CVE-2004-1509

validate.php in WebCalendar allows remote attackers to gain sensitive information via an invalid encodedlogin parameter, which reveals the full path in an error message...

CVE-2004-1502

The Telnet proxy in 602 Lan Suite 2004.0.04.0909 and earlier allows remote attackers to cause a denial of service socket exhaustion via a Telnet request to an IP address of the proxy's network interface, which causes a loop...

CVE-2004-1540

ZyXEL Prestige 623, 650, and 652 HW Routers, and possibly other versions, with HTTP Remote Administration enabled, does not require a password to access rpFWUpload.html, which allows remote attackers to reset the router configuration file...

CVE-2004-1507

CRLF injection vulnerability in login.php in WebCalendar allows remote attackers to inject CRLF sequences via the returnpath parameter and perform HTTP Response Splitting attacks to modify expected HTML content from the server...

CVE-2004-1497

Web Forums Server 1.6 and 2.0 Power Pack stores passwords in plaintext in the Username.ini file, which allows local users to gain privileges...

CVE-2004-1522

CVE-2004-1522 corresponds to a format-string vulnerability in Army Men RTS 1.0. The flaw allows remote attackers to trigger a denial of service (application crash) by sending a nickname containing format strings. The NVD entry indicates an untreated impact: availability is partially affected; oth...

CVE-2004-1541

SecureCRT 4.0, 4.1, and possibly other versions, allows remote attackers to execute arbitrary commands via a telnet:// URL that uses the /F option to specify a configuration file on a samba share...

CVE-2004-1520

Stack-based buffer overflow in IPSwitch IMail 8.13 allows remote authenticated users to execute arbitrary code via a long IMAP DELETE command...

CVE-2004-1504

The CVE concerns Just Another Flat File (JAF) CMS 3.0RC. The vulnerability is in the displaycontent function of config.php, which allows remote attackers to gain sensitive information by supplying a blank show parameter; an error message reveals the installation path (demonstrated with index.php)...

CVE-2004-1505

Technical details (affected product/component/versions/root cause) are not publicly provided in the supplied Connected documents. Monitor for updates to confirm scope, impact, and remediation for CVE-2004-1505.

CVE-2004-1517

Zone Labs IMsecure and IMsecure Pro before 1.5 allow remote attackers to bypass Active Link Filtering via an instant message containing a URL with hex encoded file extensions...

CVE-2004-1495

The Repair Archive command in WinRAR 3.40 allows remote attackers to cause a denial of service application crash via a corrupt ZIP archive...

CVE-2004-1528

The Event Calendar module 2.13 for PHP-Nuke allows remote attackers to gain sensitive information via an HTTP request to 1 config.php, 2 index.php, or 3 submit.php, which reveal the full path in an error message...

CVE-2004-1521

The CVE-2004-1521 issue affects Eudora 6.2.0.14 where forwarding an email containing base64 or quoted-printable encoded attachments fails to warn, enabling a remote attacker to read arbitrary files via spoofed Converted headers. The underlying cause is improper handling/validation of encoded atta...

CVE-2004-1536

CVE-2004-1536 affects the ibProArcade module of Invision Power Board (IPB) 1.x and 2.x. The vulnerability is a SQL injection in index.php through the cat parameter, allowing remote attackers to execute arbitrary SQL commands on the backend database. The Nessus/NVD/CVE references confirm remote-ex...

CVE-2004-1496

CVE-2004-1496 describes a directory traversal vulnerability in Web Forums Server 1.6 and 2.0 Power Pack that allows remote attackers to read arbitrary files via crafted URLs containing …, ../, encoded dot-dot slash (/%2E%2E%5C, %2E%2E%2F). The NVD/NVD-derived entries confirm the affected product ...

CVE-2004-1537

PHP-Kit 1.6.03–1.6.1 contains an XSS flaw in popup.php via the img parameter, enabling remote script execution. Multiple connected advisories corroborate XSS within PHP-Kit

CVE-2004-1527

Microsoft Internet Explorer 6.0 SP1 is affected by a vulnerability in handling certain character strings in the Path attribute, which can allow a remote attacker to hijack sessions by causing cookies to be modified in other domains when the attacker’s domain name is contained in the target’s doma...

CVE-2004-1543

CVE-2004-1543 describes a directory traversal vulnerability in KorWeblog (viewimg.php) that affects version 1.6.2-cvs and earlier. The root cause is accepting a path parameter containing a “..” sequence, enabling remote attackers to list arbitrary directories. The issue is publicly documented by ...

CVE-2004-1495

CVE-2004-1495 concerns WinRAR 3.40 where the Repair Archive command can be abused to trigger a denial of service (application crash) by processing a corrupt ZIP archive. The connected records confirm the affected software and the input type (corrupt ZIP) but do not provide formal details on root ...