8092 matches found
CVE-2004-1585
Flash Messaging 5.2.0g rev 1.1.2 and earlier allows remote attackers to cause a denial of service application crash via certain wide characters...
CVE-2004-1591
CVE-2004-1591 affects the Micronet Wireless Broadband Router SP916BM (firmware before 1.9). The web interface resets the router password to the default password when the device is shut off, potentially allowing an attacker to gain access remotely. The available documents confirm the affected prod...
CVE-2004-1619
CVE-2004-1619 describes a buffer overflow in Privateer’s Bounty: Age of Sail II that allows remote attackers to execute arbitrary code via a long nickname. The NVD entry confirms the impact as remote code execution with network-exposed vector, low complexity, no authentication required, and parti...
CVE-2004-1565
CVE-2004-1565 affects w-Agora 4.1.6a: list.php exposes the full server path via a crafted HTTP request to an id parameter (path disclosure). The connected Nessus entry notes multiple input validation issues in the remote software, including SQL injection and XSS vectors, but does not provide a pa...
CVE-2004-1700
The CVE-2004-1700 entry affects Pinnacle ShowCenter (web interface), specifically the skin parameter handling in SettingsBase.php. The root cause is insufficient input validation for the Skin parameter, enabling cross-site scripting (XSS) and, per OpenVAS, potentially arbitrary code execution wit...
CVE-2004-1546
CVE-2004-1546 affects MDaemon 6.5.1. The issue is a stack buffer overflow in the MDaemon SMTP and IMAP command processing (overly long arguments to SAML/SOML/SEND/MAIL or LIST), leading to denial of service (crash) and, per advisories, potential remote code execution with system privileges. Explo...
CVE-2004-1563
CVE-2004-1563 concerns multiple XSS flaws in w-Agora 4.1.6a. The affected component is the web-based forum software (PHP) and the vulnerable vectors are: (1) thread parameter in download_thread.php, (2) loginuser parameter in login.php, and (3) userid parameter in forgot_password.php. The underly...
CVE-2004-1580
CubeCart 2.0.1 is affected: index.php uses the cat_id parameter in SQL queries, enabling remote SQL injection to potentially modify or disclose data. Root cause: unsafely constructed SQL from user input in cat_id. Impact aligns with CVSS: HIGH (partial confidentiality, integrity, and availability...
CVE-2004-1698
The issue CVE-2004-1698 affects PopMessenger 1.60 and earlier, where the Base64 function mishandles invalid characters in a message, causing multiple alert dialogs to appear and the application to crash (DoS). The available documents do not specify a patch version or workaround; no exploitation d...
CVE-2004-1693
CVE-2004-1693 affects Mambo 4.5 (1.0.9) via Function.php. The vulnerability arises from a PHP remote file inclusion: by setting mosConfig_absolute_path to reference a URL on a remote server that contains code, an attacker can execute arbitrary PHP on the affected system. This is a remote code exe...
CVE-2004-1653
CVE-2004-1653 concerns OpenSSH’s default setting that enables AllowTcpForwarding. The description states that with an anonymous access program such as AnonCVS, remote authenticated users could perform a port bounce, effectively using the SSH server as a proxy to reach internal services. The vulne...
CVE-2004-1674
viewaction.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to 1 delete arbitrary files via the originalfolder parameter or 2 move arbitrary files via the messageid parameter...
CVE-2004-1657
The provided connected documents confirm CVE-2004-1657 affects dasBlog’s Activity and Events Viewer, where the application fails to sanitize HTTP headers (User-Agent and Referrer), enabling cross-site scripting. The Nessus NASL item specifies vulnerability in dasBlog versions up to 1.6.0 due to u...
CVE-2004-1564
The CVE-2004-1564 entry concerns w-Agora 4.1.6a, where CRLF injection in subscribe_thread.php allows HTTP Response Splitting to alter server‑generated HTML content via the thread parameter. The vulnerability is caused by improper handling of input that can introduce CRLF sequences in HTTP headers...
CVE-2004-1494
Buffer overflow in the Screen Fetch option in XDICT 2002 through 2005 allows remote attackers to cause a denial of service CPU consumption or application exit and possibly execute arbitrary code via a long string...
CVE-2004-1529
CVE-2004-1529 refers to a Cross-site Scripting (XSS) vulnerability in the Event Calendar module 2.13 for PHP-Nuke. The issue allows remote attackers to trigger script execution by supplying malicious input in the Preview operation via the parameters (type, day, month, year) or in event comments. ...
CVE-2004-1492
CVE-2004-1492 concerns the game Master of Orion III (versions up to 1.2.5 and earlier). The vulnerability arises in how the game processes an incoming data packet that contains a large size specifier, triggering a large memory allocation that can fail and cause a remote denial of service (the gam...
CVE-2004-1508
init.php in WebCalendar allows remote attackers to execute arbitrary local PHP scripts via the userinc parameter...
CVE-2004-1533
CVE-2004-1533 describes a remote denial-of-service vulnerability in Digital Mappings Systems POP3 Server (pop3svr.exe) affecting DMS POP3 1.5.3.27 and earlier. The issue is a buffer overflow triggered by an excessively long username or password, leading to the service crash. The entry specifies a...