CVE-2004-0314

The CVE-2004-0314 entry describes an XSS flaw in WebzEdit up to version 1.9, exploitable via the message parameter in done.jsp. The underlying issue enables remote attackers to execute arbitrary script in the context of other users, with the impact limited to partial integrity and no confidential...

CVE-2004-0247

CVE-2004-0247 affects Chaser 1.50 and earlier. A remote attacker can cause a denial of service by sending a UDP packet whose length field exceeds actual data, causing the client/server to read past memory. The provided documents describe the vulnerability and impact but do not specify a remediati...

CVE-2004-0295

CVE-2004-0295 affects Broker FTP 6.1.0.0, where the TsFtpSrv.exe service accepts an open idle connection that can be abused by remote attackers to cause CPU consumption and a denial of service. The available records describe the vulnerable component and the impact (DoS via idle connection), but d...

CVE-2004-0299

CVE-2004-0299 refers to a buffer/DoS issue in SmallFTPD. The consolidated data shows that an FTP request containing a large number of "/" characters can trigger a denial of service (crash) on affected SmallFTPD versions (notably referenced as 0.99 in the CVE description and as

CVE-2004-0305

CVE-2004-0305 describes a cross-site scripting (XSS) vulnerability in WebCortex WebStores 2000 version 6.0, specifically in error.asp. The underlying issue is the handling of the Message_id parameter, enabling remote attackers to execute arbitrary scripts in the context of other users’ sessions a...

CVE-2004-0358

CVE-2004-0358 is a cross-site scripting (XSS) vulnerability in VirtuaNews Admin Panel Pro 1.0.3 . The issue allows remote attackers to execute arbitrary script as another user by supplying crafted input through multiple parameters in admin.php (specifically the mainnews , expand , id , and catid ...

CVE-2004-0360

CVE-2004-0360 describes an unknown vulnerability in Solaris 8/9 passwd(1) that enables local privilege escalation via a circ() stack-based overflow. Public artifacts (Exploit-DB, 0day) document local root exploits exploiting a circ() buffer overflow and, in some descriptions, a ret-into-ld.so tec...

CVE-2004-0287

Xlight FTP Server 1.52 is vulnerable to a remote denial-of-service via a RETR command with an excessively long argument containing many slash characters, which may trigger a buffer overflow and crash the service. The issue requires authenticated access and affects the server version 1.52 (as cite...

CVE-2004-0338

SQL injection vulnerability in search.php for Invision Board Forum allows remote attackers to execute arbitrary SQL queries via the st parameter...

CVE-2004-0318

CVE-2004-0318 affects Load Sharing Facility (LSF) versions 4.x, 5.x, and 6.x. The vulnerability arises because LSF_EAUTH_UID may be used in place of the real user UID, enabling remote attackers within the local cluster to gain privileges. The underlying issue is the handling of an environment var...

CVE-2004-0246

CVE-2004-0246 describes multiple PHP remote file inclusion vulnerabilities in Les Commentaires 2.0, specifically in (1) fonctions.lib.php, (2) derniers_commentaires.php, and (3) admin.php. The underlying issue is remote code execution via the rep parameter, allowing an attacker to influence inclu...

CVE-2004-0308

Cisco ONS platform vulnerability CVE-2004-0308 affects ONS 15327 pre-4.1(3), ONS 15454 pre-4.6(1), ONS 15454 SD pre-4.1(3), and ONS15600 pre-1.3(0). A superuser account that is locked out, disabled, or suspended can gain unauthorized access via Telnet to the VxWorks shell. No remediation details ...

CVE-2004-0311

CVE-2004-0311 affects APC Web/SNMP Management SmartSlot Card, specifically versions 3.0 through 3.0.3 and 3.21. The issue is a default password vulnerability: the device ships with the password TENmanUFactOryPOWER, allowing remote attackers to gain unauthorized access. Connected documents corrobo...

CVE-2004-0251

The CVE-2004-0251 issue affects the web CGI component rxgoogle.cgi. The concrete vulnerability is a Cross-site Scripting (XSS) flaw in the rxgoogle.cgi query parameter, which can allow remote attackers to execute arbitrary script in the context of other users. The available connected records stat...

CVE-2004-0327

Directory traversal vulnerability in functions.php in PhpNewsManager 1.46 allows remote attackers to retrieve arbitrary files via .. dot dot sequences in the clang parameter...

CVE-2004-0265

This CVE concerns a Cross-site Scripting (XSS) vulnerability in Php-Nuke 6.x-7.1.0, specifically in modules.php. The vulnerability allows remote attackers to execute arbitrary script as other users by manipulating URL-encoded parameters (1) title or (2) fname in the News or Reviews modules. Affec...

CVE-2004-0312

CVE-2004-0312 affects Linksys WAP55AG (firmware 1.07) where an SNMP read-only community can be exploited to gain access to read/write community strings by querying OID 1.3.6.1.4.1.3955.2.1.13.1.2. This reveals a flaw in SNMP information exposure that allows escalation from read to write access. T...

CVE-2004-0333

CVE-2004-0333 describes a buffer overflow in the UUDeview component used by WinZip 6.2–8.1 SR-1 (and possibly other packages). The overflow can be triggered by decoding a MIME archive with long MIME parameters, allowing remote code execution. Multiple sources corroborate the same core issue acros...

CVE-2004-0330

CVE-2004-0330 is a buffer overflow in the MDTM handling of Serv-U FTP Server (pre-5.0.0.4). The vulnerability allows remote authenticated attackers to execute arbitrary code by sending a crafted MDTM timezone parameter. Public references show exploitation tooling and disclosures (Metasploit modul...

CVE-2004-0342

CVE-2004-0342 affects WFTPD Pro Server 3.21 Release 1 when XeroxDocutech is enabled. A denial-of-service (crash) can be triggered by local users issuing MKD or XMKD commands that build an absolute path of 260 characters, which overwrites a cookie with a null character—likely due to an off-by-one ...