VYPR

CVEs

378,371 total · page 7381 of 7,568

AllCriticalHighKEV
  • CVE-2004-2696Dec 31, 2004
    Bea
    WebLogic Server
    risk 0.00cvss —epss 0.01

    BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation (RMI) over Internet Inter-ORB Protocol (IIOP), does not properly handle when multiple logins for different users coming from the same client, which could cause an "unexpected user…

  • CVE-2004-2697Dec 31, 2004
    IBM
    Aix
    risk 0.03cvss —epss 0.01

    The Inventory Scout daemon (invscoutd) 1.3.0.0 and 2.0.2 for AIX 4.3.3 and 5.1 allows local users to gain privileges via a symlink attack on a command line argument (log file). NOTE: this might be related to CVE-2006-5002.

  • CVE-2004-2698Dec 31, 2004
    Jon Atkins
    Imwheel
    risk 0.03cvss —epss 0.00

    Race condition in IMWheel 1.0.0pre11 and earlier, when running with the -k option, allows local users to cause a denial of service (IMWheel crash) and possibly modify arbitrary files via a symlink attack on the imwheel.pid file.

  • CVE-2004-2699Dec 31, 2004
    Aspdotnetstorefront
    Aspdotnetstorefront
    risk 0.03cvss —epss 0.02

    deleteicon.aspx in AspDotNetStorefront 3.3 allows remote attackers to delete arbitrary product images via a modified ProductID parameter.

  • CVE-2004-2700Dec 31, 2004
    Aspdotnetstorefront
    Aspdotnetstorefront
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in AspDotNetStorefront 3.3 allows remote authenticated administrators to upload arbitrary files with executable extensions via admin/images.aspx.

  • CVE-2004-2701Dec 31, 2004
    Aspdotnetstorefront
    Aspdotnetstorefront
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in signin.aspx for AspDotNetStorefront 3.3 allows remote attackers to inject arbitrary web script or HTML via the returnurl parameter.

  • CVE-2004-2702Dec 31, 2004
    Swsoft
    Plesk
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in login_up.php3 in Plesk 7.0 and 7.1 Reloaded allows remote attackers to inject arbitrary web script or HTML via the login_name parameter. NOTE: this might be the same vector as CVE-2006-6451.

  • CVE-2004-2703Dec 31, 2004
    Clearswift
    Mailsweeper
    risk 0.00cvss —epss 0.01

    Clearswift MIMEsweeper 5.0.5, when it has been upgraded from MAILsweeper for SMTP version 4.3 or MAILsweeper Business Suite I or II, allows remote attackers to bypass scanning by including encrypted data in a mail message, which causes the message to be marked as "Clean" instead…

  • CVE-2004-2704Dec 31, 2004
    Microsoft
    Internet Explorer
    risk 0.00cvss —epss 0.05

    Hastymail 1.0.1 and earlier (stable) and 1.1 and earlier (development) does not send the "attachment" parameter in the Content-Disposition field for attachments, which causes the attachment to be rendered inline by Internet Explorer when the victim clicks the download link,…

  • CVE-2004-2705Dec 31, 2004
    Pvpgn
    Pvpgn
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Player vs. Player Gaming Network (PvPGN) before 1.6.4 allows remote attackers to obtain attributes of arbitrary accounts, including the password hash, via certain statsreq packets.

  • CVE-2004-2706Dec 31, 2004
    Gyach Enhanced
    Gyach Enhanced
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Gyach Enhanced (Gyach-E) before 1.0.4 allows remote attackers to cause a denial of service (crash) via conference packets with error messages.

  • CVE-2004-2707Dec 31, 2004
    Phrozensmoke
    Gyach Enhanced
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Gyach Enhanced (Gyach-E) before 1.0.5 have unknown impact and attack vectors related to "several security flaws," probably related to buffer overflows in HTTP server responses.

  • CVE-2004-2708Dec 31, 2004
    Gyach
    Gyach Enhanced
    risk 0.00cvss —epss 0.01

    Gyach Enhanced (Gyach-E) before 1.0.0 stores passwords in plaintext, which allows attackers to obtain user passwords by reading the configuration file.

  • CVE-2004-2709Dec 31, 2004
    Gyach Enhanced
    Gyach Enhanced
    risk 0.00cvss —epss 0.02

    Buffer overflow in the strip_html_tags method for Gyach Enhanced (Gyach-E) before 1.0.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via unknown vectors involving HTML tags.

  • CVE-2004-2710Dec 31, 2004
    Gyach Enhanced
    Gyach Enhanced
    risk 0.00cvss —epss 0.03

    Multiple buffer overflows in Gyach Enhanced (Gyach-E) before 1.0.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to (1) sending certain typing statuses or (2) setting the chat room status bar to the current…

  • CVE-2004-2711Dec 31, 2004
    Gyach
    Gyach Enhanced
    risk 0.00cvss —epss 0.02

    Multiple buffer overflows in Gyach Enhanced (Gyach-E) before 1.0.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to "avatar retrieval."

  • CVE-2004-2712Dec 31, 2004
    Gyach Enhanced
    Gyach-E
    risk 0.00cvss —epss 0.01

    Buffer overflow in Gyach Enhanced (Gyach-E) before 1.0.0-SneakPeek-3 allows remote attackers to cause a denial of service (crash) via unspecified vectors related to "URL data."

  • CVE-2004-2713Dec 31, 2004
    Zonelabs
    Zonealarm
    risk 0.00cvss —epss 0.00

    Zone Alarm Pro 1.0 through 5.1 gives full access to %windir%\Internet Logs\* to the EVERYONE group, which allows local users to cause a denial of service by modifying the folder contents or permissions. NOTE: this issue has been disputed by the vendor, who claims that it does…

  • CVE-2004-2714Dec 31, 2004
    Windowmaker
    Windowmaker
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Window Maker 0.80.2 and earlier allows attackers to perform unknown actions via format string specifiers in a font specification in WMGLOBAL, probably a format string vulnerability.

  • CVE-2004-2715Dec 31, 2004
    Phpmychat
    Phpmychat
    risk 0.03cvss —epss 0.05

    edituser.php3 in PHPMyChat 0.14.5 allow remote attackers to bypass authentication and gain administrative privileges by setting the do_not_login parameter to false.

  • CVE-2004-2716Dec 31, 2004
    Phpmychat
    Phpmychat
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in usersL.php3 in PHPMyChat 0.14.5 allow remote attackers to execute arbitrary SQL commands via the (1) sortBy, (2) sortOrder, (3) startReg, (4) U, (5) LastCheck , and (6) R parameters.

  • CVE-2004-2717Dec 31, 2004
    Phpheaven
    Phpmychat
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in admin.php3 in PHPMyChat 0.14.5 allow remote attackers with administrative privileges to read arbitrary files via a .. (dot dot) in the (1) sheet and (2) What parameters.

  • CVE-2004-2718Dec 31, 2004
    Phpmychat
    Phpmychat
    risk 0.03cvss —epss 0.02

    PHPMyChat 0.14.5 does not remove or protect setup.php3 after installation, which allows attackers to obtain sensitive information including database passwords via a direct request.

  • CVE-2004-2719Dec 31, 2004
    Foxmail
    Foxmail
    risk 0.04cvss —epss 0.07

    Buffer overflow in the UrlToLocal function in PunyLib.dll of Foxmail 5.0.300 allows remote attackers to execute arbitrary code via a mail message with a long From field, a different issue than CVE-2005-0339.

  • CVE-2004-2720Dec 31, 2004
    Snitz Communications
    Forums 2000
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in register.asp in Snitz Forums 2000 3.4.04 and earlier allows remote attackers to inject arbitrary web script or HTML via javascript events in the Email parameter.

  • CVE-2004-2721Dec 31, 2004
    openSkat
    VTMF
    risk 0.00cvss —epss 0.02

    The CheckGroup function in openSkat VTMF before 2.1 generates public key pairs in which the "p" variable might not be prime, which allows remote attackers to determine the private key and decrypt messages.

  • CVE-2004-2722Dec 31, 2004
    Tenable
    Nessus
    risk 0.00cvss —epss 0.00

    Nessus 2.0.10a stores account passwords in plaintext in .nessusrc files, which allows local users to obtain passwords. NOTE: the original researcher reports that the vendor has disputed this issue

  • CVE-2004-2723Dec 31, 2004
    Tenable
    Nessuswx
    risk 0.00cvss —epss 0.00

    NessusWX 1.4.4 stores account passwords in plaintext in .session files, which allows local users to obtain passwords.

  • CVE-2004-2724Dec 31, 2004
    Lionmax Software
    Chat Anywhere
    risk 0.00cvss —epss 0.02

    LionMax Software Chat Anywhere 2.72a allows remote attackers to cause a denial of service (server crash and client CPU consumption) via a username beginning with percent (%) followed by a null character.

  • CVE-2004-2725Dec 31, 2004
    Aztek Forum
    Forum
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Aztek Forum 4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in (a) search.php, (2) the email parameter in (b) subscribe.php, and (3) the return and (4) title parameters in (c)…

  • CVE-2004-2726Dec 31, 2004
    MailEnable
    Mailenable
    risk 0.00cvss —epss 0.03

    HTTPMail service in MailEnable Professional 1.18 does not properly handle arguments to the Authorization header, which allows remote attackers to cause a denial of service (null dereference and application crash). NOTE: This is a different vulnerability than CVE-2005-1348.

  • CVE-2004-2727Dec 31, 2004
    MailEnable
    Mailenable
    risk 0.03cvss —epss 0.04

    Buffer overflow in MEHTTPS (HTTPMail) of MailEnable Professional 1.5 through 1.7 allows remote attackers to cause a denial of service (application crash) via a long HTTP GET request.

  • CVE-2004-2728Dec 31, 2004
    Hummingbird
    Connectivity
    risk 0.00cvss —epss 0.01

    Buffer overflow in the FTP server of Hummingbird Connectivity 7.1 and 9.0 allows remote, authenticated users to cause a denial of service (application crash) via a long argument to the XCWD command.

  • CVE-2004-2729Dec 31, 2004
    Hummingbird
    Connectivity
    risk 0.00cvss —epss 0.00

    Inetd32 Administration Tool of Hummingbird Connectivity 7.1 and 9.0 allows local users to execute arbitrary code by changing the program for handling incoming connections.

  • CVE-2004-2730Dec 31, 2004
    Sysinternals
    PsTools
    risk 0.00cvss —epss 0.02

    Sysinternals PsTools before 2.05, including (1) PsExec before 1.54, (2) PsGetsid before 1.41, (3) PsInfo before 1.61, (4) PsKill before 1.03, (5) PsList before 1.26, (6) PsLoglist before 2.51, (7) PsPasswd before 1.21, (8) PsService before 2.12, (9) PsSuspend before 1.05, and…

  • CVE-2004-2731Dec 31, 2004
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Multiple integer overflows in Sbus PROM driver (drivers/sbus/char/openprom.c) for the Linux kernel 2.4.x up to 2.4.27, 2.6.x up to 2.6.7, and possibly later versions, allow local users to execute arbitrary code by specifying (1) a small buffer size to the copyin_string function…

  • CVE-2004-2732Dec 31, 2004
    Netbilling
    Netbilling
    risk 0.03cvss —epss 0.04

    nbmember.cgi in Netbilling 2.0 allows remote attackers to obtain sensitive information via the cmd=test option, which can be leveraged to determine the access key.

  • CVE-2004-2733Dec 31, 2004
    Webwiz
    Forums
    risk 0.00cvss —epss 0.01

    Web Wiz Forums 7.7a uses invalid logic to determine user privileges, which allows remote attackers to (1) block arbitrary IP addresses via pop_up_ip_blocking.asp or (2) modify topics via pop_up_topic_admin.asp.

  • CVE-2004-2734Dec 31, 2004
    Novell
    Netware
    risk 0.00cvss —epss 0.04

    webadmin-apache.conf in Novell Web Manager of Novell NetWare 6.5 uses an uppercase Alias tag with an inconsistent lowercase directory tag for a volume, which allows remote attackers to bypass access control to the WEB-INF folder.

  • CVE-2004-2735Dec 31, 2004
    Fredric Fredricson
    P4db
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in P4DB 2.01 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) SET_PREFERENCES parameter in SetPreferences.cgi; (2) BRANCH parameter in branchView.cgi; (3) FSPC and (4) COMPLETE parameters in…

  • CVE-2004-2736Dec 31, 2004
    Polar Software
    Helpdesk
    risk 0.03cvss —epss 0.05

    Polar HelpDesk 3.0 allows remote attackers to bypass authentication by setting the UserId and UserType values in a cookie.

  • CVE-2004-2737Dec 31, 2004
    Netsupport
    Dna Helpdesk
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in problist.asp in NetSupport DNA HelpDesk 1.01 allows remote attackers to execute arbitrary SQL commands via the where parameter.

  • CVE-2004-2738Dec 31, 2004
    Zeroboard
    Zeroboard
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in check_user_id.php in ZeroBoard 4.1pl4 and earlier allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.

  • CVE-2004-2739Dec 31, 2004
    Phprojekt
    Phprojekt
    risk 0.00cvss —epss 0.02

    The setup routine (setup.php) in PHProjekt 4.2.1 and earlier allows remote attackers to modify system configuration via unknown attack vectors.

  • CVE-2004-2740Dec 31, 2004
    Phprojekt
    Phprojekt
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in authform.inc.php in PHProjekt 4.2.3 and earlier allows remote attackers to include arbitrary PHP code via a URL in the path_pre parameter.

  • CVE-2004-2741Dec 31, 2004
    Horde (software)
    Application Framework
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the "help window" (help.php) in Horde Application Framework 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) module, (2) topic, or (3) module parameters.

  • CVE-2004-2742Dec 31, 2004
    Businessobjects
    Crystal Enterprise
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the report viewer in Crystal Enterprise 8.5, 9, and 10 allows remote attackers to inject arbitrary web script or HTML via script in the URL to a report (RPT) file.

  • CVE-2004-2743Dec 31, 2004
    Mega Upload Progress Bar
    Mega Upload Progress Bar
    risk 0.00cvss —epss 0.01

    upload.cgi in Mega Upload Progress Bar before 1.45 allows remote attackers to copy or overwrite arbitrary files via unspecified parameters related to names of uploaded files.

  • CVE-2004-2744Dec 31, 2004
    Phplist
    Phplist
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Tincan Limited PHPlist before 2.8.12 has unknown impact and attack vectors, related to a "security update release."

  • CVE-2004-2745Dec 31, 2004
    Anteco Visual Technologies
    Ownserver
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in Anteco Visual Technologies OwnServer 1.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in a URL.