CVE-2004-2319

IBM Informix Dynamic Server (IDS) prior to 9.40.xC3 is affected. Two issues are described: (1) local users can create or overwrite files via the /001 log file to onedcu, and (2) local users can read arbitrary files via a symlink attack on a file in /tmp to onshowaudit. Root cause details are not ...

CVE-2004-2334

CVE-2004-2334 affects EMU WebMail 5.2.7. The vulnerability is described as multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML through: (1) a hex-encoded value to the variable parameter in emumail.fcgi, (2) the folder parameter in emumail.f...

CVE-2004-2322

CVE-2004-2322 affects phpWebSite before 0.9.3-2. SQL injection exists in the announce and notes modules (ANN_id parameter) that allows remote attackers to execute arbitrary SQL queries. Impact: partial confidentiality/integrity/availability. Exploitation details are not provided in the available ...

CVE-2004-2340

Technical details about CVE-2004-2340 are not publicly available in the provided connected documents; the entry remains unverified in accessible sources. Monitor for updates.

CVE-2004-2327

Vizer Web Server 1.9.1 allows remote attackers to cause a denial of service crash via multiple malformed requests including 1 requests without GET, 2 GET requests without HTTP, 3 or long GET requests...

CVE-2004-2347

The CVE-2004-2347 entry applies to Leif M. Wright Web Blog (blog.cgi) versions 1.1 and 1.1.5. The vulnerability arises in the ViewFile request’s file parameter, where shell metacharacters (e.g., |) enable remote command execution. Impact is remote arbitrary commands executed with the web server u...

CVE-2004-2332

The provided records indicate a vulnerability in CPAN WWW::Form before 1.13 with multiple XSS vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via unknown vectors. The affected component is CPAN WWW::Form; the exact root cause, affected versions beyond the stated...

CVE-2004-2331

Summary of CVE-2004-2331 (ColdFusion MX 6.1 / 6.1 J2EE): Local users could bypass sandbox security and access sensitive information by using Java reflection to reach trusted Java objects without invoking CreateObject or the cfobject tag. The issue affects ColdFusion MX 6.1 and ColdFusion MX 6.1 J...

CVE-2004-2363

PHPX 3.0–3.2.6 contains a Validate-Before-Canonicalize flaw in functions.inc.php: checkURI can be bypassed with hex-encoded tags, enabling remote XSS via the limit parameter to forums.php and similar vectors. Impact is XSS without bypassing literal character checks. Affected component/function: c...

CVE-2004-2351

CVE-2004-2351 describes a cross-site scripting (XSS) vulnerability in GBook for Php-Nuke 1.0. Remote attackers can inject arbitrary web script or HTML through multiple user-input fields (name, email, city, message) that reportedly do not use [removed] or tags, which PHP-Nuke purportedly filters....

CVE-2004-2305

CVE-2004-2305 affects Computer Associates eTrust Antivirus EE 6.0–7.0. The vulnerability allows a remote attacker to bypass scanning by including a password-protected file inside a ZIP archive, which causes eTrust to scan only the password-protected file and skip the other files in the archive. T...

CVE-2004-2320

Technical details for CVE-2004-2320 are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2004-2388

The vulnerability CVE-2004-2388 affects the AIX 4.3.3 rexecd component. It stems from not properly using a local copy of the pwd structure when calling getpwnam, allowing the authenticate function to overwrite the pwd data and potentially assign privileges to the wrong user. This creates a privil...

CVE-2004-2374

The CVE-2004-2374 entry concerns BadBlue 2.4. Affected: BadBlue 2.4. Vulnerable behavior: requesting phptest.php embeds server installation pathname in the HTML source, allowing remote disclosure of the installation path. Impact: disclosure of server location information; exact impact described i...

CVE-2004-2313

Inter7 SqWebMail 3.4.1–3.6.1 exposes a password-guessing vulnerability: authentication responses differ for incorrect vs. correct passwords on non-mail-enabled accounts (e.g., root), enabling remote attackers to brute-force the root password. The issue is tied to the login error handling and disc...

CVE-2004-2337

The CVE-2004-2337 entry concerns the file /.inlook/.crypt in inlook 0.7.3 and earlier, which is installed with world readable permissions. This allows local users to access POP3 credentials stored by the application. The root cause is improper permissions on the .crypt file, leading to confidenti...

CVE-2004-2307

CVE-2004-2307 affects Microsoft Internet Explorer 6.0.2600 on Windows XP. The vulnerability allows remote attackers to cause a denial of service (browser crash) by using a shell: URI with double backslashes (\) in an HTML tag (e.g., IFRAME or A). The connected documents confirm the attack vector ...

CVE-2004-2350

The CVE-2004-2350 entry pertains to an SQL injection in phpBB’s search.php affecting phpBB 1.0 through 2.0.6 via the search_results parameter. The underlying vulnerability allows remote attackers to execute arbitrary SQL and potentially gain privileges, as described in the fixed-text CVE descript...

CVE-2004-2371

Technical details for CVE-2004-2371 are not publicly provided in the connected documents. The initial description lacks vendor/product/version specifics or a remediation. Monitor for updates.

CVE-2004-2365

CVE-2004-2365 affects Windows XP and Windows Server 2003. The issue is a memory leak in the operating system that allows a local user to cause a denial of service (memory exhaustion) by repeatedly creating and deleting directories using a non-standard tool such as smbmount. The provided documents...