CVE-2004-2484

PHP Gift Registry 1.3.5 and earlier contain a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the message parameter to event.php or index.php. The description indicates the vulnerability is triggered through user-supplied input in t...

CVE-2004-2516

Summary: CVE-2004-2516 corresponds to a directory traversal vulnerability in the web server implementation of myServer. Documents indicate that myServer versions

CVE-2004-2532

CVE-2004-2532 affects the Serv-U FTP Server prior to version 5.1.0.0. The issue arises from a default administrator account and password that allow a local user to authenticate to the server, create a new user, log in as that user, and then issue a SITE EXEC command to execute arbitrary commands ...

CVE-2004-2497

The CVE-2004-2497 entry describes an XSS in the error handler of Hitachi Web Page Generator and Web Page Generator Enterprise (version 4.01 and earlier) when using the default error template with debug mode ON. This allows remote attackers to inject arbitrary script/HTML via unknown attack vector...

CVE-2004-2487

CVE-2004-2487 concerns Nexgen FTP Server before 2.2.3.23, where authenticated remote users can read or list arbitrary files via directory traversal sequences in FTP commands (RETR, NLST, LIST, RNFR, RNTO). Affected component is the FTP command handling in Nexgen server; root cause: traversal sequ...

CVE-2004-2494

The CVE-2004-2494 entry describes a Cross-site Scripting (XSS) vulnerability in Ability Mail Server 1.18, exploitable through the erromsg parameter in the _error handler. The underlying issue is an input/output handling flaw that allows remote attackers to inject arbitrary web script or HTML via ...

CVE-2004-2535

The CVE refers to Sticker prior to version 3.1.0 beta 2, where the person‑to‑person secure messaging feature is vulnerable. The underlying issue allows remote attackers to post messages to unauthorized private groups by abusing the group’s public encryption key, resulting in partial impact to int...

CVE-2004-2514

Cross-site scripting XSS vulnerability in modules/privatemessages/index.php in PowerPortal 1.x allows remote attackers to inject arbitrary web script or HTML via the 1 SUBJECT or 2 MESSAGE field...

CVE-2004-2530

CVE-2004-2530 affects the Gadu-Gadu client. The issue is a visual truncation vulnerability in file name handling that lets remote attackers spoof the file extension of transmitted files by using a filename with many spaces before the real extension, which is not shown in the dialog. Impact stated...

CVE-2004-2525

CVE-2004-2525 affects Serendipity prior to 0.7.1: a cross-site scripting vulnerability in compat.php allows an attacker to inject script via the searchTerm parameter. Reported in multiple feeds (NVD/OpenVAS), with impact described as browser-level integrity risk (I:P) and no confidentiality impac...

CVE-2004-2488

The CVE-2004-2488 entry concerns Nexgen FTP Server prior to version 2.2.3.23. It describes a directory traversal vulnerability that allows remote authenticated users to read or list arbitrary files through “C:” sequences in the RETR, NLST, LIST, RNFR, and RNTO FTP commands. Affected software: Nex...

CVE-2004-2538

CVE-2004-2538 affects phpCodeGenie’s PCG simple application generation; versions before 3.0.2 are vulnerable. A direct static code injection flaw in the generated code path allows remote authenticated users to execute arbitrary code via the (1) header or (2) footer. Exploitation details or in-the...

CVE-2004-2523

OpenFTPD affected: OpenFTPD 0.30.2 and earlier. The vulnerability is a format string flaw in the SITE MSG command’s msg.c (cat_message) that lets remote authenticated users execute arbitrary code via format specifiers in the message argument. This is a remote code execution risk with authenticati...

CVE-2004-2492

The CVE-2004-2492 entry describes a cross-site scripting (XSS) vulnerability in Groupmax World Wide Web (GmaxWWW) Desktop 5, 6, and Desktop for Jichitai 6, exploitable via the QUERY parameter to inject arbitrary script/HTML. Based on the provided documents, the issue involves remote, unauthentica...

CVE-2004-2519

The CVE-2004-2519 entry concerns Gattaca Server 2003 version 1.1.10.0. The vulnerability is a denial-of-service condition caused by how the LANGUAGE parameter handles directory specifiers in index.tmpl and web.tmpl. Examples include using: /, , ., .., and lang//en, which can lead to CPU consumpti...

CVE-2004-2518

CVE-2004-2518 affects Gattaca Server 2003 (version 1.1.10.0). The issue is an information disclosure: remote attackers can cause an error message to reveal the full installation path by supplying (1) a trailing null byte (%00) in a URL or (2) an invalid LANGUAGE parameter to web.tmpl. The connect...

CVE-2004-2490

CVE-2004-2490 describes a buffer overflow in IBM Informix Dynamic Server (IDS) , affecting versions 9.40.xC1 and 9.40.xC2 . The root cause is a vulnerability in the handling of a long GL_PATH environment variable, which allows local users to execute arbitrary code . The impact is local code execu...

CVE-2004-2509

Infopop UBB.Threads exposes XSS in multiple pages. Affected versions include 6.2.3 and 6.5, with vulnerable scripts calendar.php, login.php, and online.php. The underlying issue is cross-site scripting via the Cat parameter, enabling remote attackers to inject arbitrary script/HTML into a user’s ...

CVE-2004-2510

Cross-site scripting XSS vulnerability in showflat.php in Infopop UBB.Threads before 6.5 allows remote attackers to inject arbitrary web script or HTML via the Cat parameter...

CVE-2004-2496

OpenText FirstClass HTTP daemon (OpenText FirstClass 7.1 and 8.0) is vulnerable to a denial-of-service via a flood of POST requests to /Search. Root cause is an excessively resource-intensive handling of /Search POSTs, which can exhaust service availability. Impact is denial of service to the HTT...