack-based buffer overflows in xine-lib 1-rc2 through 1-rc5 allow attackers to execute arbitrary code via (1) long VideoCD vcd:// (no CVSS)
- [CVE-2004-1476](https://cve.now/CVE-2004-1476.md): Stack-based buffer overflow in the VideoCD (VCD) code in xine-lib 1-rc2 through 1-rc5, as derived from libcdio, allows attackers to execute (no CVSS)
- [CVE-2004-1477](https://cve.now/CVE-2004-1477.md): Cross-site scripting (XSS) vulnerability in the Management Console in JRun 4.0 allows remote attackers to execute arbitrary web script or HT (no CVSS)
- [CVE-2004-1478](https://cve.now/CVE-2004-1478.md): JRun 4.0 does not properly generate and handle the JSESSIONID, which allows remote attackers to perform a session fixation attack and hijack (no CVSS)
- [CVE-2004-1480](https://cve.now/CVE-2004-1480.md): Unknown vulnerability in the management station in HP StorageWorks Command View XP 1.8B and earlier allows remote attackers to bypass access (no CVSS)
- [CVE-2004-1481](https://cve.now/CVE-2004-1481.md): Integer overflow in pnen3260.dll in RealPlayer 8 through 10.5 (6.0.12.1040) and earlier, and RealOne Player 1 or 2 on Windows or Mac OS, all (no CVSS)
- [CVE-2004-1482](https://cve.now/CVE-2004-1482.md): The sbuf\_getmsg function in BNC incorrectly handles backspace characters, which could allow remote attackers to bypass authentication and ga (no CVSS)
- [CVE-2004-1483](https://cve.now/CVE-2004-1483.md): Multiple unknown vulnerabilities in the ActiveX and HTML file browsers in Symantec Clientless VPN Gateway 4400 Series 5.0 have unknown attac (no CVSS)
- [CVE-2004-1484](https://cve.now/CVE-2004-1484.md): Format string vulnerability in the \_msg function in error.c in socat 1.4.0.3 and earlier, when used as an HTTP proxy client and run with the (no CVSS)
- [CVE-2004-1485](https://cve.now/CVE-2004-1485.md): Buffer overflow in the TFTP client in InetUtils 1.4.2 allows remote malicious DNS servers to execute arbitrary code via a large DNS response (no CVSS)
- [CVE-2004-1486](https://cve.now/CVE-2004-1486.md): Unknown vulnerability in Serviceguard A.11.13 through A.11.16.00 and Cluster Object Manager A.01.03 and B.01.04 through B.03.00.01 on HP-UX, (no CVSS)
- [CVE-2005-0373](https://cve.now/CVE-2005-0373.md): Buffer overflow in digestmd5.c CVS release 1.170 (also referred to as digestmda5.c), as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL bu (no CVSS)
- [CVE-2005-0374](https://cve.now/CVE-2005-0374.md): Cross-site scripting (XSS) vulnerability in Bitboard 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via an \[ (no CVSS)
- [CVE-2005-0375](https://cve.now/CVE-2005-0375.md): imageview.php in SGallery 1.01 allows remote attackers to obtain sensitive information via an HTTP request with (1) idalbum and (2) idimage (no CVSS)
- [CVE-2005-0376](https://cve.now/CVE-2005-0376.md): PHP remote file inclusion vulnerability in SGallery 1.01 allows local and possibly remote attackers to execute arbitrary PHP code by modifyi (no CVSS)
- [CVE-2005-0377](https://cve.now/CVE-2005-0377.md): SQL injection vulnerability in imageview.php for SGallery 1.01 allows remote attackers to execute arbitrary SQL commands via the (1) idalbum (no CVSS)
- [CVE-2005-0378](https://cve.now/CVE-2005-0378.md): Multiple cross-site scripting (XSS) vulnerabilities in Horde 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) g (no CVSS)
- [CVE-2005-0379](https://cve.now/CVE-2005-0379.md): Multiple directory traversal vulnerabilities in ZeroBoard 4.1pl5 and earlier allow remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2005-0380](https://cve.now/CVE-2005-0380.md): Multiple PHP remote file inclusion vulnerabilities in (1) print\_category.php, (2) login.php, (3) setup.php, (4) ask\_password.php, or (5) err (no CVSS)
- [CVE-2005-0381](https://cve.now/CVE-2005-0381.md): Cross-site scripting (XSS) vulnerability in f.aspx in forumKIT 1.0 allows remote attackers to inject arbitrary web script or HTML via the me (no CVSS)
- [CVE-2005-0382](https://cve.now/CVE-2005-0382.md): Breed patch 1 and earlier allows remote attackers to cause a denial of service (application crash) via an empty UDP packet, which triggers a (no CVSS)
- [CVE-2005-0383](https://cve.now/CVE-2005-0383.md): Trend Micro Control Manager 3.0 Enterprise Edition allows remote attackers to gain privileges via a replay attack of the encrypted username (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-02-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.