CVE-2004-2414

Novell NetWare 6.5 SP 1.1 (Overlay CD installation/upgrade with OpenSSH, custom install) stores admin passwords in NIOUTPUT.TXT and NI.LOG during installation. Local users could access these log files and recover passwords, constituting an information-disclosure vulnerability. The vulnerability i...

CVE-2004-2418

CVE-2004-2418 is a buffer overflow in SlimFTPd up to version 3.15 that allows a local user to execute arbitrary code by sending a very long FTP command. Affected commands include CWD, STOR, MKD, and STAT . The initial description confirms local-exploit risk with arbitrary code execution; connecte...

CVE-2004-2426

Axis Network Camera 2.40 and earlier and Axis Video Server 3.12 and earlier are affected by a directory-traversal vulnerability that lets remote attackers bypass authentication by using a .. sequence in an HTTP POST to ServerManager.srv and then perform privileged actions such as modifying files ...

CVE-2004-2425

CVE-2004-2425 affects Axis Network Camera (2.40 and earlier) and Axis Video Server (3.12 and earlier). The issue allows remote attackers to execute arbitrary OS commands by injecting shell metacharacters (notably the backtick) in the query string to the CGI endpoint virtualinput.cgi. The NVD entr...

CVE-2004-2413

SQL injection vulnerability in VP-ASP Shopping Cart 4.0 through 5.0 allows remote attackers to execute arbitrary SQL commands via the 1 Processed0 and 2 Processed1 parameters in a POST request to shopproductselect.asp...

CVE-2004-2433

The CVE-2004-2433 issue is a buffer overflow in the IsValidFile function of the ADM ActiveX control used by Altnet Download Manager (versions

CVE-2004-2431

Technical details for CVE-2004-2431 are not publicly provided in the supplied documents; affected version range and exploit characteristics remain unspecified. Monitor for official disclosures or updated security advisories.

CVE-2004-2408

Technical details for CVE-2004-2408 are not publicly available in the provided documents. Monitor for updates.

CVE-2004-2415

CVE-2004-2415 affects Davenport prior to 0.9.10. The issue allows a denial-of-service through (1) very large XML inputs or (2) XML entity expansion, causing resource consumption. Connected records confirm the impact as a DoS, but the documents do not specify exact vulnerable components, versions ...

CVE-2004-2406

CVE-2004-2406 – summary: The vulnerability concerns an overflow in the phpgw_config table within phpGroupWare, reported for versions before 0.9.14.002. The connected records confirm the component (phpGroupWare) and the affected version boundary (prior to 0.9.14.002), but neither the exact root ca...

[SECURITY] [DSA 777-1] New Mozilla packages fix frame injection spoofing vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 777-1 [email protected] http://www.debian.org/security/ Martin Schulze August 17th, 2005 http://www.debian.org/security/faq -...

CVE-2004-2397

The CVE affects Blue Coat Security Gateway OS (Blue Coat) web-based Management Console. When importing a private key, the console stores the key and its passphrase in plaintext in a log file, enabling an attacker to extract digital certificates. Affected versions: OS 3.0–3.1.3.13 and 3.2.1. Root ...

CVE-2004-2389

Technical details about CVE-2004-2389 are not publicly provided in the supplied documents; monitor for updates. No explicit affected products, versions, or fixes are described here.

CVE-2004-2398

Vulnerability summary (CVE-2004-2398): Netenberg Fantastico De Luxe 2.8 stores database file names that reveal usernames because file names in the database directory are readable. This enables local attackers to enumerate valid usernames by listing files under /var/lib/mysql, where permissions we...

CVE-2004-2398

Netenberg Fantastico De Luxe 2.8 uses database file names that contain the associated usernames, which allows local users to determine valid usernames and conduct brute force attacks by reading the file names from /var/lib/mysql, which is assigned world-readable permissions by cPanel 9.3.0 R5...

CVE-2004-2391

CVE-2004-2391 affects Jabber Gadu-Gadu Transport (jabber-gg-transport) 2.0.x prior to 2.0.8. A malformed or empty tag in a message can cause a remote denial of service. The vulnerability is due to processing of priority fields in the Jabber-gg-transport message handling. Impact is denial of serv...

CVE-2004-2400

Summary: CVE-2004-2400 affects WinFTP Server 1.6. The vulnerability arises because credentials (username and password) are stored in plaintext in the file data\user.wfd, allowing local users to obtain credentials. The NVD reports a low base score (2.1) with LOCAL attack vector and PARTIAL confide...

CVE-2004-2396

passwd 0.68 does not check the return code for the pamstart function, which has unknown impact and attack vectors that may prevent "safe and proper operation" of PAM...

CVE-2004-2394

CVE-2004-2394 affects the passwd program (versions 0.68 and earlier). The root cause is an off-by-one error in the --stdin path, causing passwords to be truncated to the first 78 characters instead of 79, which reduces the brute-force search space. Remediation appears in connected advisories: Man...

CVE-2004-2404

CVE-2004-2404 is a duplicate of CVE-2004-2347. Connected records show that the affected product is Leif M. Wright Web Blog (versions 1.1 and 1.1.5). The vulnerability is remote command execution via shell metacharacters (e.g., |) in the file parameter of ViewFile requests, indicating improper han...