CVE-2004-1688

Pigeon Server 3.02.0143 and earlier allows remote attackers to cause a denial of service infinite loop and CPU consumption via a long login name sent to port 3103...

CVE-2004-1574

Buffer overflow in Vypress Messenger 3.5.1 and earlier allows remote attackers to execute arbitrary code via a message with a long first field...

CVE-2004-1604

cPanel 9.9.1-RELEASE-3 allows remote authenticated users to chmod arbitrary files via a symlink attack on the private directory, which is created when Front Page extensions are enabled...

CVE-2004-1607

slxweb.dll in SalesLogix 6.1 allows remote attackers to obtain sensitive information via a 1 Library or 2 Attachment request with an invalid file parameter, which reveals the path in an error message...

CVE-2004-1547

The file server in ActivePost Standard 3.1 and earlier allows remote authenticated users to cause a denial of service application crash via a long filename, possibly triggering a buffer overflow...

CVE-2004-1636

CVE-2004-1636 describes a heap-based buffer overflow in the WvTFTPServer::new_connection function (wvtftpserver.cc) of WvTftp 0.9. An attacker can trigger it by sending a TFTP packet with a long option string, leading to remote code execution. The NVD entry rates it as HIGH severity (CVSS v2 base...

CVE-2004-1620

CVE-2004-1620: Serendipity before 0.7rc1 has a CRLF injection (HTTP Response Splitting) allowing remote attackers to modify server HTML content via the url parameter in index.php and exit.php, or via the HTTP Referer header in comment.php. The vulnerability is exploitable remotely over the networ...

CVE-2004-1635

CVE-2004-1635 affects Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS when using the insidergroup feature. The issue: private attachments are not adequately protected if metadata (filename, description, MIME type, or review flags) changes, allowing remote authenticated users to disclose sensiti...

CVE-2004-1623

The CVE-2004-1623 entry concerns the WAV file property handler in Windows XP SP1, where processing a WAV file with an invalid header (fmt chunk length = 0xFFFFFFFF) can cause an infinite loop in Explorer, leading to a denial of service. Public sources confirm the affected software as Windows XP S...

CVE-2004-1621

IBM Lotus Notes and IBM Domino (Notes/Domino versions prior to R6) are affected by a cross-site scripting (XSS) vulnerability involving square brackets at the beginning and end of fields computed for display, computed when composed, or computed text element fields. The vendor has disputed that No...

CVE-2004-1631

Open WorkFlow Engine OpenWFE 1.4.x allows remote attackers to conduct port scans of remote hosts by specifying the target in an rmi:// Worklist URL, then using the response times to infer the results...

CVE-2004-1677

Technical details about CVE-2004-1677 are not provided in the provided documents. The description notes an information disclosure via invalid lang parameter in pdesk.cgi, but no further data on affected versions, root cause, or fixes is provided here. Monitor for updates.

CVE-2004-1585

CVE-2004-1585 affects Flash Messaging versions 5.2.0g and earlier . The underlying issue is a vulnerability in handling certain wide characters that can be exploited remotely to cause a denial of service via an application crash. The available documents consistently describe the affected product ...

CVE-2004-1582

CVE-2004-1582 affects BlackBoard Internet Newsboard System (BBBoard) 1.5.1. The vulnerability is a PHP remote file inclusion in the libpath parameter (typoed as libpach) that allows an attacker to include a URL on a remote server containing _more.php via checkdb.inc.php, enabling arbitrary PHP co...

CVE-2004-1574

Vypress Messenger 3.5.1 and earlier contains a buffer overflow in the first field of a message that allows remote code execution. The issue is documented under CVE-2004-1574; exploitation details are not provided in the supplied documents. Affected version range is explicitly stated as 3.5.1 and ...

CVE-2004-1666

CVE-2004-1666 describes a buffer overflow in the MSN module of Trillian 0.74i. A long string ending in a newline, processed by the MSN component, can be exploited by a remote MSN server to execute arbitrary code on a vulnerable client. The vulnerability is triggered via the MSN protocol handling ...

CVE-2004-1627

CVE-2004-1627 describes a remote buffer overflow in Ability Server (FTP service) versions 2.25, 2.32, 2.34 and potentially others, triggered by a long APPE command. Connected sources (CVE records and Nessus/NASL entries) confirm the vulnerability vector is over the FTP channel and could allow arb...

CVE-2004-1551

The CVE-2004-1551 entry describes a Cross-site scripting (XSS) vulnerability in paFileDB 3.1 Final affecting the (1) email and (2) file modules. The attack path is via the id parameter, allowing remote attackers to execute arbitrary script/HTML in a victim’s browser. Affected product: paFileDB 3....

CVE-2004-1683

CVE-2004-1683 concerns a race condition in crrtrap on QNX RTP 6.1. The vulnerability allows local users to gain privileges by manipulating the PATH environment variable to invoke a malicious io-graphics program before crrtrap executes. Impact is described as local privilege escalation with partia...

CVE-2004-1669

Cross-site scripting XSS vulnerability in MERAK Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to execute arbitrary web script or HTML via the 1 User name parameter to accountsettings.html or 2 Search string parameter to search.html...