CVE,CVSS Score,EPSS,Description,Published,Source CVE-1999-0103,0.0,0.87549,"Echo and chargen, or other combinations of UDP services, can be used in tandem to flood the server, a.k.a. UDP bomb or UDP packet storm.",1996-02-08 05:00:00.000,Metasploit CVE-1999-0170,0.0,0.00727,"Remote attackers can mount an NFS file system in Ultrix or OSF, even if it is denied on the access list.",1997-01-01 05:00:00.000,Metasploit CVE-1999-0191,0.0,0.96782,IIS newdsn.exe CGI script allows remote users to overwrite files.,1997-09-01 04:00:00.000,EPSS CVE-1999-0209,0.0,0.55777,The SunView (SunTools) selection_svc facility allows remote users to read files.,1990-08-14 04:00:00.000,Metasploit CVE-1999-0256,0.0,0.96207,Buffer overflow in War FTP allows remote execution of commands.,1998-02-01 05:00:00.000,EPSS CVE-1999-0526,0.0,0.80735,"An X server's access control is disabled (e.g. through an ""xhost +"" command) and allows anyone to connect to the server.",1997-07-01 04:00:00.000,Metasploit CVE-1999-0531,0.0,0.03276,"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE). Notes: the former description is: ""An SMTP service supports EXPN, VRFY, HELP, ESMTP, and/or EHLO.",1999-01-01 05:00:00.000,Metasploit CVE-1999-0532,0.0,0.97542,A DNS server allows zone transfers.,1997-07-01 04:00:00.000,EPSS/Metasploit CVE-1999-0554,0.0,0.015,"NFS exports system-critical data to the world, e.g. / or a password file.",1999-01-01 05:00:00.000,Metasploit CVE-1999-0612,0.0,0.96044,A version of finger is running that exposes valid user information to any entity on the network.,1997-03-01 05:00:00.000,EPSS CVE-1999-0667,0.0,0.0069,The ARP protocol allows any host to spoof ARP replies and poison the ARP cache to conduct IP address spoofing or a denial of service.,1997-09-19 04:00:00.000,Metasploit CVE-1999-0874,0.0,0.90742,"Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions.",1999-06-16 04:00:00.000,Metasploit CVE-1999-1011,0.0,0.68331,"The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attackers to execute arbitrary commands.",1999-07-19 04:00:00.000,Metasploit CVE-1999-1053,0.0,0.94363,"guestbook.pl cleanses user-inserted SSI commands by removing text between """" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides ""-->"".",1999-09-13 04:00:00.000,Metasploit CVE-1999-1105,0.0,0.96655,"Windows 95, when Remote Administration and File Sharing for NetWare Networks is enabled, creates a share (C$) when an administrator logs in remotely, which allows remote attackers to read arbitrary files by mapping the network drive.",1999-12-31 05:00:00.000,EPSS CVE-1999-1510,0.0,0.94463,"Buffer overflows in Bisonware FTP server prior to 4.1 allow remote attackers to cause a denial of service, and possibly execute arbitrary commands, via long (1) USER, (2) LIST, or (3) CWD commands.",1999-05-17 04:00:00.000,Metasploit CVE-2000-0098,0.0,0.96377,Microsoft Index Server allows remote attackers to determine the real path for a web directory via a request to an Internet Data Query file that does not exist.,2000-01-26 05:00:00.000,EPSS CVE-2000-0114,0.0,0.15958,Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /_vti_bin/ virtual directory.,2000-02-02 05:00:00.000,Nuclei CVE-2000-0126,0.0,0.95606,Sample Internet Data Query (IDQ) scripts in IIS 3 and 4 allow remote attackers to read files via a .. (dot dot) attack.,2000-01-26 05:00:00.000,EPSS CVE-2000-0246,0.0,0.95864,"IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the ""Virtualized UNC Share"" vulnerability.",2000-03-30 05:00:00.000,EPSS CVE-2000-0248,0.0,0.0133,The web GUI for the Linux Virtual Server (LVS) software in the Red Hat Linux Piranha package has a backdoor password that allows remote attackers to execute arbitrary commands.,2000-04-24 04:00:00.000,Metasploit CVE-2000-0284,0.0,0.92336,Buffer overflow in University of Washington imapd version 4.7 allows users with a valid account to execute commands via LIST or other commands.,2000-04-16 04:00:00.000,Metasploit CVE-2000-0302,0.0,0.96678,Microsoft Index Server allows remote attackers to view the source code of ASP files by appending a %20 to the filename in the CiWebHitsFile argument to the null.htw URL.,2000-03-31 05:00:00.000,EPSS CVE-2000-0322,0.0,0.23672,The passwd.php3 CGI script in the Red Hat Piranha Virtual Server Package allows local users to execute arbitrary commands via shell metacharacters.,2000-04-24 04:00:00.000,Metasploit CVE-2000-0380,0.0,0.95969,The IOS HTTP service in Cisco routers and switches running IOS 11.1 through 12.1 allows remote attackers to cause a denial of service by requesting a URL that contains a %% string.,2000-04-26 04:00:00.000,EPSS/Metasploit CVE-2000-0573,0.0,0.96953,"The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitrary commands via the SITE EXEC command.",2000-07-07 04:00:00.000,EPSS/Metasploit CVE-2000-0649,0.0,0.0036,IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.,2000-07-13 04:00:00.000,Metasploit CVE-2000-0665,0.0,0.24928,GAMSoft TelSrv telnet server 1.5 and earlier allows remote attackers to cause a denial of service via a long username.,2000-07-17 04:00:00.000,Metasploit CVE-2000-0709,0.0,0.96423,The shtml.exe component of Microsoft FrontPage 2000 Server Extensions 1.1 allows remote attackers to cause a denial of service in some components by requesting a URL whose name includes a standard DOS device name.,2000-10-20 04:00:00.000,EPSS CVE-2000-0710,0.0,0.96506,The shtml.exe component of Microsoft FrontPage 2000 Server Extensions 1.1 allows remote attackers to determine the physical path of the server components by requesting an invalid URL whose name includes a standard DOS device name.,2000-10-20 04:00:00.000,EPSS CVE-2000-0778,0.0,0.96737,"IIS 5.0 allows remote attackers to obtain source code for .ASP files and other scripts via an HTTP GET request with a ""Translate: f"" header, aka the ""Specialized Header"" vulnerability.",2000-10-20 04:00:00.000,EPSS CVE-2000-0886,0.0,0.95962,"IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the ""Web Server File Request Parsing"" vulnerability.",2000-12-19 05:00:00.000,EPSS CVE-2000-0917,0.0,0.95709,Format string vulnerability in use_syslog() function in LPRng 3.6.24 allows remote attackers to execute arbitrary commands.,2000-12-19 05:00:00.000,EPSS/Metasploit CVE-2000-0942,0.0,0.95023,"The CiWebHitsFile component in Microsoft Indexing Services for Windows 2000 allows remote attackers to conduct a cross site scripting (CSS) attack via a CiRestriction parameter in a .htw request, aka the ""Indexing Services Cross Site Scripting"" vulnerability.",2000-12-19 05:00:00.000,EPSS CVE-2000-0945,0.0,0.96497,"The web configuration interface for Catalyst 3500 XL switches allows remote attackers to execute arbitrary commands without authentication when the enable password is not set, via a URL containing the /exec/ directory.",2000-12-19 05:00:00.000,EPSS/Metasploit CVE-2000-1089,0.0,0.96966,"Buffer overflow in Microsoft Phone Book Service allows local users to execute arbitrary commands, aka the ""Phone Book Service Buffer Overflow"" vulnerability.",2001-01-09 05:00:00.000,EPSS/Metasploit CVE-2000-1209,0.0,0.95732,"The ""sa"" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4) Tumbleweed Secure Mail (MMS) (5) Compaq Insight Manager, and (6) Visio 2000, which allows remote attackers to gain privileges, as exploited by worms such as Voyager Alpha Force and Spida.",2002-08-12 04:00:00.000,EPSS CVE-2001-0152,0.0,0.00078,"The password protection option for the Compressed Folders feature in Plus! for Windows 98 and Windows Me writes password information to a file, which allows local users to recover the passwords and read the compressed folders.",2001-05-03 04:00:00.000,Metasploit CVE-2001-0167,0.0,0.09507,Buffer overflow in AT&T WinVNC (Virtual Network Computing) client 3.3.3r7 and earlier allows remote attackers to execute arbitrary commands via a long rfbConnFailed packet with a long reason string.,2001-05-03 04:00:00.000,Metasploit CVE-2001-0168,0.0,0.21185,Buffer overflow in AT&T WinVNC (Virtual Network Computing) server 3.3.3r7 and earlier allows remote attackers to execute arbitrary commands via a long HTTP GET request when the DebugLevel registry key is greater than 0.,2001-05-03 04:00:00.000,Metasploit CVE-2001-0241,0.0,0.95418,Buffer overflow in Internet Printing ISAPI extension in Windows 2000 allows remote attackers to gain root privileges via a long print request that is passed to the extension through IIS 5.0.,2001-06-27 04:00:00.000,EPSS/Metasploit CVE-2001-0311,0.0,0.00101,Vulnerability in OmniBackII A.03.50 in HP 11.x and earlier allows attackers to gain unauthorized access to an OmniBack client.,2001-06-02 04:00:00.000,Metasploit CVE-2001-0333,0.0,0.04956,"Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and ""\"" characters twice.",2001-06-27 04:00:00.000,Metasploit CVE-2001-0414,0.0,0.96763,Buffer overflow in ntpd ntp daemon 4.0.99k and earlier (aka xntpd and xntp3) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long readvar argument.,2001-06-18 04:00:00.000,EPSS/Metasploit CVE-2001-0499,0.0,0.07145,"Buffer overflow in Transparent Network Substrate (TNS) Listener in Oracle 8i 8.1.7 and earlier allows remote attackers to gain privileges via a long argument to the commands (1) STATUS, (2) PING, (3) SERVICES, (4) TRC_FILE, (5) SAVE_CONFIG, or (6) RELOAD.",2001-07-21 04:00:00.000,Metasploit CVE-2001-0500,0.0,0.96728,"Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red.",2001-07-21 04:00:00.000,EPSS/Metasploit CVE-2001-0537,0.0,0.87683,"HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.",2001-07-21 04:00:00.000,Metasploit/Nuclei CVE-2001-0550,0.0,0.96051,"wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a ""~{"" argument to commands such as CWD, which is not properly handled by the glob function (ftpglob).",2001-11-30 05:00:00.000,EPSS CVE-2001-0727,0.0,0.96334,"Internet Explorer 6.0 allows remote attackers to execute arbitrary code by modifying the Content-Disposition and Content-Type header fields in a way that causes Internet Explorer to believe that the file is safe to open without prompting the user, aka the ""File Execution Vulnerability.""",2001-12-14 05:00:00.000,EPSS CVE-2001-0731,0.0,0.96516,"Apache 1.3.20 with Multiviews enabled allows remote attackers to view directory contents and bypass the index page via a URL containing the ""M=D"" query string.",2001-10-01 04:00:00.000,EPSS CVE-2001-0797,0.0,0.97214,Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of arguments through services such as telnet and rlogin.,2001-12-12 05:00:00.000,EPSS CVE-2001-0800,0.0,0.96516,lpsched in IRIX 6.5.13f and earlier allows remote attackers to execute arbitrary commands via shell metacharacters.,2001-12-06 05:00:00.000,EPSS/Metasploit CVE-2001-0803,0.0,0.25932,Buffer overflow in the client connection routine of libDtSvc.so.1 in CDE Subprocess Control Service (dtspcd) allows remote attackers to execute arbitrary commands.,2001-12-06 05:00:00.000,Metasploit CVE-2001-0876,0.0,0.9684,"Buffer overflow in Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to execute arbitrary code via a NOTIFY directive with a long Location URL.",2001-12-20 05:00:00.000,EPSS CVE-2001-0877,0.0,0.97232,"Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to cause a denial of service via (1) a spoofed SSDP advertisement that causes the client to connect to a service on another machine that generates a large amount of traffic (e.g., chargen), or (2) via a spoofed SSDP announcement to broadcast or multicast addresses, which could cause all UPnP clients to send traffic to a single target system.",2001-12-20 05:00:00.000,EPSS CVE-2001-0986,0.0,0.95775,"SQLQHit.asp sample file in Microsoft Index Server 2.0 allows remote attackers to obtain sensitive information such as the physical path, file attributes, or portions of source code by directly calling sqlqhit.asp with a CiScope parameter set to (1) webinfo, (2) extended_fileinfo, (3) extended_webinfo, or (4) fileinfo.",2001-09-14 04:00:00.000,EPSS CVE-2001-1013,0.0,0.03631,"Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html directory and when the username does not exist, which could allow remote attackers to determine valid usernames on the server.",2001-09-12 04:00:00.000,Metasploit CVE-2001-1320,0.0,0.43713,"Network Associates PGP Keyserver 7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via exceptional BER encodings (possibly buffer overflows), as demonstrated by the PROTOS LDAPv3 test suite.",2001-07-16 04:00:00.000,Metasploit CVE-2001-1473,0.0,0.00258,"The SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay a client challenge response to a target server by creating a Session ID that matches the Session ID of the target, but which uses a public key pair that is weaker than the target's public key, which allows the attacker to compute the corresponding private key and use the target's Session ID with the compromised key pair to masquerade as the target.",2001-01-18 05:00:00.000,Nuclei CVE-2001-1583,0.0,0.22066,lpd daemon (in.lpd) in Solaris 8 and earlier allows remote attackers to execute arbitrary commands via a job request with a crafted control file that is not properly handled when lpd invokes a mail program. NOTE: this might be the same vulnerability as CVE-2000-1220.,2001-12-31 05:00:00.000,Metasploit CVE-2002-0055,0.0,0.96316,"SMTP service in Microsoft Windows 2000, Windows XP Professional, and Exchange 2000 allows remote attackers to cause a denial of service via a command with a malformed data transfer (BDAT) request.",2002-03-08 05:00:00.000,EPSS CVE-2002-0073,0.0,0.96621,"The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters.",2002-04-22 04:00:00.000,EPSS CVE-2002-0079,0.0,0.96475,Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code.,2002-04-22 04:00:00.000,EPSS CVE-2002-0367,0.0,0.00086,"smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.",2002-06-25 04:00:00.000,CISA CVE-2002-0392,0.0,0.75283,"Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.",2002-07-03 04:00:00.000,Metasploit CVE-2002-0421,0.0,0.97134,"IIS 4.0 allows local users to bypass the ""User cannot change password"" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including (1) aexp2.htr, (2) aexp2b.htr, (3) aexp3.htr , or (4) aexp4.htr.",2002-08-12 04:00:00.000,EPSS CVE-2002-0642,0.0,0.97424,"The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, has insecure permissions, which allows local users to gain privileges, aka ""Incorrect Permission on SQL Server Service Account Registry Key.""",2002-07-23 04:00:00.000,EPSS CVE-2002-0649,0.0,0.96364,"Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption, as exploited by the Slammer/Sapphire worm.",2002-08-12 04:00:00.000,EPSS/Metasploit CVE-2002-0661,0.0,0.95962,"Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. (dot dot) sequences containing \ (backslash) characters.",2002-08-12 04:00:00.000,EPSS CVE-2002-0840,0.0,0.97141,"Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is ""Off"" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.",2002-10-11 04:00:00.000,EPSS CVE-2002-0965,0.0,0.95009,"Buffer overflow in TNS Listener for Oracle 9i Database Server on Windows systems, and Oracle 8 on VM, allows local users to execute arbitrary code via a long SERVICE_NAME parameter, which is not properly handled when writing an error message to a log file.",2002-10-04 04:00:00.000,EPSS/Metasploit CVE-2002-0976,0.0,0.95055,"Internet Explorer 4.0 and later allows remote attackers to read arbitrary files via a web page that accesses a legacy XML Datasource applet (com.ms.xml.dso.XMLDSO.class) and modifies the base URL to point to the local system, which is trusted by the applet.",2002-09-24 04:00:00.000,EPSS CVE-2002-1059,0.0,0.10709,"Buffer overflow in Van Dyke SecureCRT SSH client before 3.4.6, and 4.x before 4.0 beta 3, allows an SSH server to execute arbitrary code via a long SSH1 protocol version string.",2002-10-04 04:00:00.000,Metasploit CVE-2002-1120,0.0,0.20431,Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.,2002-09-24 04:00:00.000,Metasploit CVE-2002-1123,0.0,0.96182,"Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attackers to execute arbitrary code via a long request to TCP port 1433, aka the ""Hello"" overflow.",2002-09-24 04:00:00.000,EPSS/Metasploit CVE-2002-1131,0.0,0.04774,"Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2) options.php, (3) search.php, or (4) help.php.",2002-10-04 04:00:00.000,Nuclei CVE-2002-1142,0.0,0.88314,"Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub.",2002-11-29 05:00:00.000,Metasploit CVE-2002-1214,0.0,0.96773,Buffer overflow in Microsoft PPTP Service on Windows XP and Windows 2000 allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via a certain PPTP packet with malformed control data.,2002-10-28 05:00:00.000,EPSS/Metasploit CVE-2002-1318,0.0,0.14543,Buffer overflow in samba 2.2.2 through 2.2.6 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an encrypted password that causes the overflow during decryption in which a DOS codepage string is converted to a little-endian UCS2 unicode string.,2002-12-11 05:00:00.000,Metasploit CVE-2002-1359,0.0,0.97181,"Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code via buffer overflow attacks, as demonstrated by the SSHredder SSH protocol test suite.",2002-12-23 05:00:00.000,EPSS/Metasploit CVE-2002-1473,0.0,0.00079,Multiple buffer overflows in lp subsystem for HP-UX 10.20 through 11.11 (11i) allow local users to cause a denial of service and possibly execute arbitrary code.,2003-04-22 04:00:00.000,Metasploit CVE-2002-1643,0.0,0.94547,"Multiple buffer overflows in RealNetworks Helix Universal Server 9.0 (9.0.2.768) allow remote attackers to execute arbitrary code via (1) a long Transport field in a SETUP RTSP request, (2) a DESCRIBE RTSP request with a long URL argument, or (3) two simultaneous HTTP GET requests with long arguments.",2002-12-19 05:00:00.000,Metasploit CVE-2002-1751,0.0,0.95349,"csLiveSupport.cgi in CGIScript.net csLiveSupport allows remote attackers to execute arbitrary Perl code via the setup parameter, which is processed by the Perl eval function.",2002-12-31 05:00:00.000,EPSS CVE-2002-1864,0.0,0.45813,"Directory traversal vulnerability in Simple Web Server (SWS) 0.0.4 through 0.1.0 allows remote attackers to read arbitrary files via a "".."" (dot dot) in an HTTP request.",2002-12-31 05:00:00.000,Metasploit CVE-2002-2226,0.0,0.50006,Buffer overflow in tftpd of TFTP32 2.21 and earlier allows remote attackers to execute arbitrary code via a long filename argument.,2002-12-31 05:00:00.000,Metasploit CVE-2002-2443,0.0,0.95516,"schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103.",2013-05-29 14:29:06.287,EPSS CVE-2003-0027,0.0,0.52349,Directory traversal vulnerability in Sun Kodak Color Management System (KCMS) library service daemon (kcms_server) allows remote attackers to read arbitrary files via the KCS_OPEN_PROFILE procedure.,2003-02-07 05:00:00.000,Metasploit CVE-2003-0028,0.0,0.96788,"Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391.",2003-03-25 05:00:00.000,EPSS CVE-2003-0050,0.0,0.65929,parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via shell metacharacters.,2003-03-07 05:00:00.000,Metasploit CVE-2003-0085,0.0,0.96331,"Buffer overflow in the SMB/CIFS packet fragment re-assembly code for SMB daemon (smbd) in Samba before 2.2.8, and Samba-TNG before 0.3.1, allows remote attackers to execute arbitrary code.",2003-03-31 05:00:00.000,EPSS CVE-2003-0109,0.0,0.97418,"Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute arbitrary code, as demonstrated via a WebDAV request to IIS 5.0.",2003-03-31 05:00:00.000,EPSS/Metasploit CVE-2003-0190,0.0,0.06451,"OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.",2003-05-12 04:00:00.000,Metasploit CVE-2003-0201,0.0,0.9704,"Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code.",2003-05-05 04:00:00.000,EPSS CVE-2003-0213,0.0,0.34115,"ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1, which causes a negative value to be fed into a read operation, leading to a buffer overflow.",2003-05-12 04:00:00.000,Metasploit CVE-2003-0220,0.0,0.52614,Buffer overflow in the administrator authentication process for Kerio Personal Firewall (KPF) 2.1.4 and earlier allows remote attackers to execute arbitrary code via a handshake packet.,2003-05-12 04:00:00.000,Metasploit CVE-2003-0227,0.0,0.95933,"The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0 and 2000, nsiislog.dll, allows remote attackers to cause a denial of service in Internet Information Server (IIS) and execute arbitrary code via a certain network request.",2003-06-09 04:00:00.000,EPSS CVE-2003-0228,0.0,0.95343,Directory traversal vulnerability in Microsoft Windows Media Player 7.1 and Windows Media Player for Windows XP allows remote attackers to execute arbitrary code via a skins file with a URL containing hex-encoded backslash characters (%5C) that causes an executable to be placed in an arbitrary location.,2003-05-27 04:00:00.000,EPSS CVE-2003-0245,0.0,0.96634,"Vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library for Apache 2.0.37 through 2.0.45 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors.",2003-06-09 04:00:00.000,EPSS CVE-2003-0264,0.0,0.2422,"Multiple buffer overflows in SLMail 5.1.0.4420 allows remote attackers to execute arbitrary code via (1) a long EHLO argument to slmail.exe, (2) a long XTRN argument to slmail.exe, (3) a long string to POPPASSWD, or (4) a long password to the POP3 server.",2003-05-27 04:00:00.000,Metasploit CVE-2003-0270,0.0,0.02846,"The administration capability for Apple AirPort 802.11 wireless access point devices uses weak encryption (XOR with a fixed key) for protecting authentication credentials, which could allow remote attackers to obtain administrative access via sniffing when the capability is available via Ethernet or non-WEP connections.",2003-06-16 04:00:00.000,Metasploit CVE-2003-0344,0.0,0.96971,"Buffer overflow in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code via / (slash) characters in the Type property of an Object tag in a web page.",2003-06-16 04:00:00.000,EPSS/Metasploit CVE-2003-0349,0.0,0.96157,"Buffer overflow in the streaming media component for logging multicast requests in the ISAPI for the logging capability of Microsoft Windows Media Services (nsiislog.dll), as installed in IIS 5.0, allows remote attackers to execute arbitrary code via a large POST request to nsiislog.dll.",2003-07-24 04:00:00.000,EPSS/Metasploit CVE-2003-0352,0.0,0.97075,"Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms.",2003-08-18 04:00:00.000,EPSS/Metasploit CVE-2003-0471,0.0,0.3689,Buffer overflow in WebAdmin.exe for WebAdmin allows remote attackers to execute arbitrary code via an HTTP request to WebAdmin.dll with a long USER argument.,2003-08-07 04:00:00.000,Metasploit CVE-2003-0533,0.0,0.97158,"Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm.",2004-06-01 04:00:00.000,EPSS/Metasploit CVE-2003-0543,0.0,0.95927,Integer overflow in OpenSSL 0.9.6 and 0.9.7 allows remote attackers to cause a denial of service (crash) via an SSL client certificate with certain ASN.1 tag values.,2003-11-17 05:00:00.000,EPSS CVE-2003-0558,0.0,0.01278,Buffer overflow in LeapFTP 2.7.3.600 allows remote FTP servers to execute arbitrary code via a long IP address response to a PASV request.,2003-08-18 04:00:00.000,Metasploit CVE-2003-0605,0.0,0.96682,"The RPC DCOM interface in Windows 2000 SP3 and SP4 allows remote attackers to cause a denial of service (crash), and local attackers to use the DoS to hijack the epmapper pipe to gain privileges, via certain messages to the __RemoteGetClassObject interface that cause a NULL pointer to be passed to the PerformScmStage function.",2003-08-27 04:00:00.000,EPSS CVE-2003-0662,0.0,0.96604,Buffer overflow in Troubleshooter ActiveX Control (Tshoot.ocx) in Microsoft Windows 2000 SP4 and earlier allows remote attackers to execute arbitrary code via an HTML document with a long argument to the RunQuery2 method.,2003-11-17 05:00:00.000,EPSS CVE-2003-0694,0.0,0.05703,"The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.",2003-10-06 04:00:00.000,Metasploit CVE-2003-0714,0.0,0.09161,"The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory exhaustion) by directly connecting to the SMTP service and sending a certain extended verb request, possibly triggering a buffer overflow in Exchange 2000.",2003-11-17 05:00:00.000,Metasploit CVE-2003-0717,0.0,0.97105,"The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute arbitrary code via a buffer overflow attack.",2003-11-17 05:00:00.000,EPSS CVE-2003-0719,0.0,0.95755,"Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via PCT 1.0 handshake packets.",2004-06-01 04:00:00.000,EPSS/Metasploit CVE-2003-0722,0.0,0.97031,"The default installation of sadmind on Solaris uses weak authentication (AUTH_SYS), which allows local and remote attackers to spoof Solstice AdminSuite clients and gain root privileges via a certain sequence of RPC packets.",2003-09-22 04:00:00.000,EPSS/Metasploit CVE-2003-0768,0.0,0.95104,Microsoft ASP.Net 1.1 allows remote attackers to bypass the Cross-Site Scripting (XSS) and Script Injection protection feature via a null character in the beginning of a tag name.,2003-09-22 04:00:00.000,EPSS CVE-2003-0772,0.0,0.96013,Multiple buffer overflows in WS_FTP 3 and 4 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code via long (1) APPE (append) or (2) STAT (status) arguments.,2003-09-22 04:00:00.000,EPSS CVE-2003-0812,0.0,0.96901,"Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long entries to be written to a debug log file (""NetSetup.LOG""), as demonstrated using the NetAddAlternateComputerName API.",2003-12-15 05:00:00.000,EPSS/Metasploit CVE-2003-0818,0.0,0.97363,"Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and XP, allow remote attackers to execute arbitrary code via ASN.1 BER encodings with (1) very large length fields that cause arbitrary heap data to be overwritten, or (2) modified bit strings.",2004-03-03 05:00:00.000,EPSS/Metasploit CVE-2003-0822,0.0,0.97104,Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request.,2003-12-15 05:00:00.000,EPSS/Metasploit CVE-2003-0825,0.0,0.96665,"The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets, which allows attackers to cause a denial of service and possibly execute arbitrary code.",2004-03-03 05:00:00.000,EPSS CVE-2003-0838,0.0,0.95041,"Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a ""data"" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but later executes as an HTA application, a different vulnerability than CVE-2003-0532, and as exploited using the QHosts Trojan horse (aka Trojan.Qhosts, QHosts-1, VBS.QHOSTS, or aolfix.exe).",2003-11-17 05:00:00.000,EPSS CVE-2003-0990,0.0,0.70166,"The parseAddress code in (1) SquirrelMail 1.4.0 and (2) GPG Plugin 1.1 allows remote attackers to execute commands via shell metacharacters in the ""To:"" field.",2004-01-20 05:00:00.000,Metasploit CVE-2003-1025,0.0,0.97356,"Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a ""%01"" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the ""Improper URL Canonicalization Vulnerability.""",2004-01-20 05:00:00.000,EPSS CVE-2003-1141,0.0,0.83039,Buffer overflow in NIPrint 4.10 allows remote attackers to execute arbitrary code via a long string to TCP port 515.,2003-11-04 05:00:00.000,Metasploit CVE-2003-1192,0.0,0.96349,Stack-based buffer overflow in IA WebMail Server 3.1.0 allows remote attackers to execute arbitrary code via a long GET request.,2003-11-03 05:00:00.000,EPSS/Metasploit CVE-2003-1200,0.0,0.96607,Stack-based buffer overflow in FORM2RAW.exe in Alt-N MDaemon 6.5.2 through 6.8.5 allows remote attackers to execute arbitrary code via a long From parameter to Form2Raw.cgi.,2003-12-29 05:00:00.000,EPSS/Metasploit CVE-2003-1336,0.0,0.82838,Buffer overflow in mIRC before 6.11 allows remote attackers to execute arbitrary code via a long irc:// URL.,2003-12-31 05:00:00.000,Metasploit CVE-2004-0119,7.5,0.96423,"The Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection.",2004-06-01 04:00:00.000,EPSS CVE-2004-0120,0.0,0.96671,"The Microsoft Secure Sockets Layer (SSL) library, as used in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service via malformed SSL messages.",2004-06-01 04:00:00.000,EPSS CVE-2004-0199,0.0,0.96056,"Help and Support Center in Microsoft Windows XP and Windows Server 2003 SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code, as demonstrated using certain hcp:// URLs that access the DVD Upgrade capability (dvdupgrd.htm).",2004-06-14 04:00:00.000,EPSS CVE-2004-0200,0.0,0.95702,"Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.",2004-09-28 04:00:00.000,EPSS CVE-2004-0203,0.0,0.96201,Cross-site scripting (XSS) vulnerability in Outlook Web Access for Exchange Server 5.5 Service Pack 4 allows remote attackers to insert arbitrary script and spoof content in HTML email or web caches via an HTML redirect query.,2004-11-23 05:00:00.000,EPSS CVE-2004-0204,0.0,0.96546,"Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via "".."" sequences in the dynamicimag argument to crystalimagehandler.aspx.",2004-08-06 04:00:00.000,EPSS CVE-2004-0206,0.0,0.22192,"Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an ""unchecked buffer,"" possibly a buffer overflow.",2004-11-03 05:00:00.000,Metasploit CVE-2004-0210,0.0,0.00395,"The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by modifying message length values and causing a buffer overflow.",2004-08-06 04:00:00.000,CISA CVE-2004-0214,0.0,0.96278,"Buffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba.",2004-11-03 05:00:00.000,EPSS CVE-2004-0297,0.0,0.9435,Buffer overflow in the Lightweight Directory Access Protocol (LDAP) daemon (iLDAP.exe 3.9.15.10) in Ipswitch IMail Server 8.03 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via an LDAP message with a large tag length.,2004-11-23 05:00:00.000,Metasploit CVE-2004-0313,0.0,0.32082,"Buffer overflow in PSOProxy 0.91 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP request, as demonstrated using a long (1) GET argument or (2) method name.",2004-11-23 05:00:00.000,Metasploit CVE-2004-0326,0.0,0.79486,Buffer overflow in the web proxy for GateKeeper Pro 4.7 allows remote attackers to execute arbitrary code via a long GET request.,2004-11-23 05:00:00.000,Metasploit CVE-2004-0330,0.0,0.93624,Buffer overflow in Serv-U ftp before 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM command.,2004-11-23 05:00:00.000,Metasploit CVE-2004-0331,0.0,0.95235,Heap-based buffer overflow in Dell OpenManage Web Server 3.4.0 allows remote attackers to cause a denial of service (crash) via a HTTP POST with a long application variable.,2004-11-23 05:00:00.000,EPSS/Metasploit CVE-2004-0362,0.0,0.9616,"Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRV_MULTI response containing a SRV_USER_ONLINE response packet and a SRV_META_USER response packet with long (1) nickname, (2) firstname, (3) lastname, or (4) email address fields, as exploited by the Witty worm.",2004-04-15 04:00:00.000,EPSS/Metasploit CVE-2004-0363,0.0,0.94081,"Stack-based buffer overflow in the SymSpamHelper ActiveX component (symspam.dll) in Norton AntiSpam 2004, as used in Norton Internet Security 2004, allows remote attackers to execute arbitrary code via a long parameter to the LaunchCustomRuleWizard method.",2004-04-15 04:00:00.000,Metasploit CVE-2004-0380,0.0,0.96759,"The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the ""MHTML URL Processing Vulnerability.""",2004-05-04 04:00:00.000,EPSS CVE-2004-0396,0.0,0.96945,"Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines.",2004-06-14 04:00:00.000,EPSS CVE-2004-0397,0.0,0.96278,Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.,2004-07-07 04:00:00.000,EPSS/Metasploit CVE-2004-0420,0.0,0.96765,"The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP.",2004-07-07 04:00:00.000,EPSS CVE-2004-0430,0.0,0.10566,Stack-based buffer overflow in AppleFileServer for Mac OS X 10.3.3 and earlier allows remote attackers to execute arbitrary code via a LoginExt packet for a Cleartext Password User Authentication Method (UAM) request with a PathName argument that includes an AFPName type string that is longer than the associated length field.,2004-07-07 04:00:00.000,Metasploit CVE-2004-0493,0.0,0.96228,"The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.",2004-08-06 04:00:00.000,EPSS CVE-2004-0519,0.0,0.02285,"Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php.",2004-08-18 04:00:00.000,Nuclei CVE-2004-0541,0.0,0.96322,"Buffer overflow in the ntlm_check_auth (NTLM authentication) function for Squid Web Proxy Cache 2.5.x and 3.x, when compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password (""pass"" variable).",2004-08-06 04:00:00.000,EPSS/Metasploit CVE-2004-0549,0.0,0.96426,"The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a ""URL:"" prepended to a ""ms-its"" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object.",2004-08-06 04:00:00.000,EPSS CVE-2004-0574,0.0,0.95503,"The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an ""unchecked buffer,"" leading to off-by-one and heap-based buffer overflows.",2004-11-03 05:00:00.000,EPSS CVE-2004-0597,0.0,0.96415,"Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.",2004-11-23 05:00:00.000,EPSS CVE-2004-0600,0.0,0.96401,Buffer overflow in the Samba Web Administration Tool (SWAT) in Samba 3.0.2 to 3.0.4 allows remote attackers to execute arbitrary code via an invalid base-64 character during HTTP basic authentication.,2004-07-27 04:00:00.000,EPSS CVE-2004-0636,0.0,0.91897,"Buffer overflow in the goaway function in the aim:goaway URI handler for AOL Instant Messenger (AIM) 5.5, including 5.5.3595, allows remote attackers to execute arbitrary code via a long Away message.",2004-11-23 05:00:00.000,Metasploit CVE-2004-0637,0.0,0.96515,"Oracle Database Server 8.1.7.4 through 9.2.0.4 allows local users to execute commands with additional privileges via the ctxsys.driload package, which is publicly accessible.",2004-09-02 04:00:00.000,EPSS CVE-2004-0695,0.0,0.87713,Stack-based buffer overflow in the FTP service for 4D WebSTAR 5.3.2 and earlier allows remote attackers to execute arbitrary code via a long FTP command.,2004-07-27 04:00:00.000,Metasploit CVE-2004-0735,0.0,0.42987,"Buffer overflow in Medal of Honor (1) Allied Assault 1.11v9 and earlier, (2) Breakthrough 2.40b and earlier, and (3) Spearhead 2.15 and earlier, when playing on a Local Area Network (LAN), allows remote attackers to execute arbitrary code via vectors such as (1) the getinfo query, (2) the connect packet, and other unknown vectors.",2004-07-27 04:00:00.000,Metasploit CVE-2004-0763,0.0,0.95963,"Mozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the ""onunload"" method.",2004-08-18 04:00:00.000,EPSS CVE-2004-0790,0.0,0.96499,"Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the ""blind connection-reset attack."" NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.",2005-04-12 04:00:00.000,EPSS CVE-2004-0795,0.0,0.01949,"DB2 8.1 remote command server (DB2RCMD.EXE) executes the db2rcmdc.exe program as the db2admin administrator, which allows local users to gain privileges via the DB2REMOTECMD named pipe.",2004-10-20 04:00:00.000,Metasploit CVE-2004-0798,0.0,0.93127,Buffer overflow in the _maincfgret.cgi script for Ipswitch WhatsUp Gold before 8.03 Hotfix 1 allows remote attackers to execute arbitrary code via a long instancename parameter.,2004-10-20 04:00:00.000,Metasploit CVE-2004-0841,0.0,0.96478,"Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka ""HijackClick 3"" and the ""Script in Image Tag File Download Vulnerability.""",2004-12-23 05:00:00.000,EPSS CVE-2004-0842,0.0,0.96846,"Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from ""memory corruption"") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the ""