CVE-2004-0273

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in RealOne Player, RealOne Player 2.0, and RealOne Enterprise Desktop allows remote attackers to upload arbitrary files via an RMP file that contains .. (dot dot) sequences in a .rjs skin file.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=107642978524321&w=2
http://service.real.com/help/faq/security/040123_player/EN/Patch, Vendor Advisory
http://www.kb.cert.org/vuls/id/514734US Government Resource
http://www.securityfocus.com/bid/9580Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15123
http://marc.info/?l=bugtraq&m=107642978524321&w=2
http://service.real.com/help/faq/security/040123_player/EN/Patch, Vendor Advisory
http://www.kb.cert.org/vuls/id/514734US Government Resource
http://www.securityfocus.com/bid/9580Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15123

Timeline

Published: Nov 23, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-02747.5Share.mod in Eggheads Eggdrop IRC bot 1.6.10 through 1.6.15 can mistakenly assign STAT_OFFERED status to a bot that is not a sharebot, which CVE-2004-02755.0SQL injection vulnerability in calendar_download.php in BosDates 3.2 and earlier allows remote attackers to obtain sensitive information and CVE-2004-02765.0The get_real_string function in Monkey HTTP Daemon (monkeyd) 0.8.1 and earlier allows remote attackers to cause a denial of service (crash) CVE-2004-027710.0Format string vulnerability in Dream FTP 1.02 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary co CVE-2004-02785.0Ratbag game engine, as used in products such as Dirt Track Racing, Leadfoot, and World of Outlaws Spring Cars, allows remote attackers to ca CVE-2004-02797.2AIM Sniff (aimSniff.pl) 0.9b allows local users to overwrite arbitrary files via a symlink attack on /tmp/AS.log.CVE-2004-02805.0Caucho Technology Resin 2.1.12 allows remote attackers to view JSP source via an HTTP request to a .jsp file that ends in a "%20" (encoded s CVE-2004-02815.0Caucho Technology Resin 2.1.12 allows remote attackers to gain sensitive information and view the contents of the /WEB-INF/ directory via an CVE-2004-02825.0Crob FTP daemon 3.5.2 allows remote attackers to cause a denial of service (crash) by repeatedly connecting to and disconnecting from the se CVE-2004-02832.1Mailmgr 1.2.3 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/mailmgr.unsort, (2) /tmp/mailmgr.tmp, or (3) CVE-2004-02845.0Microsoft Internet Explorer 6.0, Outlook 2002, and Outlook 2003 allow remote attackers to cause a denial of service (CPU consumption), if "D CVE-2004-02859.8PHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2) AllMyLinks, and (3) AllMyGuests allow remote a