CVEs

340,752 total · page 6629 of 6,816

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2004-2716	Phpmychat Phpmychat	0.03	—	0.01	Dec 31, 2004	Multiple SQL injection vulnerabilities in usersL.php3 in PHPMyChat 0.14.5 allow remote attackers to execute arbitrary SQL commands via the (1) sortBy, (2) sortOrder, (3) startReg, (4) U, (5) LastCheck , and (6) R parameters.
CVE-2004-2717	Phpmychat Phpmychat	0.03	—	0.03	Dec 31, 2004	Multiple directory traversal vulnerabilities in admin.php3 in PHPMyChat 0.14.5 allow remote attackers with administrative privileges to read arbitrary files via a .. (dot dot) in the (1) sheet and (2) What parameters.
CVE-2004-2718	Phpmychat Phpmychat	0.03	—	0.03	Dec 31, 2004	PHPMyChat 0.14.5 does not remove or protect setup.php3 after installation, which allows attackers to obtain sensitive information including database passwords via a direct request.
CVE-2004-2719	Foxmail Foxmail	0.05	—	0.21	Dec 31, 2004	Buffer overflow in the UrlToLocal function in PunyLib.dll of Foxmail 5.0.300 allows remote attackers to execute arbitrary code via a mail message with a long From field, a different issue than CVE-2005-0339.
CVE-2004-2720	Snitz Communications Forums 2000	0.04	—	0.09	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in register.asp in Snitz Forums 2000 3.4.04 and earlier allows remote attackers to inject arbitrary web script or HTML via javascript events in the Email parameter.
CVE-2004-2721	openSkat VTMF	0.00	—	0.01	Dec 31, 2004	The CheckGroup function in openSkat VTMF before 2.1 generates public key pairs in which the "p" variable might not be prime, which allows remote attackers to determine the private key and decrypt messages.
CVE-2004-2722	Tenable Nessus	0.00	—	0.00	Dec 31, 2004	Nessus 2.0.10a stores account passwords in plaintext in .nessusrc files, which allows local users to obtain passwords. NOTE: the original researcher reports that the vendor has disputed this issue
CVE-2004-2723	Tenable Nessuswx	0.00	—	0.00	Dec 31, 2004	NessusWX 1.4.4 stores account passwords in plaintext in .session files, which allows local users to obtain passwords.
CVE-2004-2724	Lionmax Software Chat Anywhere	0.00	—	0.01	Dec 31, 2004	LionMax Software Chat Anywhere 2.72a allows remote attackers to cause a denial of service (server crash and client CPU consumption) via a username beginning with percent (%) followed by a null character.
CVE-2004-2725	Aztek Forum Aztek Forum	0.03	—	0.01	Dec 31, 2004	Multiple cross-site scripting (XSS) vulnerabilities in Aztek Forum 4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in (a) search.php, (2) the email parameter in (b) subscribe.php, and (3) the return and (4) title parameters in (c)…
CVE-2004-2726	MailEnable Mailenable	0.00	—	0.02	Dec 31, 2004	HTTPMail service in MailEnable Professional 1.18 does not properly handle arguments to the Authorization header, which allows remote attackers to cause a denial of service (null dereference and application crash). NOTE: This is a different vulnerability than CVE-2005-1348.
CVE-2004-2727	MailEnable Mailenable	0.03	—	0.04	Dec 31, 2004	Buffer overflow in MEHTTPS (HTTPMail) of MailEnable Professional 1.5 through 1.7 allows remote attackers to cause a denial of service (application crash) via a long HTTP GET request.
CVE-2004-2728	Hummingbird Connectivity	0.00	—	0.01	Dec 31, 2004	Buffer overflow in the FTP server of Hummingbird Connectivity 7.1 and 9.0 allows remote, authenticated users to cause a denial of service (application crash) via a long argument to the XCWD command.
CVE-2004-2729	Hummingbird Connectivity	0.00	—	0.00	Dec 31, 2004	Inetd32 Administration Tool of Hummingbird Connectivity 7.1 and 9.0 allows local users to execute arbitrary code by changing the program for handling incoming connections.
CVE-2004-2730	Sysinternals PsTools	0.00	—	0.01	Dec 31, 2004	Sysinternals PsTools before 2.05, including (1) PsExec before 1.54, (2) PsGetsid before 1.41, (3) PsInfo before 1.61, (4) PsKill before 1.03, (5) PsList before 1.26, (6) PsLoglist before 2.51, (7) PsPasswd before 1.21, (8) PsService before 2.12, (9) PsSuspend before 1.05, and…
CVE-2004-2731	Linux Kernel	0.00	—	0.00	Dec 31, 2004	Multiple integer overflows in Sbus PROM driver (drivers/sbus/char/openprom.c) for the Linux kernel 2.4.x up to 2.4.27, 2.6.x up to 2.6.7, and possibly later versions, allow local users to execute arbitrary code by specifying (1) a small buffer size to the copyin_string function…
CVE-2004-2732	Netbilling Netbilling	0.03	—	0.03	Dec 31, 2004	nbmember.cgi in Netbilling 2.0 allows remote attackers to obtain sensitive information via the cmd=test option, which can be leveraged to determine the access key.
CVE-2004-2733	Webwiz Web Wiz Forums	0.00	—	0.01	Dec 31, 2004	Web Wiz Forums 7.7a uses invalid logic to determine user privileges, which allows remote attackers to (1) block arbitrary IP addresses via pop_up_ip_blocking.asp or (2) modify topics via pop_up_topic_admin.asp.
CVE-2004-2734	Novell Netware	0.00	—	0.03	Dec 31, 2004	webadmin-apache.conf in Novell Web Manager of Novell NetWare 6.5 uses an uppercase Alias tag with an inconsistent lowercase directory tag for a volume, which allows remote attackers to bypass access control to the WEB-INF folder.
CVE-2004-2735	Fredric Fredricson P4db	0.00	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in P4DB 2.01 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) SET_PREFERENCES parameter in SetPreferences.cgi; (2) BRANCH parameter in branchView.cgi; (3) FSPC and (4) COMPLETE parameters in…
CVE-2004-2736	Polar Software Helpdesk	0.04	—	0.06	Dec 31, 2004	Polar HelpDesk 3.0 allows remote attackers to bypass authentication by setting the UserId and UserType values in a cookie.
CVE-2004-2737	Netsupport Dna Helpdesk	0.03	—	0.01	Dec 31, 2004	SQL injection vulnerability in problist.asp in NetSupport DNA HelpDesk 1.01 allows remote attackers to execute arbitrary SQL commands via the where parameter.
CVE-2004-2738	Zeroboard Zeroboard	0.00	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in check_user_id.php in ZeroBoard 4.1pl4 and earlier allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.
CVE-2004-2739	Phprojekt Phprojekt	0.00	—	0.01	Dec 31, 2004	The setup routine (setup.php) in PHProjekt 4.2.1 and earlier allows remote attackers to modify system configuration via unknown attack vectors.
CVE-2004-2740	Phprojekt Phprojekt	0.00	—	0.01	Dec 31, 2004	PHP remote file inclusion vulnerability in authform.inc.php in PHProjekt 4.2.3 and earlier allows remote attackers to include arbitrary PHP code via a URL in the path_pre parameter.
CVE-2004-2741	Horde (software) Application Framework	0.00	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in the "help window" (help.php) in Horde Application Framework 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) module, (2) topic, or (3) module parameters.
CVE-2004-2742	Businessobjects Crystal Enterprise	0.00	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in the report viewer in Crystal Enterprise 8.5, 9, and 10 allows remote attackers to inject arbitrary web script or HTML via script in the URL to a report (RPT) file.
CVE-2004-2743	Raditha Dissanayake Mega Upload Progress Bar	0.00	—	0.01	Dec 31, 2004	upload.cgi in Mega Upload Progress Bar before 1.45 allows remote attackers to copy or overwrite arbitrary files via unspecified parameters related to names of uploaded files.
CVE-2004-2744	Tincan Phplist	0.00	—	0.00	Dec 31, 2004	Unspecified vulnerability in Tincan Limited PHPlist before 2.8.12 has unknown impact and attack vectors, related to a "security update release."
CVE-2004-2745	Anteco Visual Technologies Ownserver	0.03	—	0.02	Dec 31, 2004	Directory traversal vulnerability in Anteco Visual Technologies OwnServer 1.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in a URL.
CVE-2004-2746	Francisco Charrua Photo Gallery	0.03	—	0.01	Dec 31, 2004	SQL injection vulnerability in adminlogin.asp in XTREME ASP Photo Gallery 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
CVE-2004-2747	Pablo Software Solutions Quick N Easy FTP Server	0.00	—	0.00	Dec 31, 2004	Directory traversal vulnerability in Pablo Software Solutions Quick 'n Easy FTP Server 1.77, and possibly earlier versions, allows remote authenticated users to determine the existence of arbitrary files via a .. (dot dot) in the DEL command, which triggers different error…
CVE-2004-2748	Webtrends Reporting Center	0.04	—	0.07	Dec 31, 2004	viewreport.pl in NetIQ WebTrends Reporting Center Enterprise Edition 6.1a allows remote attackers to determine the installation path via an invalid profileid parameter, which leaks the pathname in an error message.
CVE-2004-2749	2wire Homeportal	0.03	—	0.01	Dec 31, 2004	Directory traversal vulnerability in wra/public/wralogin in 2Wire Gateway, possibly as used in HomePortal and other product lines, allows remote attackers to read arbitrary files via a .. (dot dot) in the return parameter. NOTE: this issue was reported as XSS, but this might be…
CVE-2004-2750	Jbrowser Jbrowser	0.03	—	0.03	Dec 31, 2004	Directory traversal vulnerability in browser.php in JBrowser 1.0 through 2.1 allows remote attackers to read arbitrary files via the directory parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2004-2751	Postnuke Postnuke	0.00	—	0.01	Dec 31, 2004	SQL injection vulnerability in the members_list module in PostNuke 0.726, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the sortby parameter.
CVE-2004-2752	Postnuke Postnuke	0.00	—	0.00	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in the Downloads module in PostNuke up to 0.726, and possibly later versions, allows remote attackers to inject arbitrary HTML and web script via the ttitle parameter in a viewdownloaddetails action.
CVE-2004-2753	HPE HP-UX	0.00	—	0.00	Dec 31, 2004	Unspecified vulnerability in SharedX in HP-UX B.11.00, B.11.11, and B.11.22 allows local users to access unspecified files or cause a denial of service via unknown vectors related to handling of "files in a potentially insecure manner."
CVE-2004-2754	Yabb Yabb Se	0.03	—	0.02	Dec 31, 2004	SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the ID_MEMBER parameter to the (1) recentTopics and (2) welcome functions.
CVE-2004-2755	Symantec Web Security	0.00	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in Symantec Web Security 2.5, 3.0.0, and 3.0.1 before build 62 allows remote attackers to inject arbitrary web script or HTML via the query string in blocked URLs that are listed in (1) error or (2) block page messages.
CVE-2004-2756	XOOPS Xoops	0.03	—	0.00	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in viewtopic.php in Xoops 2.x, possibly 2 through 2.0.5, allows remote attackers to inject arbitrary web script or HTML via the (1) forum and (2) topic_id parameters.
CVE-2004-2757	Novell Ichain	0.00	—	0.00	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in the failed login page in Novell iChain before 2.2 build 2.2.113 and 2.3 First Customer Ship (FCS) allows remote attackers to inject arbitrary web script or HTML via url parameter.
CVE-2004-2758	Sun Corporation Sunforum	0.01	—	0.08	Dec 31, 2004	Multiple unspecified vulnerabilities in the H.323 protocol implementation for Sun SunForum 3.2 and 3D 1.0 allow remote attackers to cause a denial of service (segmentation fault and process crash), as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.
CVE-2004-2759	Sun Corporation Storedge Qfs	0.00	—	0.00	Dec 31, 2004	Shared Sun StorEdge QFS and SAM-QFS file systems, as used in Utilization Suite 4.0 through 4.1 and Performance Suite 4.0 through 4.1, might allow local users to read portions of deleted files by accessing data within sparse files.
CVE-2004-2760	Apache Sshd	0.00	—	0.00	Dec 31, 2004	sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open after an attempt with an incorrect password, which makes it easier for remote attackers to guess…
CVE-2004-1376	Microsoft Internet Explorer	0.01	—	0.11	Dec 30, 2004	Directory traversal vulnerability in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote malicious FTP servers to overwrite arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command.
CVE-2004-1316	Mozilla Corporation Mozilla	0.00	—	0.05	Dec 29, 2004	Heap-based buffer overflow in MSG_UnEscapeSearchUrl in nsNNTPProtocol.cpp for Mozilla 1.7.3 and earlier allows remote attackers to cause a denial of service (application crash) via an NNTP URL (news:) with a trailing '\' (backslash) character, which prevents a string from being…
CVE-2004-1062	Viewvc Viewcvs	0.00	—	0.01	Dec 28, 2004	Multiple cross-site scripting (XSS) vulnerabilities in ViewCVS 0.9.2 allow remote attackers to inject arbitrary HTML and web script via certain error messages.
CVE-2004-1317	Netcat Netcat	0.09	—	0.78	Dec 27, 2004	Stack-based buffer overflow in doexec.c in Netcat for Windows 1.1, when running with the -e option, allows remote attackers to execute arbitrary code via a long DNS command.
CVE-2004-1377	GNU A2ps	0.00	—	0.00	Dec 27, 2004	The (1) fixps (aka fixps.in) and (2) psmandup (aka psmandup.in) scripts in a2ps before 4.13 allow local users to overwrite arbitrary files via a symlink attack on temporary files.

CVE-2004-2716Dec 31, 2004
Phpmychat
Phpmychat
risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in usersL.php3 in PHPMyChat 0.14.5 allow remote attackers to execute arbitrary SQL commands via the (1) sortBy, (2) sortOrder, (3) startReg, (4) U, (5) LastCheck , and (6) R parameters.
CVE-2004-2717Dec 31, 2004
Phpmychat
Phpmychat
risk 0.03cvss —epss 0.03
Multiple directory traversal vulnerabilities in admin.php3 in PHPMyChat 0.14.5 allow remote attackers with administrative privileges to read arbitrary files via a .. (dot dot) in the (1) sheet and (2) What parameters.
CVE-2004-2718Dec 31, 2004
Phpmychat
Phpmychat
risk 0.03cvss —epss 0.03
PHPMyChat 0.14.5 does not remove or protect setup.php3 after installation, which allows attackers to obtain sensitive information including database passwords via a direct request.
CVE-2004-2719Dec 31, 2004
Foxmail
Foxmail
risk 0.05cvss —epss 0.21
Buffer overflow in the UrlToLocal function in PunyLib.dll of Foxmail 5.0.300 allows remote attackers to execute arbitrary code via a mail message with a long From field, a different issue than CVE-2005-0339.
CVE-2004-2720Dec 31, 2004
Snitz Communications
Forums 2000
risk 0.04cvss —epss 0.09
Cross-site scripting (XSS) vulnerability in register.asp in Snitz Forums 2000 3.4.04 and earlier allows remote attackers to inject arbitrary web script or HTML via javascript events in the Email parameter.
CVE-2004-2721Dec 31, 2004
openSkat
VTMF
risk 0.00cvss —epss 0.01
The CheckGroup function in openSkat VTMF before 2.1 generates public key pairs in which the "p" variable might not be prime, which allows remote attackers to determine the private key and decrypt messages.
CVE-2004-2722Dec 31, 2004
Tenable
Nessus
risk 0.00cvss —epss 0.00
Nessus 2.0.10a stores account passwords in plaintext in .nessusrc files, which allows local users to obtain passwords. NOTE: the original researcher reports that the vendor has disputed this issue
CVE-2004-2723Dec 31, 2004
Tenable
Nessuswx
risk 0.00cvss —epss 0.00
NessusWX 1.4.4 stores account passwords in plaintext in .session files, which allows local users to obtain passwords.
CVE-2004-2724Dec 31, 2004
Lionmax Software
Chat Anywhere
risk 0.00cvss —epss 0.01
LionMax Software Chat Anywhere 2.72a allows remote attackers to cause a denial of service (server crash and client CPU consumption) via a username beginning with percent (%) followed by a null character.
CVE-2004-2725Dec 31, 2004
Aztek Forum
Aztek Forum
risk 0.03cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Aztek Forum 4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in (a) search.php, (2) the email parameter in (b) subscribe.php, and (3) the return and (4) title parameters in (c)…
CVE-2004-2726Dec 31, 2004
MailEnable
Mailenable
risk 0.00cvss —epss 0.02
HTTPMail service in MailEnable Professional 1.18 does not properly handle arguments to the Authorization header, which allows remote attackers to cause a denial of service (null dereference and application crash). NOTE: This is a different vulnerability than CVE-2005-1348.
CVE-2004-2727Dec 31, 2004
MailEnable
Mailenable
risk 0.03cvss —epss 0.04
Buffer overflow in MEHTTPS (HTTPMail) of MailEnable Professional 1.5 through 1.7 allows remote attackers to cause a denial of service (application crash) via a long HTTP GET request.
CVE-2004-2728Dec 31, 2004
Hummingbird
Connectivity
risk 0.00cvss —epss 0.01
Buffer overflow in the FTP server of Hummingbird Connectivity 7.1 and 9.0 allows remote, authenticated users to cause a denial of service (application crash) via a long argument to the XCWD command.
CVE-2004-2729Dec 31, 2004
Hummingbird
Connectivity
risk 0.00cvss —epss 0.00
Inetd32 Administration Tool of Hummingbird Connectivity 7.1 and 9.0 allows local users to execute arbitrary code by changing the program for handling incoming connections.
CVE-2004-2730Dec 31, 2004
Sysinternals
PsTools
risk 0.00cvss —epss 0.01
Sysinternals PsTools before 2.05, including (1) PsExec before 1.54, (2) PsGetsid before 1.41, (3) PsInfo before 1.61, (4) PsKill before 1.03, (5) PsList before 1.26, (6) PsLoglist before 2.51, (7) PsPasswd before 1.21, (8) PsService before 2.12, (9) PsSuspend before 1.05, and…
CVE-2004-2731Dec 31, 2004
Linux
Kernel
risk 0.00cvss —epss 0.00
Multiple integer overflows in Sbus PROM driver (drivers/sbus/char/openprom.c) for the Linux kernel 2.4.x up to 2.4.27, 2.6.x up to 2.6.7, and possibly later versions, allow local users to execute arbitrary code by specifying (1) a small buffer size to the copyin_string function…
CVE-2004-2732Dec 31, 2004
Netbilling
Netbilling
risk 0.03cvss —epss 0.03
nbmember.cgi in Netbilling 2.0 allows remote attackers to obtain sensitive information via the cmd=test option, which can be leveraged to determine the access key.
CVE-2004-2733Dec 31, 2004
Webwiz
Web Wiz Forums
risk 0.00cvss —epss 0.01
Web Wiz Forums 7.7a uses invalid logic to determine user privileges, which allows remote attackers to (1) block arbitrary IP addresses via pop_up_ip_blocking.asp or (2) modify topics via pop_up_topic_admin.asp.
CVE-2004-2734Dec 31, 2004
Novell
Netware
risk 0.00cvss —epss 0.03
webadmin-apache.conf in Novell Web Manager of Novell NetWare 6.5 uses an uppercase Alias tag with an inconsistent lowercase directory tag for a volume, which allows remote attackers to bypass access control to the WEB-INF folder.
CVE-2004-2735Dec 31, 2004
Fredric Fredricson
P4db
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in P4DB 2.01 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) SET_PREFERENCES parameter in SetPreferences.cgi; (2) BRANCH parameter in branchView.cgi; (3) FSPC and (4) COMPLETE parameters in…
CVE-2004-2736Dec 31, 2004
Polar Software
Helpdesk
risk 0.04cvss —epss 0.06
Polar HelpDesk 3.0 allows remote attackers to bypass authentication by setting the UserId and UserType values in a cookie.
CVE-2004-2737Dec 31, 2004
Netsupport
Dna Helpdesk
risk 0.03cvss —epss 0.01
SQL injection vulnerability in problist.asp in NetSupport DNA HelpDesk 1.01 allows remote attackers to execute arbitrary SQL commands via the where parameter.
CVE-2004-2738Dec 31, 2004
Zeroboard
Zeroboard
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in check_user_id.php in ZeroBoard 4.1pl4 and earlier allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.
CVE-2004-2739Dec 31, 2004
Phprojekt
Phprojekt
risk 0.00cvss —epss 0.01
The setup routine (setup.php) in PHProjekt 4.2.1 and earlier allows remote attackers to modify system configuration via unknown attack vectors.
CVE-2004-2740Dec 31, 2004
Phprojekt
Phprojekt
risk 0.00cvss —epss 0.01
PHP remote file inclusion vulnerability in authform.inc.php in PHProjekt 4.2.3 and earlier allows remote attackers to include arbitrary PHP code via a URL in the path_pre parameter.
CVE-2004-2741Dec 31, 2004
Horde (software)
Application Framework
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the "help window" (help.php) in Horde Application Framework 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) module, (2) topic, or (3) module parameters.
CVE-2004-2742Dec 31, 2004
Businessobjects
Crystal Enterprise
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the report viewer in Crystal Enterprise 8.5, 9, and 10 allows remote attackers to inject arbitrary web script or HTML via script in the URL to a report (RPT) file.
CVE-2004-2743Dec 31, 2004
Raditha Dissanayake
Mega Upload Progress Bar
risk 0.00cvss —epss 0.01
upload.cgi in Mega Upload Progress Bar before 1.45 allows remote attackers to copy or overwrite arbitrary files via unspecified parameters related to names of uploaded files.
CVE-2004-2744Dec 31, 2004
Tincan
Phplist
risk 0.00cvss —epss 0.00
Unspecified vulnerability in Tincan Limited PHPlist before 2.8.12 has unknown impact and attack vectors, related to a "security update release."
CVE-2004-2745Dec 31, 2004
Anteco Visual Technologies
Ownserver
risk 0.03cvss —epss 0.02
Directory traversal vulnerability in Anteco Visual Technologies OwnServer 1.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in a URL.
CVE-2004-2746Dec 31, 2004
Francisco Charrua
Photo Gallery
risk 0.03cvss —epss 0.01
SQL injection vulnerability in adminlogin.asp in XTREME ASP Photo Gallery 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
CVE-2004-2747Dec 31, 2004
Pablo Software Solutions
Quick N Easy FTP Server
risk 0.00cvss —epss 0.00
Directory traversal vulnerability in Pablo Software Solutions Quick 'n Easy FTP Server 1.77, and possibly earlier versions, allows remote authenticated users to determine the existence of arbitrary files via a .. (dot dot) in the DEL command, which triggers different error…
CVE-2004-2748Dec 31, 2004
Webtrends
Reporting Center
risk 0.04cvss —epss 0.07
viewreport.pl in NetIQ WebTrends Reporting Center Enterprise Edition 6.1a allows remote attackers to determine the installation path via an invalid profileid parameter, which leaks the pathname in an error message.
CVE-2004-2749Dec 31, 2004
2wire
Homeportal
risk 0.03cvss —epss 0.01
Directory traversal vulnerability in wra/public/wralogin in 2Wire Gateway, possibly as used in HomePortal and other product lines, allows remote attackers to read arbitrary files via a .. (dot dot) in the return parameter. NOTE: this issue was reported as XSS, but this might be…
CVE-2004-2750Dec 31, 2004
Jbrowser
Jbrowser
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in browser.php in JBrowser 1.0 through 2.1 allows remote attackers to read arbitrary files via the directory parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2004-2751Dec 31, 2004
Postnuke
Postnuke
risk 0.00cvss —epss 0.01
SQL injection vulnerability in the members_list module in PostNuke 0.726, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the sortby parameter.
CVE-2004-2752Dec 31, 2004
Postnuke
Postnuke
risk 0.00cvss —epss 0.00
Cross-site scripting (XSS) vulnerability in the Downloads module in PostNuke up to 0.726, and possibly later versions, allows remote attackers to inject arbitrary HTML and web script via the ttitle parameter in a viewdownloaddetails action.
CVE-2004-2753Dec 31, 2004
HPE
HP-UX
risk 0.00cvss —epss 0.00
Unspecified vulnerability in SharedX in HP-UX B.11.00, B.11.11, and B.11.22 allows local users to access unspecified files or cause a denial of service via unknown vectors related to handling of "files in a potentially insecure manner."
CVE-2004-2754Dec 31, 2004
Yabb
Yabb Se
risk 0.03cvss —epss 0.02
SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the ID_MEMBER parameter to the (1) recentTopics and (2) welcome functions.
CVE-2004-2755Dec 31, 2004
Symantec
Web Security
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Symantec Web Security 2.5, 3.0.0, and 3.0.1 before build 62 allows remote attackers to inject arbitrary web script or HTML via the query string in blocked URLs that are listed in (1) error or (2) block page messages.
CVE-2004-2756Dec 31, 2004
XOOPS
Xoops
risk 0.03cvss —epss 0.00
Cross-site scripting (XSS) vulnerability in viewtopic.php in Xoops 2.x, possibly 2 through 2.0.5, allows remote attackers to inject arbitrary web script or HTML via the (1) forum and (2) topic_id parameters.
CVE-2004-2757Dec 31, 2004
Novell
Ichain
risk 0.00cvss —epss 0.00
Cross-site scripting (XSS) vulnerability in the failed login page in Novell iChain before 2.2 build 2.2.113 and 2.3 First Customer Ship (FCS) allows remote attackers to inject arbitrary web script or HTML via url parameter.
CVE-2004-2758Dec 31, 2004
Sun Corporation
Sunforum
risk 0.01cvss —epss 0.08
Multiple unspecified vulnerabilities in the H.323 protocol implementation for Sun SunForum 3.2 and 3D 1.0 allow remote attackers to cause a denial of service (segmentation fault and process crash), as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.
CVE-2004-2759Dec 31, 2004
Sun Corporation
Storedge Qfs
risk 0.00cvss —epss 0.00
Shared Sun StorEdge QFS and SAM-QFS file systems, as used in Utilization Suite 4.0 through 4.1 and Performance Suite 4.0 through 4.1, might allow local users to read portions of deleted files by accessing data within sparse files.
CVE-2004-2760Dec 31, 2004
Apache
Sshd
risk 0.00cvss —epss 0.00
sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open after an attempt with an incorrect password, which makes it easier for remote attackers to guess…
CVE-2004-1376Dec 30, 2004
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.11
Directory traversal vulnerability in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote malicious FTP servers to overwrite arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command.
CVE-2004-1316Dec 29, 2004
Mozilla Corporation
Mozilla
risk 0.00cvss —epss 0.05
Heap-based buffer overflow in MSG_UnEscapeSearchUrl in nsNNTPProtocol.cpp for Mozilla 1.7.3 and earlier allows remote attackers to cause a denial of service (application crash) via an NNTP URL (news:) with a trailing '\' (backslash) character, which prevents a string from being…
CVE-2004-1062Dec 28, 2004
Viewvc
Viewcvs
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in ViewCVS 0.9.2 allow remote attackers to inject arbitrary HTML and web script via certain error messages.
CVE-2004-1317Dec 27, 2004
Netcat
Netcat
risk 0.09cvss —epss 0.78
Stack-based buffer overflow in doexec.c in Netcat for Windows 1.1, when running with the -e option, allows remote attackers to execute arbitrary code via a long DNS command.
CVE-2004-1377Dec 27, 2004
GNU
A2ps
risk 0.00cvss —epss 0.00
The (1) fixps (aka fixps.in) and (2) psmandup (aka psmandup.in) scripts in a2ps before 4.13 allow local users to overwrite arbitrary files via a symlink attack on temporary files.