VYPR

CVEs

378,376 total · page 7380 of 7,568

AllCriticalHighKEV
  • CVE-2004-2641Dec 31, 2004
    Sun Corporation
    Sun Fire
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Sun Fire 3800/4800/4810/6800, Sun Fire V1280, and Netra 1280 allows remote attackers to cause a denial of service (system controller hang) via IP Packets With Type of Service (TOS) Bits set.

  • CVE-2004-2642Dec 31, 2004
    Yeemp
    Yeemp
    risk 0.00cvss —epss 0.02

    Yeemp 0.9.9 and earlier does not properly encrypt inbound files, which allows remote attackers to spoof the identity of the sender.

  • CVE-2004-2643Dec 31, 2004
    Microsoft
    Cabarc
    risk 0.01cvss —epss 0.07

    Directory traversal vulnerability in Microsoft cabarc allows remote attackers to overwrite files via "../" sequences in file names in a CAB archive.

  • CVE-2004-2644Dec 31, 2004
    Asn.1 Compiler
    Asn.1 Compiler
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in ASN.1 Compiler (asn1c) before 0.9.7 has unknown impact and attack vectors when processing "ANY" type tags.

  • CVE-2004-2645Dec 31, 2004
    Asn.1 Compiler
    Asn.1 Compiler
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in ASN.1 Compiler (asn1c) before 0.9.7 has unknown impact and attack vectors when processing "CHOICE" types with "indefinite length structures."

  • CVE-2004-2646Dec 31, 2004
    risk 0.03cvss —epss 0.04

    The addUser function in UserManager.java in Free Web Chat 2.0 allows remote attackers to cause a denial of service (uncaught NullPointerException) via unknown attack vectors that cause the usrName variable to be null.

  • CVE-2004-2647Dec 31, 2004
    Free Web Chat
    Free Web Chat
    risk 0.03cvss —epss 0.04

    Free Web Chat 2.0 allows remote attackers to cause a denial of service (CPU consumption) via multiple connections from the same user.

  • CVE-2004-2648Dec 31, 2004
    FreezeX
    FreezeX
    risk 0.00cvss —epss 0.00

    FreezeX 1.00.100.0666 allows local users with administrator privileges to cause a denial of service (FreezeX application) by overwriting the db.fzx file.

  • CVE-2004-2649Dec 31, 2004
    Eudora
    Eudora
    risk 0.03cvss —epss 0.03

    Eudora 6.1.0.6 allows remote attackers to obfuscate URLs displayed in the status bar by inserting a large number of characters (e.g. spaces coded as "&#32") in the middle of the URL.

  • CVE-2004-2650Dec 31, 2004
    Apache
    James
    risk 0.00cvss —epss 0.01

    Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error conditions in the retrieve function, which prevents a lock from being released and causes a memory leak.

  • CVE-2004-2651Dec 31, 2004
    Yacy
    YaCy
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in YaCy before 0.32 allow remote attackers to inject arbitrary web script or HTML via the (1) urlmaskfilter parameter to index.html or the (2) page parameter to Wiki.html.

  • CVE-2004-2652Dec 31, 2004
    Snort
    Snort
    risk 0.04cvss —epss 0.11

    The DecodeTCPOptions function in decode.c in Snort before 2.3.0, when printing TCP/IP options using FAST output or verbose mode, allows remote attackers to cause a denial of service (crash) via packets with invalid TCP/IP options, which trigger a null dereference.

  • CVE-2004-2653Dec 31, 2004
    Pd9 Software
    Megabbs
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in PD9 Software MegaBBS 2.0 and 2.1 allows attackers to gain privileges via unknown vectors involving (1) admin/userlevelmembers-edit.asp and (2) admin/edit-groups.asp.

  • CVE-2004-2654Dec 31, 2004
    Squid Cache
    Squid
    risk 0.00cvss —epss 0.02

    The clientAbortBody function in client_side.c in Squid Web Proxy Cache before 2.6 STABLE6 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors that trigger a null dereference. NOTE: in a followup advisory, a researcher claimed that…

  • CVE-2004-2655Dec 31, 2004
    Xscreensaver
    Xscreensaver
    risk 0.00cvss —epss 0.02

    rdesktop 1.3.1 with xscreensaver 4.14, and possibly other versions, when running on Fedora and possibly other platforms, does not release the keyboard focus when xscreensaver starts, which causes the password to be entered into the active window when the user unlocks the screen.

  • CVE-2004-2656Dec 31, 2004
    Open Source Development Network
    Slashcode
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Slashdot Like Automated Storytelling Homepage (Slash) (aka Slashcode) before R_2_5_0_41 allow remote attackers to inject arbitrary web script or HTML via (1) the topic parameter in search.pl and (2) the filter parameter in…

  • CVE-2004-2657Dec 31, 2004
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.00

    Mozilla Firefox 1.5.0.1, and possibly other versions, preserves some records of user activity even after uninstalling, which allows local users who share a Windows profile to view the records after a new installation of Firefox, as reported for the list of Passwords Never Saved…

  • CVE-2004-2658Dec 31, 2004
    Novell
    SUSE CORE 9
    risk 0.00cvss —epss 0.00

    resmgr in SUSE CORE 9 does not properly identify terminal names, which allows local users to spoof terminals and login types.

  • CVE-2004-2659Dec 31, 2004
    Opera
    Opera
    risk 0.00cvss —epss 0.01

    Opera offers an Open button to verify that a user wishes to execute a downloaded file, which allows user-assisted remote attackers to construct a race condition that tricks a user into clicking Open via a request for a different mouse or keyboard action very shortly before the…

  • CVE-2004-2660Dec 31, 2004
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Memory leak in direct-io.c in Linux kernel 2.6.x before 2.6.10 allows local users to cause a denial of service (memory consumption) via certain O_DIRECT (direct IO) write requests.

  • CVE-2004-2661Dec 31, 2004
    Soft3304
    04webserver
    risk 0.00cvss —epss 0.01

    Soft3304 04WebServer before 1.41 does not properly check file names, which allows remote attackers to obtain sensitive information (CGI source code).

  • CVE-2004-2662Dec 31, 2004
    Soft3304
    04webserver
    risk 0.00cvss —epss 0.02

    Soft3304 04WebServer before 1.41 allows remote attackers to cause a denial of service (resource consumption or crash) via certain data related to OpenSSL, which causes a thread to terminate but continue to hold resources.

  • CVE-2004-2663Dec 31, 2004
    IBM
    Egatherer
    risk 0.00cvss —epss 0.02

    The (1) SetDebugging and (2) RunEgatherer methods in IBM Access Support eGatherer ActiveX control 2.0.0.16 allow remote attackers to create files with arbitrary content, as demonstrated by creating a .hta file in a Startup folder.

  • CVE-2004-2664Dec 31, 2004
    Adodb
    Adodb
    risk 0.00cvss —epss 0.01

    John Lim ADOdb Library for PHP before 4.23 allows remote attackers to obtain sensitive information via direct requests to certain scripts that result in an undefined value of ADODB_DIR, which reveals the installation path in an error message.

  • CVE-2004-2665Dec 31, 2004
    Microfocus
    Hpux
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport software in HP-UX B.11.00, B.11.04, and B.11.11 before 20040628 allows local users to cause a denial of service via unspecified vectors.

  • CVE-2004-2666Dec 31, 2004
    Mantisbt
    Mantis
    risk 0.00cvss —epss 0.01

    Mantis before 20041016 provides a complete Issue History (Bug History) in the web interface regardless of view_history_threshold, which allows remote attackers to obtain sensitive information (private bug details) by visiting a bug's web page.

  • CVE-2004-2667Dec 31, 2004
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Lotus Domino 6.0.x before 6.0.4 and 6.5.x before 6.5.2 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

  • CVE-2004-2668Dec 31, 2004
    Interchange Development Group
    Interchange
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Interchange before 4.8.9 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

  • CVE-2004-2669Dec 31, 2004
    Neocrome
    Land Down Under
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Land Down Under (LDU) v701 allow remote attackers to execute arbitrary SQL commands or obtain the installation path via parameters including (1) s, w, and d in users.php, (2) id in comments.php, (3) rusername in auth.php, or (4) h in…

  • CVE-2004-2670Dec 31, 2004
    Endonesia
    eNdonesia Portal
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in mod.php in eNdonesia 8.3 allow remote attackers to inject arbitrary web script or HTML via (1) the mod parameter in a viewcat operation or (2) the query parameter in a search operation in the publisher module.

  • CVE-2004-2671Dec 31, 2004
    Endonesia
    eNdonesia Portal
    risk 0.00cvss —epss 0.02

    mod.php in eNdonesia 8.3 allows remote attackers to obtain sensitive information via certain direct requests, and certain requests with invalid parameter values, which reveal the path in various error messages, as demonstrated by the (1) mod and (2) cid parameters.

  • CVE-2004-2672Dec 31, 2004
    Argosoft
    FTP Server
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in ArGoSoft FTP server before 1.4.2.2 allows attackers to upload .lnk files via unknown vectors.

  • CVE-2004-2673Dec 31, 2004
    Argosoft
    FTP Server
    risk 0.00cvss —epss 0.05

    Multiple buffer overflows in ArGoSoft FTP Server before 1.4.1.6 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code via (1) a SITE ZIP command with a long first or second argument, or (2) a SITE COPY with a long argument.

  • CVE-2004-2674Dec 31, 2004
    Argosoft
    FTP Server
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in ArGoSoft FTP Server before 1.4.1.6 allows remote authenticated users to determine the existence of arbitrary files via ".." sequences in the SITE UNZIP argument.

  • CVE-2004-2675Dec 31, 2004
    Argosoft
    FTP Server
    risk 0.03cvss —epss 0.03

    ArGoSoft FTP Server before 1.4.1.6 allows remote authenticated users to cause a denial of service (crash) via a SITE PASS command with a long password parameter, which causes the database to be corrupted.

  • CVE-2004-2676Dec 31, 2004
    Webroot Software
    Spy Sweeper Enterprise
    risk 0.00cvss —epss 0.00

    The Spy Sweeper Enterprise Client (SpySweeperTray.exe) in WebRoot Spy Sweeper before 2.0 does not drop privileges when using the help functionality, which allows local users to gain privileges.

  • CVE-2004-2677Dec 31, 2004
    Qwikmail
    Qwikmail SMTP
    risk 0.04cvss —epss 0.06

    Format string vulnerability in qwik-smtpd.c in QwikMail SMTP (qwik-smtpd) 0.3 and earlier allows remote attackers to execute arbitrary code via format specifiers in the (1) clientRcptTo array, and the (2) Received and (3) messageID variables, possibly involving HELO and hostname…

  • CVE-2004-2678Dec 31, 2004
    Microfocus
    Tru64
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in HP Tru64 UNIX 5.1B PK2(BL22) and PK3(BL24), and 5.1A PK6(BL24), when using IPsec/IKE (Internet Key Exchange) with Certificates, allows remote attackers to gain privileges via unknown attack vectors.

  • CVE-2004-2679Dec 31, 2004
    Checkpoint
    Firewall 1
    risk 0.00cvss —epss 0.01

    Check Point Firewall-1 4.1 up to NG AI R55 allows remote attackers to obtain potentially sensitive information by sending an Internet Key Exchange (IKE) with a certain Vendor ID payload that causes Firewall-1 to return a response containing version and other information.

  • CVE-2004-2680Dec 31, 2004
    Apache
    Mod Python
    risk 0.00cvss —epss 0.04

    mod_python (libapache2-mod-python) 3.1.4 and earlier does not properly handle when output filters process more than 16384 bytes, which can cause filter.read to return portions of previously freed memory.

  • CVE-2004-2681Dec 31, 2004
    Matrixssl
    Matrixssl
    risk 0.00cvss —epss 0.01

    PeerSec MatrixSSL before 1.1 caches session keys for an indefinitely long time, which might make it easier for remote attackers to hijack a session.

  • CVE-2004-2682Dec 31, 2004
    Matrixssl
    Matrixssl
    risk 0.00cvss —epss 0.01

    PeerSec MatrixSSL before 1.1 does not implement RSA blinding, which allows context-dependent attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of…

  • CVE-2004-2683Dec 31, 2004
    Intersystems
    Caché
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the %XML.Utils.SchemaServer class in InterSystems Cache' 5.0 allows attackers to access arbitrary files on a server.

  • CVE-2004-2684Dec 31, 2004
    Intersystems
    Cache Database
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the %template package in InterSystems Cache' 5.0 allows attackers to access certain files on a server, including (1) cache.key and (2) cache.dat, related to .csp files under (a) Dev\studio\templates and (b) Devuser\studio\templates.

  • CVE-2004-2685Dec 31, 2004
    Youngzsoft
    Ccproxy
    risk 0.04cvss —epss 0.11

    Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long address in a ping (p) command to the Telnet proxy service, a different vector than CVE-2004-2416.

  • CVE-2004-2686Dec 31, 2004
    Sun Corporation
    Solaris
    risk 0.03cvss —epss 0.01

    Directory traversal vulnerability in the vfs_getvfssw function in Solaris 2.6, 7, 8, and 9 allows local users to load arbitrary kernel modules via crafted (1) mount or (2) sysfs system calls. NOTE: this might be the same issue as CVE-2004-1767, but there are insufficient…

  • CVE-2004-2687Dec 31, 2004
    Distcc
    Distcc
    risk 0.10cvss —epss 0.88

    distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.

  • CVE-2004-2688Dec 31, 2004
    Newsphp
    Newsphp
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in NewsPHP allows remote attackers to inject arbitrary web script or HTML via the cat_id parameter. NOTE: this issue might overlap vector 3 in CVE-2006-3358.

  • CVE-2004-2689Dec 31, 2004
    Newsphp
    Newsphp
    risk 0.00cvss —epss 0.02

    NewsPHP allows remote attackers to gain unauthorized administrative access by setting a cookie to the "autorized=admin; root=admin" value.

  • CVE-2004-2690Dec 31, 2004
    Newsphp
    Newsphp
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in the Administration Panel for NewsPHP allows remote authenticated administrators to upload and execute arbitrary code instead of video files.