VYPR

CVEs

378,380 total · page 7378 of 7,568

AllCriticalHighKEV
  • CVE-2004-2537Dec 31, 2004
    Netwin
    Surgemail
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in SurgeMail before 2.2c10 has unknown impact and attack vectors, related to a "Webmail security bug."

  • CVE-2004-2538Dec 31, 2004
    Phpcodegenie
    phpCodeGenie
    risk 0.00cvss —epss 0.02

    Direct static code injection vulnerability in the PCG simple application generation in phpCodeGenie before 3.0.2 allows remote authenticated users to execute arbitrary code via the (1) header or (2) footer.

  • CVE-2004-2539Dec 31, 2004
    Network Appliance
    Data Ontap
    risk 0.00cvss —epss 0.02

    Unknown vulnerability in Network Appliance NetCache 5.2 and Data ONTAP 6.0 allows remote attackers to cause a denial of service (panic and reboot) and possibly other impacts via unknown attack vectors, possibly related to unspecified worms, as identified by bug ID

  • CVE-2004-2540Dec 31, 2004
    Sun Corporation
    Jre
    risk 0.00cvss —epss 0.02

    readObject in (1) Java Runtime Environment (JRE) and (2) Software Development Kit (SDK) 1.4.0 through 1.4.2_05 allows remote attackers to cause a denial of service (JVM unresponsive) via crafted serialized data.

  • CVE-2004-2541Dec 31, 2004
    Cscope
    Cscope
    risk 0.00cvss —epss 0.02

    Buffer overflow in Cscope 15.5, and possibly multiple overflows, allows remote attackers to execute arbitrary code via a C file with a long #include line that is later browsed by the target.

  • CVE-2004-2542Dec 31, 2004
    SirsiDynix
    Webpac
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Dynix (formerly known as epixtech) WebPAC allow remote attackers to execute arbitrary SQL commands via unknown attack vectors, resulting in an ability to execute stored procedures, bypass login authentication, and cause an unspecified…

  • CVE-2004-2543Dec 31, 2004
    Secure Computing Corporation
    Sidewinder G2
    risk 0.00cvss —epss 0.02

    Secure Computing Corporation Sidewinder G2 6.1.0.01 might allow remote attackers to cause a denial of service (proxy failure) via invalid traffic to the (1) T.120 or (2) RTSP proxy, or (3) invalid MIME messages to the mail filter. NOTE: this might not be a vulnerability because…

  • CVE-2004-2544Dec 31, 2004
    Securecomputing
    Sidewinder G2
    risk 0.00cvss —epss 0.00

    Admin Console in Secure Computing Corporation Sidewinder G2 6.1.0.01 exports private keys when exporting firewall certificates, which might allow attackers to obtain sensitive information.

  • CVE-2004-2545Dec 31, 2004
    Securecomputing
    Sidewinder G2
    risk 0.00cvss —epss 0.02

    Secure Computing Corporation Sidewinder G2 6.1.0.01 allows remote attackers to cause a denial of service (SMTP proxy failure) via unknown attack vendors involving an "extremely busy network." NOTE: this might not be a vulnerability because the embedded monitoring sub-system…

  • CVE-2004-2546Dec 31, 2004
    Samba (software)
    Samba
    risk 0.00cvss —epss 0.03

    Multiple memory leaks in Samba before 3.0.6 allow attackers to cause a denial of service (memory consumption).

  • CVE-2004-2547Dec 31, 2004
    Netwin
    Surgemail
    risk 0.03cvss —epss 0.03

    NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to obtain sensitive information via HTTP requests that (a) specify the / URI, (b) specify the /scripts/ URI, or (c) specify a non-existent file, which reveal the path in an error message.

  • CVE-2004-2548Dec 31, 2004
    Netwin
    Surgemail
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to inject arbitrary web script or HTML via (a) a URI containing the script, or (b) the username field in the login form. NOTE: it is possible that the…

  • CVE-2004-2549Dec 31, 2004
    Nortel
    Wlan Access Point 2220
    risk 0.04cvss —epss 0.10

    Nortel Wireless LAN (WLAN) Access Point (AP) 2220, 2221, and 2225 allow remote attackers to cause a denial of service (service crash) via a TCP request with a large string, followed by 8 newline characters, to (1) the Telnet service on TCP port 23 and (2) the HTTP service on TCP…

  • CVE-2004-2550Dec 31, 2004
    Sandsurfer
    Sandsurfer
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in unspecified Perl scripts in SandSurfer before 1.7.1 allow remote attackers to inject arbitrary web script or HTML, which is later executed by a target who views reports containing the injected data.

  • CVE-2004-2551Dec 31, 2004
    Layton Technology
    Helpbox
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Layton HelpBox 3.0.1 allow remote attackers to execute arbitrary SQL commands via (1) the sys_comment_id parameter in editcommentenduser.asp, (2) the sys_suspend_id parameter in editsuspensionuser.asp, (3) the table parameter in…

  • CVE-2004-2552Dec 31, 2004
    XBoard
    XBoard
    risk 0.00cvss —epss 0.01

    Buffer overflow in XBoard 4.2.7 and earlier might allow local users to execute arbitrary code via a long -icshost command line argument. NOTE: since the program is not setuid and not normally called from remote programs, there may not be a typical attack vector for the issue…

  • CVE-2004-2553Dec 31, 2004
    The Ignition Project
    Ignitionserver
    risk 0.00cvss —epss 0.02

    The Ignition Project ignitionServer 0.1.2 through 0.1.2-R2 allows remote authenticated users with local IRC operator privileges to obtain global IRC operator privileges by using the unofficial umode command with the +ORD argument.

  • CVE-2004-2554Dec 31, 2004
    Novell
    Client Firewall
    risk 0.00cvss —epss 0.00

    Novell Client Firewall (NCF) 2.0, as based on the Agnitum Outpost Firewall, allows local users to execute arbitrary code with SYSTEM privileges by opening the NCF tray icon and using the Help functionality to launch programs with SYSTEM privileges.

  • CVE-2004-2555Dec 31, 2004
    Riverdeep
    FoolProof Security
    risk 0.03cvss —epss 0.01

    Riverdeep FoolProof Security 3.9.x on Windows 98 and Windows ME uses weak cryptography (arithmetic and XOR operations) to relate the Control password to the Administrator password, which allows local users to calculate the Administrator password if they know the Control password…

  • CVE-2004-2556Dec 31, 2004
    Netgear
    Wg602
    risk 0.00cvss —epss 0.03

    NetGear WG602 (aka WG602v1) Wireless Access Point firmware 1.04.0 and 1.5.67 has a hardcoded account of username "super" and password "5777364", which allows remote attackers to modify the configuration.

  • CVE-2004-2557Dec 31, 2004
    Netgear
    Wg602
    risk 0.00cvss —epss 0.03

    NetGear WG602 (aka WG602v1) Wireless Access Point 1.7.14 has a hardcoded account of username "superman" and password "21241036", which allows remote attackers to modify the configuration.

  • CVE-2004-2558Dec 31, 2004
    IBM
    Tivoli Secureway Policy Director
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in IBM Tivoli SecureWay Policy Director 3.8, Access Manager for e-business 3.9 to 5.1, Access Manager Identity Manager Solution 5.1, Configuration Manager 4.2, Configuration Manager for Automated Teller Machines 2.1.0, and IBM WebSphere Everyplace…

  • CVE-2004-2559Dec 31, 2004
    Dokuwiki
    Dokuwiki
    risk 0.00cvss —epss 0.02

    DokuWiki before 2004-10-19 allows remote attackers to access administrative functionality including (1) Mediaselectiondialog, (2) Recent changes, (3) feed, and (4) search, possibly due to the lack of ACL checks.

  • CVE-2004-2560Dec 31, 2004
    Dokuwiki
    Dokuwiki
    risk 0.00cvss —epss 0.03

    DokuWiki before 2004-10-19, when used on a web server that permits execution based on file extension, allows remote attackers to execute arbitrary code by uploading a file with an appropriate extension such as ".php" or ".cgi".

  • CVE-2004-2561Dec 31, 2004
    Internet Sofware Sciences
    Web\+center
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Internet Software Sciences Web+Center 4.0.1 allow remote attackers to execute arbitrary SQL commands via (1) the ISS_TECH_CENTER_LOGIN cookie in search.asp and (2) one or more cookies in DoCustomerOptions.asp.

  • CVE-2004-2562Dec 31, 2004
    Leigh Business Enterprises
    Web Helpdesk
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in jobedit.asp in Leigh Business Enterprises (LBE) Web Helpdesk before 4.0.0.81 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2004-2563Dec 31, 2004
    Serena
    Serena Teamtrack
    risk 0.03cvss —epss 0.02

    Serena TeamTrack 6.1.1 allows remote attackers to obtain sensitive information such as user names, versions, and database information, and conduct cross-site scripting (XSS) attacks, via a direct request to tmtrack.dll with modified LoginPage and Template parameters.

  • CVE-2004-2564Dec 31, 2004
    Sambar
    Sambar Server
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in Sambar Server 6.1 Beta 2 on Windows, and possibly other versions on Linux, allow remote attackers to inject arbitrary web script or HTML via (1) the show parameter in show.asp and (2) the title parameter in showperf.asp.

  • CVE-2004-2565Dec 31, 2004
    Sambar
    Sambar Server
    risk 0.04cvss —epss 0.09

    Multiple directory traversal vulnerabilities in Sambar Server 6.1 Beta 2 on Windows, and possibly other versions on Linux, when the administrative IP address restrictions have been modified from the default, allow remote authenticated users to read arbitrary files via (1) a…

  • CVE-2004-2566Dec 31, 2004
    Livechat
    Livefocusgroup
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in LiveWorld products, possibly including (1) LiveForum, (2) LiveQ&A, (3) LiveChat, and (4) LiveFocusGroup, allow remote attackers to inject arbitrary web script or HTML via the q parameter in (a) search.jsp, (b)…

  • CVE-2004-2567Dec 31, 2004
    Recipants
    Recipants
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ReciPants 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) user id, (2) recipe id, (3) category id, and (4) other ID number fields.

  • CVE-2004-2568Dec 31, 2004
    Recipants
    Recipants
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in ReciPants 1.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) user id, (2) recipe id, (3) category id, and (4) other ID number fields.

  • CVE-2004-2569Dec 31, 2004
    David Stes
    Ipmenu
    risk 0.00cvss —epss 0.00

    ipmenu 0.0.3 before Debian GNU/Linux ipmenu_0.0.3-5 allows local users to overwrite arbitrary files via a symlink attack on the ipmenu.log temporary file.

  • CVE-2004-2570Dec 31, 2004
    Opera
    Opera
    risk 0.00cvss —epss 0.03

    Opera before 7.54 allows remote attackers to modify properties and methods of the location object and execute Javascript to read arbitrary files from the client's local filesystem or display a false URL to the user.

  • CVE-2004-2571Dec 31, 2004
    Enderunix
    Isoqlog
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in EnderUNIX isoqlog 2.1.1 allow remote attackers to execute arbitrary code via the (1) parseQmailFromBytesLine, (2) parseQmailToRemoteLine, (3) parseQmailToLocalLine, (4) parseSendmailFromBytesLine, (5) parseSendmailToLine, (6) parseEximFromBytesLine,…

  • CVE-2004-2572Dec 31, 2004
    Amax Information Technologies
    Magic Winmail Server
    risk 0.00cvss —epss 0.02

    AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering (1) invalid characters such as "()" or (2) a large number of characters in the Lookup field on the netaddressbook.php web form, which reveals the path in an ldaplib.php error…

  • CVE-2004-2573Dec 31, 2004
    PhpGroupWare
    Phpgroupware
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in tables_update.inc.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to execute arbitrary PHP code via an external URL in the appdir parameter.

  • CVE-2004-2574Dec 31, 2004
    PhpGroupWare
    Phpgroupware
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in index.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to inject arbitrary web script or HTML via the date parameter in a calendar.uicalendar.planner menuaction.

  • CVE-2004-2575Dec 31, 2004
    PhpGroupWare
    Phpgroupware
    risk 0.00cvss —epss 0.02

    phpGroupWare 0.9.14.005 and earlier allow remote attackers to obtain sensitive information via a direct request to (1) hook_admin.inc.php, (2) hook_home.inc.php, (3) class.holidaycalc.inc.php, and (4) setup.inc.php.sample, which reveals the path in an error message.

  • CVE-2004-2576Dec 31, 2004
    PhpGroupWare
    Phpgroupware
    risk 0.00cvss —epss 0.02

    class.vfs_dav.inc.php in phpGroupWare 0.9.16.000 does not create .htaccess files to enable authorization checks for access to users' home-directory files, which allows remote attackers to obtain sensitive information from these files.

  • CVE-2004-2577Dec 31, 2004
    PhpGroupWare
    Phpgroupware
    risk 0.00cvss —epss 0.01

    The acl_check function in phpGroupWare 0.9.16RC2 always returns True, even when mkdir does not behave as expected, which could allow remote attackers to obtain sensitive information via WebDAV from users' home directories that lack .htaccess files, and possibly has other unknown…

  • CVE-2004-2578Dec 31, 2004
    PhpGroupWare
    Phpgroupware
    risk 0.00cvss —epss 0.01

    phpGroupWare before 0.9.16.002 transmits the (1) header admin and (2) setup passwords in plaintext via cookies, which allows remote attackers to sniff passwords.

  • CVE-2004-2579Dec 31, 2004
    Novell
    Ichain
    risk 0.00cvss —epss 0.02

    ACLCHECK module in Novell iChain 2.3 allows attackers to bypass access control rules of an unspecified component via an unspecified attack vector involving a string that contains escape sequences represented with "overlong UTF-8 encoding."

  • CVE-2004-2580Dec 31, 2004
    Novell
    Ichain
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Novell iChain 2.3 allows remote attackers to obtain login credentials via unspecified vectors.

  • CVE-2004-2581Dec 31, 2004
    Novell
    Ichain
    risk 0.00cvss —epss 0.02

    Novell iChain 2.3 allows attackers to cause a denial of service via a URL with a "specific string."

  • CVE-2004-2582Dec 31, 2004
    Novell
    Ichain
    risk 0.00cvss —epss 0.02

    Novell iChain 2.3 includes the build number in the VIA line of the proxy server's HTTP headers, which allows remote attackers to obtain sensitive information.

  • CVE-2004-2583Dec 31, 2004
    Smartertools
    Smartermail
    risk 0.00cvss —epss 0.02

    SMTP service in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous open connections to TCP port 25.

  • CVE-2004-2584Dec 31, 2004
    Smartertools
    Smartermail
    risk 0.00cvss —epss 0.01

    frmAddfolder.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote authenticated users to create a folder that SmarterMail cannot delete or rename via a folder name with a null byte ("%00"). NOTE: it is not clear whether this issue poses a vulnerability.

  • CVE-2004-2585Dec 31, 2004
    Smartertools
    Smartermail
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in frmCompose.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to inject arbitrary web script or HTML via Javascript to the "check spelling" feature in the compose area.

  • CVE-2004-2586Dec 31, 2004
    Smartertools
    Smartermail
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in frmGetAttachment.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to read arbitrary files via the filename parameter.