CVE-2004-1689

sudoedit aka sudo -e in sudo 1.6.8 opens a temporary file with root privileges, which allows local users to read arbitrary files via a symlink attack on the temporary file before quitting sudoedit...

CVE-2004-1639

Mozilla Firefox before 0.10, Mozilla 5.0, and Gecko 20040913 allows remote attackers to cause a denial of service application crash or memory consumption via a large binary file with a .html extension...

CVE-2004-1685

The CVE-2004-1685 issue affects SMC routers: SMC7004VWBR (firmware 1.00.014) and SMC7008ABR EU (firmware 1.42.003). Root cause: authentication bypass by a remote attacker who connects from the same IP address as the administrator currently logged in, then accesses setup_status.htm or status.HTM. ...

CVE-2004-1576

CVE-2004-1576 affects Judge Dredd: Dredd vs. Death 1.01 and earlier. The vulnerability is a format string flaw in chat messages, leading to a denial of service (application crash). The provided documents do not specify exploit code, affected versions beyond 1.01 and earlier, or a remediation(patc...

CVE-2004-1695

CVE-2004-1695 affects EmuLive Server4 Commerce Edition Build 7560. The connected Nessus entry discloses a concrete vulnerability in the administrative interface: a remote attacker can bypass authentication by requesting the page "/public/admin/index.htm" directly, effectively gaining administrati...

CVE-2004-1607

In SalesLogix 6.1, the vulnerable component is slxweb.dll. Affected functionality is the Library or Attachment request using an invalid file parameter, which triggers an error message revealing the local path, exposing sensitive information. The impact is partial confidentiality disclosure. No ex...

CVE-2004-1599

CVE-2004-1599 concerns a Cross-site Scripting (XSS) vulnerability in CoolPHP 1.0-stable, exploitable via index.php using the query or nick parameters. The underlying issue is insufficient input handling in the affected script, allowing an attacker to inject and execute arbitrary web scripts/HTML ...

CVE-2004-1545

The CVE-2004-1545 vulnerability affects MoniWiki (versions 1.0.9.2 and earlier) when used with Apache mod_mime. UploadFile.php fails to properly handle files with two extensions (e.g., .php.hwp), allowing remote attackers to upload and execute arbitrary code. This is triggered by the file-extensi...

CVE-2004-1697

The CVE-2004-1697 issue affects CA Unicenter Management Portal versions 2.0 and 3.1, where the Forgot your Password link reveals different error messages for existing vs non-existing usernames, enabling remote username guessing. Underlying cause is information disclosure through authentication er...

CVE-2004-1558

Multiple stack-based buffer overflows in YPOPs! aka YahooPOPS 0.4 through 0.6 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long 1 POP3 USER command or 2 SMTP request...

CVE-2004-1584

CRLF injection vulnerability in wp-login.php in WordPress 1.2 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the text parameter...

CVE-2004-1616

Links allows remote attackers to cause a denial of service memory consumption via a web page or HTML email that contains a table with a td element and a large rowspan value,as demonstrated by mangleme...

CVE-2004-1648

CVE-2004-1648 is a cross-site scripting (XSS) vulnerability in Password Protect affecting multiple ASP pages (index.asp, ChangePassword.asp, users_list.asp, users_add.asp) via the ShowMsg parameter. The issue is documented across CVE entries (NVD, CVE List) with a MEDIUM severity (CVSS v2 base sc...

CVE-2004-1650

The CVE covers the D-Link DCS-900 Internet Camera. The device listens on UDP port 62976 for an IP address, enabling remote attackers to change the camera’s IP address via a UDP broadcast packet. Impact is partial confidentiality/integrity/availability (per CVSS), with network-based access and no ...

CVE-2004-1678

CVE-2004-1678 describes a directory traversal vulnerability in PerlDesk’s pdesk.cgi. A remote attacker can read portions of arbitrary files (and possibly trigger execution of Perl modules) by crafting lang parameters with ‘..’ sequences terminated by a NULL character (%00), potentially leaking fi...

CVE-2004-1663

CVE-2004-1663 affects Engenio/LSI Logic storage controllers (used in Storagetek D280, IBM DS4100, Brocade SilkWorm Switches). It allows remote attackers to trigger a denial of service (freeze and possible data corruption) via crafted TCP packets. The documents describe the vulnerability and affec...

CVE-2004-1665

PsNews is affected by cross-site scripting (XSS) flaws in index.php for version 1.1 (and older than 1.2). The OpenVAS/Nessus entries describe multiple parameter XSS allowing the attacker to steal cookies from legitimate users. The root cause is described as XSS in index.php via the no parameter, ...

CVE-2004-1664

CVE-2004-1664 affects Call of Duty 1.4 and earlier. The issue arises from handling a large query or reply packet, where the buffer overflow protection mechanism fails to properly process the data, enabling remote attackers to cause a denial of service (game end). It may overlap with CVE-2005-0430...

CVE-2004-1606

Affected software: SalesLogix 6.1; vulnerable component: slxweb.dll. Description from CVE entries: remote attackers can cause a denial of service (application crash) by sending an invalid HTTP request, with potential leakage of sensitive information via the ErrorLogMsg cookie. The connected docum...

CVE-2004-1687

Snitz Forums 2000 v3.4.04 has a CRLF injection vulnerability in down.asp that enables HTTP Response Splitting via the location parameter. This remote issue can alter the server's HTML output. OpenVAS data labels it as Snitz Forums 2000 HTTP Response Splitting . No explicit remediation/patch detai...