CVE-2004-0928

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The Microsoft IIS Connector in JRun 4.0 and Macromedia ColdFusion MX 6.0, 6.1, and 6.1 J2EE allows remote attackers to bypass authentication and view source files, such as .asp, .pl, and .php files, via an HTTP request that ends in ";.cfm".

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=109621995623823&w=2
http://secunia.com/advisories/12638/Patch, Vendor Advisory
http://secunia.com/advisories/12647/Patch, Vendor Advisory
http://www.idefense.com/application/poi/display?id=148&type=vulnerabilitiesPatch, Vendor Advisory
http://www.kb.cert.org/vuls/id/977440Patch, Third Party Advisory, US Government Resource
http://www.macromedia.com/devnet/security/security_zone/mpsb04-08.htmlPatch, Vendor Advisory
http://www.macromedia.com/devnet/security/security_zone/mpsb04-09.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/11245Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17484
http://marc.info/?l=bugtraq&m=109621995623823&w=2
http://secunia.com/advisories/12638/Patch, Vendor Advisory
http://secunia.com/advisories/12647/Patch, Vendor Advisory
http://www.idefense.com/application/poi/display?id=148&type=vulnerabilitiesPatch, Vendor Advisory
http://www.kb.cert.org/vuls/id/977440Patch, Third Party Advisory, US Government Resource
http://www.macromedia.com/devnet/security/security_zone/mpsb04-08.htmlPatch, Vendor Advisory
http://www.macromedia.com/devnet/security/security_zone/mpsb04-09.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/11245Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17484

Timeline

Published: Oct 5, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-092910.0Heap-based buffer overflow in the OJPEGVSetField function in tif_ojpeg.c for libtiff 3.6.1 and earlier, when compiled with the OJPEG_SUPPORT CVE-2004-09305.0The ms_fnmatch function in Samba 3.0.4 and 3.0.7 and possibly other versions allows remote authenticated users to cause a denial of service CVE-2004-09315.0MySQL MaxDB before 7.5.00.18 allows remote attackers to cause a denial of service (crash) via an HTTP request to webdbm with high ASCII valu CVE-2004-09327.5McAfee Anti-Virus Engine DATS drivers before 4398 released on Oct 13th 2004 and DATS Driver before 4397 October 6th 2004 allows remote attac CVE-2004-09337.5Computer Associates (CA) InoculateIT 6.0, eTrust Antivirus r6.0 through r7.1, eTrust Antivirus for the Gateway r7.0 and r7.1, eTrust Secure CVE-2004-09347.5Kaspersky 3.x to 4.x allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to CVE-2004-09357.5Eset Anti-Virus before 1.020 (16th September 2004) allows remote attackers to bypass antivirus protection via a compressed file with both lo CVE-2004-09367.5RAV antivirus allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, w CVE-2004-09377.5Sophos Anti-Virus before 3.87.0, and Sophos Anti-Virus for Windows 95, 98, and Me before 3.88.0, allows remote attackers to bypass antivirus CVE-2004-09385.0FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (server crash) by sending an Ascend-Send-Secret attribute witho CVE-2004-09395.0changepassword.cgi in Neoteris Instant Virtual Extranet (IVE) 3.x and 4.x, with LDAP authentication or NT domain authentication enabled, doe CVE-2004-09407.8Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute