CVE-2004-1458

The CSAdmin web administration interface for Cisco Secure Access Control Server ACS 3.22 build 15 allows remote attackers to cause a denial of service hang via a flood of TCP connections to port 2002...

CVE-2004-1494

Buffer overflow in the Screen Fetch option in XDICT 2002 through 2005 allows remote attackers to cause a denial of service CPU consumption or application exit and possibly execute arbitrary code via a long string...

CVE-2004-1496

Directory traversal vulnerability in Web Forums Server 1.6 and 2.0 Power Pack allows remote attackers to read arbitrary files via a URL containing 1 ".." dot dot backslash, 2 "../" dot dot slash, 3 "/%2E%2E%5C" encoded dot dot backslash, or 4 "%2E%2E%2F" encoded dot dot slash...

CVE-2004-1497

Web Forums Server 1.6 and 2.0 Power Pack stores passwords in plaintext in the Username.ini file, which allows local users to gain privileges...

CVE-2004-1503

Integer overflow in the InitialDirContext in Java Runtime Environment JRE 1.4.2, 1.5.0 and possibly other versions allows remote attackers to cause a denial of service Java exception and failed DNS requests via a large number of DNS requests, which causes the xid variable to wrap around and becom...

CVE-2004-1504

The displaycontent function in config.php for Just Another Flat file JAF CMS 3.0RC allows remote attackers to gain sensitive information via a blank show parameter, which reveals the installation path in an error message, as demonstrated using index.php...

CVE-2004-1510

WebCalendar allows remote attackers to gain privileges by modifying critical parameters to 1 viewentry.php or 2 upcoming.php...

CVE-2004-1514

04WebServer 1.42 allows remote attackers to cause a denial of service fail to restart properly via an HTTP request for an MS-DOS device name such as COM2...

CVE-2004-1516

CRLF injection vulnerability in index.php in phpWebSite 0.9.3-4 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the blockusername parameter in the user module...

CVE-2004-1527

Microsoft Internet Explorer 6.0 SP1 does not properly handle certain character strings in the Path attribute, which can cause it to modify cookies in other domains when the attacker's domain name is within the target's domain name or when wildcard DNS is being used, which allows remote attackers ...

CVE-2004-1526

Hired Team: Trial 2.0 and earlier and 2.200 does not limit how game players can kick other players off the server, including the administrator...

CVE-2004-1534

ZoneAlarm and ZoneAlarm Pro before 5.5.062, with ad-blocking enabled, allows remote web sites to cause a denial of service application instability or system hang via certain JavaScript...

CVE-2004-1537

Cross-site scripting XSS vulnerability in popup.php in PHPKIT 1.6.03 through 1.6.1 allows remote attackers to execute arbitrary web script via the img parameter...

CVE-2004-1536

SQL injection vulnerability in index.php in the ibProArcade module for Invision Power Board IPB 1.x and 2.x allows remote attackers to execute arbitrary SQL commands via the cat parameter...

CVE-2004-1542

Buffer overflow in Soldier of Fortune II 1.03 Gold and earlier allows remote attackers to cause a denial of service server or client crash via a long 1 query or 2 reply...

CVE-2004-1547

The file server in ActivePost Standard 3.1 and earlier allows remote authenticated users to cause a denial of service application crash via a long filename, possibly triggering a buffer overflow...

CVE-2004-1550

Motorola Wireless Router WR850G running firmware 4.03 allows remote attackers to bypass authentication, log on as an administrator, and obtain sensitive information by repeatedly making an HTTP request for ver.asp until an administrator logs on...

CVE-2004-1564

CRLF injection vulnerability in subscribethread.php in w-Agora 4.1.6a allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the thread parameter...

CVE-2004-1565

list.php in w-Agora 4.1.6a allows remote attackers to reveal the full path via a crafted HTTP request, possibly involving a malformed id parameter...

CVE-2004-1569

Buffer overflow in 1 MusicConverter.exe, 2 playlist.exe, and 3 amp.exe in dBpowerAMP Audio Player 2.0 and dbPowerAmp Music Converter 10.0 allows remote attackers to cause a denial of service or execute arbitrary code via a .pls or .m3u playlist that contains long File1 filename fields...