CVE-2004-2563

Serena TeamTrack 6.1.1 allows remote attackers to obtain sensitive information such as user names, versions, and database information, and conduct cross-site scripting XSS attacks, via a direct request to tmtrack.dll with modified LoginPage and Template parameters...

CVE-2004-2565

Multiple directory traversal vulnerabilities in Sambar Server 6.1 Beta 2 on Windows, and possibly other versions on Linux, when the administrative IP address restrictions have been modified from the default, allow remote authenticated users to read arbitrary files via 1 a ".." dot dot backslash i...

CVE-2004-2572

AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering 1 invalid characters such as "" or 2 a large number of characters in the Lookup field on the netaddressbook.php web form, which reveals the path in an ldaplib.php error message when the ldapsearch...

CVE-2004-2574

Cross-site scripting XSS vulnerability in index.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to inject arbitrary web script or HTML via the date parameter in a calendar.uicalendar.planner menuaction...

CVE-2004-2577

The aclcheck function in phpGroupWare 0.9.16RC2 always returns True, even when mkdir does not behave as expected, which could allow remote attackers to obtain sensitive information via WebDAV from users' home directories that lack .htaccess files, and possibly has other unknown impacts...

CVE-2004-2579

ACLCHECK module in Novell iChain 2.3 allows attackers to bypass access control rules of an unspecified component via an unspecified attack vector involving a string that contains escape sequences represented with "overlong UTF-8 encoding."...

CVE-2004-2587

login.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service via a long txtusername parameter, possibly due to a buffer overflow...

CVE-2004-2620

The MIMEHreadheaders function in ripMIME 1.3.1.0 does not properly handle trailing "\r" and "\n" characters in headers, which leads to a buffer underflow...

CVE-2004-2624

Cross-site scripting XSS vulnerability in "TextSearch" in WackoWiki 3.5 allows remote attackers to inject arbitrary web script or HTML via the "phrase" parameter...

CVE-2004-2633

Unspecified vulnerability in Sesamie 1.0 allows remote anonymous attackers to gain access to repositories of other users via unknown vectors...

CVE-2004-2663

The 1 SetDebugging and 2 RunEgatherer methods in IBM Access Support eGatherer ActiveX control 2.0.0.16 allow remote attackers to create files with arbitrary content, as demonstrated by creating a .hta file in a Startup folder...

CVE-2004-2667

Cross-site scripting XSS vulnerability in Lotus Domino 6.0.x before 6.0.4 and 6.5.x before 6.5.2 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors...

CVE-2004-2684

Unspecified vulnerability in the %template package in InterSystems Cache' 5.0 allows attackers to access certain files on a server, including 1 cache.key and 2 cache.dat, related to .csp files under a Dev\studio\templates and b Devuser\studio\templates...

CVE-2004-2693

HP-UX B.11.00 and B.11.11 with B6848AB GTK+ Support Libraries installed uses insecure directory permissions, which allows local users to gain privileges via files in /opt/gnome/src/GLib/...

CVE-2004-2695

SQL injection vulnerability in the Authorize.net callback code subscriptions/authorize.php in Jelsoft vBulletin 3.0 through 3.0.3 allows remote attackers to execute arbitrary SQL statements via the xinvoicenum parameter. NOTE: this issue might be related to CVE-2006-4267...

CVE-2004-2713

Zone Alarm Pro 1.0 through 5.1 gives full access to %windir%\Internet Logs\ to the EVERYONE group, which allows local users to cause a denial of service by modifying the folder contents or permissions. NOTE: this issue has been disputed by the vendor, who claims that it does not affect product...

CVE-2004-2730

Sysinternals PsTools before 2.05, including 1 PsExec before 1.54, 2 PsGetsid before 1.41, 3 PsInfo before 1.61, 4 PsKill before 1.03, 5 PsList before 1.26, 6 PsLoglist before 2.51, 7 PsPasswd before 1.21, 8 PsService before 2.12, 9 PsSuspend before 1.05, and 10 PsShutdown before 2.32, does not...

CVE-2004-2741

Cross-site scripting XSS vulnerability in the "help window" help.php in Horde Application Framework 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the 1 module, 2 topic, or 3 module parameters...

CVE-2004-2745

Directory traversal vulnerability in Anteco Visual Technologies OwnServer 1.0 and earlier allows remote attackers to read arbitrary files via a .. dot dot in a URL...

CVE-2004-2757

Cross-site scripting XSS vulnerability in the failed login page in Novell iChain before 2.2 build 2.2.113 and 2.3 First Customer Ship FCS allows remote attackers to inject arbitrary web script or HTML via url parameter...