8091 matches found
CVE-2004-2390
The CVE-2004-2390 issue affects Jabber Gadu-Gadu Transport (jabber-gg-transport) 2.0.x up to but not including 2.0.8 when used with libgadu 1.0 and later. The roster import functionality exposes a denial-of-service vulnerability via unknown vectors, as described in the initial documentation. The ...
CVE-2004-2402
CVE-2004-2402 affects YaBB 1 GOLD SP 1.3.2. YaBB.pl CGI is vulnerable to cross-site scripting via a hex-encoded to parameter; note that some sources claimed the board parameter is affected, but this is stated as incorrect in the primary description. Connected sources corroborate multiple vulnerab...
CVE-2004-2399
Summary: CVE-2004-2399 affects Secure Computing Corporation Sidewinder G2 6.1.0.01. The vulnerability allows remote attackers to cause a denial of service via delayed responses to DNS queries, resulting in CPU consumption. The connected documentation confirms the affected product/version and the ...
CVE-2004-2395
CVE-2004-2395 describes a memory leak in the passwd 0.68 utility that allows local users to cause a denial-of-service through a large number of failed read attempts from the password buffer. The issue is triggered by local access and results in memory consumption leading to potential service disr...
CVE-2004-2401
CVE-2004-2401 affects Ipswitch IMail Express Web Messaging prior to version 8.05. The issue is a stack-based buffer overflow triggered by an HTML message containing long "tag text", which could allow remote attackers to execute arbitrary code. The NVD entry lists a base score of 7.5 (High) with n...
CVE-2004-2396
The CVE-2004-2396 issue concerns passwd 0.68 failing to check the return code from pam_start, per Mandrake MDKSA-2004:045. This indicates a potential risk in PAM initialization that could affect safe and proper operation; exact impact is not quantified in the documents. The connected advisory not...
CVE-2004-2403
CVE-2004-2403 describes a CSRF vulnerability in YaBB 1 GOLD SP 1.3.2. An attacker can cause the administrative user to perform unauthorized actions by enticing the admin to click a crafted link or view an IMG tag that targets YaBB.pl with specific action, id, and moda parameters. The vulnerabilit...
CVE-2004-2393
Affected software : Java Secure Socket Extension (JSSE) 1.0.3 through 1.0.3_2. Issue : JSSE does not properly validate the certificate chain of a client or server, enabling remote attackers to falsely authenticate peers for SSL/TLS. Root cause : insufficient certificate-chain validation. Impact :...
CVE-2004-2392
The CVE-2004-2392 issue concerns the libuser library (notably version around 0.51.7). Multiple denial-of-service bugs were identified in libuser that can cause an application linked against it to crash or behave irregularly under certain conditions, including read failures and other bugs. Public ...
CVE-2004-2339
Microsoft Windows 2000, XP, and possibly 2003 allows local users with the SeDebugPrivilege privilege to execute arbitrary code as kernel and read or write kernel memory via the NtSystemDebugControl function, which does not verify its pointer arguments. Note: this issue has been disputed, since...
CVE-2004-2315
Mbedthis AppWeb HTTP server before 1.0.2 allows remote attackers to cause a denial of service crash via an empty OPTIONS request...
CVE-2004-2383
Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to bypass cross-frame scripting restrictions and capture keyboard events from other domains via an HTML document with Javascript that is outside a frameset that includes the target domain, then forcing the frameset to maintain...
CVE-2004-2341
PHP file include injection vulnerability in isearch.inc.php for iSearch allows remote attackers to execute arbitrary code via the isearchpath parameter...
CVE-2004-2352
The CVE-2004-2352 entry documents a Cross-site Scripting (XSS) vulnerability in GBook for PHP-Nuke 1.0. Affected component: GBook for PHP-Nuke 1.0; vulnerability type: XSS via cookies stored in the $_COOKIE variable that are not cleansed by PHP-Nuke. Impact: remote attackers could inject arbitrar...
CVE-2004-2321
BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including 1 ServerStartMBean.Password and 2 NodeManagerMBean.CertificatePassword...
CVE-2004-2349
Tunez before 1.20-pre2 has multiple SQL injection vulnerabilities enabling remote execution of arbitrary SQL queries. The provided documents identify the app and version but do not specify affected components beyond the overall application, nor provide exploitation or remediation details.
CVE-2004-2316
CVE-2004-2316 affects the Mbedthis AppWeb HTTP server prior to 1.0.2. A remote attacker can crash the server by sending a GET request that contains an MS-DOS device name (e.g., COM1). The available sources confirm the vulnerable software/version and the crash-based impact; no exploit details or c...
CVE-2004-2325
CVE-2004-2325 describes a cross-site scripting (XSS) vulnerability in the EditModule.aspx page of DotNetNuke (formerly IBuySpy Workshop), affecting versions 1.0.6 through 1.0.10d. The flaw allows remote attackers to inject arbitrary web script or HTML. The provided documents identify the affected...
CVE-2004-2346
CVE-2004-2346 affects Forum Web Server 1.6 and earlier, with two XSS vectors: (1) Subject field in post1.htm and (2) File Description field in postfile2.htm. The vulnerability allows remote attackers to inject arbitrary web script or HTML. Documents describe the issue but do not provide mitigatio...