2004 CVEs (page 13)
Page 13 of 27 — CVEs published in 2004, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2004-1556 | | 2004-12-31 | MyWebServer 1.0.3 allows remote attackers to cause a denial of service (application crash) via a large number of connections within a short time. | |
CVE-2004-1555 | | 2004-12-31 | Multiple SQL injection vulnerabilities in BroadBoard Instant ASP Message Board allow remote attackers to run arbitrary SQL commands via the (1) keywords parame… | |
CVE-2004-1554 | | 2004-12-31 | PHP remote file inclusion vulnerability in livre_include.php in @lex Guestbook allows remote attackers to execute arbitrary PHP code by modifying the chem_abso… | |
CVE-2004-1553 | | 2004-12-31 | SQL injection vulnerability in aspWebAlbum allows remote attackers to execute arbitrary SQL statements via (1) the username field on the login page or (2) the… | |
CVE-2004-1552 | | 2004-12-31 | SQL injection vulnerability in aspWebCalendar allows remote attackers to execute arbitrary SQL statements via (1) the username field on the login page or (2) t… | |
CVE-2004-1551 | | 2004-12-31 | Cross-site scripting (XSS) vulnerability in the (1) email or (2) file modules in paFileDB 3.1 Final allows remote attackers to execute arbitrary web script or… | |
CVE-2004-1550 | | 2004-12-31 | Motorola Wireless Router WR850G running firmware 4.03 allows remote attackers to bypass authentication, log on as an administrator, and obtain sensitive inform… | |
CVE-2004-1549 | | 2004-12-31 | The conference menu in ActivePost Standard 3.1 sends passwords of password-protected rooms in cleartext, which could allow remote attackers to gain sensitive i… | |
CVE-2004-1548 | | 2004-12-31 | Directory traversal vulnerability in the file server in ActivePost Standard 3.1 allows remote authenticated users to upload arbitrary files via a .. (dot dot)… | |
CVE-2004-1547 | | 2004-12-31 | The file server in ActivePost Standard 3.1 and earlier allows remote authenticated users to cause a denial of service (application crash) via a long filename… | |
CVE-2004-1546 | | 2004-12-31 | Multiple buffer overflows in MDaemon 6.5.1 allow remote attackers to cause a denial of service (application crash) via a long (1) SAML, SOML, SEND, or MAIL com… | |
CVE-2004-1545 | | 2004-12-31 | UploadFile.php in MoniWiki 1.0.9.2 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, such as .php.hwp, whic… | |
CVE-2004-1544 | | 2004-12-31 | Cross-site scripting (XSS) vulnerability in Search.jsp in JSPWiki 2.1.120-cvs and earlier allows remote attackers to execute arbitrary web script as other user… | |
CVE-2004-1543 | | 2004-12-31 | Directory traversal vulnerability in viewimg.php in KorWeblog 1.6.2-cvs and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in… | |
CVE-2004-1542 | | 2004-12-31 | Buffer overflow in Soldier of Fortune II 1.03 Gold and earlier allows remote attackers to cause a denial of service (server or client crash) via a long (1) que… | |
CVE-2004-1541 | | 2004-12-31 | SecureCRT 4.0, 4.1, and possibly other versions, allows remote attackers to execute arbitrary commands via a telnet:// URL that uses the /F option to specify a… | |
CVE-2004-1540 | | 2004-12-31 | ZyXEL Prestige 623, 650, and 652 HW Routers, and possibly other versions, with HTTP Remote Administration enabled, does not require a password to access rpFWUp… | |
CVE-2004-1539 | | 2004-12-31 | Halo: Combat Evolved 1.05 and earlier allows remote game servers to cause a denial of service (client crash) via a long value in a game server reply, which tri… | |
CVE-2004-1538 | | 2004-12-31 | SQL injection vulnerability in include.php in PHPKIT 1.6.03 through 1.6.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. | |
CVE-2004-1537 | | 2004-12-31 | Cross-site scripting (XSS) vulnerability in popup.php in PHPKIT 1.6.03 through 1.6.1 allows remote attackers to execute arbitrary web script via the img parame… | |
CVE-2004-1536 | | 2004-12-31 | SQL injection vulnerability in index.php in the ibProArcade module for Invision Power Board (IPB) 1.x and 2.x allows remote attackers to execute arbitrary SQL… | |
CVE-2004-1535 | | 2004-12-31 | PHP remote file inclusion vulnerability in admin_cash.php for the Cash Mod module for phpBB allows remote attackers to execute arbitrary PHP code by modifying… | |
CVE-2004-1534 | | 2004-12-31 | ZoneAlarm and ZoneAlarm Pro before 5.5.062, with ad-blocking enabled, allows remote web sites to cause a denial of service (application instability or system h… | |
CVE-2004-1533 | | 2004-12-31 | Buffer overflow in pop3svr.exe for DMS POP3 1.5.3.27 and earlier allows remote attackers to cause a denial of service (service crash) via a long (1) username o… | |
CVE-2004-1532 | | 2004-12-31 | AppServ 2.5.x and earlier installs a default username and password, which allows remote attackers to gain access. | |
CVE-2004-1531 | | 2004-12-31 | SQL injection vulnerability in post.php in Invision Power Board (IPB) 2.0.0 through 2.0.2 allows remote attackers to execute arbitrary SQL commands via the qpi… | |
CVE-2004-1530 | | 2004-12-31 | SQL injection vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the (1) eid or (2) cid… | |
CVE-2004-1529 | | 2004-12-31 | Cross-site scripting (XSS) vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary web script via the (1) typ… | |
CVE-2004-1528 | | 2004-12-31 | The Event Calendar module 2.13 for PHP-Nuke allows remote attackers to gain sensitive information via an HTTP request to (1) config.php, (2) index.php, or (3)… | |
CVE-2004-1527 | | 2004-12-31 | Microsoft Internet Explorer 6.0 SP1 does not properly handle certain character strings in the Path attribute, which can cause it to modify cookies in other dom… | |
CVE-2004-1526 | | 2004-12-31 | Hired Team: Trial 2.0 and earlier and 2.200 does not limit how game players can kick other players off the server, including the administrator. | |
CVE-2004-1525 | | 2004-12-31 | Hired Team: Trial 2.0 and earlier and 2.200 allows remote attackers to cause a denial of service (application crash) via the status command. | |
CVE-2004-1524 | | 2004-12-31 | Hired Team: Trial 2.0 and earlier and 2.200 allows remote attackers to cause a denial of service (game interruption) via a malformed UDP packet sent to a game… | |
CVE-2004-1523 | | 2004-12-31 | Format string vulnerability in the game console in Hired Team: Trial 2.0 and earlier and 2.200 allows remote attackers to cause a denial of service (applicatio… | |
CVE-2004-1522 | | 2004-12-31 | Format string vulnerability in Army Men RTS 1.0 allows remote attackers to cause a denial of service (application crash) via a nickname that contains format st… | |
CVE-2004-1521 | | 2004-12-31 | Eudora 6.2.0.14 does not issue a warning when a user forwards an e-mail message that contains base64 or quoted-printable encoded attachments, which makes it ea… | |
CVE-2004-1520 | | 2004-12-31 | Stack-based buffer overflow in IPSwitch IMail 8.13 allows remote authenticated users to execute arbitrary code via a long IMAP DELETE command. | |
CVE-2004-1519 | | 2004-12-31 | SQL injection vulnerability in bug.php in phpBugTracker 0.9.1 allows remote attackers to execute arbitrary SQL commands via (1) the bug_id parameter in a viewv… | |
CVE-2004-1518 | | 2004-12-31 | SQL injection vulnerability in follow.php in Phorum 5.0.12 and earlier allows remote authenticated users to execute arbitrary SQL command via the forum_id para… | |
CVE-2004-1517 | | 2004-12-31 | Zone Labs IMsecure and IMsecure Pro before 1.5 allow remote attackers to bypass Active Link Filtering via an instant message containing a URL with hex encoded… | |
CVE-2004-1516 | | 2004-12-31 | CRLF injection vulnerability in index.php in phpWebSite 0.9.3-4 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML cont… | |
CVE-2004-1515 | | 2004-12-31 | SQL injection vulnerability in (1) ttlast.php and (2) last10.php in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL statements via the fsel pa… | |
CVE-2004-1514 | | 2004-12-31 | 04WebServer 1.42 allows remote attackers to cause a denial of service (fail to restart properly) via an HTTP request for an MS-DOS device name such as COM2. | |
CVE-2004-1513 | | 2004-12-31 | 04WebServer 1.42 does not adequately filter data that is written to log files, which could allow remote attackers to inject carriage return characters into the… | |
CVE-2004-1512 | | 2004-12-31 | Cross-site scripting (XSS) vulnerability in Response_default.html in 04WebServer 1.42 allows remote attackers to execute arbitrary web script or HTML via scrip… | |
CVE-2004-1511 | | 2004-12-31 | Hotfoon 4.0 does not notify users before opening links in web browsers, which could allow remote attackers to execute arbitrary code via a certain link sent in… | |
CVE-2004-1510 | | 2004-12-31 | WebCalendar allows remote attackers to gain privileges by modifying critical parameters to (1) view_entry.php or (2) upcoming.php. | |
CVE-2004-1509 | | 2004-12-31 | validate.php in WebCalendar allows remote attackers to gain sensitive information via an invalid encoded_login parameter, which reveals the full path in an err… | |
CVE-2004-1508 | | 2004-12-31 | init.php in WebCalendar allows remote attackers to execute arbitrary local PHP scripts via the user_inc parameter. | |
CVE-2004-1507 | | 2004-12-31 | CRLF injection vulnerability in login.php in WebCalendar allows remote attackers to inject CRLF sequences via the return_path parameter and perform HTTP Respon… | |
CVE-2004-1506 | | 2004-12-31 | Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar allow remote attackers to inject arbitrary web script via (1) view_entry.php, (2) view_d.php… | |
CVE-2004-1505 | | 2004-12-31 | Directory traversal vulnerability in index.php in Just Another Flat file (JAF) CMS 3.0RC allows remote attackers to read arbitrary files and possibly execute P… | |
CVE-2004-1504 | | 2004-12-31 | The displaycontent function in config.php for Just Another Flat file (JAF) CMS 3.0RC allows remote attackers to gain sensitive information via a blank show par… | |
CVE-2004-1503 | | 2004-12-31 | Integer overflow in the InitialDirContext in Java Runtime Environment (JRE) 1.4.2, 1.5.0 and possibly other versions allows remote attackers to cause a denial… | |
CVE-2004-1502 | | 2004-12-31 | The Telnet proxy in 602 Lan Suite 2004.0.04.0909 and earlier allows remote attackers to cause a denial of service (socket exhaustion) via a Telnet request to a… | |
CVE-2004-1501 | | 2004-12-31 | The webmail service in 602 Lan Suite 2004.0.04.0909 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) by sending a… | |
CVE-2004-1500 | | 2004-12-31 | Format string vulnerability in the Lithtech engine, as used in multiple games, allows remote authenticated users to cause a denial of service (application cras… | |
CVE-2004-1499 | | 2004-12-31 | Cross-site scripting (XSS) vulnerability in the compose message form in HELM 3.1.19 and earlier allows remote attackers to execute arbitrary web script or HTML… | |
CVE-2004-1498 | | 2004-12-31 | SQL injection vulnerability in the compose message form in HELM 3.1.19 and earlier allows remote attackers to execute arbitrary SQL commands via the messageToU… | |
CVE-2004-1497 | | 2004-12-31 | Web Forums Server 1.6 and 2.0 Power Pack stores passwords in plaintext in the Username.ini file, which allows local users to gain privileges. | |
CVE-2004-1496 | | 2004-12-31 | Directory traversal vulnerability in Web Forums Server 1.6 and 2.0 Power Pack allows remote attackers to read arbitrary files via a URL containing (1) "..\" (d… | |
CVE-2004-1495 | | 2004-12-31 | The Repair Archive command in WinRAR 3.40 allows remote attackers to cause a denial of service (application crash) via a corrupt ZIP archive. | |
CVE-2004-1494 | | 2004-12-31 | Buffer overflow in the Screen Fetch option in XDICT 2002 through 2005 allows remote attackers to cause a denial of service ( CPU consumption or application exi… | |
CVE-2004-1493 | | 2004-12-31 | Master of Orion III 1.2.5 and earlier allows remote attackers to cause a denial of service (server crash) via multiple connections with long nicknames, possibl… | |
CVE-2004-1492 | | 2004-12-31 | Master of Orion III 1.2.5 and earlier allows remote attackers to cause a denial of service (game exit) via a data packet that contains a large size specifier… | |
CVE-2004-1491 | | 2004-12-31 | Opera 7.54 and earlier uses kfmclient exec to handle unknown MIME types, which allows remote attackers to execute arbitrary code via a shortcut or launcher tha… | |
CVE-2004-1490 | | 2004-12-31 | Opera 7.54 and earlier allows remote attackers to spoof file types in the download dialog via dots and non-breaking spaces (ASCII character code 160) in the (1… | |
CVE-2004-1489 | | 2004-12-31 | Opera 7.54 and earlier does not properly limit an applet's access to internal Java packages from Sun, which allows remote attackers to gain sensitive informati… | |
CVE-2004-1486 | | 2004-12-31 | Unknown vulnerability in Serviceguard A.11.13 through A.11.16.00 and Cluster Object Manager A.01.03 and B.01.04 through B.03.00.01 on HP-UX, Serviceguard A.11… | |
CVE-2004-1485 | | 2004-12-31 | Buffer overflow in the TFTP client in InetUtils 1.4.2 allows remote malicious DNS servers to execute arbitrary code via a large DNS response that is handled by… | |
CVE-2004-1484 | | 2004-12-31 | Format string vulnerability in the _msg function in error.c in socat 1.4.0.3 and earlier, when used as an HTTP proxy client and run with the -ly option, allows… | |
CVE-2004-1483 | | 2004-12-31 | Multiple unknown vulnerabilities in the ActiveX and HTML file browsers in Symantec Clientless VPN Gateway 4400 Series 5.0 have unknown attack vectors and unkno… | |
CVE-2004-1482 | | 2004-12-31 | The sbuf_getmsg function in BNC incorrectly handles backspace characters, which could allow remote attackers to bypass authentication and gain access to arbitr… | |
CVE-2004-1481 | | 2004-12-31 | Integer overflow in pnen3260.dll in RealPlayer 8 through 10.5 (6.0.12.1040) and earlier, and RealOne Player 1 or 2 on Windows or Mac OS, allows remote attacker… | |
CVE-2004-1480 | | 2004-12-31 | Unknown vulnerability in the management station in HP StorageWorks Command View XP 1.8B and earlier allows remote attackers to bypass access restrictions. | |
CVE-2004-1478 | | 2004-12-31 | JRun 4.0 does not properly generate and handle the JSESSIONID, which allows remote attackers to perform a session fixation attack and hijack a user's HTTP sess… | |
CVE-2004-1477 | | 2004-12-31 | Cross-site scripting (XSS) vulnerability in the Management Console in JRun 4.0 allows remote attackers to execute arbitrary web script or HTML and possibly hij… | |
CVE-2004-1476 | | 2004-12-31 | Stack-based buffer overflow in the VideoCD (VCD) code in xine-lib 1-rc2 through 1-rc5, as derived from libcdio, allows attackers to execute arbitrary code via… | |
CVE-2004-1475 | | 2004-12-31 | Multiple stack-based buffer overflows in xine-lib 1-rc2 through 1-rc5 allow attackers to execute arbitrary code via (1) long VideoCD vcd:// MRLs or (2) long su… | |
CVE-2004-1474 | | 2004-12-31 | Symantec Enterprise Firewall/VPN Appliances 100, 200, and 200R running firmware before 1.63 and Gateway Security 320, 360, and 360R running firmware before 622… | |
CVE-2004-1473 | | 2004-12-31 | Symantec Enterprise Firewall/VPN Appliances 100, 200, and 200R running firmware before 1.63 and Gateway Security 320, 360, and 360R running firmware before 622… | |
CVE-2004-1472 | | 2004-12-31 | Symantec Enterprise Firewall/VPN Appliances 100, 200, and 200R running firmware before 1.63 allow remote attackers to cause a denial of service (device freeze)… | |
CVE-2004-1471 | | 2004-12-31 | Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a… | |
CVE-2004-1470 | | 2004-12-31 | CRLF injection vulnerability in SnipSnap 0.5.2a, and other versions before 1.0b1, allows remote attackers to perform HTTP Response Splitting attacks to modify… | |
CVE-2004-1469 | | 2004-12-31 | Format string vulnerability in the log function in SUS 2.0.2, and other versions before 2.0.6, allows local users to execute arbitrary code via format string s… | |
CVE-2004-1468 | | 2004-12-31 | The web mail functionality in Usermin 1.x and Webmin 1.x allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail message. | |
CVE-2004-1467 | | 2004-12-31 | Multiple cross-site scripting (XSS) vulnerabilities in eGroupWare 1.0.00.003 and earlier allow remote attackers to inject arbitrary web script or HTML via (1)… | |
CVE-2004-1466 | | 2004-12-31 | The set_time_limit function in Gallery before 1.4.4_p2 deletes non-image files in a temporary directory every 30 seconds after they have been uploaded using sa… | |
CVE-2004-1465 | | 2004-12-31 | Multiple buffer overflows in WinZip 9.0 and earlier may allow attackers to execute arbitrary code via multiple vectors, including the command line. | |
CVE-2004-1464 | Medium | 5.9 | 2004-12-31 | Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection… |
CVE-2004-1463 | | 2004-12-31 | Unknown vulnerability in the PageEditor in MoinMoin 1.2.2 and earlier, related to Access Control Lists (ACL), has unknown impact. | |
CVE-2004-1462 | | 2004-12-31 | Unknown vulnerability in MoinMoin 1.2.2 and earlier allows remote attackers to gain unauthorized access to administrator functions such as (1) revert and (2) d… | |
CVE-2004-1461 | | 2004-12-31 | Cisco Secure Access Control Server (ACS) 3.2(3) and earlier spawns a separate unauthenticated TCP connection on a random port when a user authenticates to the… | |
CVE-2004-1460 | | 2004-12-31 | Cisco Secure Access Control Server (ACS) 3.2(3) and earlier, when configured with an anonymous bind in Novell Directory Services (NDS) and authenticating NDS u… | |
CVE-2004-1459 | | 2004-12-31 | Cisco Secure Access Control Server (ACS) 3.2, when configured as a Light Extensible Authentication Protocol (LEAP) RADIUS proxy, allows remote attackers to cau… | |
CVE-2004-1458 | | 2004-12-31 | The CSAdmin web administration interface for Cisco Secure Access Control Server (ACS) 3.2(2) build 15 allows remote attackers to cause a denial of service (han… | |
CVE-2004-1457 | | 2004-12-31 | The Virtual Private Network (VPN) capability in Novell Bordermanager 3.8 allows remote attackers to cause a denial of service (ABEND in IKE.NLM) via a malforme… | |
CVE-2004-1456 | | 2004-12-31 | filediff in CVStrac allows remote attackers to execute arbitrary commands via shell metacharacters in rcsinfo. | |
CVE-2004-1455 | | 2004-12-31 | Stack-based buffer overflow in Xine-lib-rc5 in xine-lib 1_rc5-r2 and earlier allows remote attackers to execute arbitrary code via crafted playlists that resul… | |
CVE-2004-1454 | | 2004-12-31 | Cisco IOS 12.0S, 12.2, and 12.3, with Open Shortest Path First (OSPF) enabled, allows remote attackers to cause a denial of service (device reload) via a malfo… |