CVE-2004-0365

The CVE-2004-0365 entry affects Ethereal (pcap/RADIUS decoder) with a vulnerability in packet-radius.c (Ethereal 0.8.13 through 0.10.2) that can cause a denial of service via a malformed RADIUS packet triggering a null dereference. Public advisories in connected docs reference vendor fixes (e.g.,...

CVE-2004-1857

Directory traversal vulnerability in setinfo.hts in HP Web Jetadmin 7.5.2546 allows remote authenticated attackers to read arbitrary files via a .. dot dot in the setinclude parameter...

CVE-2004-1859

Directory traversal vulnerability in Trend Micro Interscan Web Viruswall in InterScan VirusWall 3.5x allows remote attackers to read arbitrary files via a .. dot dot in the URL...

CVE-2004-2037

Buffer overflow in Mollensoft Lightweight FTP Server 3.6 allows remote authenticated users to cause a denial of service crash and possibly execute arbitrary code via a long CWD command, as demonstrated in one example by using the "cd" command in an interactive FTP client...

CVE-2004-0362

CVE-2004-0362 affects ISS PAM ICQ parsing in RealSecure/BlackICE/Proventia products. The issue is multiple stack-based buffer overflows in the ICQ server response handling (SRV_MULTI carrying SRV_USER_ONLINE/SRV_META_USER with long nickname/firstname/lastname/email), enabling remote code executio...

CVE-2004-1884

Ipswitch WSFTP Server 4.0.2 has a backdoor XXSESSMGRYY username with a default password, which allows remote attackers to gain access...

CVE-2004-0151

CVE-2004-0151 affects xitalk, with the vulnerability in 1.1.11 and earlier allowing a local user to execute arbitrary commands under the utmp GID. Debian’s DSA-462-1 fixes this by updating xitalk to 1.1.11-9.1woody1 for woody (and related notices for unstable). The issue is a local privilege-rele...

CVE-2004-0362

Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module PAM component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRVMULTI response containing a SRVUSERONLINE response packet...

CVE-2004-1852

DameWare Mini Remote Control 3.x before 3.74 and 4.x before 4.2 transmits the Blowfish encryption key in plaintext, which allows remote attackers to gain sensitive information...

CVE-2004-0364

The CVE-2004-0364 vulnerability affects Norton Internet Security 2004 (WrapNISUM/WrapUM.dll ActiveX). The ActiveX control is marked safe for scripting, enabling a remote attacker to cause the browser to execute arbitrary programs via the LaunchURL method when a user visits a malicious page or HTM...

CVE-2004-0363

CVE-2004-0363 describes a stack-based buffer overflow in the SymSpamHelper ActiveX control (symspam.dll) used by Norton AntiSpam 2004 (in Norton Internet Security 2004). A long parameter to LaunchCustomRuleWizard can allow a remote attacker to execute arbitrary code. Public references cite Metasp...

CVE-2004-1850

The Rage 1.01 and earlier allows remote attackers to cause a denial of service infinite loop via a TCP packet with the port and IP address set to zero...

CVE-2004-1855

Dark Age of Camelot before 1.68 live patch does not sign the RSA public key, which could allow remote malicious servers to gain sensitive information via a man-in-the-middle attack...

CVE-2004-0364

The WrapNISUM ActiveX component WrapUM.dll in Norton Internet Security 2004 is marked safe for scripting, which allows remote attackers to execute arbitrary programs via the LaunchURL method...

CVE-2004-1838

Directory traversal vulnerability in xweb 1.0 allows remote attackers to download arbitrary files via a .. dot dot in the URL...

CVE-2004-1839

MS Analysis module 2.0 for PHP-Nuke allows remote attackers to obtain sensitive information via a direct request to 1 browsers.php, 2 mstrack.php, or 3 title.php, which reveal the full path in a PHP error message...

CVE-2004-1847

News Manager Lite 2.5 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMIN parameter in the NEWSLOGIN cookie...

CVE-2004-1843

SQL injection vulnerability in Member Management System 2.1 allows remote attackers to execute arbitrary SQL via the ID parameter to 1 resend.asp or 2 newsview.asp...

CVE-2004-1853

Buffer overflow in Terminator 3: War of the Machines 1.0 allows remote attackers to cause a denial of service via a long ServerInfo variable...

CVE-2004-0308

Cisco ONS platform vulnerability CVE-2004-0308 affects ONS 15327 pre-4.1(3), ONS 15454 pre-4.6(1), ONS 15454 SD pre-4.1(3), and ONS15600 pre-1.3(0). A superuser account that is locked out, disabled, or suspended can gain unauthorized access via Telnet to the VxWorks shell. No remediation details ...