CVE-2004-1475

Multiple stack-based buffer overflows in xine-lib 1-rc2 through 1-rc5 allow attackers to execute arbitrary code via 1 long VideoCD vcd:// MRLs or 2 long subtitle lines...

CVE-2004-1445

CVE-2004-1445 describes a race condition in Nessus’ nessus-adduser utility. If TMPDIR is not set, a local user can potentially escalate privileges. This affects Nessus 2.0.11 and possibly earlier versions. The vulnerability is documented with a CVSSv2 base score of 3.7 (Low), local attack vector,...

CVE-2004-1437

Multiple buffer overflows in the digest authentication functionality in Pavuk 0.9.28-r2 and earlier allow remote attackers to execute arbitrary code...

CVE-2004-1463

Removed by vendor...

CVE-2004-1398

CVE-2004-1398 describes a format string vulnerability in prelink.c within kextload on Apple OS X, used by TDIXSupport in Roxio Toast Titanium and possibly other products. The underlying issue arises from format string specifiers in the extension argument, enabling local users to execute arbitrary...

CVE-2004-1420

WHM AutoPilot 2.4.6.5 and earlier contains multiple XSS flaws in header.php, allowing remote attackers to inject arbitrary script/HTML via site_title or http_images parameters. Affected component is WHM AutoPilot’s header.php; root cause is improper handling of user-supplied values in these param...

CVE-2004-1429

The CVE-2004-1429 entry applies to ArGoSoft FTP 1.4.2.4 and earlier, where there is no limit on password entry attempts. This disclosure indicates that remote attackers could perform brute-force password guesses against the FTP service, potentially compromising accounts. The connected records con...

CVE-2004-1417

PsychoStats is affected: login.php in version 2.2.4 Beta and earlier is vulnerable to Cross-Site Scripting via the login parameter. Root cause: insufficient sanitization of the login parameter leading to arbitrary script execution. Impact aligns with CVSS 4.3 (medium). Remediation: upgrade to a v...

CVE-2004-1428

ArGoSoft FTP before 1.4.2.1 generates an error message if the user name does not exist instead of prompting for a password, which allows remote attackers to determine valid usernames...

CVE-2004-1403

PHP remote file inclusion vulnerability in index.php in GNUBoard 3.39 and earlier allows remote attackers to execute arbitrary PHP code by modifying the doc parameter to reference a URL on a remote web server that contains the code...

CVE-2004-1421

Multiple PHP remote file inclusion vulnerabilities 1 stepone.php, 2 steponetables.php, 3 steptwotables.php in WHM AutoPilot 2.4.6.5 and earlier allow remote attackers to execute arbitrary PHP code by modifying the serverinc parameter to reference a URL on a remote web server that contains the cod...

CVE-2004-1400

The control panel in ASP Calendar does not require authentication to access, which allows remote attackers to gain unauthorized access via a direct request to main.asp...

CVE-2004-1416

pnxr3260.dll in the RealOne 2.0 build 6.0.11.868 browser plugin, as used in Internet Explorer, allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a crafted embed tag...

CVE-2004-1430

SQL injection vulnerability CVE-2004-1430 affects IbProArcade’s show_stats module (Arcade.php) where the gameid parameter can be exploited to inject arbitrary SQL. This is remote and arises from input handling in the application’s PHP code. The available sources confirm the vulnerability and base...

CVE-2004-1423

PHP-Calendar (Sean Proctor) before 0.10.1 contains multiple remote file inclusion flaws. The vulnerability is triggered by a URL in the phpc_root_path parameter to includes/calendar.php or includes/setup.php, allowing remote attackers to execute arbitrary PHP code. Affected product: PHP-Calendar;...

CVE-2004-1409

CVE-2004-1409 affects Image Gallery Web Application 0.9.10 with multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. The provided documents specify the affected software and vulnerable condition but do not include explicit exploit...

CVE-2004-1425

CVE-2004-1425 describes a directory traversal vulnerability in Moodle 1.4.2 and earlier, where an attacker can read arbitrary session files by manipulating the file parameter with a .. sequence. The affected component is Moodle’s file.php; root cause is improper validation of the file path, enabl...

CVE-2004-1405

Affected software: MediaWiki 1.3.8 and earlier (with Apache mod_mime); also referenced as vulnerable in MediaWiki

CVE-2004-1395

The CVE-2004-1395 entry concerns the Lithtech engine as used in several games (Contract Jack, No One Lives Forever 2, Tron 2.0, F.E.A.R., and potentially others). A remote attacker can trigger a denial of service by sending a UDP packet that causes recvfrom to produce a return code which makes th...

CVE-2004-1419

CVE-2004-1419 affects Zeroboard 4.1pl4 and earlier. The vulnerability arises from PHP remote file inclusion by manipulating parameters: _zb_path in outlogin.php or dir in write.php to reference a URL on a remote server, enabling arbitrary PHP code execution. OpenVAS notes additional remote code e...