VYPR

CVEs

378,380 total · page 7377 of 7,568

AllCriticalHighKEV
  • CVE-2004-2487Dec 31, 2004
    Nexgen
    FTP Server
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in Nexgen FTP Server before 2.2.3.23 allows remote authenticated users to read or list arbitrary files via (1) "..", (2) "\..\" (backslash dot dot), or (3) "/../" sequences in (a) RETR (get), (b) NLST (ls), (c) LIST (ls), (d) RNFR, or (e) RNTO…

  • CVE-2004-2488Dec 31, 2004
    Nexgen
    FTP Server
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Nexgen FTP Server before 2.2.3.23 allows remote authenticated users to read or list arbitrary files via "C:" sequences in the (1) RETR (get), (2) NLST (ls), (3) LIST (ls), (4) RNFR, or (5) RNTO FTP commands.

  • CVE-2004-2489Dec 31, 2004
    IBM
    Informix Dynamic Server
    risk 0.00cvss —epss 0.00

    Format string vulnerability in IBM Informix Dynamic Server (IDS) before 9.40.xC3 allows local users to execute arbitrary code via a modified INFORMIXDIR environment variable that points to a file with format string specifiers in the filename.

  • CVE-2004-2490Dec 31, 2004
    IBM
    Informix Dynamic Server
    risk 0.00cvss —epss 0.00

    Buffer overflow in IBM Informix Dynamic Server (IDS) 9.40.xC1 and 9.40.xC2 allows local users to execute arbitrary code via a long GL_PATH environment variable.

  • CVE-2004-2491Dec 31, 2004
    Opera
    Opera
    risk 0.04cvss —epss 0.06

    A race condition in Opera web browser 7.53 Build 3850 causes Opera to fill in the address bar before the page has been loaded, which allows remote attackers to spoof the URL in the address bar via the window.open and location.replace HTML parameters, which facilitates phishing…

  • CVE-2004-2492Dec 31, 2004
    Hitachi
    Groupmax World Wide Web Desktop
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Groupmax World Wide Web (GmaxWWW) Desktop 5, 6, and Desktop for Jichitai 6, allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter.

  • CVE-2004-2493Dec 31, 2004
    Hitachi
    Groupmax World Wide Web
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in Groupmax World Wide Web (GmaxWWW) 2 and 3, and Desktop 5, 6, and Desktop for Jichitai allows remote authenticated users to read arbitrary .html files via the template name parameter.

  • CVE-2004-2494Dec 31, 2004
    Ability
    Mail Server
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in _error in Ability Mail Server 1.18 allows remote attackers to inject arbitrary web script or HTML via the erromsg parameter.

  • CVE-2004-2495Dec 31, 2004
    Ability
    Mail Server
    risk 0.00cvss —epss 0.02

    The (1) Webmail, (2) admin, and (3) SMTP services in Ability Mail Server 1.18 allow remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous connections to the service.

  • CVE-2004-2496Dec 31, 2004
    Opentext
    Firstclass
    risk 0.04cvss —epss 0.09

    The HTTP daemon in OpenText FirstClass 7.1 and 8.0 allows remote attackers to cause a denial of service (service availability loss) via a large number of POST requests to /Search.

  • CVE-2004-2497Dec 31, 2004
    Hitachi
    Web Page Generator
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the error handler in Hitachi Web Page Generator and Web Page Generator Enterprise 4.01 and earlier, when using the default error template and debug mode is set to ON, allows remote attackers to inject arbitrary web script or HTML via…

  • CVE-2004-2498Dec 31, 2004
    Hitachi
    Web Page Generator
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the error handler in Hitachi Web Page Generator and Web Page Generator Enterprise 4.01 and earlier, when using the default error template and debug mode is set to ON, allows remote attackers to determine internal directory structures via unknown…

  • CVE-2004-2499Dec 31, 2004
    Hitachi
    Web Page Generator
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Hitachi Web Page Generator and Web Page Generator Enterprise 4.01 and earlier allows remote attackers to cause a denial of service via unknown attack vectors when a web site is "improperly accessed."

  • CVE-2004-2500Dec 31, 2004
    Ilohamail
    Ilohamail
    risk 0.00cvss —epss 0.02

    Unknown vulnerability in IlohaMail before 0.8.14-rc1 has unknown impact and attack vectors.

  • CVE-2004-2501Dec 31, 2004
    MailEnable
    Mailenable
    risk 0.04cvss —epss 0.14

    Buffer overflow in the IMAP service of MailEnable Professional Edition 1.52 and Enterprise Edition 1.01 allows remote attackers to execute arbitrary code via (1) a long command string or (2) a long string to the MEIMAP service and then terminating the connection.

  • CVE-2004-2502Dec 31, 2004
    Fedorahosted
    im-switch
    risk 0.03cvss —epss 0.01

    im-switch before 11.4-46.1 in Fedora Core 2 allows local users to overwrite arbitrary files via a symlink attack on the imswitcher[PID] temporary file.

  • CVE-2004-2503Dec 31, 2004
    Inweb
    Mail Server
    risk 0.00cvss —epss 0.02

    INweb Mail Server 2.40 allows remote attackers to cause a denial of service (crash) via a large number of connect/disconnect actions to the (1) POP3 and (2) SMTP services.

  • CVE-2004-2504Dec 31, 2004
    Alt N
    Mdaemon
    risk 0.00cvss —epss 0.00

    The GUI in Alt-N Technologies MDaemon 7.2 and earlier, including 6.8, executes child processes such as NOTEPAD.EXE with SYSTEM privileges when users create new files, which allows local users with physical access to gain privileges.

  • CVE-2004-2505Dec 31, 2004
    Macromedia
    Coldfusion
    risk 0.03cvss —epss 0.03

    Macromedia ColdFusion MX before 6.1 does not restrict the size of error messages, which allows remote attackers to cause a denial of service (memory consumption and crash) by sending repeated GET or POST requests that trigger error messages that use long strings of data.

  • CVE-2004-2506Dec 31, 2004
    Wikindx
    Wikindx
    risk 0.00cvss —epss 0.01

    Unparsed web content delivery vulnerability in WIKINDX before 0.9.9g allows remote attackers to obtain sensitive information via a direct HTTP request to the config.inc file.

  • CVE-2004-2507Dec 31, 2004
    Linksys
    Wvc11b
    risk 0.04cvss —epss 0.08

    Absolute path traversal vulnerability in main.cgi in Linksys WVC11B Wireless-B Internet Video Camera allows remote attackers to read arbitrary files via an absolute pathname in the next_file parameter.

  • CVE-2004-2508Dec 31, 2004
    Linksys
    Wvc11b
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in main.cgi in Linksys WVC11B Wireless-B Internet Video Camera allows remote attackers to inject arbitrary web script or HTML via the next_file parameter.

  • CVE-2004-2509Dec 31, 2004
    Infopop
    UBB.Threads
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerabilities in (1) calendar.php, (2) login.php, and (3) online.php in Infopop UBB.Threads 6.2.3 and 6.5 allow remote attackers to inject arbitrary web script or HTML via the Cat parameter.

  • CVE-2004-2510Dec 31, 2004
    Infopop
    UBB.Threads
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in showflat.php in Infopop UBB.Threads before 6.5 allows remote attackers to inject arbitrary web script or HTML via the Cat parameter.

  • CVE-2004-2511Dec 31, 2004
    Dcp Portal
    Dcp Portal
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 5.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the year, (2) month, and (3) day parameters in calendar.php; (4) the cid and (5) url parameters in index.php; (6) the cid…

  • CVE-2004-2512Dec 31, 2004
    Dcp Portal
    Dcp Portal
    risk 0.03cvss —epss 0.05

    CRLF injection vulnerability in calendar.php in DCP-Portal 5.3.2 and earlier allows remote attackers to conduct HTTP response splitting attacks to spoof web content and poison web caches via CRLF ("%0d%0a") sequences in the PHPSESSID parameter.

  • CVE-2004-2513Dec 31, 2004
    David Harris
    Mail
    risk 0.04cvss —epss 0.10

    Buffer overflow in the IMAP service of Mercury (Pegasus) Mail 4.01 allows remote attackers to execute arbitrary code via a long SELECT command.

  • CVE-2004-2514Dec 31, 2004
    Powerportal
    Powerportal
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in modules/private_messages/index.php in PowerPortal 1.x allows remote attackers to inject arbitrary web script or HTML via the (1) SUBJECT or (2) MESSAGE field.

  • CVE-2004-2515Dec 31, 2004
    VMware
    Workstation
    risk 0.00cvss —epss 0.01

    Format string vulnerability in VMware Workstation 4.5.2 build-8848, if running with elevated privileges, might allow local users to execute arbitrary code via format string specifiers in command line arguments. NOTE: it is not clear if there are any default or typical…

  • CVE-2004-2516Dec 31, 2004
    Caddy Project
    Myserver
    risk 0.04cvss —epss 0.08

    Directory traversal vulnerability in myServer 0.7 allows remote attackers to list arbitrary directories via an HTTP GET command with a large number of "./" sequences followed by "../" sequences.

  • CVE-2004-2517Dec 31, 2004
    Caddy Project
    Myserver
    risk 0.03cvss —epss 0.04

    myServer 0.7.1 allows remote attackers to cause a denial of service (crash) via a long HTTP POST request in a View=Logon operation to index.html.

  • CVE-2004-2518Dec 31, 2004
    Gattaca
    Gattaca Server 2003
    risk 0.03cvss —epss 0.04

    Gattaca Server 2003 1.1.10.0 allows remote attackers to obtain sensitive information via (1) a trailing null byte ("%00") to a URL or (2) an invalid LANGUAGE parameter to web.tmpl, which reveals the full installation path in an error message.

  • CVE-2004-2519Dec 31, 2004
    Gattaca
    Gattaca Server 2003
    risk 0.04cvss —epss 0.08

    Gattaca Server 2003 1.1.10.0 allows remote attackers to cause a denial of service (CPU consumption) via directory specifiers in the LANGUAGE parameter to (1) index.tmpl and (2) web.tmpl, such as (a) slash "/", (b) backslash "\", (c) dot ".",, (d) dot dot "..", and (e) internal…

  • CVE-2004-2520Dec 31, 2004
    Gattaca
    Gattaca Server 2003
    risk 0.03cvss —epss 0.03

    POP3 protocol in Gattaca Server 2003 1.1.10.0 allows remote authenticated users to cause a denial of service (application crash) via a large numeric value in the (1) LIST, (2) RETR, or (3) UIDL commands.

  • CVE-2004-2521Dec 31, 2004
    Gattaca
    Gattaca Server 2003
    risk 0.00cvss —epss 0.02

    Mail server in Gattaca Server 2003 1.1.10.0 allows remote attackers to perform a denial of service (application crash) via a large number of connections to TCP port (1) 25 (SMTP) or (2) 110 (POP).

  • CVE-2004-2522Dec 31, 2004
    Gattaca
    Gattaca Server 2003
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in web.tmpl in Gattaca Server 2003 1.1.10.0 allows remote attackers to inject arbitrary web script or HTML via the (1) template or (2) language parameter.

  • CVE-2004-2523Dec 31, 2004
    Openftpd
    OpenFTPD
    risk 0.03cvss —epss 0.05

    Format string vulnerability in the msg command (cat_message function in msg.c) in OpenFTPD 0.30.2 and earlier allows remote authenticated users to execute arbitrary code via format string specifiers in the message argument.

  • CVE-2004-2524Dec 31, 2004
    Whm Autopilot
    Whm Autopilot
    risk 0.00cvss —epss 0.02

    clogin.php in Benchmark Designs' WHM AutoPilot 2.4.5 and earlier allows remote attackers to obtain plaintext username and password credentials by using the clogin_e and base64_encode functions to encode the desired user ID in the c parameter, then read the plaintext values in…

  • CVE-2004-2525Dec 31, 2004
    Serendipity
    Serendipity
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in compat.php in Serendipity before 0.7.1 allows remote attackers to inject arbitrary web script or HTML via the searchTerm variable.

  • CVE-2004-2526Dec 31, 2004
    IBM
    Tivoli Directory Server
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in ldacgi.exe in IBM Tivoli Directory Server 4.1 and earlier allows remote attackers to view arbitrary files via a .. (dot dot) in the Template parameter.

  • CVE-2004-2527Dec 31, 2004
    Microsoft
    Windows Xp
    risk 0.00cvss —epss 0.02

    The local and remote desktop login screens in Microsoft Windows XP before SP2 and 2003 allow remote attackers to cause a denial of service (CPU and memory consumption) by repeatedly using the WinKey+"U" key combination, which causes multiple copies of Windows Utility Manager to…

  • CVE-2004-2528Dec 31, 2004
    Webcam Watchdog
    Webcam Watchdog
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in sresult.exe in Webcam Watchdog 4.0.1a allows remote attackers to inject arbitrary web script or HTML via the cam parameter.

  • CVE-2004-2529Dec 31, 2004
    Gadu Gadu
    Gadu-Gadu
    risk 0.00cvss —epss 0.02

    Gadu-Gadu allows remote attackers to bypass the "image send" option by sending a very small image file, which could be used in conjunction with image-related vulnerabilities.

  • CVE-2004-2530Dec 31, 2004
    Gadu Gadu
    Gadu-Gadu
    risk 0.03cvss —epss 0.02

    Visual truncation vulnerability in Gadu-Gadu allows remote attackers to spoof the file extension on transmitted files via a filename with a large number of spaces followed by the real extension, which is not displayed in the dialog box.

  • CVE-2004-2531Dec 31, 2004
    GNU
    Gnutls
    risk 0.00cvss —epss 0.02

    X.509 Certificate Signature Verification in Gnu transport layer security library (GnuTLS) 1.0.16 allows remote attackers to cause a denial of service (CPU consumption) via certificates containing long chains and signed with large RSA keys.

  • CVE-2004-2532Dec 31, 2004
    SolarWinds
    Serv U File Server
    risk 0.04cvss —epss 0.15

    Serv-U FTP server before 5.1.0.0 has a default account and password for local administration, which allows local users to execute arbitrary commands by connecting to the server using the default administrator account, creating a new user, logging in as that new user, and then…

  • CVE-2004-2533Dec 31, 2004
    Serv U
    FTP Server
    risk 0.00cvss —epss 0.03

    Serv-U FTP Server 4.1 (possibly 4.0) allows remote attackers to cause a denial of service (application crash) via a SITE CHMOD command with a "\\...\" followed by a short string, causing partial memory corruption, a different vulnerability than CVE-2004-2111.

  • CVE-2004-2534Dec 31, 2004
    Fastream
    Netfile FTP Web Server
    risk 0.03cvss —epss 0.04

    Fastream NETFile Server 7.1.2 does not properly handle keep-alive connection timeouts and does not close the connection after a HEAD request, which allows remote attackers to perform a denial of service (connection consumption) by sending a large number HTTP HEAD requests.

  • CVE-2004-2535Dec 31, 2004
    Matthew Phillips
    Sticker
    risk 0.00cvss —epss 0.01

    The person-to-person secure messaging feature in Sticker before 3.1.0 beta 2 allows remote attackers to post messages to unauthorized private groups by using the group's public encryption key.

  • CVE-2004-2536Dec 31, 2004
    Linux
    Kernel
    risk 0.00cvss —epss 0.02

    The exit_thread function (process.c) in Linux kernel 2.6 through 2.6.5 does not invalidate the per-TSS io_bitmap pointers if a process obtains IO access permissions from the ioperm function but does not drop those permissions when it exits, which allows other processes to access…