CVE-2004-1627

CVE-2004-1627 describes a remote buffer overflow in Ability Server (FTP service) versions 2.25, 2.32, 2.34 and potentially others, triggered by a long APPE command. Connected sources (CVE records and Nessus/NASL entries) confirm the vulnerability vector is over the FTP channel and could allow arb...

CVE-2004-1551

The CVE-2004-1551 entry describes a Cross-site scripting (XSS) vulnerability in paFileDB 3.1 Final affecting the (1) email and (2) file modules. The attack path is via the id parameter, allowing remote attackers to execute arbitrary script/HTML in a victim’s browser. Affected product: paFileDB 3....

CVE-2004-1683

CVE-2004-1683 concerns a race condition in crrtrap on QNX RTP 6.1. The vulnerability allows local users to gain privileges by manipulating the PATH environment variable to invoke a malicious io-graphics program before crrtrap executes. Impact is described as local privilege escalation with partia...

CVE-2004-1669

Cross-site scripting XSS vulnerability in MERAK Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to execute arbitrary web script or HTML via the 1 User name parameter to accountsettings.html or 2 Search string parameter to search.html...

CVE-2004-1641

Titan FTP Server versions up to 3.21 are affected by a heap-based buffer overflow triggered by long FTP commands (CWD, STAT, LIST). This remote overflow can cause a denial of service and, per some sources, may allow arbitrary code execution. Remediation mentioned in the sources is to upgrade to T...

CVE-2004-1690

CVE-2004-1690 describes a cross-site scripting (XSS) vulnerability in the DNS4Me Web Server 3.0.0.4. The flaw allows remote attackers to execute arbitrary web script or HTML via the URL. The connected documents confirm the issue and its association with DNS4Me 3.0.0.4; no exploit code or concrete...

CVE-2004-1651

Multiple cross-site scripting XSS vulnerabilities in the registration page in phpScheduleIt 1.0.0 RC1 allow remote attackers to inject arbitrary web script or HTML via the 1 Name or 2 Lastname fields during new user registration, or 3 the Schedule Name field...

CVE-2004-1571

AJ-Fork 167 is affected by an information-disclosure vulnerability where direct requests to 13 PHP scripts (auto-acronyms.php, auto-archive.php, ount-article-views.php, kses.php, custom-quick-tags.php, disable-all-comments.php, easy-date-format.php, enable-disable-comments.php, filter-by-author.p...

CVE-2004-1616

CVE-2004-1616 describes a remote-denial-of-service through crafted HTML: a web page or HTML email containing a table with a td and a large rowspan can trigger memory consumption. Publicly documented impact is availability (PARTIAL) with a base score of 5.0 (NVD CVSS2: AV:N/AC:L/Au:N/C:N/I:N/A:P)....

CVE-2004-1631

Technical details about CVE-2004-1631 are not publicly available in the provided documents; no affected products, versions, impact, or fixes are described here. Monitor for updates.

CVE-2004-1643

CVE-2004-1643 affects WS_FTP Server (WS_FTP Server 5.0.2). The vulnerability allows remote authenticated users to cause a denial of service by issuing a CD command with an invalid path containing a "../" sequence, leading to CPU consumption. Public sources consistently describe remote DoS due to ...

CVE-2004-1652

phpScheduleIt 1.0.0 RC1 does not clear administrative privileges if the administrator logs in as a normal user, which allows users with physical access to gain administrative privileges...

CVE-2004-1684

CVE-2004-1684 affects Zyxel P681 with ZyNOS Vt020225a. The flaw exposes portions of memory in ARP requests, allowing remote attackers to obtain sensitive information by sniffing the network, i.e., a network-accessible confidentiality impact. References confirm the vulnerability; however, the prov...

CVE-2004-1639

Technical details about CVE-2004-1639 are not publicly provided in the supplied connected documents; monitor for updates.

CVE-2004-1655

CVE-2004-1655 affects phpWebsite (version 0.9.3-4 and earlier). The vulnerability is a cross-site scripting (XSS) issue that allows remote attackers to inject arbitrary script or HTML via the CM_pid parameter in the comments module or via the subject or message fields in the notes module. The pro...

CVE-2004-1673

The CVE-2004-1673 entry concerns Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 (and possibly other versions). The flaw allows remote attackers to create text files with arbitrary content via the accountid parameter in accountsettings_add.html, indicating insufficient input validation in the...

CVE-2004-1699

SettingsBase.php in Pinnacle ShowCenter 1.51 allows remote attackers to cause a denial of service web interface errors via an invalid Skin parameter...

CVE-2004-1698

The Base64 function in PopMessenger 1.60 before 20 Sep 2004 and earlier allows remote attackers to cause a denial of service application crash via invalid characters in a message, which causes several alert dialogs to be displayed and leads to a crash...

CVE-2004-1611

SalesLogix 6.1 does not verify if a user is authenticated before performing sensitive operations, which could allow remote attackers to 1 execute arbitrary SLX commands on the server or spoof the server via a man-in-the-middle MITM attack, or 2 obtain the database password via a GetConnection...

CVE-2004-1670

CVE-2004-1670 affects Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 (and possibly other versions). The vulnerability enables directory traversal: an attacker can create arbitrary directories by supplying .. in the user parameter to viewaction.html, and can rename arbitrary files by supplyin...