CVE-2004-1583

The CVE-2004-1583 entry describes a directory traversal vulnerability in TriDComm’s FTP server (versions 1.3 and earlier). The flaw allows remote attackers to read or write arbitrary files by crafting .. sequences in FTP commands such as DIR, GET, or PUT, indicating a flaw in path handling during...

CVE-2004-1570

CVE-2004-1570 affects bBlog 0.7.2/0.7.3 with a SQL injection via the p parameter, per multiple sources. OpenVAS/Nessus entries also cite RSS.php and index.php vulnerabilities on older bBlog (≤0.7.4) that could allow arbitrary PHP code execution or database control. No vendor-supplied fix details ...

CVE-2004-1628

Format string vulnerability in log.c in rssh before 2.2.2 allows remote authenticated users to execute arbitrary code...

CVE-2004-1669

CVE-2004-1669 describes a cross-site scripting (XSS) vulnerability in MERAK Mail Server 7.4.5 when used with IceWarp Web Mail 5.2.7 (and possibly other versions). The issue allows remote attackers to run arbitrary HTML/JavaScript in a victim’s browser by supplying malicious input to (1) the User ...

CVE-2004-1581

CVE-2004-1581 affects BlackBoard 1.5.1. A remote attacker can request (1) checkdb.inc.php, (2) admin.inc.php, or (3) cp.inc.php and trigger a PHP error that reveals the install path, enabling information disclosure. No fixes or mitigations are described in the provided documents. Impacts are limi...

CVE-2004-1596

The CVE concerns a vulnerability in the 3COM Wireless Router model 3CRADSL72 running Boot Code 1.3d. Affected component/file: app_sta.stm accessed via direct HTTP requests. Impacted by a confidentiality risk allowing remote attackers to gain sensitive information such as passwords and router sett...

CVE-2004-1547

CVE-2004-1547 affects ActivePost Standard 3.1 and earlier. The file server allows remote authenticated users to cause a denial of service (application crash) by supplying a long filename, with the description noting a possible buffer overflow as the underlying issue. The available documents do no...

CVE-2004-1689

The CVE-2004-1689 entry concerns sudoedit (sudo -e) on sudo 1.6.8, where a temporary file is opened with root privileges and can be read by local users through a symlink attack on the temporary file before quit. This is a local privilege issue affecting the sudoedit workflow, enabling access to a...

CVE-2004-1549

The CVE affects ActivePost Standard 3.1: the conference menu transmits passwords for password-protected rooms in cleartext, enabling a network observer to capture sensitive credentials. No explicit remediation details are provided in the connected documents; exploitation specifics (or patches) ar...

CVE-2004-1558

CVE-2004-1558 affects YahooPOPS! (YPOPs!) in versions 0.4–0.6. The vulnerability arises from multiple stack-based buffer overflows in the POP3 service handling a long POP3 USER command or a long SMTP request, enabling remote denial of service (crash) and potentially arbitrary code execution. The ...

CVE-2004-1644

Xedus 1.0 allows remote attackers to cause a denial of service refuse connections by connecting multiple times from the same IP address...

CVE-2004-1624

CVE-2004-1624 affects Carbon Copy 6.0.5257. The issue: CCW32.exe (help topic interface) launches external programs (Notepad) without dropping system privileges, and the Carbon Copy Scheduler (CCSched.exe) help button similarly spawns external processes. Root cause: failure to drop privileges when...

CVE-2004-1556

The CVE-2004-1556 entry concerns MyWebServer 1.0.3 and describes a remote denial-of-service (application crash) caused by a large number of connections in a short time. The available sources confirm the affected product and behavior but do not provide root-cause analysis, exploit details, specifi...

CVE-2004-1694

The CVE-2004-1694 entry concerns Symantec ON Command CCM 5.4.x and iCommand 3.0.x that ships with four default usernames and passwords, including one hardcoded credential. This design allows remote attackers to gain unauthorized access. Public references confirm the issue, but the provided docume...

CVE-2004-1568

CVE-2004-1568 affects ParaChat Server 5.5. The vulnerability is a directory traversal in the server’s URL handling, exploited via a hex-encoded dot-dot (e.g., ..%5C) to read arbitrary files. The NVD entry lists medium severity (CVSSv2 base score 5.0) with network attack vector and no authenticati...

CVE-2004-1554

The CVE-2004-1554 entry concerns @lex Guestbook (PHP) with a remote file inclusion vulnerability in livre_include.php where the chem_absolu parameter can be manipulated to reference a remote URL containing PHP code. This allows an attacker to remotely include and execute arbitrary PHP code on the...

CVE-2004-1597

The CVE-2004-1597 entry documents a denial-of-service condition affecting RIM BlackBerry 7230 devices running BlackBerry OS 3.7 SP1. The vulnerability arises when processing a calendar message with an excessively long Location field, which triggers a watchdog during message storage and can lead t...

CVE-2004-1617

CVE-2004-1617 affects Lynx family (lynx, lynx-ssl, lynx-cur) prior to 2.8.6dev.8. Affected component is the HTML parser: processing invalid HTML (notably a TEXTAREA with a large COLS value, or an unterminated large tag name) can cause an infinite loop, i.e., a denial of service. Debians OpenVAS e...

CVE-2004-1562

The connected Nessus/NV documents confirm CVE-2004-1562 affects w-Agora 4.1.6a; vulnerability is a SQL injection in redir_url.php, exploitable via the key parameter to execute arbitrary SQL in the remote database. The related NASL entry also notes additional input validation flaws (XSS and HTTP r...

CVE-2004-1671

The CVE-2004-1671 entry describes an information disclosure in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 (and possibly other versions). The vulnerability allows remote attackers to gain sensitive information via direct requests to two web pages: accountsettings_add.html and topmenu.html...