CVE-2004-1609

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

SalesLogix 6.1 includes usernames, passwords, and other sensitive information in the headers of an HTTP response, which could allow remote attackers to gain access.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/fulldisclosure/2004-10/0661.html
http://marc.info/?l=bugtraq&m=109811852218478&w=2
http://secunia.com/advisories/12883Patch, Vendor Advisory
http://securitytracker.com/id?1011769
http://www.osvdb.org/10946
http://www.securityfocus.com/bid/11450Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17753
http://archives.neohapsis.com/archives/fulldisclosure/2004-10/0661.html
http://marc.info/?l=bugtraq&m=109811852218478&w=2
http://secunia.com/advisories/12883Patch, Vendor Advisory
http://securitytracker.com/id?1011769
http://www.osvdb.org/10946
http://www.securityfocus.com/bid/11450Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17753

Timeline

Published: Oct 18, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-16107.5SalesLogix 6.1 uses client-specified pathnames for writing certain files, which might allow remote authenticated users to create arbitrary f CVE-2004-16115.1SalesLogix 6.1 does not verify if a user is authenticated before performing sensitive operations, which could allow remote attackers to (1) CVE-2004-16125.0Directory traversal vulnerability in SalesLogix 6.1 allows remote attackers to upload arbitrary files via a .. (dot dot) in a ProcessQueueFi CVE-2004-16135.0Mozilla allows remote attackers to cause a denial of service (application crash from null dereference or infinite loop) via a web page that CVE-2004-16145.0Mozilla allows remote attackers to cause a denial of service (application crash from invalid memory access) via an "unusual combination of v CVE-2004-16152.6Opera allows remote attackers to cause a denial of service (invalid memory reference and application crash) via a web page or HTML email tha CVE-2004-16165.0Links allows remote attackers to cause a denial of service (memory consumption) via a web page or HTML email that contains a table with a td CVE-2004-16175.0Lynx, lynx-ssl, and lynx-cur before 2.8.6dev.8 allow remote attackers to cause a denial of service (infinite loop) via a web page or HTML em CVE-2004-16185.0Vypress Tonecast 1.3 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed mp2 stream.CVE-2004-16197.5Buffer overflow in Privateer's Bounty: Age of Sail II allows remote attackers to execute arbitrary code via a long nickname.CVE-2004-16205.0CRLF injection vulnerability in Serendipity before 0.7rc1 allows remote attackers to perform HTTP Response Splitting attacks to modify expec CVE-2004-16214.3NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in IBM Lotus Notes R6 and Domino R6, and possibl