CVE-2004-1036

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in the decoding of encoded text in certain headers in mime.php for SquirrelMail 1.4.3a and earlier, and 1.5.1-cvs before 23rd October 2004, allows remote attackers to execute arbitrary web script or HTML.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published: Mar 1, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-103710.0The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string.CVE-2004-10387.2A design error in the IEEE1394 specification allows attackers with physical access to a device to read and write to sensitive memory using a CVE-2004-10395.0The NFS mountd service on SCO UnixWare 7.1.1, 7.1.3, 7.1.4, and 7.0.1, and possibly other versions, when run from inetd, allows remote attac CVE-2004-10435.0Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help CVE-2004-10495.1Integer overflow in the LoadImage API of the USER32 Lib for Microsoft Windows allows remote attackers to execute arbitrary code via a .bmp, CVE-2004-105010.0Heap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute arbitrary code via long (1) SRC or (2) NAME attributes CVE-2004-10517.2sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables to create functions that have CVE-2004-105210.0Buffer overflow in the getnickuserhost function in BNC 2.8.9, and possibly other versions, allows remote IRC servers to execute arbitrary co CVE-2004-105310.0Integer overflow in fetch on FreeBSD 4.1 through 5.3 allows remote malicious servers to execute arbitrary code via certain HTTP headers in a CVE-2004-10547.2Untrusted execution path vulnerability in invscout in IBM AIX 5.1.0, 5.2.0, and 5.3.0 allows local users to gain privileges by modifying the CVE-2004-10556.8Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and earlier allow remote attackers to inject arbitrary web scrip CVE-2004-10566.4Direct Rendering Manager (DRM) driver in Linux kernel 2.6 does not properly check the DMA lock, which could allow remote attackers or local