CVE-2004-1655

Cross-site scripting XSS vulnerability in phpWebsite 0.9.3-4 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 CMpid parameter in the comments module or 2 the subject or message fields in the notes module...

CVE-2004-1660

PHP remote file inclusion vulnerability in CuteNews 1.3.6 and earlier allows remote attackers to execute arbitrary PHP code via the cutepath parameter to 1 showarchives.php or 2 shownews.php...

CVE-2004-1692

Cross-site scripting XSS vulnerability in index.php in Mambo 4.5 1.0.9 allows remote attackers to inject arbitrary web script or HTML via the 1 Itemid, 2 mosmsg, or 3 limit parameters...

CVE-2004-1642

WFTPD Pro Server 3.21 allows remote authenticated users to cause a denial of service crash via a series of long MLIST commands...

CVE-2004-1632

MoniWiki is affected by CVE-2004-1632: a cross-site scripting (XSS) vulnerability in wiki.php in MoniWiki 1.0.8 and earlier. The issue arises from insufficient validation of arguments to wiki.php, allowing remote attackers to inject arbitrary web script or HTML. Impact: XSS in users’ browsers; ex...

CVE-2004-1593

SCT Campus Pipeline is affected by a cross-site scripting (XSS) flaw in render.UserLayoutRootNode.uP; the vulnerability is exploitable by supplying arbitrary script/HTML via the utf parameter. The CVSSv2 base score is 4.3 (MEDIUM) with network attack vector and no authentication required, affecti...

CVE-2004-1567

Silent Storm Portal (2.1/2.2) exposes a privilege escalation in profile.php: setting the mail parameter to 1 (the admin value) allows remote attackers to gain administrator privileges. Vulnerable parameter handling is the root cause; the CVE entry documents this as an admin-privilege bypass via a...

CVE-2004-1688

CVE-2004-1688 affects Pigeon Server 3.02.0143 and earlier. A remote attacker can cause a denial of service by sending a long login name to TCP port 3103, resulting in an infinite loop and CPU consumption. The provided documents do not include specific fixes or remediation steps.

CVE-2004-1548

The CVE-2004-1548 entry concerns ActivePost Standard 3.1, specifically a Directory traversal vulnerability in its file server. Remote authenticated users can upload arbitrary files by manipulating the filename with a .. (dot dot) sequence. The provided documents describe the vulnerability vector ...

CVE-2004-1625

Summary: CVE-2004-1625 affects pGina 1.7.6 and possibly older versions. When the login screen Restart or Shutdown options are enabled, remote attackers can cause a denial of service by connecting via Remote Desktop and clicking restart or shutdown. The linked PT-2004-2532 entry reiterates affecte...

CVE-2004-1595

The CVE-2004-1595 entry concerns ShixxNOTE 6.net (build 117) and describes a buffer overflow in the handling of font fields, allowing a remote attacker to execute arbitrary code. Connected sources confirm concrete exploitability: Metasploit/ShixxNOTE font-field overflow modules and exploits (e.g....

CVE-2004-1652

The CVE affects phpScheduleIt 1.0.0 RC1. The vulnerability is that administrative privileges are not cleared when an administrator logs in as a normal user, enabling users with physical access to gain administrative privileges. The connected documents do not provide a patch, workaround, or explic...

CVE-2004-1584

The CVE-2004-1584 entry maps to a CRLF/HTTP Response Splitting vulnerability in WordPress 1.2, exploitable via wp-login.php using the text parameter to modify server HTML output. Affected software is WordPress 1.2 (WordPress

CVE-2004-1659

Cross-site scripting XSS vulnerability in index.php in CuteNews 1.3.6 and earlier allows remote attackers with Administrator, Editor, Journalist or Commenter privileges to inject arbitrary web script or HTML via the mod parameter...

CVE-2004-1618

Vypress Tonecast 1.3 and earlier allows remote attackers to cause a denial of service application crash via a malformed mp2 stream...

CVE-2004-1672

attachment.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to view other users' attachments by specifying the username and message ID in an HTTP request...

CVE-2004-1684

Zyxel P681 running ZyNOS Vt020225a contains portions of memory in an ARP request, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2004-1586

CVE-2004-1586 affects Flash Messaging Server 5.2.0g (rev 1.1.2). The issue is that Flash Messaging clients can ignore disconnect commands (e.g., shutdown) from the server, which could allow remote attackers to remain connected. The available documents do not provide explicit exploit details or re...

CVE-2004-1633

The CVE-2004-1633 issue affects Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS, where process_bug.cgi does not enforce edit permissions on the keywords field. An authenticated remote user can modify a bug’s keywords via the keywordaction parameter. The connection documents confirm the vulnerable ...

CVE-2004-1659

CVE-2004-1659 concerns a cross-site scripting (XSS) flaw in the CuteNews web app. Connected entries identify the vulnerability in the online script index.php for versions up to 1.3.6 and earlier, with the attack vector involving the mod parameter. Affected component: cutenews/index.php; root caus...