| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2004-2360 | 0.03 | — | 0.05 | Dec 31, 2004 | Targem Battle Mages 1.0 allows remote attackers to cause a denial of service (infinite loop) via a UDP packet with incomplete data, which causes the server to enter an infinite loop while waiting to read the rest of the data that is not sent. | |||
| CVE-2004-2361 | 0.00 | — | 0.00 | Dec 31, 2004 | Digital Reality game engine, as used in Haegemonia 1.0 through 1.0.7 and Desert Rats vs. Afrika Korps 1.0, allows remote attackers to cause a denial of service (crash) via a chat message with a large message size, which triggers an out-of-bounds read. | |||
| CVE-2004-2362 | 0.00 | — | 0.01 | Dec 31, 2004 | PHPX 3.2.6 and earlier allows remote attackers to obtain the physical path of PHPX via a null or invalid value in the limit parameter, which leaks the pathname in a database error message, as demonstrated using forums.php. | |||
| CVE-2004-2363 | 0.03 | — | 0.01 | Dec 31, 2004 | Validate-Before-Canonicalize vulnerability in the checkURI function in functions.inc.php in PHPX 3.0 through 3.2.6 allows remote attackers to conduct cross-site scripting (XSS) attacks via hex-encoded tags, which bypass the check for literal "<", ">", "(", and ")" characters, as… | |||
| CVE-2004-2364 | 0.04 | — | 0.07 | Dec 31, 2004 | Cross-site request forgery (CSRF) vulnerability in PHPX 3.0 through 3.2.6 allows remote attackers to execute arbitrary commands via URLs that are automatically executed on behalf of the administrator, as demonstrated using (1) admin/page.php, (2) admin/news.php, (3)… | |||
| CVE-2004-2365 | 0.00 | — | 0.00 | Dec 31, 2004 | Memory leak in Microsoft Windows XP and Windows Server 2003 allows local users to cause a denial of service (memory exhaustion) by repeatedly creating and deleting directories using a non-standard tool such as smbmount. | |||
| CVE-2004-2366 | 0.03 | — | 0.04 | Dec 31, 2004 | Buffer overflow in GlobalSCAPE Secure FTP Server 2.0 B03.11.2004.2 allows remote attackers to cause a denial of service (crash) via a SITE command with a long argument. | |||
| CVE-2004-2367 | 0.03 | — | 0.05 | Dec 31, 2004 | The Control Panel applet in WFTPD and WFTPD Pro 3.21 R1 and R2 allows remote authenticated users to cause a denial of service (crash) via a long FTP command. | |||
| CVE-2004-2368 | 0.03 | — | 0.04 | Dec 31, 2004 | PHP remote file inclusion vulnerability in header.php in Opt-X 0.7.2 allows remote attackers to execute arbitrary PHP code via the systempath parameter. | |||
| CVE-2004-2369 | 0.00 | — | 0.00 | Dec 31, 2004 | Directory traversal vulnerability in webadmin.nsf for Lotus Domino R6 6.5.1 allows attackers to create and detect directories via a .. (dot dot) in the directory creation command. | |||
| CVE-2004-2370 | 0.00 | — | 0.05 | Dec 31, 2004 | Stack-based buffer overflow in Trillian 0.71 through 0.74f and Trillian Pro 1.0 through 2.01 allows remote attackers to execute arbitrary code via a Yahoo Messenger packet with a long key name. | |||
| CVE-2004-2371 | 0.03 | — | 0.04 | Dec 31, 2004 | Multiple Red Storm web-based games, including Ghost Recon 1.4 and earlier, Desert Siege, and The Sum of all Fears 1.1.1.0 and earlier, do not properly check return values from certain functions, which allows remote attackers to cause a denial of service (hang) via packets that… | |||
| CVE-2004-2372 | 0.00 | — | 0.00 | Dec 31, 2004 | Buffer overflow in Bochs before 2.1.1, if installed setuid, allows local users to execute arbitrary code via a long HOME environment variable, which is used if the .bochsrc, bochsrc, and bochsrc.txt cannot be found in a known path. NOTE: some external documents recommend that… | |||
| CVE-2004-2373 | 0.03 | — | 0.03 | Dec 31, 2004 | The Buddy icon file for AOL Instant Messenger (AIM) 4.3 through 5.5 is created in a predictable location, which may allow remote attackers to use a shell: URI to exploit other vulnerabilities that involve predictable locations. | |||
| CVE-2004-2374 | 0.03 | — | 0.03 | Dec 31, 2004 | BadBlue 2.4 allows remote attackers to obtain the location of the server installation path via a request for phptest.php, which includes the pathname in the source of the resulting HTML. | |||
| CVE-2004-2375 | 0.05 | — | 0.20 | Dec 31, 2004 | Buffer overflow in the POP3 server in 1st Class Mail Server 4.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an APOP USER command with a long second parameter (digest). | |||
| CVE-2004-2376 | 0.00 | — | 0.02 | Dec 31, 2004 | Buffer overflow in postfile.exe for Twilight Utilities Web Server 2.0.0.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL request with a long attfile attribute. | |||
| CVE-2004-2377 | 0.00 | — | 0.01 | Dec 31, 2004 | Alcatel OmniSwitch 7000 and 7800 allows remote attackers to cause a denial of service (reboot) via certain network scans, as demonstrated using a Nessus port scan of ports 1 through 1024 with safe-checks disabled. | |||
| CVE-2004-2378 | 0.00 | — | 0.02 | Dec 31, 2004 | @Mail 3.64 for Windows allows remote attackers to cause a denial of service ("unusable" server) via a large number of POP3 connections to the server. | |||
| CVE-2004-2379 | 0.00 | — | 0.01 | Dec 31, 2004 | Multiple cross-site scripting (XSS) vulnerabilities in @Mail 3.64 for Windows allow remote attackers to inject arbitrary web script or HTML via (1) the Displayed Name attribute in util.pl and (2) the Folder attribute in showmail.pl. | |||
| CVE-2004-2380 | 0.00 | — | 0.00 | Dec 31, 2004 | Directory traversal vulnerability in postfile.exe for Twilight Utilities Web Server 2.0.0.0 allows remote attackers to write arbitrary files via a .. (dot dot) in the attfile parameter. | |||
| CVE-2004-2381 | 0.00 | — | 0.01 | Dec 31, 2004 | HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause denial of service (memory usage and application crash) via HTTP requests with a large Content-Length. | |||
| CVE-2004-2382 | 0.00 | — | 0.01 | Dec 31, 2004 | The PerfectNav plugin for Microsoft Internet Explorer allows remote attackers to cause a denial of service (browser crash) via a malformed URL such as "?". | |||
| CVE-2004-2383 | 0.04 | — | 0.15 | Dec 31, 2004 | Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to bypass cross-frame scripting restrictions and capture keyboard events from other domains via an HTML document with Javascript that is outside a frameset that includes the target domain, then forcing the… | |||
| CVE-2004-2384 | 0.00 | — | 0.01 | Dec 31, 2004 | NullSoft Winamp 5.02 allows remote attackers to cause a denial of service (crash) by creating a file with a long filename, which causes the victim's player to crash when the file is opened from the command line. | |||
| CVE-2004-2385 | 0.03 | — | 0.05 | Dec 31, 2004 | EMU Webmail 5.2.7 allows remote attackers to obtain sensitive path information (home directory) via an HTTP request for init.emu. | |||
| CVE-2004-2386 | 0.00 | — | 0.04 | Dec 31, 2004 | Format string vulnerability in the LogMsg function in sercd before 2.3.1 and sredird 2.2.1 and earlier allows remote attackers to execute arbitrary code via format string specifiers passed from the HandleCPCCommand function. | |||
| CVE-2004-2387 | 0.00 | — | 0.05 | Dec 31, 2004 | Buffer overflow in the HandleCPCCommand function of sercd before 2.3.1 and sredird 2.2.1 and earlier allows remote attackers to execute arbitrary code. | |||
| CVE-2004-2388 | 0.00 | — | 0.01 | Dec 31, 2004 | rexecd for AIX 4.3.3 does not properly use a local copy of the pwd structure when calling getpwnam, which may cause the structure to be overwritten by the authenticate function and assign privileges to the wrong user. | |||
| CVE-2004-2389 | 0.00 | — | 0.01 | Dec 31, 2004 | Unknown vulnerability in Jabber Gadu-Gadu Transport (a.k.a. jabber-gg-transport) 2.0.x before 2.0.8 allows remote attackers to cause a denial of service (infinite loop) via user re-registration. | |||
| CVE-2004-2390 | 0.00 | — | 0.00 | Dec 31, 2004 | The roster import functionality in Jabber Gadu-Gadu Transport (a.k.a. jabber-gg-transport) 2.0.x before 2.0.8, when using libgadu 1.0 and later, allows attackers to cause a denial of service via unknown vectors. | |||
| CVE-2004-2391 | 0.00 | — | 0.01 | Dec 31, 2004 | Jabber Gadu-Gadu Transport (a.k.a. jabber-gg-transport) 2.0.x before 2.0.8 allows remote attackers to cause a denial of service a message with an empty tag. | |||
| CVE-2004-2392 | 0.00 | — | 0.01 | Dec 31, 2004 | libuser 0.51.7 allows attackers to cause a denial of service (crash or disk consumption) via unknown attack vectors, related to read failures and other bugs. | |||
| CVE-2004-2393 | 0.00 | — | 0.01 | Dec 31, 2004 | Java Secure Socket Extension (JSSE) 1.0.3 through 1.0.3_2 does not properly validate the certificate chain of a client or server, which allows remote attackers to falsely authenticate peers for SSL/TLS. | |||
| CVE-2004-2394 | 0.00 | — | 0.00 | Dec 31, 2004 | Off-by-one error in passwd 0.68 and earlier, when using the --stdin option, causes passwd to use the first 78 characters of a password instead of the first 79, which results in a small reduction of the search space required for brute force attacks. | |||
| CVE-2004-2395 | 0.00 | — | 0.00 | Dec 31, 2004 | Memory leak in passwd 0.68 allows local users to cause a denial of service (memory consumption) via a large number of failed read attempts from the password buffer. | |||
| CVE-2004-2396 | 0.00 | — | 0.00 | Dec 31, 2004 | passwd 0.68 does not check the return code for the pam_start function, which has unknown impact and attack vectors that may prevent "safe and proper operation" of PAM. | |||
| CVE-2004-2397 | Hig | 0.49 | 7.5 | 0.00 | Dec 31, 2004 | The web-based Management Console in Blue Coat Security Gateway OS 3.0 through 3.1.3.13 and 3.2.1, when importing a private key, stores the key and its passphrase in plaintext in a log file, which allows attackers to steal digital certificates. | ||
| CVE-2004-2398 | 0.00 | — | 0.00 | Dec 31, 2004 | Netenberg Fantastico De Luxe 2.8 uses database file names that contain the associated usernames, which allows local users to determine valid usernames and conduct brute force attacks by reading the file names from /var/lib/mysql, which is assigned world-readable permissions by… | |||
| CVE-2004-2399 | 0.00 | — | 0.01 | Dec 31, 2004 | Secure Computing Corporation Sidewinder G2 6.1.0.01 allows remote attackers to cause a denial of service (CPU consumption) via delayed responses to DNS queries. | |||
| CVE-2004-2400 | 0.00 | — | 0.00 | Dec 31, 2004 | WinFTP Server 1.6 stores username and password credentials in plaintext in the data\user.wfd file, which allows local users to gain access to the credentials. | |||
| CVE-2004-2401 | 0.00 | — | 0.01 | Dec 31, 2004 | Stack-based buffer overflow in Ipswitch IMail Express Web Messaging before 8.05 might allow remote attackers to execute arbitrary code via an HTML message with long "tag text." | |||
| CVE-2004-2402 | 0.00 | — | 0.01 | Dec 31, 2004 | Cross-site scripting (XSS) vulnerability in YaBB.pl in YaBB 1 GOLD SP 1.3.2 allows remote attackers to inject arbitrary web script or HTML via a hex-encoded to parameter. NOTE: some sources say that the board parameter is affected, but this is incorrect. | |||
| CVE-2004-2403 | 0.00 | — | 0.01 | Dec 31, 2004 | Cross-site request forgery (CSRF) vulnerability in YaBB 1 GOLD SP 1.3.2 allows remote attackers to perform unauthorized actions as the administrative user via a link or IMG tag to YaBB.pl that specifies the desired action, id, and moda parameters. | |||
| CVE-2004-2405 | 0.00 | — | 0.00 | Dec 31, 2004 | Buffer overflow in multiple F-Secure Anti-Virus products, including F-Secure Anti-Virus 5.42 and earlier, allows remote attackers to bypass scanning or cause a denial of service (crash or module restart), depending on the product, via a malformed LHA archive. | |||
| CVE-2004-2406 | 0.00 | — | 0.00 | Dec 31, 2004 | Unknown "overflow" in the phpgw_config table for phpGroupWare before 0.9.14.002 has unknown attack vectors and impact. | |||
| CVE-2004-2407 | 0.00 | — | 0.00 | Dec 31, 2004 | Unknown vulnerability in phpGroupWare before 0.9.14.002 has unknown attack vectors and impact, related to a "security hole" in the Setup/Config functionality. | |||
| CVE-2004-2408 | 0.00 | — | 0.00 | Dec 31, 2004 | Linux VServer 1.27 and earlier, 1.3.9 and earlier, and 1.9.1 and earlier shares /proc permissions across all virtual and host servers, which allows local users with the ability to set permissions in /proc to obtain system information or cause a denial of service on other virtual… | |||
| CVE-2004-2409 | 0.00 | — | 0.00 | Dec 31, 2004 | Buffer overflow in the sh_hash_compdata function for Samhain 1.8.9 through 2.0.1, when running in update mode ("-t update"), might allow attackers to execute arbitrary code. | |||
| CVE-2004-2410 | 0.00 | — | 0.00 | Dec 31, 2004 | Unknown vulnerability in sh_hash_compdata for Samhain 1.8.9 through 2.0.1 might allow attackers to cause a denial of service (null pointer dereference). |
- CVE-2004-2360Dec 31, 2004risk 0.03cvss —epss 0.05
Targem Battle Mages 1.0 allows remote attackers to cause a denial of service (infinite loop) via a UDP packet with incomplete data, which causes the server to enter an infinite loop while waiting to read the rest of the data that is not sent.
- CVE-2004-2361Dec 31, 2004risk 0.00cvss —epss 0.00
Digital Reality game engine, as used in Haegemonia 1.0 through 1.0.7 and Desert Rats vs. Afrika Korps 1.0, allows remote attackers to cause a denial of service (crash) via a chat message with a large message size, which triggers an out-of-bounds read.
- CVE-2004-2362Dec 31, 2004risk 0.00cvss —epss 0.01
PHPX 3.2.6 and earlier allows remote attackers to obtain the physical path of PHPX via a null or invalid value in the limit parameter, which leaks the pathname in a database error message, as demonstrated using forums.php.
- CVE-2004-2363Dec 31, 2004risk 0.03cvss —epss 0.01
Validate-Before-Canonicalize vulnerability in the checkURI function in functions.inc.php in PHPX 3.0 through 3.2.6 allows remote attackers to conduct cross-site scripting (XSS) attacks via hex-encoded tags, which bypass the check for literal "<", ">", "(", and ")" characters, as…
- CVE-2004-2364Dec 31, 2004risk 0.04cvss —epss 0.07
Cross-site request forgery (CSRF) vulnerability in PHPX 3.0 through 3.2.6 allows remote attackers to execute arbitrary commands via URLs that are automatically executed on behalf of the administrator, as demonstrated using (1) admin/page.php, (2) admin/news.php, (3)…
- CVE-2004-2365Dec 31, 2004risk 0.00cvss —epss 0.00
Memory leak in Microsoft Windows XP and Windows Server 2003 allows local users to cause a denial of service (memory exhaustion) by repeatedly creating and deleting directories using a non-standard tool such as smbmount.
- CVE-2004-2366Dec 31, 2004risk 0.03cvss —epss 0.04
Buffer overflow in GlobalSCAPE Secure FTP Server 2.0 B03.11.2004.2 allows remote attackers to cause a denial of service (crash) via a SITE command with a long argument.
- CVE-2004-2367Dec 31, 2004risk 0.03cvss —epss 0.05
The Control Panel applet in WFTPD and WFTPD Pro 3.21 R1 and R2 allows remote authenticated users to cause a denial of service (crash) via a long FTP command.
- CVE-2004-2368Dec 31, 2004risk 0.03cvss —epss 0.04
PHP remote file inclusion vulnerability in header.php in Opt-X 0.7.2 allows remote attackers to execute arbitrary PHP code via the systempath parameter.
- CVE-2004-2369Dec 31, 2004risk 0.00cvss —epss 0.00
Directory traversal vulnerability in webadmin.nsf for Lotus Domino R6 6.5.1 allows attackers to create and detect directories via a .. (dot dot) in the directory creation command.
- CVE-2004-2370Dec 31, 2004risk 0.00cvss —epss 0.05
Stack-based buffer overflow in Trillian 0.71 through 0.74f and Trillian Pro 1.0 through 2.01 allows remote attackers to execute arbitrary code via a Yahoo Messenger packet with a long key name.
- CVE-2004-2371Dec 31, 2004risk 0.03cvss —epss 0.04
Multiple Red Storm web-based games, including Ghost Recon 1.4 and earlier, Desert Siege, and The Sum of all Fears 1.1.1.0 and earlier, do not properly check return values from certain functions, which allows remote attackers to cause a denial of service (hang) via packets that…
- CVE-2004-2372Dec 31, 2004risk 0.00cvss —epss 0.00
Buffer overflow in Bochs before 2.1.1, if installed setuid, allows local users to execute arbitrary code via a long HOME environment variable, which is used if the .bochsrc, bochsrc, and bochsrc.txt cannot be found in a known path. NOTE: some external documents recommend that…
- CVE-2004-2373Dec 31, 2004risk 0.03cvss —epss 0.03
The Buddy icon file for AOL Instant Messenger (AIM) 4.3 through 5.5 is created in a predictable location, which may allow remote attackers to use a shell: URI to exploit other vulnerabilities that involve predictable locations.
- CVE-2004-2374Dec 31, 2004risk 0.03cvss —epss 0.03
BadBlue 2.4 allows remote attackers to obtain the location of the server installation path via a request for phptest.php, which includes the pathname in the source of the resulting HTML.
- CVE-2004-2375Dec 31, 2004risk 0.05cvss —epss 0.20
Buffer overflow in the POP3 server in 1st Class Mail Server 4.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an APOP USER command with a long second parameter (digest).
- CVE-2004-2376Dec 31, 2004risk 0.00cvss —epss 0.02
Buffer overflow in postfile.exe for Twilight Utilities Web Server 2.0.0.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL request with a long attfile attribute.
- CVE-2004-2377Dec 31, 2004risk 0.00cvss —epss 0.01
Alcatel OmniSwitch 7000 and 7800 allows remote attackers to cause a denial of service (reboot) via certain network scans, as demonstrated using a Nessus port scan of ports 1 through 1024 with safe-checks disabled.
- CVE-2004-2378Dec 31, 2004risk 0.00cvss —epss 0.02
@Mail 3.64 for Windows allows remote attackers to cause a denial of service ("unusable" server) via a large number of POP3 connections to the server.
- CVE-2004-2379Dec 31, 2004risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in @Mail 3.64 for Windows allow remote attackers to inject arbitrary web script or HTML via (1) the Displayed Name attribute in util.pl and (2) the Folder attribute in showmail.pl.
- CVE-2004-2380Dec 31, 2004risk 0.00cvss —epss 0.00
Directory traversal vulnerability in postfile.exe for Twilight Utilities Web Server 2.0.0.0 allows remote attackers to write arbitrary files via a .. (dot dot) in the attfile parameter.
- CVE-2004-2381Dec 31, 2004risk 0.00cvss —epss 0.01
HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause denial of service (memory usage and application crash) via HTTP requests with a large Content-Length.
- CVE-2004-2382Dec 31, 2004risk 0.00cvss —epss 0.01
The PerfectNav plugin for Microsoft Internet Explorer allows remote attackers to cause a denial of service (browser crash) via a malformed URL such as "?".
- CVE-2004-2383Dec 31, 2004risk 0.04cvss —epss 0.15
Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to bypass cross-frame scripting restrictions and capture keyboard events from other domains via an HTML document with Javascript that is outside a frameset that includes the target domain, then forcing the…
- CVE-2004-2384Dec 31, 2004risk 0.00cvss —epss 0.01
NullSoft Winamp 5.02 allows remote attackers to cause a denial of service (crash) by creating a file with a long filename, which causes the victim's player to crash when the file is opened from the command line.
- CVE-2004-2385Dec 31, 2004risk 0.03cvss —epss 0.05
EMU Webmail 5.2.7 allows remote attackers to obtain sensitive path information (home directory) via an HTTP request for init.emu.
- CVE-2004-2386Dec 31, 2004risk 0.00cvss —epss 0.04
Format string vulnerability in the LogMsg function in sercd before 2.3.1 and sredird 2.2.1 and earlier allows remote attackers to execute arbitrary code via format string specifiers passed from the HandleCPCCommand function.
- CVE-2004-2387Dec 31, 2004risk 0.00cvss —epss 0.05
Buffer overflow in the HandleCPCCommand function of sercd before 2.3.1 and sredird 2.2.1 and earlier allows remote attackers to execute arbitrary code.
- CVE-2004-2388Dec 31, 2004risk 0.00cvss —epss 0.01
rexecd for AIX 4.3.3 does not properly use a local copy of the pwd structure when calling getpwnam, which may cause the structure to be overwritten by the authenticate function and assign privileges to the wrong user.
- CVE-2004-2389Dec 31, 2004risk 0.00cvss —epss 0.01
Unknown vulnerability in Jabber Gadu-Gadu Transport (a.k.a. jabber-gg-transport) 2.0.x before 2.0.8 allows remote attackers to cause a denial of service (infinite loop) via user re-registration.
- CVE-2004-2390Dec 31, 2004risk 0.00cvss —epss 0.00
The roster import functionality in Jabber Gadu-Gadu Transport (a.k.a. jabber-gg-transport) 2.0.x before 2.0.8, when using libgadu 1.0 and later, allows attackers to cause a denial of service via unknown vectors.
- CVE-2004-2391Dec 31, 2004risk 0.00cvss —epss 0.01
Jabber Gadu-Gadu Transport (a.k.a. jabber-gg-transport) 2.0.x before 2.0.8 allows remote attackers to cause a denial of service a message with an empty tag.
- CVE-2004-2392Dec 31, 2004risk 0.00cvss —epss 0.01
libuser 0.51.7 allows attackers to cause a denial of service (crash or disk consumption) via unknown attack vectors, related to read failures and other bugs.
- CVE-2004-2393Dec 31, 2004risk 0.00cvss —epss 0.01
Java Secure Socket Extension (JSSE) 1.0.3 through 1.0.3_2 does not properly validate the certificate chain of a client or server, which allows remote attackers to falsely authenticate peers for SSL/TLS.
- CVE-2004-2394Dec 31, 2004risk 0.00cvss —epss 0.00
Off-by-one error in passwd 0.68 and earlier, when using the --stdin option, causes passwd to use the first 78 characters of a password instead of the first 79, which results in a small reduction of the search space required for brute force attacks.
- CVE-2004-2395Dec 31, 2004risk 0.00cvss —epss 0.00
Memory leak in passwd 0.68 allows local users to cause a denial of service (memory consumption) via a large number of failed read attempts from the password buffer.
- CVE-2004-2396Dec 31, 2004risk 0.00cvss —epss 0.00
passwd 0.68 does not check the return code for the pam_start function, which has unknown impact and attack vectors that may prevent "safe and proper operation" of PAM.
- risk 0.49cvss 7.5epss 0.00
The web-based Management Console in Blue Coat Security Gateway OS 3.0 through 3.1.3.13 and 3.2.1, when importing a private key, stores the key and its passphrase in plaintext in a log file, which allows attackers to steal digital certificates.
- CVE-2004-2398Dec 31, 2004risk 0.00cvss —epss 0.00
Netenberg Fantastico De Luxe 2.8 uses database file names that contain the associated usernames, which allows local users to determine valid usernames and conduct brute force attacks by reading the file names from /var/lib/mysql, which is assigned world-readable permissions by…
- CVE-2004-2399Dec 31, 2004risk 0.00cvss —epss 0.01
Secure Computing Corporation Sidewinder G2 6.1.0.01 allows remote attackers to cause a denial of service (CPU consumption) via delayed responses to DNS queries.
- CVE-2004-2400Dec 31, 2004risk 0.00cvss —epss 0.00
WinFTP Server 1.6 stores username and password credentials in plaintext in the data\user.wfd file, which allows local users to gain access to the credentials.
- CVE-2004-2401Dec 31, 2004risk 0.00cvss —epss 0.01
Stack-based buffer overflow in Ipswitch IMail Express Web Messaging before 8.05 might allow remote attackers to execute arbitrary code via an HTML message with long "tag text."
- CVE-2004-2402Dec 31, 2004risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in YaBB.pl in YaBB 1 GOLD SP 1.3.2 allows remote attackers to inject arbitrary web script or HTML via a hex-encoded to parameter. NOTE: some sources say that the board parameter is affected, but this is incorrect.
- CVE-2004-2403Dec 31, 2004risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in YaBB 1 GOLD SP 1.3.2 allows remote attackers to perform unauthorized actions as the administrative user via a link or IMG tag to YaBB.pl that specifies the desired action, id, and moda parameters.
- CVE-2004-2405Dec 31, 2004risk 0.00cvss —epss 0.00
Buffer overflow in multiple F-Secure Anti-Virus products, including F-Secure Anti-Virus 5.42 and earlier, allows remote attackers to bypass scanning or cause a denial of service (crash or module restart), depending on the product, via a malformed LHA archive.
- CVE-2004-2406Dec 31, 2004risk 0.00cvss —epss 0.00
Unknown "overflow" in the phpgw_config table for phpGroupWare before 0.9.14.002 has unknown attack vectors and impact.
- CVE-2004-2407Dec 31, 2004risk 0.00cvss —epss 0.00
Unknown vulnerability in phpGroupWare before 0.9.14.002 has unknown attack vectors and impact, related to a "security hole" in the Setup/Config functionality.
- CVE-2004-2408Dec 31, 2004risk 0.00cvss —epss 0.00
Linux VServer 1.27 and earlier, 1.3.9 and earlier, and 1.9.1 and earlier shares /proc permissions across all virtual and host servers, which allows local users with the ability to set permissions in /proc to obtain system information or cause a denial of service on other virtual…
- CVE-2004-2409Dec 31, 2004risk 0.00cvss —epss 0.00
Buffer overflow in the sh_hash_compdata function for Samhain 1.8.9 through 2.0.1, when running in update mode ("-t update"), might allow attackers to execute arbitrary code.
- CVE-2004-2410Dec 31, 2004risk 0.00cvss —epss 0.00
Unknown vulnerability in sh_hash_compdata for Samhain 1.8.9 through 2.0.1 might allow attackers to cause a denial of service (null pointer dereference).