CVE-2004-2352

Cross-site scripting XSS vulnerability in GBook for PHP-Nuke 1.0 allows remote attackers to inject arbitrary web script or HTML via cookies that are stored in the $COOKIE PHP variable, which is not cleansed by PHP-Nuke...

CVE-2004-2382

The CVE-2004-2382 issue concerns The PerfectNav plugin for Microsoft Internet Explorer. It describes a remote DoS where a malformed URL (for example "?") can crash the browser. The available sources specify the vulnerable component and the impact (browser crash) but do not provide additional expl...

CVE-2004-2335

Technical details about CVE-2004-2335 are not publicly provided in the connected documents. Current sources reiterate the issue with Macromedia installers elevating privileges on macOS. Monitor for updates for vulnerability specifics.

CVE-2004-2373

Technical details beyond the public description are not provided in the supplied documents; monitor for updates for potential details on affected products, versions, root cause, and remediation.

CVE-2004-2304

Integer overflow in Trillian 0.74 and earlier, and Trillian Pro 2.01 and earlier, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a directIM packet that triggers a heap-based buffer overflow...

CVE-2004-2341

CVE-2004-2341 describes a PHP file include injection in the iSearch component, specifically isearch.inc.php, allowing remote attackers to execute arbitrary code via the isearch_path parameter. The vulnerability indicates a remote code execution impact when an attacker can influence included files...

CVE-2004-2354

CVE-2004-2354 describes a SQL injection vulnerability in the 4nGuestbook 0.92 module used with PHP-Nuke 6.5–6.9. The flaw allows remote attackers to modify SQL statements via the entry parameter to modules.php, with the potential to trigger MySQL errors that may enable cross-site scripting (XSS)....

CVE-2004-2378

CVE-2004-2378 affects @Mail 3.64 for Windows. The vulnerability allows a remote attacker to cause a denial of service resulting in an unusable server by establishing a large number of POP3 connections. The provided documents describe the impact as a DoS via many POP3 connections but do not specif...

CVE-2004-2364

CVE-2004-2364 affects PHPX versions 3.0–3.2.6. A CSRF flaw lets remote attackers cause the administrator to trigger commands via specific admin URLs (admin/page.php, admin/news.php, admin/user.php, admin/images.php, admin/forums.php). The vulnerability’s root cause is CSRF that executes privilege...

CVE-2004-2377

The CVE-2004-2377 entry affects Alcatel OmniSwitch 7000 and 7800. It permits remote attackers to cause a denial of service (reboot) via certain network scans, demonstrated with a Nessus scan of ports 1–1024 with safe-checks disabled. The NVD/CVE records note a network-accessible impact with parti...

CVE-2004-2367

The CVE-2004-2367 entry relates to the Control Panel applet in WFTPD and WFTPD Pro 3.21 R1 and R2. The vulnerability is triggered by a long FTP command issued by remote authenticated users, leading to a denial-of-service (crash). This is the stated impact and affected component in the available d...

CVE-2004-2385

Technical details about CVE-2004-2385 are not publicly provided in the connected documents. No specifics on affected products, versions, root cause, or remediation are present. Monitor for updates.

CVE-2004-2328

The CVE concerns Clearswift MAILsweeper for SMTP prior to version 4.3_13. It is triggered by processing an e-mail with a crafted RAR archive attached, causing an infinite loop and resulting in a denial of service. The vulnerability affects the SMTP‑scanning path of MAILsweeper and is described in...

CVE-2004-2376

CVE-2004-2376 affects Twilight Utilities Web Server 2.0.0.0, with a vulnerability in the helper executable postfile.exe . The issue is a buffer overflow triggered by a URL request containing a long attfile attribute , which can allow a remote attacker to cause a denial of service (crash) and pote...

CVE-2004-2370

CVE-2004-2370 describes a stack-based buffer overflow in Trillian 0.71–0.74f and Trillian Pro 1.0–2.01 that allows remote attackers to execute arbitrary code via a Yahoo Messenger packet with a long key name. Affected component: Trillian client software; root cause: stack-based overflow in proces...

CVE-2004-2303

CVE-2004-2303 affects MTools Mformat prior to 3.9.9. When installed setuid root, mformat can create files with world-readable and world-writable permissions, enabling local users to read and overwrite files. Root cause is the setuid root usage and permissive file creation. In Mandrake/MKSA adviso...

CVE-2004-2329

Kerio Personal Firewall 2.1.5 is vulnerable to local privilege escalation: when loading firewall configuration files, the Load button opens a file dialog without dropping privileges, allowing a local user to execute arbitrary code with SYSTEM privileges. Affected component: firewall configuration...

CVE-2004-2321

Affected products: BEA WebLogic Server and Express 8.1 SP1 and earlier. Vulnerability: local users in the Operator role can obtain administrator passwords via MBean attributes (ServerStartMBean.Password; NodeManagerMBean.CertificatePassword). Impact: partial confidentiality exposure; access is LO...

CVE-2004-2381

CVE-2004-2381 affects the Jetty HTTP Server prior to 4.2.19. The vulnerability arises in HttpRequest.java handling of HTTP requests with a large Content-Length, allowing remote attackers over the network to cause memory usage growth and a denial of service (application crash). Affected products a...

CVE-2004-2313

Inter7 SqWebMail 3.4.1 through 3.6.1 generates different error messages for incorrect passwords versus correct passwords on non-mail-enabled accounts such as root, which allows remote attackers to guess the root password via brute force attacks...