CVEs

340,749 total · page 6634 of 6,815

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2004-0314	Freewebs Webzedit		0.00	—	0.00	Nov 23, 2004	Cross-site scripting (XSS) vulnerability in done.jsp in WebzEdit 1.9 and earlier allows remote attackers to execute arbitrary script as other users via the message parameter.
CVE-2004-0315	Avirt Voice		0.00	—	0.03	Nov 23, 2004	Buffer overflow in Avirt Voice 4.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long GET request on port 1080.
CVE-2004-0316	Avirt Avirt Soho		0.00	—	0.01	Nov 23, 2004	Buffer overflow in Avirt Soho 4.3 allows remote attackers to cause a denial of service (crash) via (1) a large GET request to port 1080 or (2) a large GET request of % characters to port 8080.
CVE-2004-0317	Platform Lsf		0.00	—	0.03	Nov 23, 2004	Buffer overflow in eauth in Load Sharing Facility 4.x, 5.x, and 6.x allows local users or remote attackers within the LSF cluster to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long LSF_From_PC parameter.
CVE-2004-0318	Platform Lsf		0.04	—	0.07	Nov 23, 2004	Load Sharing Facility (LSF) 4.x, 5.x, and 6.x uses the LSF_EAUTH_UID environment variable, if it exists, instead of the real UID of the user, which could allow remote attackers within the local cluster to gain privileges.
CVE-2004-0319	Ezboard Ezboard		0.03	—	0.06	Nov 23, 2004	Cross-site scripting (XSS) vulnerability in the font tag in ezBoard 7.3u allows remote attackers to execute arbitrary script as other users, as demonstrated using the background:url in a (1) font color or (2) font face argument.
CVE-2004-0320	Ncipher Hardware Security Modules (HSM)		0.00	—	0.00	Nov 23, 2004	Unknown vulnerability in nCipher Hardware Security Modules (HSM) 1.67.x through 1.99.x allows local users to access secrets stored in the module's run-time memory via certain sequences of commands.
CVE-2004-0321	Singularity Software Team Factor		0.00	—	0.01	Nov 23, 2004	Team Factor 1.25 and earlier allows remote attackers to cause a denial of service (crash) via a packet that uses a negative number to specify the size of the data block that follows, which causes Team Factor to read unallocated memory.
CVE-2004-0326	Proxy Pro Professional Gatekeeper		0.09	—	0.80	Nov 23, 2004	Buffer overflow in the web proxy for GateKeeper Pro 4.7 allows remote attackers to execute arbitrary code via a long GET request.
CVE-2004-0327	Skintech Phpnewsmanager		0.03	—	0.04	Nov 23, 2004	Directory traversal vulnerability in functions.php in PhpNewsManager 1.46 allows remote attackers to retrieve arbitrary files via .. (dot dot) sequences in the clang parameter.
CVE-2004-0328	Gigabyte Gn B46b		0.00	—	0.00	Nov 23, 2004	Gigabyte Gn-B46B 2.4Ghz wireless broadband router firmware 1.003.00 allows local users on the same local network as the router to bypass authentication by using a copy of the router's html menu on a separate system.
CVE-2004-0329	Freechat Freechat		0.00	—	0.01	Nov 23, 2004	FreeChat 1.1.1a allows remote attackers to cause a denial of service (crash) via certain unexpected strings, as demonstrated using "aaaaa".
CVE-2004-0330	SolarWinds Serv U File Server		0.10	—	0.83	Nov 23, 2004	Buffer overflow in Serv-U ftp before 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM command.
CVE-2004-0331	Dell Openmanage		0.08	—	0.68	Nov 23, 2004	Heap-based buffer overflow in Dell OpenManage Web Server 3.4.0 allows remote attackers to cause a denial of service (crash) via a HTTP POST with a long application variable.
CVE-2004-0332	Extremail Extremail		0.00	—	0.01	Nov 23, 2004	Extremail 1.5.9 does not check passwords correctly when they are all digits or begin with a digit, which allows remote attackers to gain privileges.
CVE-2004-0333	Winzip Winzip		0.08	—	0.65	Nov 23, 2004	Buffer overflow in the UUDeview package, as used in WinZip 6.2 through WinZip 8.1 SR-1, and possibly other packages, allows remote attackers to execute arbitrary code via a MIME archive with certain long MIME parameters.
CVE-2004-0334	Innomedia VideoPhone		0.00	—	0.00	Nov 23, 2004	InnoMedia VideoPhone allows remote attackers to bypass Basic Authorization via an HTTP request to (1) videophone_admindetail.asp, (2) videophone_syscfg.asp, (3) videophone_upgrade.asp, or (4) videophone_sysctrl.asp that contains a trailing / (slash). NOTE: the original report…
CVE-2004-0335	Software602 602pro Lan Suite		0.00	—	0.01	Nov 23, 2004	LAN SUITE Web Mail 602Pro, when configured to use the "Directory browsing" feature, allows remote attackers to obtain a directory listing via an HTTP request to (1) index.html, (2) cgi-bin/, or (3) users/.
CVE-2004-0336	Software602 602pro Lan Suite		0.00	—	0.01	Nov 23, 2004	LAN SUITE Web Mail 602Pro allows remote attackers to gain sensitive information via the mail login form, which contains the path to the mail directory.
CVE-2004-0337	Software602 602pro Lan Suite		0.03	—	0.00	Nov 23, 2004	Cross-site scripting (XSS) vulnerability in LAN SUITE Web Mail 602Pro allows remote attackers to execute arbitrary script or HTML as other users via a URL to index.html, followed by a / (slash) and the desired script. NOTE: the vendor states that this bug could not be…
CVE-2004-0338	Invision Power Services Board Forum		0.00	—	0.00	Nov 23, 2004	SQL injection vulnerability in search.php for Invision Board Forum allows remote attackers to execute arbitrary SQL queries via the st parameter.
CVE-2004-0339	PhpBB phpBB		0.00	—	0.01	Nov 23, 2004	Cross-site scripting (XSS) vulnerability in ViewTopic.php in phpBB, possibly 2.0.6c and earlier, allows remote attackers to execute arbitrary script or HTML as other users via the postorder parameter.
CVE-2004-0340	Texas Imperial Software Wftpd		0.03	—	0.00	Nov 23, 2004	Stack-based buffer overflow in WFTPD Pro Server 3.21 Release 1, Pro Server 3.20 Release 2, Server 3.21 Release 1, and Server 3.10 allows local users to execute arbitrary code via long (1) LIST, (2) NLST, or (3) STAT commands.
CVE-2004-0341	Texas Imperial Software Wftpd		0.00	—	0.00	Nov 23, 2004	WFTPD Pro Server 3.21 Release 1 allocates memory for a command until a 0Ah byte (newline) is sent, which allows local users to cause a denial of service (CPU consumption) by continuing to send a long command that does not contain a newline.
CVE-2004-0342	Wftpd Pro Server Project Wftpd Pro Server	Med	0.36	5.5	0.00	Nov 23, 2004	WFTPD Pro Server 3.21 Release 1, with the XeroxDocutech option enabled, allows local users to cause a denial of service (crash) via a (1) MKD or (2) XMKD command that causes an absolute path of 260 characters to be used, which overwrites a cookie with a null character, possibly…
CVE-2004-0343	Yabb Yabb		0.03	—	0.00	Nov 23, 2004	Multiple SQL injection vulnerabilities in YaBB SE 1.5.4 through 1.5.5b allow remote attackers to execute arbitrary SQL via (1) the msg parameter in ModifyMessage.php or (2) the postid parameter in ModifyMessage.php.
CVE-2004-0344	Yabb Yabb		0.03	—	0.03	Nov 23, 2004	Directory traversal vulnerability in ModifyMessage.php in YaBB SE 1.5.4 through 1.5.5b allows remote attackers to delete arbitrary files via a .. (dot dot) in the attachOld parameter.
CVE-2004-0345	Volition Red Faction		0.03	—	0.05	Nov 23, 2004	Buffer overflow in Red Faction client 1.20 and earlier allows remote servers to execute arbitrary code via a long server name.
CVE-2004-0346	Proftpd Proftpd	Hig	0.51	7.8	0.00	Nov 23, 2004	Off-by-one buffer overflow in _xlate_ascii_write() in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.
CVE-2004-0347	Netscreen Netscreen Sa 5000 Series		0.00	—	0.01	Nov 23, 2004	Cross-site scripting (XSS) vulnerability in delhomepage.cgi in NetScreen-SA 5000 Series running firmware 3.3 Patch 1 (build 4797) allows remote authenticated users to execute arbitrary script as other users via the row parameter.
CVE-2004-0348	Spidersales Spidersales		0.03	—	0.01	Nov 23, 2004	SQL injection vulnerability in viewCart.asp in SpiderSales shopping cart software allows remote attackers to execute arbitrary SQL via the userId parameter.
CVE-2004-0349	Gweb Gweb HTTP Server		0.03	—	0.03	Nov 23, 2004	Directory traversal vulnerability in GWeb HTTP Server 0.6 allows remote attackers to view arbitrary files via a .. (dot dot) in the URL.
CVE-2004-0350	Spidersales Spidersales		0.00	—	0.00	Nov 23, 2004	SpiderSales shopping cart does not enforce a minimum length for the private key, which can make it easier for local users to obtain the private key by factoring.
CVE-2004-0351	Spidersales Spidersales		0.00	—	0.00	Nov 23, 2004	Spider Sales shopping cart stores the private key in the same database and table as the public key, which allows local users with access to the database to decrypt data.
CVE-2004-0352	Cisco Systems, Inc. Css11000 Content Services Switch		0.00	—	0.01	Nov 23, 2004	Cisco 11000 Series Content Services Switches (CSS) running WebNS 5.0(x) before 05.0(04.07)S, and 6.10(x) before 06.10(02.05)S allow remote attackers to cause a denial of service (device reset) via a malformed packet to UDP port 5002.
CVE-2004-0353	GNU Anubis		0.04	—	0.09	Nov 23, 2004	Multiple buffer overflows in auth_ident() function in auth.c for GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to gain privileges via a long string.
CVE-2004-0354	GNU Anubis		0.03	—	0.06	Nov 23, 2004	Multiple format string vulnerabilities in GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to execute arbitrary code via format string specifiers in strings passed to (1) the info function in log.c, (2) the anubis_error function in errs.c, or (3) the…
CVE-2004-0355	Invision Power Services Invision Power Board		0.00	—	0.01	Nov 23, 2004	Invision Power Board 1.3 Final allows remote attackers to gain sensitive information by selecting a file for "Personal Photo" that is not an image file, which displays the installation path in an error message.
CVE-2004-0356	SL Mail Pro Supervisor Report Center		0.01	—	0.08	Nov 23, 2004	Stack-based buffer overflow in Supervisor Report Center in SL Mail Pro 2.0.9 and earlier allows remote attackers to execute arbitrary code via an HTTP request with a long HTTP sub-version.
CVE-2004-0357	SL Mail Pro		0.00	—	0.06	Nov 23, 2004	Stack-based buffer overflows in SL Mail Pro 2.0.9 allow remote attackers to execute arbitrary code via (1) user.dll, (2) loadpageadmin.dll or (3) loadpageuser.dll.
CVE-2004-0358	Hedef Tracking Admin Panel		0.03	—	0.01	Nov 23, 2004	Cross-site scripting (XSS) vulnerability in VirtuaNews Admin Panel Pro 1.0.3 allows remote attackers to execute arbitrary script as other users via (1) the mainnews parameter in admin.php, (2) the expand parameter in admin.php, (3) the id parameter in admin.php, (4) the catid…
CVE-2004-0359	Invision Power Services Invision Power Board		0.00	—	0.02	Nov 23, 2004	Cross-site scripting (XSS) vulnerability in index.php for Invision Power Board 1.3 final allows remote attackers to execute arbitrary script as other users via the (1) c, (2) f, (3) showtopic, (4) showuser, or (5) username parameters.
CVE-2004-0360	Sun Corporation Solaris		0.03	—	0.00	Nov 23, 2004	Unknown vulnerability in passwd(1) in Solaris 8.0 and 9.0 allows local users to gain privileges via unknown attack vectors.
CVE-2004-0361	Apple Inc. Safari		0.03	—	0.06	Nov 23, 2004	The Javascript engine in Safari 1.2 and earlier allows remote attackers to cause a denial of service (segmentation fault) by creating a new Array object with a large size value, then writing into that array.
CVE-2004-0415	Linux Kernel		0.03	—	0.00	Nov 23, 2004	Linux kernel does not properly convert 64-bit file offset pointers to 32 bits, which allows local users to access portions of kernel memory.
CVE-2004-0494	Avaya Cvlan		0.00	—	0.01	Nov 23, 2004	Multiple extfs backend scripts for GNOME virtual file system (VFS) before 1.0.1 may allow remote attackers to perform certain unauthorized actions via a gnome-vfs URI.
CVE-2004-0597	Libpng Libpng		0.10	—	0.83	Nov 23, 2004	Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or…
CVE-2004-0598	Pnggroup Libpng		0.03	—	0.32	Nov 23, 2004	The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference.
CVE-2004-0599	Libpng Libpng		0.03	—	0.32	Nov 23, 2004	Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed…
CVE-2004-0636	AOL Instant Messenger		0.09	—	0.80	Nov 23, 2004	Buffer overflow in the goaway function in the aim:goaway URI handler for AOL Instant Messenger (AIM) 5.5, including 5.5.3595, allows remote attackers to execute arbitrary code via a long Away message.

CVE-2004-0314Nov 23, 2004
Freewebs
Webzedit
risk 0.00cvss —epss 0.00
Cross-site scripting (XSS) vulnerability in done.jsp in WebzEdit 1.9 and earlier allows remote attackers to execute arbitrary script as other users via the message parameter.
CVE-2004-0315Nov 23, 2004
Avirt
Voice
risk 0.00cvss —epss 0.03
Buffer overflow in Avirt Voice 4.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long GET request on port 1080.
CVE-2004-0316Nov 23, 2004
Avirt
Avirt Soho
risk 0.00cvss —epss 0.01
Buffer overflow in Avirt Soho 4.3 allows remote attackers to cause a denial of service (crash) via (1) a large GET request to port 1080 or (2) a large GET request of % characters to port 8080.
CVE-2004-0317Nov 23, 2004
Platform
Lsf
risk 0.00cvss —epss 0.03
Buffer overflow in eauth in Load Sharing Facility 4.x, 5.x, and 6.x allows local users or remote attackers within the LSF cluster to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long LSF_From_PC parameter.
CVE-2004-0318Nov 23, 2004
Platform
Lsf
risk 0.04cvss —epss 0.07
Load Sharing Facility (LSF) 4.x, 5.x, and 6.x uses the LSF_EAUTH_UID environment variable, if it exists, instead of the real UID of the user, which could allow remote attackers within the local cluster to gain privileges.
CVE-2004-0319Nov 23, 2004
Ezboard
Ezboard
risk 0.03cvss —epss 0.06
Cross-site scripting (XSS) vulnerability in the font tag in ezBoard 7.3u allows remote attackers to execute arbitrary script as other users, as demonstrated using the background:url in a (1) font color or (2) font face argument.
CVE-2004-0320Nov 23, 2004
Ncipher
Hardware Security Modules (HSM)
risk 0.00cvss —epss 0.00
Unknown vulnerability in nCipher Hardware Security Modules (HSM) 1.67.x through 1.99.x allows local users to access secrets stored in the module's run-time memory via certain sequences of commands.
CVE-2004-0321Nov 23, 2004
Singularity Software
Team Factor
risk 0.00cvss —epss 0.01
Team Factor 1.25 and earlier allows remote attackers to cause a denial of service (crash) via a packet that uses a negative number to specify the size of the data block that follows, which causes Team Factor to read unallocated memory.
CVE-2004-0326Nov 23, 2004
Proxy Pro
Professional Gatekeeper
risk 0.09cvss —epss 0.80
Buffer overflow in the web proxy for GateKeeper Pro 4.7 allows remote attackers to execute arbitrary code via a long GET request.
CVE-2004-0327Nov 23, 2004
Skintech
Phpnewsmanager
risk 0.03cvss —epss 0.04
Directory traversal vulnerability in functions.php in PhpNewsManager 1.46 allows remote attackers to retrieve arbitrary files via .. (dot dot) sequences in the clang parameter.
CVE-2004-0328Nov 23, 2004
Gigabyte
Gn B46b
risk 0.00cvss —epss 0.00
Gigabyte Gn-B46B 2.4Ghz wireless broadband router firmware 1.003.00 allows local users on the same local network as the router to bypass authentication by using a copy of the router's html menu on a separate system.
CVE-2004-0329Nov 23, 2004
Freechat
Freechat
risk 0.00cvss —epss 0.01
FreeChat 1.1.1a allows remote attackers to cause a denial of service (crash) via certain unexpected strings, as demonstrated using "aaaaa".
CVE-2004-0330Nov 23, 2004
SolarWinds
Serv U File Server
risk 0.10cvss —epss 0.83
Buffer overflow in Serv-U ftp before 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM command.
CVE-2004-0331Nov 23, 2004
Dell
Openmanage
risk 0.08cvss —epss 0.68
Heap-based buffer overflow in Dell OpenManage Web Server 3.4.0 allows remote attackers to cause a denial of service (crash) via a HTTP POST with a long application variable.
CVE-2004-0332Nov 23, 2004
Extremail
Extremail
risk 0.00cvss —epss 0.01
Extremail 1.5.9 does not check passwords correctly when they are all digits or begin with a digit, which allows remote attackers to gain privileges.
CVE-2004-0333Nov 23, 2004
Winzip
Winzip
risk 0.08cvss —epss 0.65
Buffer overflow in the UUDeview package, as used in WinZip 6.2 through WinZip 8.1 SR-1, and possibly other packages, allows remote attackers to execute arbitrary code via a MIME archive with certain long MIME parameters.
CVE-2004-0334Nov 23, 2004
Innomedia
VideoPhone
risk 0.00cvss —epss 0.00
InnoMedia VideoPhone allows remote attackers to bypass Basic Authorization via an HTTP request to (1) videophone_admindetail.asp, (2) videophone_syscfg.asp, (3) videophone_upgrade.asp, or (4) videophone_sysctrl.asp that contains a trailing / (slash). NOTE: the original report…
CVE-2004-0335Nov 23, 2004
Software602
602pro Lan Suite
risk 0.00cvss —epss 0.01
LAN SUITE Web Mail 602Pro, when configured to use the "Directory browsing" feature, allows remote attackers to obtain a directory listing via an HTTP request to (1) index.html, (2) cgi-bin/, or (3) users/.
CVE-2004-0336Nov 23, 2004
Software602
602pro Lan Suite
risk 0.00cvss —epss 0.01
LAN SUITE Web Mail 602Pro allows remote attackers to gain sensitive information via the mail login form, which contains the path to the mail directory.
CVE-2004-0337Nov 23, 2004
Software602
602pro Lan Suite
risk 0.03cvss —epss 0.00
Cross-site scripting (XSS) vulnerability in LAN SUITE Web Mail 602Pro allows remote attackers to execute arbitrary script or HTML as other users via a URL to index.html, followed by a / (slash) and the desired script. NOTE: the vendor states that this bug could not be…
CVE-2004-0338Nov 23, 2004
Invision Power Services
Board Forum
risk 0.00cvss —epss 0.00
SQL injection vulnerability in search.php for Invision Board Forum allows remote attackers to execute arbitrary SQL queries via the st parameter.
CVE-2004-0339Nov 23, 2004
PhpBB
phpBB
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in ViewTopic.php in phpBB, possibly 2.0.6c and earlier, allows remote attackers to execute arbitrary script or HTML as other users via the postorder parameter.
CVE-2004-0340Nov 23, 2004
Texas Imperial Software
Wftpd
risk 0.03cvss —epss 0.00
Stack-based buffer overflow in WFTPD Pro Server 3.21 Release 1, Pro Server 3.20 Release 2, Server 3.21 Release 1, and Server 3.10 allows local users to execute arbitrary code via long (1) LIST, (2) NLST, or (3) STAT commands.
CVE-2004-0341Nov 23, 2004
Texas Imperial Software
Wftpd
risk 0.00cvss —epss 0.00
WFTPD Pro Server 3.21 Release 1 allocates memory for a command until a 0Ah byte (newline) is sent, which allows local users to cause a denial of service (CPU consumption) by continuing to send a long command that does not contain a newline.
CVE-2004-0342MedNov 23, 2004
Wftpd Pro Server Project
Wftpd Pro Server
risk 0.36cvss 5.5epss 0.00
WFTPD Pro Server 3.21 Release 1, with the XeroxDocutech option enabled, allows local users to cause a denial of service (crash) via a (1) MKD or (2) XMKD command that causes an absolute path of 260 characters to be used, which overwrites a cookie with a null character, possibly…
CVE-2004-0343Nov 23, 2004
Yabb
Yabb
risk 0.03cvss —epss 0.00
Multiple SQL injection vulnerabilities in YaBB SE 1.5.4 through 1.5.5b allow remote attackers to execute arbitrary SQL via (1) the msg parameter in ModifyMessage.php or (2) the postid parameter in ModifyMessage.php.
CVE-2004-0344Nov 23, 2004
Yabb
Yabb
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in ModifyMessage.php in YaBB SE 1.5.4 through 1.5.5b allows remote attackers to delete arbitrary files via a .. (dot dot) in the attachOld parameter.
CVE-2004-0345Nov 23, 2004
Volition
Red Faction
risk 0.03cvss —epss 0.05
Buffer overflow in Red Faction client 1.20 and earlier allows remote servers to execute arbitrary code via a long server name.
CVE-2004-0346HigNov 23, 2004
Proftpd
Proftpd
risk 0.51cvss 7.8epss 0.00
Off-by-one buffer overflow in _xlate_ascii_write() in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.
CVE-2004-0347Nov 23, 2004
Netscreen
Netscreen Sa 5000 Series
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in delhomepage.cgi in NetScreen-SA 5000 Series running firmware 3.3 Patch 1 (build 4797) allows remote authenticated users to execute arbitrary script as other users via the row parameter.
CVE-2004-0348Nov 23, 2004
Spidersales
Spidersales
risk 0.03cvss —epss 0.01
SQL injection vulnerability in viewCart.asp in SpiderSales shopping cart software allows remote attackers to execute arbitrary SQL via the userId parameter.
CVE-2004-0349Nov 23, 2004
Gweb
Gweb HTTP Server
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in GWeb HTTP Server 0.6 allows remote attackers to view arbitrary files via a .. (dot dot) in the URL.
CVE-2004-0350Nov 23, 2004
Spidersales
Spidersales
risk 0.00cvss —epss 0.00
SpiderSales shopping cart does not enforce a minimum length for the private key, which can make it easier for local users to obtain the private key by factoring.
CVE-2004-0351Nov 23, 2004
Spidersales
Spidersales
risk 0.00cvss —epss 0.00
Spider Sales shopping cart stores the private key in the same database and table as the public key, which allows local users with access to the database to decrypt data.
CVE-2004-0352Nov 23, 2004
Cisco Systems, Inc.
Css11000 Content Services Switch
risk 0.00cvss —epss 0.01
Cisco 11000 Series Content Services Switches (CSS) running WebNS 5.0(x) before 05.0(04.07)S, and 6.10(x) before 06.10(02.05)S allow remote attackers to cause a denial of service (device reset) via a malformed packet to UDP port 5002.
CVE-2004-0353Nov 23, 2004
GNU
Anubis
risk 0.04cvss —epss 0.09
Multiple buffer overflows in auth_ident() function in auth.c for GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to gain privileges via a long string.
CVE-2004-0354Nov 23, 2004
GNU
Anubis
risk 0.03cvss —epss 0.06
Multiple format string vulnerabilities in GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to execute arbitrary code via format string specifiers in strings passed to (1) the info function in log.c, (2) the anubis_error function in errs.c, or (3) the…
CVE-2004-0355Nov 23, 2004
Invision Power Services
Invision Power Board
risk 0.00cvss —epss 0.01
Invision Power Board 1.3 Final allows remote attackers to gain sensitive information by selecting a file for "Personal Photo" that is not an image file, which displays the installation path in an error message.
CVE-2004-0356Nov 23, 2004
SL Mail Pro
Supervisor Report Center
risk 0.01cvss —epss 0.08
Stack-based buffer overflow in Supervisor Report Center in SL Mail Pro 2.0.9 and earlier allows remote attackers to execute arbitrary code via an HTTP request with a long HTTP sub-version.
CVE-2004-0357Nov 23, 2004
SL
Mail Pro
risk 0.00cvss —epss 0.06
Stack-based buffer overflows in SL Mail Pro 2.0.9 allow remote attackers to execute arbitrary code via (1) user.dll, (2) loadpageadmin.dll or (3) loadpageuser.dll.
CVE-2004-0358Nov 23, 2004
Hedef Tracking
Admin Panel
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in VirtuaNews Admin Panel Pro 1.0.3 allows remote attackers to execute arbitrary script as other users via (1) the mainnews parameter in admin.php, (2) the expand parameter in admin.php, (3) the id parameter in admin.php, (4) the catid…
CVE-2004-0359Nov 23, 2004
Invision Power Services
Invision Power Board
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in index.php for Invision Power Board 1.3 final allows remote attackers to execute arbitrary script as other users via the (1) c, (2) f, (3) showtopic, (4) showuser, or (5) username parameters.
CVE-2004-0360Nov 23, 2004
Sun Corporation
Solaris
risk 0.03cvss —epss 0.00
Unknown vulnerability in passwd(1) in Solaris 8.0 and 9.0 allows local users to gain privileges via unknown attack vectors.
CVE-2004-0361Nov 23, 2004
Apple Inc.
Safari
risk 0.03cvss —epss 0.06
The Javascript engine in Safari 1.2 and earlier allows remote attackers to cause a denial of service (segmentation fault) by creating a new Array object with a large size value, then writing into that array.
CVE-2004-0415Nov 23, 2004
Linux
Kernel
risk 0.03cvss —epss 0.00
Linux kernel does not properly convert 64-bit file offset pointers to 32 bits, which allows local users to access portions of kernel memory.
CVE-2004-0494Nov 23, 2004
Avaya
Cvlan
risk 0.00cvss —epss 0.01
Multiple extfs backend scripts for GNOME virtual file system (VFS) before 1.0.1 may allow remote attackers to perform certain unauthorized actions via a gnome-vfs URI.
CVE-2004-0597Nov 23, 2004
Libpng
Libpng
risk 0.10cvss —epss 0.83
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or…
CVE-2004-0598Nov 23, 2004
Pnggroup
Libpng
risk 0.03cvss —epss 0.32
The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference.
CVE-2004-0599Nov 23, 2004
Libpng
Libpng
risk 0.03cvss —epss 0.32
Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed…
CVE-2004-0636Nov 23, 2004
AOL
Instant Messenger
risk 0.09cvss —epss 0.80
Buffer overflow in the goaway function in the aim:goaway URI handler for AOL Instant Messenger (AIM) 5.5, including 5.5.3595, allows remote attackers to execute arbitrary code via a long Away message.