Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: August 2004

34 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2004-1364
    38Monitor

    Directory traversal vulnerability in extproc in Oracle 9i and 10g allows remote attackers to access arbitrary libraries outside of the $ORAC

    HighCVSS 8.5Proof of conceptEPSS 13%

    oracle · application serverAug 4, 2004

  • CVE-2004-1366
    23Monitor

    Oracle 10g Database Server stores the password for the SYSMAN account in cleartext in the world-readable emoms.properties file, which could

    MediumCVSS 4.6No exploitEPSS 15%

    oracle · application serverAug 4, 2004

  • CVE-2004-1371
    39Monitor

    Stack-based buffer overflow in Oracle 9i and 10g allows remote attackers to execute arbitrary code via a long token in the text of a wrapped

    CriticalCVSS 9.0No exploitEPSS 10%

    oracle · application serverAug 4, 2004

  • CVE-2004-0201
    54Plan

    Heap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 all

    CriticalCVSS 10.0No exploitEPSS 45%

    microsoft · windows 2000Aug 6, 2004

  • CVE-2004-0202
    28Monitor

    IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allo

    MediumCVSS 5.0No exploitEPSS 26%

    microsoft · directxAug 6, 2004

  • CVE-2004-0204
    52Plan

    Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used

    HighCVSS 7.5Proof of conceptEPSS 72%

    bea · weblogic serverAug 6, 2004

  • CVE-2004-0205
    35Monitor

    Buffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arbitrary code via the redirect function.

    HighCVSS 7.2No exploitEPSS 24%

    microsoft · internet information serverAug 6, 2004

  • CVE-2004-0210
    63This week

    The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly b

    HighCVSS 7.8KEVWeaponizedEPSS 7%

    microsoft · interixAug 6, 2004

  • CVE-2004-0212
    59Plan

    Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote

    CriticalCVSS 10.0Proof of conceptEPSS 63%

    avaya · ip600 media serversAug 6, 2004

  • CVE-2004-0213
    37Monitor

    Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to g

    HighCVSS 7.8Proof of conceptEPSS 20%

    microsoft · windows 2000Aug 6, 2004

  • CVE-2004-0215
    25Monitor

    Microsoft Outlook Express 5.5 and 6 allows attackers to cause a denial of service (application crash) via a malformed e-mail header.

    MediumCVSS 5.0No exploitEPSS 15%

    microsoft · outlook expressAug 6, 2004

  • CVE-2004-0416
    44Plan

    Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attacker

    CriticalCVSS 10.0Proof of conceptEPSS 13%

    cvs · cvsAug 6, 2004

  • CVE-2004-0460
    54Plan

    Buffer overflow in the logging capability for the DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13 allows remote attackers to cause

    CriticalCVSS 10.0No exploitEPSS 45%

    isc · dhcpdAug 6, 2004

  • CVE-2004-0461
    45Plan

    The DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13, when compiled in environments that do not provide the vsnprintf function, uses

    CriticalCVSS 10.0No exploitEPSS 16%

    isc · dhcpdAug 6, 2004

  • CVE-2004-0492
    50Plan

    Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (pr

    CriticalCVSS 10.0No exploitEPSS 33%

    apache · http serverAug 6, 2004

  • CVE-2004-0493
    50Plan

    The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and p

    MediumCVSS 6.4Proof of conceptEPSS 84%

    apache · http serverAug 6, 2004

  • CVE-2004-0526
    25Monitor

    Unknown versions of Internet Explorer and Outlook allow remote attackers to spoof a legitimate URL in the status bar via A HREF tags with mo

    MediumCVSS 5.0Proof of conceptEPSS 17%

    microsoft · ieAug 6, 2004

  • CVE-2004-0541
    61This week

    Buffer overflow in the ntlm_check_auth (NTLM authentication) function for Squid Web Proxy Cache 2.5.x and 3.x, when compiled with NTLM handl

    CriticalCVSS 10.0WeaponizedEPSS 71%

    national science foundation · squid web proxy cacheAug 6, 2004

  • CVE-2004-0542
    49Plan

    PHP before 4.3.7 on Win32 platforms does not properly filter all shell metacharacters, which allows local or remote attackers to execute arb

    CriticalCVSS 10.0No exploitEPSS 31%

    php · phpAug 6, 2004

  • CVE-2004-0549
    58Plan

    The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attac

    CriticalCVSS 10.0Proof of conceptEPSS 61%

    microsoft · internet explorerAug 6, 2004

  • CVE-2004-0557
    48Plan

    Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers t

    CriticalCVSS 10.0Proof of conceptEPSS 25%

    sox · soxAug 6, 2004

  • CVE-2004-0659
    45Plan

    Buffer overflow in TranslateFilename for common.c in MPlayer 1.0pre4 allows remote attackers to execute arbitrary code via a long file name.

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    mplayer · mplayerAug 6, 2004

  • CVE-2004-0716
    44Plan

    Buffer overflow in the DCE daemon (DCED) for the DCE endpoint mapper (epmap) on HP-UX 11 allows remote attackers to execute arbitrary code v

    CriticalCVSS 10.0No exploitEPSS 12%

    hp · hp-uxAug 6, 2004

  • CVE-2004-1701
    46Plan

    Heap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers to execut

    CriticalCVSS 10.0Proof of conceptEPSS 19%

    gnu · cfengineAug 9, 2004

  • CVE-2004-0234
    43Plan

    Multiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14, as used in products such as Barracuda Spam Firewa

    CriticalCVSS 10.0No exploitEPSS 10%

    clearswift · mailsweeperAug 18, 2004

  • CVE-2004-0501
    26Monitor

    Outlook 2003 allows remote attackers to bypass intended access restrictions and cause Outlook to request a URL from a remote site via an HTM

    MediumCVSS 5.0Proof of conceptEPSS 18%

    microsoft · outlookAug 18, 2004

  • CVE-2004-0502
    26Monitor

    Outlook 2003, when replying to an e-mail message, stores certain files in a predictable location for the "src" of an img tag of the original

    MediumCVSS 5.0Proof of conceptEPSS 20%

    microsoft · outlookAug 18, 2004

  • CVE-2004-0503
    23Monitor

    Microsoft Outlook 2003 allows remote attackers to bypass the default zone restrictions and execute script within media files via a Rich Text

    MediumCVSS 5.0No exploitEPSS 11%

    microsoft · outlookAug 18, 2004

  • CVE-2004-0519
    34Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users

    MediumCVSS 6.8Proof of conceptEPSS 22%

    squirrelmail · squirrelmailAug 18, 2004

  • CVE-2004-0523
    43Plan

    Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary

    CriticalCVSS 10.0No exploitEPSS 11%

    mit · kerberosAug 18, 2004

  • CVE-2004-0722
    44Plan

    Integer overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6, and possibly earlier versi

    CriticalCVSS 10.0Proof of conceptEPSS 13%

    mozilla · mozillaAug 18, 2004

  • CVE-2004-0839
    30Monitor

    Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a

    MediumCVSS 5.0No exploitEPSS 33%

    avaya · ip600 media serversAug 18, 2004

  • CVE-2004-0230
    44Plan

    TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connectio

    MediumCVSS 5.0Proof of conceptEPSS 80%

    juniper · junosAug 18, 2004

  • CVE-2004-1653
    28Monitor

    The default configuration for OpenSSH enables AllowTcpForwarding, which could allow remote authenticated users to perform a port bounce, whe

    MediumCVSS 6.4No exploitEPSS 11%

    openbsd · opensshAug 31, 2004