CVE-2004-0055

The printattrstring function in print-radius.c for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service segmentation fault via a RADIUS attribute with a large length value...

CVE-2004-0060

WWW File Share Pro 2.42 and earlier allows remote attackers to cause a denial of service crash via a large POST request...

CVE-2004-0064

The SuSEconfig.gnome-filesystem script for YaST in SuSE 9.0 allows local users to overwrite arbitrary files via a symlink attack on files within the tmp.SuSEconfig.gnome-filesystem.$RANDOM temporary directory...

CVE-2004-0061

CVE-2004-0061 affects WWW File Share Pro 2.42 and earlier . It allows remote attackers to bypass directory access restrictions by using a URL with a trailing dot or a URI beginning with a slash or backslash. The impact described is partial disclosure/integrity/availability with a network attack v...

CVE-2004-0067

Multiple cross-site scripting XSS vulnerabilities in phpGedView before 2.65 allow remote attackers to inject arbitrary HTML or web script via 1 descendancy.php, 2 index.php, 3 individual.php, 4 login.php, 5 relationship.php, 6 source.php, 7 imageview.php, 8 calendar.php, 9 gedrecord.php, 10...

CVE-2004-0062

Integer overflow in the rnd arithmetic rounding function for various versions of FishCart before 3.1 allows remote attackers to "cause negative totals" via an order with a large quantity...

CVE-2004-0058

The CVE-2004-0058 entry affects Antivir for Linux 2.0.9-9 and potentially earlier versions. It describes a local privilege issue where a symlink race on the temporary file .pid_antivir_$$ allows a local user to overwrite arbitrary files. The underlying cause is a symlink attack on a daemon-relate...

CVE-2004-0069

HD Soft Windows FTP Server 1.6 and earlier is affected by CVE-2004-0069 due to a format string vulnerability in the username parameter, which is processed by wscanf. This allows remote attackers to induce arbitrary code execution on vulnerable installations. The vulnerability is described in the ...

CVE-2004-0073

CVE-2004-0073 affects EasyDynamicPages 2.0 via a PHP remote file inclusion in the edp_relative_path parameter of config.php and config_page.php. An attacker can reference a URL on a remote server containing a malicious serverdata.php to cause the web server to execute arbitrary PHP code. The vuln...

CVE-2004-0055

CVE-2004-0055 affects tcpdump v3.8.1 and earlier, where the print_attr_string function in the RADIUS decoding routines can be triggered by a large-length RADIUS attribute. The vulnerability allows remote attackers to cause a denial of service (segmentation fault) via crafted packets. Multiple ven...

CVE-2004-0067

CVE-2004-0067 describes multiple cross-site scripting (XSS) vulnerabilities in phpGedView prior to 2.65. The issue allows remote attackers to inject arbitrary HTML or JavaScript through numerous PHP/WEB pages (e.g., descendancy.php, index.php, individual.php, login.php, relationship.php, source.p...

CVE-2004-0071

Summary: CVE-2004-0071 is a directory traversal vulnerability in PHP Man Page Lookup 1.2.0. The issue stems from buildManPage in class.manpagelookup.php, allowing remote attackers to read arbitrary files via the command parameter ($cmd) to index.php. Affected components: PHP Man Page Lookup 1.2.0...

CVE-2004-0072

Directory traversal vulnerability in Accipiter Direct Server 6.0 allows remote attackers to read arbitrary files via encoded .. backslash .., "%5c%2e%2e" sequences in an HTTP request...

PhpDig config.php relative_script_path Parameter Remote File Inclusion

The remote host is running phpdig, an http search engine written in PHP. There is a flaw in this product that could allow an attacker to execute arbitrary PHP code on this by forcing this set of CGI to include a PHP script hosted on a third-party host. %NASLMINLEVEL 70300 C Tenable Network...

CVE-2004-0042

CVE-2004-0042 concerns vsftpd 1.1.3, where the login error messages differ based on whether a supplied username exists. The underlying effect is information disclosure: remote attackers can determine valid usernames on the server. The available connected sources corroborate the version (vsftpd 1....

CVE-2004-0046

The CVE-2004-0046 entry describes an XSS vulnerability in SnapStream PVS LITE. The issue allows remote attackers to inject arbitrary web script or HTML via a GET request containing a terminating '"' character. Affected component: SnapStream PVS LITE web interface; root cause: improper handling of...

CVE-2004-0017

PhpGroupWare (calendar and infolog modules, version 0.9.14 era) is affected by SQL injection vulnerabilities due to non-escaping of user-supplied data, enabling remote attackers to influence SQL query logic. Public sources (Debian DSA-419, OpenVAS entries, and NVD reference) confirm CAN-2004-0017...

CVE-2004-0043

CVE-2004-0043 relates to a buffer overflow in Yahoo Messenger before and including version 5.6.0.1351, triggered by a long filename in the download feature. The vulnerability can cause a denial of service and, potentially, remote code execution. Affected software is Yahoo Instant Messenger, with ...

CVE-2004-0042

vsftpd 1.1.3 generates different error messages depending on whether or not a valid username exists, which allows remote attackers to identify valid usernames...

Microsoft Security Bulletin MS04-001

Microsoft Security Bulletin MS04-001 Vulnerability in Microsoft Internet Security and Acceleration Server 2000 H.323 Filter Could Allow Remote Code Execution 816458 Issued: January 13, 2004 Version: 1.0 Summary Who should read this document: Customers who use Microsoft® Internet Security and...