CVE-2004-0358

Cross-site scripting XSS vulnerability in VirtuaNews Admin Panel Pro 1.0.3 allows remote attackers to execute arbitrary script as other users via 1 the mainnews parameter in admin.php, 2 the expand parameter in admin.php, 3 the id parameter in admin.php, 4 the catid parameter in admin.php, or 5 a...

CVE-2004-0301

CVE-2004-0301 is an XSS vulnerability in Online Store Kit 3.0, specifically in more.php via the id parameter. The root cause is insufficient input sanitization of the id value, allowing remote attackers to inject arbitrary HTML. Impact is described as partial confidentiality, integrity, and avail...

CVE-2004-0246

CVE-2004-0246 describes multiple PHP remote file inclusion vulnerabilities in Les Commentaires 2.0, specifically in (1) fonctions.lib.php, (2) derniers_commentaires.php, and (3) admin.php. The underlying issue is remote code execution via the rep parameter, allowing an attacker to influence inclu...

CVE-2004-0342

CVE-2004-0342 affects WFTPD Pro Server 3.21 Release 1 when XeroxDocutech is enabled. A denial-of-service (crash) can be triggered by local users issuing MKD or XMKD commands that build an absolute path of 260 characters, which overwrites a cookie with a null character—likely due to an off-by-one ...

CVE-2004-0247

CVE-2004-0247 affects Chaser 1.50 and earlier. A remote attacker can cause a denial of service by sending a UDP packet whose length field exceeds actual data, causing the client/server to read past memory. The provided documents describe the vulnerability and impact but do not specify a remediati...

CVE-2004-0311

CVE-2004-0311 affects APC Web/SNMP Management SmartSlot Card, specifically versions 3.0 through 3.0.3 and 3.21. The issue is a default password vulnerability: the device ships with the password TENmanUFactOryPOWER, allowing remote attackers to gain unauthorized access. Connected documents corrobo...

CVE-2004-0305

CVE-2004-0305 describes a cross-site scripting (XSS) vulnerability in WebCortex WebStores 2000 version 6.0, specifically in error.asp. The underlying issue is the handling of the Message_id parameter, enabling remote attackers to execute arbitrary scripts in the context of other users’ sessions a...

CVE-2004-0279

AIM Sniff aimSniff.pl 0.9b allows local users to overwrite arbitrary files via a symlink attack on /tmp/AS.log...

CVE-2004-0236

CVE-2004-0236 concerns a SQL injection in login.asp of thePHOTOtool, allowing remote attackers to gain unauthorized access via the password field. The vulnerability is described across multiple sources (NVD/CVE databases) with a high impact and remote exploitation potential. Connected documents c...

CVE-2004-0329

CVE-2004-0329 affects FreeChat 1.1.1a. The issue allows remote attackers to trigger a denial-of-service crash by sending certain unexpected strings (demonstrated with “aaaaa”). According to the connected records, the vulnerability is exploitable over the network without authentication, but no con...

CVE-2004-0266

Affects Php-Nuke 6.x to 7.1.0 where the SQL injection vulnerability is in the public_message capability (c_mid parameter) that can disclose the administrator password. Exploitation details or specific patches are not provided in the connected documents. The OpenVAS/Nessus references confirm long-...

CVE-2004-0345

Affected software: Red Faction client 1.20 and earlier. The issue is a buffer overflow that allows a remote server to execute arbitrary code via a long server name. This CVE entry does not include explicit remediation details in the provided documents. The exploitation status is not stated.

CVE-2004-0321

CVE-2004-0321 affects Team Factor 1.25 and earlier. A remote attacker can crash the service by sending a packet where the data block size is a negative number, causing Team Factor to read unallocated memory and trigger a denial of service. The available descriptions consistently state this issue ...

CVE-2004-0337

The CVE-2004-0337 entry documents a cross-site scripting vulnerability in LAN SUITE Web Mail 602Pro. An attacker could craft a URL to index.html with a trailing slash and script payload to execute arbitrary script/HTML as another user. The vendor notes the bug could not be reproduced, leaving unc...

CVE-2004-0290

CVE-2004-0290 describes a buffer overflow in Purge Jihad 2.0.1 and earlier. The flaw occurs when processing an information packet with unusually large battle type and map name fields, enabling remote execution of arbitrary code on affected game servers. Documents do not provide a disclosed remedi...

CVE-2004-0344

YaBB SE 1.5.4–1.5.5b contains a directory traversal vulnerability in ModifyMessage.php, exploitable with an attached Old parameter to delete arbitrary files via .. path component. Impact: remote attacker could remove files on the affected host. Root cause is improper validation of the attachOld p...

CVE-2004-0338

SQL injection vulnerability in search.php for Invision Board Forum allows remote attackers to execute arbitrary SQL queries via the st parameter...

CVE-2004-0298

CesarFTP 0.99e allows remote attackers to cause a denial of service CPU consumption via a long RETR parameter...

CVE-2004-0360

Unknown vulnerability in passwd1 in Solaris 8.0 and 9.0 allows local users to gain privileges via unknown attack vectors...

CVE-2004-0328

Gigabyte Gn-B46B 2.4Ghz wireless broadband router firmware 1.003.00 allows local users on the same local network as the router to bypass authentication by using a copy of the router's html menu on a separate system...