CVEs

340,763 total · page 6617 of 6,816

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2004-2075	Sophos Anti Virus	0.00	—	0.01	Dec 31, 2004	Sophos Anti-Virus 3.78 allows remote attackers to cause a denial of service (infinite loop) via a MIME header that is not properly terminated.
CVE-2004-2076	Jelsoft Vbulletin	0.03	—	0.00	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in search.php for Jelsoft vBulletin 3.0.0 RC4 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
CVE-2004-2081	Karjasoft Sami FTP Server	0.03	—	0.03	Dec 31, 2004	The samiftp.dll library in Sami FTP Server 1.1.3 allows local users to cause a denial of service (pmsystem.exe crash) by issuing (1) a CD command with a tilde (~) character or dot dot (/../) or (2) a GET command for an unavailable file.
CVE-2004-2094	Webcamxp Webcamxp	0.03	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in WebcamXP 1.06.945 allows remote attackers to inject arbitrary HTML or web script as other users via a URL that contains the script.
CVE-2004-2095	Libevent Project Honeyd	0.00	—	0.01	Dec 31, 2004	Honeyd before 0.8 replies to TCP packets with the SYN and RST flags set, which allows remote attackers to identify IP addresses that are being simulated by Honeyd.
CVE-2004-2096	Mephistoles Internet Suite Mephistoles Httpd	0.03	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in Mephistoles httpd 0.6.0 final allows remote attackers to execute arbitrary script as other users by injecting arbitrary HTML or script into the URL.
CVE-2004-2097	SUSE S.A. Linux	0.00	—	0.00	Dec 31, 2004	Multiple scripts on SuSE Linux 9.0 allow local users to overwrite arbitrary files via a symlink attack on (1) /tmp/fvwm-bug created by fvwm-bug, (2) /tmp/wmmenu created by wm-oldmenu2new, (3) /tmp/rates created by x11perfcomp, (4) /tmp/xf86debug.1.log created by xf86debug, (5)…
CVE-2004-2098	Native Solutions The Banner Engine	0.00	—	0.00	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in the banner engine (TBE) 5.0 allows remote attackers to execute arbitrary script as other users via the HTML banner view/preview capability.
CVE-2004-2099	Electronic Arts Need For Speed Hot Pursuit 2	0.03	—	0.05	Dec 31, 2004	Buffer overflow in Need for Speed Hot Pursuit 2.0 client (NFSHP2), version 242 and earlier, allows remote attackers (servers) to execute arbitrary code via long (1) gamename, (2) gamever, (3) hostname, (4) gametype, (5) mapname or (6) gamemode commands.
CVE-2004-2100	Geovision Geohttpserver	0.00	—	0.00	Dec 31, 2004	GeoHttpServer, when configured to authenticate users, allows remote attackers to bypass authentication and access unauthorized files via a URL that contains %0a%0a (encoded newlines).
CVE-2004-2101	Geovision Geohttpserver	0.00	—	0.01	Dec 31, 2004	The sysinfo script in GeoHttpServer allows remote attackers to cause a denial of service (crash) via a long pwd parameter, possibly triggering a buffer overflow.
CVE-2004-2102	Acme Thttpd	0.03	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in FREESCO 2.05, a modified version of thttpd, allows remote attackers to inject arbitrary web script or HTML via the test parameter.
CVE-2004-2103	Novell Netware	0.00	—	0.00	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to process arbitrary script or HTML as other users via (1) a malformed request for a Perl program with script in the filename, (2) the User.id parameter to the…
CVE-2004-2104	Novell Netware	0.04	—	0.07	Dec 31, 2004	Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to obtain sensitive server information, including the internal IP address, via a direct request to (1) snoop.jsp, (2) SnoopServlet, (3) env.bas, or (4) lcgitest.nlm.
CVE-2004-2105	Novell Netware	0.00	—	0.00	Dec 31, 2004	The webacc servlet in Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to read arbitrary .htt files via a full pathname in the error parameter.
CVE-2004-2106	Novell Netware	0.00	—	0.00	Dec 31, 2004	Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to list directories via a direct request to (1) /com/, (2) /com/novell/, (3) /com/novell/webaccess, or (4) /ns-icons/.
CVE-2004-2107	Finjan Software Surfingate	0.04	—	0.10	Dec 31, 2004	Finjan SurfinGate 6.0 and 7.0, when running in proxy mode, does not authenticate FHTTP commands on TCP port 3141, which allows remote attackers to use the finjan-parameter-type header to (1) restart the service, (2) use the getlastmsg command to view log information, or (3) use…
CVE-2004-2108	Quadcomm Q Shop	0.00	—	0.04	Dec 31, 2004	Multiple SQL injection vulnerabilities in QuadComm Q-Shop allow remote attackers to execute arbitrary SQL commands via certain parameters to (1) search.asp, (2) browse.asp, (3) details.asp, (4) showcat.asp, (5) users.asp, (6) addtomylist.asp, (7) modline.asp, (8) cart.asp, or…
CVE-2004-2109	Quadcomm Q Shop	0.00	—	0.02	Dec 31, 2004	Multiple cross-site scripting (XSS) vulnerabilities in (1) imagezoom.asp or (2) recommend.asp in Q-Shop allow remote attackers to execute arbitrary script and steal the user session ID via Javascript in a URL.
CVE-2004-2110	Phorum Phorum	0.00	—	0.00	Dec 31, 2004	SQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hide_email parameter.
CVE-2004-2111	SolarWinds Serv U File Server	0.09	—	0.81	Dec 31, 2004	Stack-based buffer overflow in the site chmod command in Serv-U FTP Server before 4.2 allows remote attackers to execute arbitrary code via a long filename.
CVE-2004-2112	Herberlin Bremsserver	0.03	—	0.05	Dec 31, 2004	Directory traversal vulnerability in BremsServer 1.2.4 allows remote attackers to read arbitrary files via ".." (dot dot) sequences in the URL.
CVE-2004-2113	Herberlin Bremsserver	0.03	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in BremsServer 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the URL.
CVE-2004-2114	Internetnow Proxynow	0.03	—	0.06	Dec 31, 2004	Stack-based and heap-based buffer overflows in ProxyNow! 2.75 and earlier allow remote attackers to execute arbitrary code via a GET request with a long ftp:// URL.
CVE-2004-2115	Oracle Corporation HTTP Server	0.07	—	0.50	Dec 31, 2004	Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.
CVE-2004-2116	Tinyserver Tinyserver	0.04	—	0.12	Dec 31, 2004	Directory traversal vulnerability in Tiny Server 1.1 allows remote attackers to read or download arbitrary files via a .. (dot dot) in the URL.
CVE-2004-2118	Tinyserver Tinyserver	0.00	—	0.01	Dec 31, 2004	Tiny Server 1.1 allows remote attackers to cause a denial of service (crash) via a GET request with a long filename, possibly due to a buffer overflow.
CVE-2004-2119	Saurabh Gupta Tiny Server	0.03	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in Tiny Server 1.1 allows remote attackers to inject arbitrary web script or HTML via the URL.
CVE-2004-2121	Borland Software Borland Web Server	0.03	—	0.04	Dec 31, 2004	Multiple directory traversal vulnerabilities in Borland Web Server (BWS) 1.0b3 and earlier allow remote attackers to read and download arbitrary files via (1) multi-dot "......" sequences, or (2) "%5c%2e%2e" (encoded "\..") sequences, in the URL.
CVE-2004-2123	Nextplace E Commerce Asp Engine	0.00	—	0.00	Dec 31, 2004	Multiple cross-site scripting (XSS) vulnerabilities in Nextplace.com E-Commerce ASP Engine allow remote attackers to inject arbitrary web script or HTML via the (1) level parameter of productdetail.asp, (2) searchKey parameter of searchresults.asp, and possibly (3) level…
CVE-2004-2124	Gallery Project Gallery	0.04	—	0.06	Dec 31, 2004	The register_globals simulation capability in Gallery 1.3.1 through 1.4.1 allows remote attackers to modify the HTTP_POST_VARS variable and conduct a PHP remote file inclusion attack via the GALLERY_BASEDIR parameter, a different vulnerability than CVE-2002-1412.
CVE-2004-2125	Iss Blackice Pc Protection	0.00	—	0.00	Dec 31, 2004	Buffer overflow in blackd.exe for BlackICE PC Protection 3.6 and other versions before 3.6.ccb, with application protection off, allows local users to gain system privileges by modifying the .INI file to contain a long packetLog.fileprefix value.
CVE-2004-2126	Iss Blackice Pc Protection	0.00	—	0.00	Dec 31, 2004	The upgrade for BlackICE PC Protection 3.6 and earlier sets insecure permissions for .INI files such as (1) blackice.ini, (2) firewall.ini, (3) protect.ini, or (4) sigs.ini, which allows local users to modify BlackICE configuration or possibly execute arbitrary code by…
CVE-2004-2128	Brs Webweaver	0.03	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in BRS WebWeaver 1.07 allows remote attackers to execute arbitrary script as other users via the query string to ISAPISkeleton.dll.
CVE-2004-2129	SurfNOW SurfNOW	0.03	—	0.05	Dec 31, 2004	SurfNOW 2.2 allows remote attackers to cause a denial of service (crash) via a series of long HTTP GET requests, possibly triggering a buffer overflow.
CVE-2004-2137	Microsoft Outlook Express	0.02	—	0.22	Dec 31, 2004	Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" setting, leaks the BCC recipients of the message to the addresses listed in the To and CC fields, which may allow remote attackers to obtain sensitive information.
CVE-2004-2138	Allwebscripts Mysqlguest	0.00	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in AWSguest.php in AllWebScripts MySQLGuest allows remote attackers to inject arbitrary HTML and PHP code via the (1) Name, (2) Email, (3) Homepage or (4) Comments field.
CVE-2004-2139	Yabb Yabb	0.00	—	0.01	Dec 31, 2004	Unknown vulnerability in Adminedit.pl YaBB 1 Gold before 1.3.2 allows attackers to execute arbitrary code via settings.pl.
CVE-2004-2140	Yabb Yabb	0.00	—	0.00	Dec 31, 2004	CRLF injection vulnerability in YaBB 1 Gold before 1.3.2 allows remote attackers to modify text file contents via the subject variable.
CVE-2004-2142	Jorg Schilling Sdd	0.00	—	0.00	Dec 31, 2004	Unknown vulnerability in the remote tape support (remote.c) in the RMT client for Jorg Schilling sdd 1.28 and 1.31 has unknown impact and attack vectors.
CVE-2004-2143	Mambo (software) Mambo Portal	0.03	—	0.02	Dec 31, 2004	SQL injection vulnerability in the ReMOSitory Server add-on module to Mambo Portal 4.5.1 (1.09) and earlier allows remote attackers to execute arbitrary SQL commands via the filecatid parameter in the com_remository option.
CVE-2004-2144	Baalsystems Baal Smart Forms	0.00	—	0.01	Dec 31, 2004	Baal Smart Forms before 3.2 allows remote attackers to bypass authentication and obtain system access via a direct request to regadmin.php.
CVE-2004-2145	Pd9 Software Megabbs	0.00	—	0.01	Dec 31, 2004	SQL injection vulnerability in PD9 Software MegaBBS 2 and 2.1 allows remote attackers to execute arbitrary SQL commands via the (1) sortdir or (2) criteria parameter to ladder-log.asp or the (3) memberid or (4) teamid parameter to view-profile.asp.
CVE-2004-2146	Pd9 Software Megabbs	0.00	—	0.00	Dec 31, 2004	CRLF injection vulnerability in PD9 Software MegaBBS 2 and 2.1 allows attackers to conduct HTTP response splitting attacks via the fid parameter in a writenew action to thread-post.asp.
CVE-2004-2147	Symantec Norton Antivirus	0.00	—	0.01	Dec 31, 2004	Unknown versions of Symantec Norton AntiVirus and Microsoft Outlook allow attackers to cause a denial of service (crash) via malformed e-mail messages (1) without a body or (2) without a carriage return ("\n") separating the headers from the body.
CVE-2004-2148	Slava Astashonok Fprobe	0.00	—	0.00	Dec 31, 2004	Unknown local vulnerability in the "change user" feature of Slava Astashonok Fprobe 1.0.5 and earlier has unknown impact and attack vectors.
CVE-2004-2149	MySQL MySQL	0.00	—	0.02	Dec 31, 2004	Buffer overflow in the prepared statements API in libmysqlclient for MySQL 4.1.3 beta and 4.1.4 allows remote attackers to cause a denial of service via a large number of placeholders.
CVE-2004-2150	Nettica Intellipeer Email Server	0.00	—	0.01	Dec 31, 2004	Nettica Corporation INTELLIPEER Email Server 1.01 displays different error messages for valid and invalid account names, which allows remote attackers to determine valid account names.
CVE-2004-2151	Virtual Projects Chatman	0.03	—	0.06	Dec 31, 2004	Chatman 1.1.1 RC1 and earlier allows remote attackers to cause a denial of service (memory consumption or application crash) via a very large data size.
CVE-2004-2152	MediaWiki Mediawiki	0.00	—	0.00	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in 'raw' page output mode for MediaWiki 1.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML.

CVE-2004-2075Dec 31, 2004
Sophos
Anti Virus
risk 0.00cvss —epss 0.01
Sophos Anti-Virus 3.78 allows remote attackers to cause a denial of service (infinite loop) via a MIME header that is not properly terminated.
CVE-2004-2076Dec 31, 2004
Jelsoft
Vbulletin
risk 0.03cvss —epss 0.00
Cross-site scripting (XSS) vulnerability in search.php for Jelsoft vBulletin 3.0.0 RC4 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
CVE-2004-2081Dec 31, 2004
Karjasoft
Sami FTP Server
risk 0.03cvss —epss 0.03
The samiftp.dll library in Sami FTP Server 1.1.3 allows local users to cause a denial of service (pmsystem.exe crash) by issuing (1) a CD command with a tilde (~) character or dot dot (/../) or (2) a GET command for an unavailable file.
CVE-2004-2094Dec 31, 2004
Webcamxp
Webcamxp
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in WebcamXP 1.06.945 allows remote attackers to inject arbitrary HTML or web script as other users via a URL that contains the script.
CVE-2004-2095Dec 31, 2004
Libevent Project
Honeyd
risk 0.00cvss —epss 0.01
Honeyd before 0.8 replies to TCP packets with the SYN and RST flags set, which allows remote attackers to identify IP addresses that are being simulated by Honeyd.
CVE-2004-2096Dec 31, 2004
Mephistoles Internet Suite
Mephistoles Httpd
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Mephistoles httpd 0.6.0 final allows remote attackers to execute arbitrary script as other users by injecting arbitrary HTML or script into the URL.
CVE-2004-2097Dec 31, 2004
SUSE S.A.
Linux
risk 0.00cvss —epss 0.00
Multiple scripts on SuSE Linux 9.0 allow local users to overwrite arbitrary files via a symlink attack on (1) /tmp/fvwm-bug created by fvwm-bug, (2) /tmp/wmmenu created by wm-oldmenu2new, (3) /tmp/rates created by x11perfcomp, (4) /tmp/xf86debug.1.log created by xf86debug, (5)…
CVE-2004-2098Dec 31, 2004
Native Solutions
The Banner Engine
risk 0.00cvss —epss 0.00
Cross-site scripting (XSS) vulnerability in the banner engine (TBE) 5.0 allows remote attackers to execute arbitrary script as other users via the HTML banner view/preview capability.
CVE-2004-2099Dec 31, 2004
Electronic Arts
Need For Speed Hot Pursuit 2
risk 0.03cvss —epss 0.05
Buffer overflow in Need for Speed Hot Pursuit 2.0 client (NFSHP2), version 242 and earlier, allows remote attackers (servers) to execute arbitrary code via long (1) gamename, (2) gamever, (3) hostname, (4) gametype, (5) mapname or (6) gamemode commands.
CVE-2004-2100Dec 31, 2004
Geovision
Geohttpserver
risk 0.00cvss —epss 0.00
GeoHttpServer, when configured to authenticate users, allows remote attackers to bypass authentication and access unauthorized files via a URL that contains %0a%0a (encoded newlines).
CVE-2004-2101Dec 31, 2004
Geovision
Geohttpserver
risk 0.00cvss —epss 0.01
The sysinfo script in GeoHttpServer allows remote attackers to cause a denial of service (crash) via a long pwd parameter, possibly triggering a buffer overflow.
CVE-2004-2102Dec 31, 2004
Acme
Thttpd
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in FREESCO 2.05, a modified version of thttpd, allows remote attackers to inject arbitrary web script or HTML via the test parameter.
CVE-2004-2103Dec 31, 2004
Novell
Netware
risk 0.00cvss —epss 0.00
Cross-site scripting (XSS) vulnerability in Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to process arbitrary script or HTML as other users via (1) a malformed request for a Perl program with script in the filename, (2) the User.id parameter to the…
CVE-2004-2104Dec 31, 2004
Novell
Netware
risk 0.04cvss —epss 0.07
Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to obtain sensitive server information, including the internal IP address, via a direct request to (1) snoop.jsp, (2) SnoopServlet, (3) env.bas, or (4) lcgitest.nlm.
CVE-2004-2105Dec 31, 2004
Novell
Netware
risk 0.00cvss —epss 0.00
The webacc servlet in Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to read arbitrary .htt files via a full pathname in the error parameter.
CVE-2004-2106Dec 31, 2004
Novell
Netware
risk 0.00cvss —epss 0.00
Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to list directories via a direct request to (1) /com/, (2) /com/novell/, (3) /com/novell/webaccess, or (4) /ns-icons/.
CVE-2004-2107Dec 31, 2004
Finjan Software
Surfingate
risk 0.04cvss —epss 0.10
Finjan SurfinGate 6.0 and 7.0, when running in proxy mode, does not authenticate FHTTP commands on TCP port 3141, which allows remote attackers to use the finjan-parameter-type header to (1) restart the service, (2) use the getlastmsg command to view log information, or (3) use…
CVE-2004-2108Dec 31, 2004
Quadcomm
Q Shop
risk 0.00cvss —epss 0.04
Multiple SQL injection vulnerabilities in QuadComm Q-Shop allow remote attackers to execute arbitrary SQL commands via certain parameters to (1) search.asp, (2) browse.asp, (3) details.asp, (4) showcat.asp, (5) users.asp, (6) addtomylist.asp, (7) modline.asp, (8) cart.asp, or…
CVE-2004-2109Dec 31, 2004
Quadcomm
Q Shop
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in (1) imagezoom.asp or (2) recommend.asp in Q-Shop allow remote attackers to execute arbitrary script and steal the user session ID via Javascript in a URL.
CVE-2004-2110Dec 31, 2004
Phorum
Phorum
risk 0.00cvss —epss 0.00
SQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hide_email parameter.
CVE-2004-2111Dec 31, 2004
SolarWinds
Serv U File Server
risk 0.09cvss —epss 0.81
Stack-based buffer overflow in the site chmod command in Serv-U FTP Server before 4.2 allows remote attackers to execute arbitrary code via a long filename.
CVE-2004-2112Dec 31, 2004
Herberlin
Bremsserver
risk 0.03cvss —epss 0.05
Directory traversal vulnerability in BremsServer 1.2.4 allows remote attackers to read arbitrary files via ".." (dot dot) sequences in the URL.
CVE-2004-2113Dec 31, 2004
Herberlin
Bremsserver
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in BremsServer 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the URL.
CVE-2004-2114Dec 31, 2004
Internetnow
Proxynow
risk 0.03cvss —epss 0.06
Stack-based and heap-based buffer overflows in ProxyNow! 2.75 and earlier allow remote attackers to execute arbitrary code via a GET request with a long ftp:// URL.
CVE-2004-2115Dec 31, 2004
Oracle Corporation
HTTP Server
risk 0.07cvss —epss 0.50
Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.
CVE-2004-2116Dec 31, 2004
Tinyserver
Tinyserver
risk 0.04cvss —epss 0.12
Directory traversal vulnerability in Tiny Server 1.1 allows remote attackers to read or download arbitrary files via a .. (dot dot) in the URL.
CVE-2004-2118Dec 31, 2004
Tinyserver
Tinyserver
risk 0.00cvss —epss 0.01
Tiny Server 1.1 allows remote attackers to cause a denial of service (crash) via a GET request with a long filename, possibly due to a buffer overflow.
CVE-2004-2119Dec 31, 2004
Saurabh Gupta
Tiny Server
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Tiny Server 1.1 allows remote attackers to inject arbitrary web script or HTML via the URL.
CVE-2004-2121Dec 31, 2004
Borland Software
Borland Web Server
risk 0.03cvss —epss 0.04
Multiple directory traversal vulnerabilities in Borland Web Server (BWS) 1.0b3 and earlier allow remote attackers to read and download arbitrary files via (1) multi-dot "......" sequences, or (2) "%5c%2e%2e" (encoded "\..") sequences, in the URL.
CVE-2004-2123Dec 31, 2004
Nextplace
E Commerce Asp Engine
risk 0.00cvss —epss 0.00
Multiple cross-site scripting (XSS) vulnerabilities in Nextplace.com E-Commerce ASP Engine allow remote attackers to inject arbitrary web script or HTML via the (1) level parameter of productdetail.asp, (2) searchKey parameter of searchresults.asp, and possibly (3) level…
CVE-2004-2124Dec 31, 2004
Gallery Project
Gallery
risk 0.04cvss —epss 0.06
The register_globals simulation capability in Gallery 1.3.1 through 1.4.1 allows remote attackers to modify the HTTP_POST_VARS variable and conduct a PHP remote file inclusion attack via the GALLERY_BASEDIR parameter, a different vulnerability than CVE-2002-1412.
CVE-2004-2125Dec 31, 2004
Iss
Blackice Pc Protection
risk 0.00cvss —epss 0.00
Buffer overflow in blackd.exe for BlackICE PC Protection 3.6 and other versions before 3.6.ccb, with application protection off, allows local users to gain system privileges by modifying the .INI file to contain a long packetLog.fileprefix value.
CVE-2004-2126Dec 31, 2004
Iss
Blackice Pc Protection
risk 0.00cvss —epss 0.00
The upgrade for BlackICE PC Protection 3.6 and earlier sets insecure permissions for .INI files such as (1) blackice.ini, (2) firewall.ini, (3) protect.ini, or (4) sigs.ini, which allows local users to modify BlackICE configuration or possibly execute arbitrary code by…
CVE-2004-2128Dec 31, 2004
Brs
Webweaver
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in BRS WebWeaver 1.07 allows remote attackers to execute arbitrary script as other users via the query string to ISAPISkeleton.dll.
CVE-2004-2129Dec 31, 2004
SurfNOW
SurfNOW
risk 0.03cvss —epss 0.05
SurfNOW 2.2 allows remote attackers to cause a denial of service (crash) via a series of long HTTP GET requests, possibly triggering a buffer overflow.
CVE-2004-2137Dec 31, 2004
Microsoft
Outlook Express
risk 0.02cvss —epss 0.22
Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" setting, leaks the BCC recipients of the message to the addresses listed in the To and CC fields, which may allow remote attackers to obtain sensitive information.
CVE-2004-2138Dec 31, 2004
Allwebscripts
Mysqlguest
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in AWSguest.php in AllWebScripts MySQLGuest allows remote attackers to inject arbitrary HTML and PHP code via the (1) Name, (2) Email, (3) Homepage or (4) Comments field.
CVE-2004-2139Dec 31, 2004
Yabb
Yabb
risk 0.00cvss —epss 0.01
Unknown vulnerability in Adminedit.pl YaBB 1 Gold before 1.3.2 allows attackers to execute arbitrary code via settings.pl.
CVE-2004-2140Dec 31, 2004
Yabb
Yabb
risk 0.00cvss —epss 0.00
CRLF injection vulnerability in YaBB 1 Gold before 1.3.2 allows remote attackers to modify text file contents via the subject variable.
CVE-2004-2142Dec 31, 2004
Jorg Schilling
Sdd
risk 0.00cvss —epss 0.00
Unknown vulnerability in the remote tape support (remote.c) in the RMT client for Jorg Schilling sdd 1.28 and 1.31 has unknown impact and attack vectors.
CVE-2004-2143Dec 31, 2004
Mambo (software)
Mambo Portal
risk 0.03cvss —epss 0.02
SQL injection vulnerability in the ReMOSitory Server add-on module to Mambo Portal 4.5.1 (1.09) and earlier allows remote attackers to execute arbitrary SQL commands via the filecatid parameter in the com_remository option.
CVE-2004-2144Dec 31, 2004
Baalsystems
Baal Smart Forms
risk 0.00cvss —epss 0.01
Baal Smart Forms before 3.2 allows remote attackers to bypass authentication and obtain system access via a direct request to regadmin.php.
CVE-2004-2145Dec 31, 2004
Pd9 Software
Megabbs
risk 0.00cvss —epss 0.01
SQL injection vulnerability in PD9 Software MegaBBS 2 and 2.1 allows remote attackers to execute arbitrary SQL commands via the (1) sortdir or (2) criteria parameter to ladder-log.asp or the (3) memberid or (4) teamid parameter to view-profile.asp.
CVE-2004-2146Dec 31, 2004
Pd9 Software
Megabbs
risk 0.00cvss —epss 0.00
CRLF injection vulnerability in PD9 Software MegaBBS 2 and 2.1 allows attackers to conduct HTTP response splitting attacks via the fid parameter in a writenew action to thread-post.asp.
CVE-2004-2147Dec 31, 2004
Symantec
Norton Antivirus
risk 0.00cvss —epss 0.01
Unknown versions of Symantec Norton AntiVirus and Microsoft Outlook allow attackers to cause a denial of service (crash) via malformed e-mail messages (1) without a body or (2) without a carriage return ("\n") separating the headers from the body.
CVE-2004-2148Dec 31, 2004
Slava Astashonok
Fprobe
risk 0.00cvss —epss 0.00
Unknown local vulnerability in the "change user" feature of Slava Astashonok Fprobe 1.0.5 and earlier has unknown impact and attack vectors.
CVE-2004-2149Dec 31, 2004
MySQL
MySQL
risk 0.00cvss —epss 0.02
Buffer overflow in the prepared statements API in libmysqlclient for MySQL 4.1.3 beta and 4.1.4 allows remote attackers to cause a denial of service via a large number of placeholders.
CVE-2004-2150Dec 31, 2004
Nettica
Intellipeer Email Server
risk 0.00cvss —epss 0.01
Nettica Corporation INTELLIPEER Email Server 1.01 displays different error messages for valid and invalid account names, which allows remote attackers to determine valid account names.
CVE-2004-2151Dec 31, 2004
Virtual Projects
Chatman
risk 0.03cvss —epss 0.06
Chatman 1.1.1 RC1 and earlier allows remote attackers to cause a denial of service (memory consumption or application crash) via a very large data size.
CVE-2004-2152Dec 31, 2004
MediaWiki
Mediawiki
risk 0.00cvss —epss 0.00
Cross-site scripting (XSS) vulnerability in 'raw' page output mode for MediaWiki 1.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML.