VYPR

CVEs

340,764 total · page 6615 of 6,816

AllCriticalHighKEV
  • CVE-2004-1823Dec 31, 2004
    Jelsoft
    Vbulletin
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Jelsoft vBulletin 2.0 beta 3 through 3.0 can4 allows remote attackers to inject arbitrary web script or HTML via the (1) page parameter to showthread.php or (2) order parameter to forumdisplay.php.

  • CVE-2004-1824Dec 31, 2004
    Jelsoft
    Vbulletin
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin before 3.0 allows remote attackers to inject arbitrary web script or HTML via the what parameter to memberlist.php.

  • CVE-2004-1828Dec 31, 2004
    Belchior Foundry
    Vcard
    risk 0.03cvss —epss 0.06

    Vcard 2.9 and possibly other versions does not require authorization to run uninstall.php, which could allow remote attackers to uninstall Vcard and delete database tables via a direct request to uninstall.php.

  • CVE-2004-1831Dec 31, 2004
    Techland
    Chrome
    risk 0.00cvss —epss 0.01

    Buffer overflow in Chrome 1.2.0.0 and earlier allows remote attackers to cause a denial of service (crash) via a packet with a large length value, which leads to a null dereference or out-of-bounds read.

  • CVE-2004-1832Dec 31, 2004
    Apple Inc.
    Mac OS X Server
    risk 0.00cvss —epss 0.01

    Buffer overflow in the GUI admin service in Mac OS X Server 10.3 allows remote attackers to cause a denial of service (crash and restart) via a large amount of data to TCP port 660.

  • CVE-2004-1835Dec 31, 2004
    Invision Power Services
    Gallery
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Invision Gallery 1.0.1 allow remote attackers to execute arbitrary SQL via the (1) img, (2) cat, (3) sort_key, (4) order_key, (5) user, or (6) album parameters.

  • CVE-2004-1836Dec 31, 2004
    Invision Power Services
    Invision Power Top Site List
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Invision Power Top Site List 1.1 RC 2 and earlier allows remote attackers to execute arbitrary SQL via the id parameter of the comments action.

  • CVE-2004-1837Dec 31, 2004
    Joel Palmius
    Mod Survey
    risk 0.00cvss —epss 0.00

    Cross-site scripting (XSS) vulnerability in Mod_survey 3.0.x before 3.0.16-pre2 and 3.2.x before 3.2.0-pre4 allows remote attackers to inject arbitrary web script or HTML via the certain survey fields or error messages for malformed query strings.

  • CVE-2004-1841Dec 31, 2004
    PHP-Nuke
    MS Analysis module
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in MS Analysis module 2.0 for PHP-Nuke allows remote attackers to execute arbitrary SQL via the referer field in an HTTP request.

  • CVE-2004-1842HigDec 31, 2004
    Warpspeed
    PHP Nuke
    risk 0.60cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Php-Nuke 6.x through 7.1.0 allows remote attackers to gain administrative privileges via an img tag with a URL to admin.php.

  • CVE-2004-1844Dec 31, 2004
    Lan Management System
    Lan Management System
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Member Management System 2.1 allows remote attackers to inject arbitrary web script or HTML via (1) the err parameter to error.asp or (2) register.asp.

  • CVE-2004-1845Dec 31, 2004
    Expinion.net
    News Manager Lite
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in News Manager Lite 2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to comment_add.asp, (2) search parameter to search.asp, or (3) n parameter to category_news_headline.asp.

  • CVE-2004-1848Dec 31, 2004
    Ipswitch, Inc.
    Ws FTP Server
    risk 0.01cvss —epss 0.14

    Ipswitch WS_FTP Server 4.0.2 allows remote attackers to cause a denial of service (disk consumption) and bypass file size restrictions via a REST command with a large size argument, followed by a STOR of a smaller file.

  • CVE-2004-1858Dec 31, 2004
    Microfocus
    Jetadmin
    risk 0.00cvss —epss 0.01

    HP Web Jetadmin 7.5.2546 allows remote attackers to cause a denial of service (crash) via a malformed request, possibly due to a stricmp() error from an invalid use of the "$" character.

  • CVE-2004-1860Dec 31, 2004
    Checkpoint
    SmartDashboard
    risk 0.00cvss —epss 0.02

    Buffer overflow in Check Point SmartDashboard in Check Point NG AI R54 and R55 allows remote authenticated users to cause a denial of service (server disconnect) and possibly execute arbitrary code via a large filter on a column when using SmartView Tracker.

  • CVE-2004-1863Dec 31, 2004
    Xmb Forum
    Xmb
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in XMB (aka extreme message board) 1.9 beta (aka Nexus beta) allow remote attackers to inject arbitrary web script or HTML via (1) the u2uheader parameter in editprofile.php, the restrict parameter in (2) member.php, (3)…

  • CVE-2004-1867Dec 31, 2004
    Web Fresh
    Fresh Guest Book
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in guest.cgi in Fresh Guest Book allows remote attackers to inject arbitrary web script or HTML via the Name field.

  • CVE-2004-1869Dec 31, 2004
    Nival Interactive
    Etherlords Ii
    risk 0.00cvss —epss 0.01

    Etherlords I 1.07 and earlier and Etherlords II 1.03 and earlier allows remote attackers to cause a denial of service (crash) by sending a packet that specifies the size for the next packet, then sending a larger packet than specified, which causes Etherlords to read unallocated…

  • CVE-2004-1873Dec 31, 2004
    Metalinks
    A Cart
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in category.asp in A-CART Pro and A-CART 2.0 allows remote attackers to gain privileges via the catcode parameter.

  • CVE-2004-1879Dec 31, 2004
    Phpkit
    Phpkit
    risk 0.00cvss —epss 0.00

    Cross-site scripting (XSS) vulnerability in PHPKIT 1.6.03 allows allows remote attackers to inject arbitrary web script or HTML via forum messages.

  • CVE-2004-1880Dec 31, 2004
    OpenLDAP
    Openldap
    risk 0.00cvss —epss 0.01

    Memory leak in the back-bdb backend for OpenLDAP 2.1.12 and earlier allows remote attackers to cause a denial of service (memory consumption).

  • CVE-2004-1881Dec 31, 2004
    Cactusoft
    Cactushop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in (1) mailorder.asp or (2) payonline.asp in CactuShop 5.x allows remote attackers to execute arbitrary SQL commands via the strItems parameter.

  • CVE-2004-1882Dec 31, 2004
    Cactusoft
    Cactushop
    risk 0.04cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in popuplargeimage.asp in CactuShop 5.x allows remote attackers to inject arbitrary web script or HTML via the strImageTag parameter.

  • CVE-2004-1883Dec 31, 2004
    Progress (organisation)
    Ws FTP Server
    risk 0.03cvss —epss 0.02

    Multiple buffer overflows in Ipswitch WS_FTP Server 4.0.2 (1) allow remote authenticated users to execute arbitrary code by causing a large error string to be generated by the ALLO handler, or (2) may allow remote FTP administrators to execute arbitrary code by causing a long…

  • CVE-2004-1885Dec 31, 2004
    Progress (organisation)
    Ws FTP Server
    risk 0.01cvss —epss 0.07

    Ipswitch WS_FTP Server 4.0.2 allows remote authenticated users to execute arbitrary programs as SYSTEM by using the SITE command to modify certain iFtpSvc options that are handled by iftpmgr.exe.

  • CVE-2004-1887Dec 31, 2004
    Patrice Freydiere
    ImgSvr
    risk 0.04cvss —epss 0.10

    Ada Image Server (ImgSvr) 0.4 allows remote attackers to view directories or download files via an HTTP request with a trailing %00 (null).

  • CVE-2004-1888Dec 31, 2004
    Aborior
    Encore Web Forum
    risk 0.04cvss —epss 0.09

    display.cgi in Aborior Encore WebForum allows remote to execute arbitrary commands via shell metacharacters in the file variable.

  • CVE-2004-1889Dec 31, 2004
    Sgi
    Irix
    risk 0.00cvss —epss 0.01

    Unknown vulnerability in ftpd in SGI IRIX 6.5.20 through 6.5.23 allows remote attackers to cause a denial of service (hang) via a link failure with Microsoft Windows.

  • CVE-2004-1891Dec 31, 2004
    Sgi
    Irix
    risk 0.00cvss —epss 0.00

    The ftp_syslog function in ftpd in SGI IRIX 6.5.20 "doesn't work with anonymous FTP," which has an unknown impact, possibly preventing the actions of anonymous users from being logged.

  • CVE-2004-1892Dec 31, 2004
    Emule
    Emule
    risk 0.04cvss —epss 0.15

    Stack-based buffer overflow in DecodeBase16 function, as used in the (1) IRC module and (2) web server in eMule 0.42d, allows remote attackers to execute arbitrary code via a long string.

  • CVE-2004-1893Dec 31, 2004
    Macromedia
    Dreamweaver
    risk 0.00cvss —epss 0.01

    Dreamweaver MX, when "Using Driver On Testing Server" or "Using DSN on Testing Server" is selected, uploads the mmhttpdb.asp script to the web site but does not require authentication, which allows remote attackers to obtain sensitive information and possibly execute arbitrary…

  • CVE-2004-1894Dec 31, 2004
    Context Project
    Context
    risk 0.00cvss —epss 0.00

    TEXutil in ConTEXt, when executed with the --silent option, allows local users to overwrite arbitrary files via a symlink attack on texutil.log.

  • CVE-2004-1895Dec 31, 2004
    SUSE S.A.
    YaST Online Update
    risk 0.00cvss —epss 0.00

    YaST Online Update (YOU) in SuSE 8.2 and 9.0 allows local users to overwrite arbitrary files via a symlink attack on you-$USER/cookies.

  • CVE-2004-1896Dec 31, 2004
    Nullsoft
    Winamp
    risk 0.02cvss —epss 0.25

    Heap-based buffer overflow in in_mod.dll in Nullsoft Winamp 2.91 through 5.02 allows remote attackers to execute arbitrary code via a Fasttracker 2 (.xm) mod media file.

  • CVE-2004-1897Dec 31, 2004
    Tildeslash
    Monit
    risk 0.04cvss —epss 0.07

    Administration interface in Monit 1.4 through 4.2 allows remote attackers to cause a denial of service (segmentation fault) by sending a Basic Authentication request without a password, which causes Monit to decrement a null pointer and perform an out-of-bounds read.

  • CVE-2004-1898Dec 31, 2004
    Tildeslash
    Monit
    risk 0.06cvss —epss 0.34

    Stack-based buffer overflow in the administration interface in Monit 1.4 through 4.2 allows remote attackers to execute arbitrary code via a long username.

  • CVE-2004-1899Dec 31, 2004
    Tildeslash
    Monit
    risk 0.00cvss —epss 0.01

    The administration interface in Monit 1.4 through 4.2 allows remote attackers to cause an off-by-one overflow via a POST that contains 1024 bytes.

  • CVE-2004-1900Dec 31, 2004
    Pan Vision
    I.g.i 2 Covert Strike
    risk 0.00cvss —epss 0.04

    Format string vulnerability in the logging function in IGI 2 Covert Strike server 1.3 and earlier allows remote attackers to execute arbitrary code via format string specifiers in RCON commands.

  • CVE-2004-1901MedDec 31, 2004
    File Project
    Portage
    risk 0.36cvss 5.5epss 0.00

    Portage before 2.0.50-r3 allows local users to overwrite arbitrary files via a hard link attack on the lockfiles.

  • CVE-2004-1902Dec 31, 2004
    Citrix Systems
    Metaframe Password Manager
    risk 0.00cvss —epss 0.00

    The Citrix MetaFrame Password Manager 2.0, when a central credential store is not configured, does not encrypt passwords entered immediately after executing the First Time User Wizards, which allows local users to gain sensitive information.

  • CVE-2004-1903Dec 31, 2004
    Sun Corporation
    3D
    risk 0.03cvss —epss 0.06

    Buffer overflow in blaxxun 3D 7.0 allows remote attackers to execute arbitrary code via a long URL property inside an object tag.

  • CVE-2004-1904Dec 31, 2004
    Panda Project
    Activescan
    risk 0.04cvss —epss 0.07

    Buffer overflow in ascontrol.dll in Panda ActiveScan 5.0 allows remote attackers to execute arbitrary code via the Internacional property followed by a long string.

  • CVE-2004-1905Dec 31, 2004
    Panda Project
    Activescan
    risk 0.00cvss —epss 0.01

    ascontrol.dll in Panda ActiveScan 5.0 allows remote attackers to cause a denial of service (crash) by calling the SetSitesFile function.

  • CVE-2004-1906Dec 31, 2004
    McAfee
    Freescan
    risk 0.04cvss —epss 0.10

    Mcafee FreeScan allows remote attackers to cause a denial of service and possibly arbitrary code via a long string in the ScanParam property of a COM object, which may trigger a buffer overflow.

  • CVE-2004-1907Dec 31, 2004
    Kerio Technologies
    Personal Firewall
    risk 0.04cvss —epss 0.09

    The Web Filtering functionality in Kerio Personal Firewall (KPF) 4.0.13 allows remote attackers to cause a denial of service (crash) by sending hex-encoded URLs containing "%13%12%13".

  • CVE-2004-1908Dec 31, 2004
    McAfee
    Freescan
    risk 0.04cvss —epss 0.12

    McFreeScan.CoMcFreeScan.1 ActiveX object in Mcafee FreeScan allows remote attackers to obtain sensitive information via the GetSpecialFolderLocation function with certain parameters.

  • CVE-2004-1909Dec 31, 2004
    ClamAV
    Clamav
    risk 0.00cvss —epss 0.01

    Claim Anti-Virus (ClamAV) 0.68 and earlier allows remote attackers to cause a denial of service (crash) via certain RAR archives, such as those generated by the Beagle/Bagle worm.

  • CVE-2004-1910Dec 31, 2004
    Symantec
    Virus Detection
    risk 0.04cvss —epss 0.07

    rufsi.dll in Symantec Virus Detection allows remote attackers to cause a denial of service (crash) via a long string to the GetPrivateProfileString function. NOTE: this issue was originally reported as a buffer overflow, but that specific claim is disputed by the vendor,…

  • CVE-2004-1911Dec 31, 2004
    Azerbaijan Development Group
    Azdgdating
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in AzDGDatingLite 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the (1) l parameter (aka language variable) to index.php or (2) id parameter to view.php.

  • CVE-2004-1912Dec 31, 2004
    Shiba Design
    Nukecalendar
    risk 0.03cvss —epss 0.00

    The (1) modules.php, (2) block-Calendar.php, (3) block-Calendar1.php, (4) block-Calendar_center.php scripts in NukeCalendar 1.1.a, as used in PHP-Nuke, allow remote attackers to obtain sensitive information via a URL with an invalid argument, which reveals the full path in an…