CVE-2004-2704
Hastymail 1.0.1 and earlier (stable) and 1.1 and earlier (development) does not send the ...
Hastymail 1.0.1 and earlier (stable) and 1.1 and earlier (development) does not send the "attachment" parameter in the Content-Disposition field for attachments, which causes the attachment to be rendered inline by Internet Explorer when the victim clicks the download link, which facilitates cross-site scripting (XSS) and possibly other attacks.
Exploit likelihood
What each source reports
NVD Score used
Hastymail 1.0.1 and earlier (stable) and 1.1 and earlier (development) does not send the "attachment" parameter in the Content-Disposition field for attachments, which causes the attachment to be rendered inline by Internet Explorer when the victim clicks the download link, which facilitates cross-site scripting (XSS) and possibly other attacks.
- Record
CVE-2004-2704- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Hastymail 1.0.1 and earlier (stable) and 1.1 and earlier (development) does not send the "attachment" parameter in the Content-Disposition field for attachments, which causes the attachment to be rendered inline by Internet Explorer when the victim clicks the download link, which facilitates cross-site scripting (XSS) and possibly other attacks.
- Record
CVE-2004-2704- Updated
- 2026-11-02
EUVDEUVD-2004-2694 No score
Hastymail 1.0.1 and earlier (stable) and 1.1 and earlier (development) does not send the "attachment" parameter in the Content-Disposition field for attachments, which causes the attachment to be rendered inline by Internet Explorer when the victim clicks the download link, which facilitates cross-site scripting (XSS) and possibly other attacks.
- Record
EUVD-2004-2694- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q953-qm86-wxwh No score
Hastymail 1.0.1 and earlier (stable) and 1.1 and earlier (development) does not send the ...
Hastymail 1.0.1 and earlier (stable) and 1.1 and earlier (development) does not send the "attachment" parameter in the Content-Disposition field for attachments, which causes the attachment to be rendered inline by Internet Explorer when the victim clicks the download link, which facilitates cross-site scripting (XSS) and possibly other attacks.
- Record
GHSA-q953-qm86-wxwh- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-2704 is a medium vulnerability (CVSS 4.3) in Hastymail, published December 31, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.73%, the 91st percentile. No source names a fixed version.
References
secunia.com/advisories/12358
securityfocus.com/bid/11022
osvdb.org/9131
archives.neohapsis.com/archives/bugtraq/2004-08/0322.html
hastymail.sourceforge.net/security.php
exchange.xforce.ibmcloud.com/vulnerabilities/17091
securitytracker.com/id?1011054
nvd.nist.gov/vuln/detail/CVE-2004-2704
github.com/advisories/GHSA-q953-qm86-wxwh