8092 matches found
CVE-2004-2181
Multiple SQL injection vulnerabilities in WowBB Forum 1.61 allow remote attackers to execute arbitrary SQL commands via the 1 sortby or 2 page parameters to viewuser.php, or the 3 forumid parameter to viewtopic.php. NOTE: the sortby vector was later reported to be present in WowBB 1.65...
CVE-2004-2194
MailEnable Professional Edition before 1.53 and Enterprise Edition before 1.02 allows remote attackers to cause a denial of service crash via malformed 1 SMTP or 2 IMAP commands...
CVE-2004-2242
Cross-site scripting XSS vulnerability in search.php in Phorum, possibly 5.0.7 beta and earlier, allows remote attackers to inject arbitrary HTML or web script via the subject parameter...
CVE-2004-2273
efFingerD 0.2.12 allows remote attackers to cause a denial of service daemon crash via a packet with a single byte, which triggers a "Wrong protocol or connection state" error...
CVE-2004-2272
Buffer overflow in the sockFingerDataArrival function in efFingerD 0.2.12 allows remote attackers to cause a denial of service daemon crash via a long finger command...
CVE-2004-2286
Integer overflow in the duplication operator in ActivePerl allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a large multiplier, which may trigger a buffer overflow...
CVE-2004-2302
Race condition in the sysfsreadfile and sysfswritefile functions in Linux kernel before 2.6.10 allows local users to read kernel memory and cause a denial of service crash via large offsets in sysfs files...
CVE-2004-2311
Directory traversal vulnerability in webadmin.nsf in Lotus Domino R6 6.5.1 allows local users to create folders or determine the existence of files via a .. dot dot in the new folder dialog...
CVE-2004-2329
Kerio Personal Firewall KPF 2.1.5 allows local users to execute arbitrary code with SYSTEM privileges via the Load button in the Firewall Configuration Files option, which does not drop privileges before opening the file loading dialog box...
CVE-2004-2328
Clearswift MAILsweeper for SMTP before 4.313 allows remote attackers to cause a denial of service infinite loop via an e-mail with a crafted RAR archive attached...
CVE-2004-2352
Cross-site scripting XSS vulnerability in GBook for PHP-Nuke 1.0 allows remote attackers to inject arbitrary web script or HTML via cookies that are stored in the $COOKIE PHP variable, which is not cleansed by PHP-Nuke...
CVE-2004-2353
BugPort before 1.099 stores its configuration file conf/config.conf under the web document root with a file extension that is not normally parsed by web servers, which allows remote attackers to obtain sensitive information...
CVE-2004-2379
Multiple cross-site scripting XSS vulnerabilities in @Mail 3.64 for Windows allow remote attackers to inject arbitrary web script or HTML via 1 the Displayed Name attribute in util.pl and 2 the Folder attribute in showmail.pl...
CVE-2004-2388
rexecd for AIX 4.3.3 does not properly use a local copy of the pwd structure when calling getpwnam, which may cause the structure to be overwritten by the authenticate function and assign privileges to the wrong user...
CVE-2004-2398
Netenberg Fantastico De Luxe 2.8 uses database file names that contain the associated usernames, which allows local users to determine valid usernames and conduct brute force attacks by reading the file names from /var/lib/mysql, which is assigned world-readable permissions by cPanel 9.3.0 R5...
CVE-2004-2410
Unknown vulnerability in shhashcompdata for Samhain 1.8.9 through 2.0.1 might allow attackers to cause a denial of service null pointer dereference...
CVE-2004-2425
Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to execute arbitrary commands via accent and possibly other shell metacharacters in the query string to virtualinput.cgi...
CVE-2004-2432
WinAgents TFTP Server 3.0 allows remote attackers to cause a denial of service crash via a request for a file with a long file name, possibly due to an off-by-one buffer overflow...
CVE-2004-2443
Jaws 0.3 allows remote attackers to bypass authentication and via an HTTP request to admin.php with the logged cookie set to the MD5 hash of a null password, which is compared against the logged session variable by the loggedon function in application.php...