CVE-2004-0030

PHP remote file inclusion vulnerability in 1 functions.php, 2 authenticationindex.php, and 3 configgedcom.php for PHPGEDVIEW 2.61 allows remote attackers to execute arbitrary PHP code by modifying the PGVBASEDIRECTORY parameter to reference a URL on a remote web server that contains the code...

CVE-2004-0014

Multiple buffer overflows in the nd WebDAV interface 0.8.2 and earlier allows remote web servers to execute arbitrary code via certain long strings...

CVE-2004-0034

Multiple cross-site scripting XSS vulnerabilities in Phorum 3.4.5 and earlier allow remote attackers to inject arbitrary HTML or web script via 1 the phorumcheckxss function in common.php, 2 the EditError variable in profile.php, and 3 the Error variable in login.php...

Resources consumption in Goahead webserver <= 2.1.8

Luigi Auriemma Application: Goahead webserver http://www.goahead.com/webserver/webserver.htm Versions: = 2.1.8 Platforms: multiplatform Bug: resources consumption Risk: medium/high Exploitation: remote Date: 19 Jan 2004 Author: Luigi Auriemma e-mail: [email protected] web:...

KDE Security Advisory: VCF file information reader vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 KDE Security Advisory: VCF file information reader vulnerability Original Release Date: 2004-01-14 URL: http://www.kde.org/info/security/advisory-20040114-1.txt 0. References 1. Systems affected: All versions of kdepim as distributed with KDE versions...

CVE-2004-0066

phpGedView before 2.65 allows remote attackers to obtain the absolute path of the web server via malformed parameters to 1 indilist.php, 2 famlist.php, 3 placelist.php, 4 imageview.php, 5 timeline.php, 6 clippings.php, 7 login.php, and 8 gdbi.php...

CVE-2004-0069

Format string vulnerability in HD Soft Windows FTP Server 1.6 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the username, which is processed by the wscanf function...

CVE-2004-0060

CVE-2004-0060 affects WWW File Share Pro 2.42 and earlier. The vulnerability allows a remote attacker to trigger a denial-of-service (crash) via a large POST request sent over the network. The connected documents confirm the affected product and the impact (DoS via crafted POST size), but do not ...

CVE-2004-0056

Multiple vulnerabilities in the H.323 protocol implementation affect Nortel Networks BCM, Succession 1000 IP Trunk/IP Peer Networking, and 802.11 Wireless IP Gateway. The issues enable remote denial of service and possibly arbitrary code execution, demonstrated via the H.225 protocol test suite (...

CVE-2004-0066

phpGedView is affected by CVE-2004-0066 up to version 2.64. The vulnerability allows remote attackers to disclose the web server’s absolute path via malformed parameters to multiple PHP pages (indilist.php, famlist.php, placelist.php, imageview.php, timeline.php, clippings.php, login.php, gdbi.ph...

CVE-2004-0072

CVE-2004-0072 affects Accipiter Direct Server 6.0. It is a directory-traversal vulnerability allowing remote attackers to read arbitrary files via encoded .. (backslash ..) sequences in an HTTP request. The NVD entry assigns a CVSSv2 base score of 5.0 (Medium) with Network attack vector and no au...

CVE-2004-0054

CVE-2004-0054 affects Cisco IOS with H.323 support (releases 11.3T through 12.2T). The issue is in the H.323 message processing that can be exploited to cause a denial of service and, potentially, remote code execution as demonstrated by the NISCC/OUSPG PROTOS test suite for H.225. Multiple sourc...

CVE-2004-0065

The CVE-2004-0065 entry refers to multiple SQL injection vulnerabilities in phpGedView prior to 2.65, allowing remote attackers to execute arbitrary SQL via timeline.php and placelist.php. Affected software: phpGedView (versions before 2.65). Root cause: SQL injection in two scripts (timeline.php...

CVE-2004-0064

The CVE-2004-0064 entry describes a local vulnerability in SuSEconfig.gnome-filesystem (YaST) on SuSE 9.0 where local users can overwrite arbitrary files via a symlink attack inside the temporary directory tmp.SuSEconfig.gnome-filesystem.$RANDOM. The attacker’s ability to create or replace files ...

CVE-2004-0057

CVE-2004-0057 concerns tcpdump

CVE-2004-0061

WWW File Share Pro 2.42 and earlier allows remote attackers to bypass directory access restrictions via 1 a URL with a trailing . dot, or 2 a URI with a leading slash or backslash character...

CVE-2004-0058

Antivir / Linux 2.0.9-9, and possibly earlier versions, allows local users to overwrite arbitrary files via a symlink attack on the .pidantivir$$ temporary file...

CVE-2004-0055

The printattrstring function in print-radius.c for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service segmentation fault via a RADIUS attribute with a large length value...

CVE-2004-0062

The CVE-2004-0062 entry concerns FishCart prior to 3.1, where an integer overflow in the rnd arithmetic rounding function can be triggered by an order with a large quantity, enabling remote attackers to cause negative totals. Affected software: FishCart (versions before 3.1). Root cause: integer ...

CVE-2004-0054

Multiple vulnerabilities in the H.323 protocol implementation for Cisco IOS 11.3T through 12.2T allow remote attackers to cause a denial of service and possibly execute arbitrary code, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol...