CVE-2004-0332

Extremail 1.5.9 contains a password validation flaw where passwords that are all digits or start with a digit bypass checks, enabling remote privilege escalation. Affected software: Extremail 1.5.9. Root cause: improper password verification logic for digit-only or digit-leading passwords. Impact...

CVE-2004-0254

CVE-2004-0254 describes a cross-site scripting (XSS) vulnerability in Discuz! Board 2.x and 3.x that allows a remote attacker to execute arbitrary script as other users via an img tag. The NVD entry lists a base score of 6.8 (Medium) with Network attack vector, no authentication, and partial impa...

CVE-2004-0335

CVE-2004-0335 affects LAN SUITE Web Mail 602Pro when the “Directory browsing” feature is enabled. A remote attacker can obtain a directory listing by requesting (1) index.html, (2) cgi-bin/, or (3) users/ via HTTP. The vulnerability allows partial confidentiality impact with network access and lo...

CVE-2004-0326

The CVE-2004-0326 entry maps to a stack/buffer overflow in the web proxy of GateKeeper Pro 4.7 triggered by a long HTTP GET request to the proxy’s default port 3128, enabling remote code execution as described in multiple sources. Connected docs include exploit-related references (Metasploit modu...

CVE-2004-0241

CVE-2004-0241 affects X-Cart 3.4.3 (Qualiteam X-Cart). The vulnerability allows remote attackers to execute arbitrary commands by supplying output in the perl_binary parameter in either upgrade.php or general.php. The underlying cause is improper handling of the perl_binary argument, leading to a...

CVE-2004-0332

Extremail 1.5.9 does not check passwords correctly when they are all digits or begin with a digit, which allows remote attackers to gain privileges...

CVE-2004-0323

CVE-2004-0323 affects XMB (XMBForum) 1.8 Final SP2 (and item 3 also observed in XMB 1.9 beta). The vulnerabilities are multiple SQL injection flaws exploitable via parameters in web scripts: ppp (viewthread.php), desc (misc.php), tpp (forumdisplay.php), ascdesc (forumdisplay.php), and addon (stat...

CVE-2004-0349

The vulnerability CVE-2004-0349 affects GWeb HTTP Server 0.6, enabling a directory traversal via a .. in the URL that could allow a remote attacker to view arbitrary files. The primary technical detail documented is the URL-based traversal vulnerability and the affected product/version (GWeb HTTP...

CVE-2004-0278

The Ratbag game engine (used in Dirt Track Racing, Leadfoot, World of Outlaws Spring Cars) is vulnerable to a remote denial-of-service through crafted TCP traffic: a packet declaring a data length followed by a second packet with less data triggers the engine to repeatedly poll the socket, consum...

CVE-2004-0317

Buffer overflow in eauth in Load Sharing Facility 4.x, 5.x, and 6.x allows local users or remote attackers within the LSF cluster to cause a denial of service segmentation fault and possibly execute arbitrary code via a long LSFFromPC parameter...

CVE-2004-0248

Cross-site scripting vulnerability XSS in PHPX 3.2.3 allows remote attackers to execute arbitrary script as other users by injecting arbitrary HTML or script into 1 keywords argument of main.inc.php, 2 body argument of help.inc.php, or 3 the subject field in Personal Messages and Forum...

CVE-2004-0329

FreeChat 1.1.1a allows remote attackers to cause a denial of service crash via certain unexpected strings, as demonstrated using "aaaaa"...

CVE-2004-0331

CVE-2004-0331 describes a heap-based buffer overflow in Dell OpenManage Web Server (omws32.exe) due to a boundary error when handling POST requests. Affected versions include 3.2.0–3.7.1 (per connected advisories and the MSF module), with exploitation possible via a remote HTTP POST containing an...

CVE-2004-0319

This CVE (CVE-2004-0319) concerns a Cross-site scripting (XSS) vulnerability in ezBoard 7.3u. The underlying issue is within the font tag handling, where attacker-controlled content can be injected via background:url used in a (1) font color or (2) font face argument, allowing remote execution of...

CVE-2004-0340

CVE-2004-0340 corresponds to a stack-based buffer overflow in WFTPD Pro Server 3.21 Release 1, Pro Server 3.20 Release 2, Server 3.21 Release 1, and Server 3.10. The vulnerability allows local users to execute arbitrary code by sending abnormally long commands in LIST, NLST, or STAT. This is a lo...

CVE-2004-0328

CVE-2004-0328 affects Gigabyte Gn-B46B 2.4Ghz wireless broadband router firmware 1.003.00. The vulnerability lets local network users bypass authentication by using a copy of the router’s HTML menu on a separate system, effectively gaining unauthorized access. No further exploitation details are ...

CVE-2004-0357

SL Mail Pro 2.0.9 is affected by stack-based buffer overflows exploitable via (1) user.dll, (2) loadpageadmin.dll, or (3) loadpageuser.dll, potentially allowing remote code execution. A patch is available (SL Mail Patch 2.0.14) to mitigate. The connected documents confirm the affected components ...

CVE-2004-0266

SQL injection vulnerability in the "public message" capability publicmessage for Php-Nuke 6.x to 7.1.0 allows remote attackers to obtain the administrator password via the cmid parameter...

CVE-2004-0280

CVE-2004-0280 affects Caucho Technology Resin 2.1.12, where an attacker can remotely view JSP source by issuing an HTTP request to a .jsp file that ends with an encoded space (for example index.jsp%20). The underlying issue allows partial disclosure of source content, as reflected in the CVSS-bas...

CVE-2004-0343

The CVE-2004-0343 entry concerns YaBB SE 1.5.4 through 1.5.5b, where multiple SQL injection flaws enable remote attackers to execute arbitrary SQL. The vulnerable vectors are in ModifyMessage.php via the msg parameter and via the postid parameter. Impact is described as complete confidentiality, ...