CVE-2004-0364

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The WrapNISUM ActiveX component (WrapUM.dll) in Norton Internet Security 2004 is marked safe for scripting, which allows remote attackers to execute arbitrary programs via the LaunchURL method.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=107970885922442&w=2
http://marc.info/?l=bugtraq&m=107980262324362&w=2
http://secunia.com/advisories/11168
http://www.kb.cert.org/vuls/id/549054US Government Resource
http://www.nextgenss.com/advisories/nisrce.txtPatch, Vendor Advisory
http://www.sarc.com/avcenter/security/Content/2004.03.19.html
http://www.securityfocus.com/bid/9915Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15538
http://marc.info/?l=bugtraq&m=107970885922442&w=2
http://marc.info/?l=bugtraq&m=107980262324362&w=2
http://secunia.com/advisories/11168
http://www.kb.cert.org/vuls/id/549054US Government Resource
http://www.nextgenss.com/advisories/nisrce.txtPatch, Vendor Advisory
http://www.sarc.com/avcenter/security/Content/2004.03.19.html
http://www.securityfocus.com/bid/9915Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15538

Timeline

Published: Apr 15, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-03657.5The dissect_attribute_value_pairs function in packet-radius.c for Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of ser CVE-2004-03667.5SQL injection vulnerability in the libpam-pgsql library before 0.5.2 allows attackers to execute arbitrary SQL statements.CVE-2004-03675.0Ethereal 0.10.1 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a zero-length Presentation protocol selector.CVE-2004-036810.0Double free vulnerability in dtlogin in CDE on Solaris, HP-UX, and other operating systems allows remote attackers to execute arbitrary code CVE-2004-03697.5Buffer overflow in Entrust LibKmp ISAKMP library, as used by Symantec Enterprise Firewall 7.0 through 8.0, Gateway Security 5300 1.0, Gatewa CVE-2004-03702.1The setsockopt call in the KAME Project IPv6 implementation, as used in FreeBSD 5.2, does not properly handle certain IPv6 socket options, w CVE-2004-03715.0Heimdal 0.6.x before 0.6.1 and 0.5.x before 0.5.3 does not properly perform certain consistency checks for cross-realm requests, which allow CVE-2004-03722.1xine allows local users to overwrite arbitrary files via a symlink attack on a bug report email that is generated by the (1) xine-bugreport CVE-2004-03746.4Interchange before 5.0.1 allows remote attackers to "expose the content of arbitrary variables" and read or modify sensitive SQL information CVE-2004-03755.0SYMNDIS.SYS in Symantec Norton Internet Security 2003 and 2004, Norton Personal Firewall 2003 and 2004, Client Firewall 5.01 and 5.1.1, and CVE-2004-03765.0oftpd 0.3.6 and earlier allows remote attackers to cause a denial of service (crash) via a PORT command with a large value.CVE-2004-037710.0Buffer overflow in the win32_stat function for (1) ActiveState's ActivePerl and (2) Larry Wall's Perl before 5.8.3 allows local or remote at