Microsoft Excel Macro Validation Uninitialized Variable Manipulation Vulnerability

Description Microsoft Excel is prone to a remote code-execution vulnerability. An attacker may exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions. Technologies Affected Microsoft Excel...

openSUSE 10 Security Update : apache2-mod_python (apache2-mod_python-4448)

This update fixes a buffer overflow in apache2-modpython that occurs while using python-based output-filter. This bug can be triggered remotely to read possibly confidential data from the process space of the web-server and in rare cases to execute arbitrary code. CVE-2004-2680 %NASLMINLEVEL 7030...

SuSE 10 Security Update : apache2-mod_python (ZYPP Patch Number 4449)

This update fixes a buffer overflow in apache2-modpython that occurs while using python-based output-filter. This bug can be triggered remotely to read possibly confidential data from the process space of the web-server and in rare cases to execute arbitrary code. CVE-2004-2680 %NASLMINLEVEL 7030...

CVE-2004-2757

CVE-2004-2757 is an XSS vulnerability in the failed login page of Novell iChain prior to version 2.2 build 2.2.113 and 2.3 First Customer Ship. The issue allows remote attackers to inject arbitrary web script or HTML via the url parameter. The provided documents do not specify a product patch/ver...

CVE-2004-2756

CVE-2004-2756 is a Cross-site Scripting (XSS) vulnerability in XOOPS. The flaw affects viewtopic.php in XOOPS 2.x (possibly up to 2.0.5) and allows remote attackers to inject arbitrary web script or HTML via the (1) forum and (2) topic_id parameters. Root cause identified in multiple sources as i...

CVE-2004-2755

CVE-2004-2755 describes an XSS in Symantec Web Security 2.5, 3.0.0, and 3.0.1 before build 62. The vulnerability allows remote attackers to inject arbitrary script or HTML via the query string of blocked URLs shown on error or block pages. The available documents confirm the affected versions and...

CVE-2004-2754

This CVE concerns a SQL injection in YaBB SE (v1.5.4, 1.5.3, and potentially older before 1.5.5) via the ID_MEMBER parameter to the recentTopics and welcome functions, allowing remote SQL commands. Affected software is YaBB SE; root cause is improper input handling in SSI.php. Impact per sources ...

CVE-2004-2753

CVE-2004-2753 corresponds to a HP-UX SharedX vulnerability affecting HP-UX B.11.00, B.11.11 and B.11.22 where local users could access unspecified files or cause a denial of service due to how SharedX handles files in a potentially insecure manner. The connected OpenVAS/Nessus entries reference H...

CVE-2004-2750

CVE-2004-2750 : Affected: JBrowser 1.0–2.1; vulnerable component: browser.php. Description indicates a directory traversal flaw that lets a remote attacker read arbitrary files through the directory parameter. The note states provenance is unknown and details come from third parties. No exploitat...

CVE-2004-2749

Directory traversal vulnerability in wra/public/wralogin in 2Wire Gateway, possibly as used in HomePortal and other product lines, allows remote attackers to read arbitrary files via a .. dot dot in the return parameter. NOTE: this issue was reported as XSS, but this might be a terminology error...

CVE-2004-2751

PostNuke 0.726 (and possibly earlier) contains an SQL injection in the members_list module, exploitable via the sortby parameter. This allows remote attackers to craft SQL commands to affect the database. The vulnerability is stated for the members_list component, with no additional exploit detai...

CVE-2004-2749

CVE-2004-2749 affects 2Wire Gateway family (e.g., HomePortal) with a vulnerable wra/public/wralogin path. The issue is a directory traversal vulnerability that allows remote attackers to read arbitrary files by supplying a .. in the return parameter. The exact affected product lines and versions ...

CVE-2004-2752

PostNuke’s Downloads module (≤0.726) is affected by a cross-site scripting (XSS) flaw in the viewdownloaddetails action, triggered via the ttitle parameter. This allows remote injection of arbitrary HTML/JavaScript. The description is corroborated across CVE/NVD/Red Hat records; one connected EUV...

CVE-2004-2747

Directory traversal vulnerability in Pablo Software Solutions Quick 'n Easy FTP Server 1.77, and possibly earlier versions, allows remote authenticated users to determine the existence of arbitrary files via a .. dot dot in the DEL command, which triggers different error messages depending on...

CVE-2004-2747

Technical details about CVE-2004-2747 are not publicly provided in the supplied documents. Monitor for updates for new information about affected products, remediation, or exploit activity.

CVE-2004-2746

CVE-2004-2746 : The connected Nessus/NASL entry confirms a SQL injection in XTreme ASP Photo Gallery 2.0, specifically in adminlogin.asp via the (1) username and (2) password parameters. This flaw allows remote attackers to inject arbitrary SQL commands, and the NASL text notes that this may be u...

CVE-2004-2748

The vulnerability CVE-2004-2748 affects NetIQ WebTrends Reporting Center Enterprise Edition 6.1a, specifically viewreport.pl. The root cause is an invalid profileid parameter that causes an error message to leak the installation pathname, enabling remote attackers to determine the installation pa...

phpFaber URLInn 2.0.5 (dir_ws) Remote File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================== phpFaber URLInn 2.0.5 dirws Remote File Inclusion Vulnerability ================================================================== / \ @ /|\ /|\ |-| / | \ /|/\ / | \ @ |...

JVN#50495547 Ichitaro series buffer overflow vulnerability

The "Ichitaro" series word processing software, from JustSystems Corporation, contains a buffer overflow vulnerability. If a user opens a specially crafted jtd file or views it on a web browser, an attacker could execute arbitrary code with the privileges of the user. Impact An attacker could...

openSUSE 10 Security Update : wget (wget-1689)

This update fixes a security in wget, where evil servers could send terminal escape codes to the user calling wget. This would only affect interactive sessions. CVE-2004-1488 Additionaly a previous '.file' fix was found to be buggy and replaced. This bug could lead to '.directories' not being...