Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2004-1603
cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled.
Affected Products: n/a
References: [{'name': 'cpanel-htaccess-modify-ownership(17780)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17780'}, {'name': '20041018 cPanel hardlink backup issue', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109811572123753&w=2'}, {'name': 'cpanel-backup-view-file(17779)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17779'}, {'name': '20041018 cPanel hardlink chown issue', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109811654104208&w=2'}, {'name': '11455', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11455'}, {'name': '12865', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12865'}, {'name': '11449', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11449'}]
CVE State: PUBLISHED
Explain CVE-2004-1604
cPanel 9.9.1-RELEASE-3 allows remote authenticated users to chmod arbitrary files via a symlink attack on the _private directory, which is created when Front Page extensions are enabled.
Affected Products: n/a
References: [{'name': '20041018 cPanel symlink chmod issue', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109811762230326&w=2'}]
CVE State: PUBLISHED
Explain CVE-2004-1605
SalesLogix 6.1 allows remote attackers to bypass authentication by modifying the slxweb cookie to set user=Admin, teams=ADMIN!, and usertype=Administrator.
Affected Products: n/a
References: [{'name': '12883', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12883'}, {'name': '20041018 Multiple vulnerabilities in Sage Saleslogix', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109811852218478&w=2'}, {'name': '1011769', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011769'}, {'name': 'saleslogix-cookie-admin-access(17749)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17749'}, {'name': '11450', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11450'}, {'name': '20041018 Multiple vulnerabilities in Sage Saleslogix', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2004-10/0661.html'}, {'name': '10942', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/10942'}]
CVE State: PUBLISHED
Explain CVE-2004-1606
slxweb.dll in SalesLogix 6.1 allows remote attackers to cause a denial service (application crash) via an invalid HTTP request, which might also leak sensitive information in the ErrorLogMsg cookie.
Affected Products: n/a
References: [{'name': 'saleslogix-info-disclosure(17750)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17750'}, {'name': '10943', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/10943'}, {'name': '12883', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12883'}, {'name': '20041018 Multiple vulnerabilities in Sage Saleslogix', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109811852218478&w=2'}, {'name': '1011769', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011769'}, {'name': '11450', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11450'}, {'name': '20041018 Multiple vulnerabilities in Sage Saleslogix', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2004-10/0661.html'}]
CVE State: PUBLISHED
Explain CVE-2004-1607
slxweb.dll in SalesLogix 6.1 allows remote attackers to obtain sensitive information via a (1) Library or (2) Attachment request with an invalid file parameter, which reveals the path in an error message.
Affected Products: n/a
References: [{'name': '12883', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12883'}, {'name': '20041018 Multiple vulnerabilities in Sage Saleslogix', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109811852218478&w=2'}, {'name': '10944', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/10944'}, {'name': '1011769', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011769'}, {'name': 'saleslogix-filename-path-disclosure(17751)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17751'}, {'name': '11450', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11450'}, {'name': '20041018 Multiple vulnerabilities in Sage Saleslogix', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2004-10/0661.html'}]
CVE State: PUBLISHED
Explain CVE-2004-1608
SQL injection vulnerability in SalesLogix 6.1 allows remote attackers to execute arbitrary SQL statements via the id parameter in a view operation.
Affected Products: n/a
References: [{'name': 'saleslogix-sql-injection(17752)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17752'}, {'name': '10945', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/10945'}, {'name': '12883', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12883'}, {'name': '20041018 Multiple vulnerabilities in Sage Saleslogix', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109811852218478&w=2'}, {'name': '1011769', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011769'}, {'name': '11450', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11450'}, {'name': '20041018 Multiple vulnerabilities in Sage Saleslogix', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2004-10/0661.html'}]
CVE State: PUBLISHED
Explain CVE-2004-1609
SalesLogix 6.1 includes usernames, passwords, and other sensitive information in the headers of an HTTP response, which could allow remote attackers to gain access.
Affected Products: n/a
References: [{'name': '10946', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/10946'}, {'name': '12883', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12883'}, {'name': '20041018 Multiple vulnerabilities in Sage Saleslogix', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109811852218478&w=2'}, {'name': '1011769', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011769'}, {'name': '11450', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11450'}, {'name': '20041018 Multiple vulnerabilities in Sage Saleslogix', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2004-10/0661.html'}, {'name': 'saleslogix-obtain-passwords(17753)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17753'}]
CVE State: PUBLISHED
Explain CVE-2004-1610
SalesLogix 6.1 uses client-specified pathnames for writing certain files, which might allow remote authenticated users to create arbitrary files and execute code via the (1) vMME.AttachmentPath or (2) vMME.LibraryPath variables.
Affected Products: n/a
References: [{'name': '20041018 Multiple vulnerabilities in Sage Saleslogix', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109811852218478&w=2'}]
CVE State: PUBLISHED
Explain CVE-2004-1611
SalesLogix 6.1 does not verify if a user is authenticated before performing sensitive operations, which could allow remote attackers to (1) execute arbitrary SLX commands on the server or spoof the server via a man-in-the-middle (MITM) attack, or (2) obtain the database password via a GetConnection request to TCP port 1707.
Affected Products: n/a
References: [{'name': '12883', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12883'}, {'name': '20041018 Multiple vulnerabilities in Sage Saleslogix', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109811852218478&w=2'}, {'name': '10948', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/10948'}, {'name': '10947', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/10947'}, {'name': '1011769', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011769'}, {'name': '11450', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11450'}, {'name': 'saleslogix-getconnection-account-disclosure(17754)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17754'}, {'name': '20041018 Multiple vulnerabilities in Sage Saleslogix', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2004-10/0661.html'}]
CVE State: PUBLISHED
Explain CVE-2004-1612
Directory traversal vulnerability in SalesLogix 6.1 allows remote attackers to upload arbitrary files via a .. (dot dot) in a ProcessQueueFile request.
Affected Products: n/a
References: [{'name': '12883', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12883'}, {'name': '10949', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/10949'}, {'name': '20041018 Multiple vulnerabilities in Sage Saleslogix', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109811852218478&w=2'}, {'name': '1011769', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011769'}, {'name': '11450', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11450'}, {'name': '20041018 Multiple vulnerabilities in Sage Saleslogix', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2004-10/0661.html'}, {'name': 'saleslogix-processqueuefile-file-upload(17765)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17765'}]
CVE State: PUBLISHED
Explain CVE-2004-1613
Mozilla allows remote attackers to cause a denial of service (application crash from null dereference or infinite loop) via a web page that contains a (1) TEXTAREA, (2) INPUT, (3) FRAMESET or (4) IMG tag followed by a null character and some trailing characters, as demonstrated by mangleme.
Affected Products: n/a
References: [{'name': '20041018 Web browsers - a mini-farce', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109811406620511&w=2'}, {'name': '11439', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11439'}, {'name': 'RHSA-2005:323', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-323.html'}, {'name': 'mozilla-html-tags-dos(17805)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17805'}, {'name': 'oval:org.mitre.oval:def:10227', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10227'}, {'name': '1011810', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011810'}, {'name': '20041018 Web browsers - a mini-farce', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/027709.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lcamtuf.coredump.cx/mangleme/gallery/'}]
CVE State: PUBLISHED
Explain CVE-2004-1614
Mozilla allows remote attackers to cause a denial of service (application crash from invalid memory access) via an "unusual combination of visual elements," including several large MARQUEE tags with large height parameters, as demonstrated by mangleme.
Affected Products: n/a
References: [{'name': '20041018 Web browsers - a mini-farce', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109811406620511&w=2'}, {'name': '1011810', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011810'}, {'name': '20041018 Web browsers - a mini-farce', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/027709.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lcamtuf.coredump.cx/mangleme/gallery/'}, {'name': '11440', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11440'}]
CVE State: PUBLISHED
Explain CVE-2004-1615
Opera allows remote attackers to cause a denial of service (invalid memory reference and application crash) via a web page or HTML email that contains a TBODY tag with a large COL SPAN value, as demonstrated by mangleme.
Affected Products: n/a
References: [{'name': '20041018 Web browsers - a mini-farce', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109811406620511&w=2'}, {'name': 'opera-colspan-tbody-dos(17806)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17806'}, {'name': '11441', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11441'}, {'name': '20041018 Web browsers - a mini-farce', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/027709.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lcamtuf.coredump.cx/mangleme/gallery/'}]
CVE State: PUBLISHED
Explain CVE-2004-1616
Links allows remote attackers to cause a denial of service (memory consumption) via a web page or HTML email that contains a table with a td element and a large rowspan value,as demonstrated by mangleme.
Affected Products: n/a
References: [{'name': '20041018 Web browsers - a mini-farce', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109811406620511&w=2'}, {'name': '20041018 Web browsers - a mini-farce', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/027709.html'}, {'name': '1011808', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011808'}, {'name': '11442', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11442'}, {'name': 'links-large-table-dos(17803)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17803'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lcamtuf.coredump.cx/mangleme/gallery/'}]
CVE State: PUBLISHED
Explain CVE-2004-1617
Lynx, lynx-ssl, and lynx-cur before 2.8.6dev.8 allow remote attackers to cause a denial of service (infinite loop) via a web page or HTML email that contains invalid HTML including (1) a TEXTAREA tag with a large COLS value and (2) a large tag name in an element that is not terminated, as demonstrated by mangleme.  NOTE: a followup suggests that the relevant trigger for this issue is the large COLS value.
Affected Products: n/a
References: [{'name': '11443', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11443'}, {'name': '20041018 Web browsers - a mini-farce', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109811406620511&w=2'}, {'name': 'DSA-1077', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1077'}, {'name': '1011809', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011809'}, {'name': '20060602 Re: [SECURITY] [DSA 1085-1] New lynx-cur packages fix several vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/435689/30/4740/threaded'}, {'name': 'DSA-1076', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1076'}, {'name': 'DSA-1085', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1085'}, {'name': '20041018 Web browsers - a mini-farce', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/027709.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lcamtuf.coredump.cx/mangleme/gallery/'}, {'name': '20383', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/20383'}, {'name': 'lynx-dos(17804)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17804'}]
CVE State: PUBLISHED
Explain CVE-2004-1618
Vypress Tonecast 1.3 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed mp2 stream.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/toneboom-adv.txt'}, {'name': '20041019 Broadcast crash in Vypress Tonecast 1.3', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109820344806472&w=2'}, {'name': '12890', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12890'}, {'name': 'vypress-tonecast-dos(17775)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17775'}, {'name': '11462', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11462'}]
CVE State: PUBLISHED
Explain CVE-2004-1619
Buffer overflow in Privateer's Bounty: Age of Sail II allows remote attackers to execute arbitrary code via a long nickname.
Affected Products: n/a
References: [{'name': 'age-of-sail-bo(17791)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17791'}, {'name': '12905', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12905'}, {'name': '20041020 Buffer-overflow in Age of Sail II 1.04.151', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109829017407842&w=2'}, {'name': '11479', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11479'}]
CVE State: PUBLISHED
Explain CVE-2004-1620
CRLF injection vulnerability in Serendipity before 0.7rc1 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the url parameter in (1) index.php and (2) exit.php, or (3) the HTTP Referer field in comment.php.
Affected Products: n/a
References: [{'name': '20041021 HTTP Response Splitting in Serendipity 0.7-beta4', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109841283115808&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.s9y.org/5.html'}, {'name': '11497', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11497'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cvs.sourceforge.net/viewcvs.py/php-blog/serendipity/exit.php?rev=1.10&view=markup'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cvs.sourceforge.net/viewcvs.py/php-blog/serendipity/index.php?rev=1.52&view=markup'}, {'name': 'serendipity-response-splitting(17798)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17798'}, {'name': '11039', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/11039'}, {'name': '1011864', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011864'}, {'name': '11038', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/11038'}, {'name': '12909', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12909/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=276694'}, {'name': '11013', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/11013'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cvs.sourceforge.net/viewcvs.py/php-blog/serendipity/comment.php?rev=1.49&view=markup'}]
CVE State: PUBLISHED
Explain CVE-2004-1621
NOTE: this issue has been disputed by the vendor.  Cross-site scripting (XSS) vulnerability in IBM Lotus Notes R6 and Domino R6, and possibly earlier versions, allows remote attackers to execute arbitrary web script or HTML via square brackets at the beginning and end of (1) computed for display, (2) computed when composed, or (3) computed text element fields.  NOTE: the vendor has disputed this issue, saying that it is not a problem with Notes/Domino itself, but with the applications that do not properly handle this feature
Affected Products: n/a
References: [{'name': 'VU#404382', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/404382'}, {'name': 'lotus-notes-xss(17758)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17758'}, {'name': '20041021 Re: IBM Lotus Notes/Domino fails to encode Square Brackets ( [  ] )', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109841682529328&w=2'}, {'name': '12891', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12891'}, {'name': '11458', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11458'}, {'name': '20041018 IBM Lotus Notes/Domino fails to encode Square Brackets ( [  ] )', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109812960023736&w=2'}, {'name': '1011779', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011779'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21187833'}]
CVE State: PUBLISHED
Explain CVE-2004-1622
SQL injection vulnerability in dosearch.php in UBB.threads 3.4.x allows remote attackers to execute arbitrary SQL statements via the Name parameter.
Affected Products: n/a
References: [{'name': '11502', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11502'}, {'name': '20041021 SQL Injection in UBB.threads 3.4.x', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109839925207038&w=2'}, {'name': 'ubbthreads-sql-injection(17821)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17821'}]
CVE State: PUBLISHED
Explain CVE-2004-1623
The WAV file property handler in Windows XP SP1 allows remote attackers to cause a denial of service (infinite loop in Explorer) via a WAV file with an invalid file header whose fmt chunk length is set to 0xFFFFFFFF.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.hexview.com/docs/20041021-1.txt'}, {'name': 'windowsxp-explorer-wav-dos(17864)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17864'}, {'name': '20041021 [HV-LOW] Unsafe WAV header handling can cause DoS on Windows', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109846319313443&w=2'}, {'name': '11503', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11503'}, {'name': '1011880', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011880'}, {'name': '11053', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/11053'}]
CVE State: PUBLISHED
Explain CVE-2004-1624
Carbon Copy 6.0.5257 does not drop system privileges when opening external programs through the help topic interface, which allows local users to gain privileges via (1) the help topic interface in CCW32.exe, which launches Notepad, or (2) the help button in the Carbon Copy Scheduler (CCSched.exe).
Affected Products: n/a
References: [{'name': '20041022 [Fwd: Altiris Carbon Copy Remote Control  local SYSTEM exploitation.]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109846296406459&w=2'}, {'name': '11500', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11500'}, {'name': 'carboncopy-help-gain-privileges(17838)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17838'}, {'name': '12962', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12962'}]
CVE State: PUBLISHED
Explain CVE-2004-1625
pGina 1.7.6 and possibly older versions, when the Restart or Shutdown options are enabled on the login screen, allows remote attackers to cause a denial of service by connecting via Remote Desktop and clicking restart or shutdown.
Affected Products: n/a
References: [{'name': 'pgina-dos(17836)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17836'}, {'name': '20041022 Windows DoS in certain pGina configurations', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109849689808245&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.lovebug.org/pgina_dos.txt'}]
CVE State: PUBLISHED
Explain CVE-2004-1626
Buffer overflow in Ability Server 2.34, and possibly other versions, allows remote attackers to execute arbitrary code via a long STOR command.
Affected Products: n/a
References: [{'name': 'abilityftpserver-stor-dos(17823)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17823'}, {'name': 'VU#857846', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/857846'}, {'name': '20041022 Ability FTP Server 2.34 Buffer Overflow Exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109850947508816&w=2'}, {'name': '11030', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/11030'}, {'name': '12941', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12941'}, {'name': '11508', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11508'}]
CVE State: PUBLISHED
Explain CVE-2004-1627
Buffer overflow in Ability Server 2.25, 2.32, 2.34, and possibly other versions, allows remote attackers to execute arbitrary code via a long APPE command.
Affected Products: n/a
References: [{'name': '12347', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/12347'}, {'name': 'ability-appe-bo(18405)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/18405'}, {'name': "[0day] 20041208 Ability Server 2.25 - 2.34 FTP => 'APPE' Buffer Overflow - PnK:: DCN3T", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.virus.org/dw-0day-0412/msg00004.html'}, {'name': '12941', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12941'}, {'name': '1012464', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1012464'}, {'name': '11508', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11508'}]
CVE State: PUBLISHED
Explain CVE-2004-1628
Format string vulnerability in log.c in rssh before 2.2.2 allows remote authenticated users to execute arbitrary code.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.pizzashack.org/rssh/'}, {'name': 'GLSA-200410-28', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200410-28.xml'}, {'name': '20041023 rssh: pizzacode security alert', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109855982425122&w=2'}, {'name': 'rssh-format-string(17831)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17831'}, {'name': '12954', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12954'}]
CVE State: PUBLISHED
Explain CVE-2004-1629
Multiple SQL injection vulnerabilities in Dwc_articles 1.6 and earlier allow remote attackers to execute arbitrary SQL statements.
Affected Products: n/a
References: [{'name': 'dwc-articles-sql-injection(17830)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17830'}, {'name': '20041023 dwc_articles possible sql injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109855895702903&w=2'}, {'name': '11509', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11509'}]
CVE State: PUBLISHED
Explain CVE-2004-1630
Cross-site scripting (XSS) vulnerability in the login form in Open WorkFlow Engine (OpenWFE) 1.4.x allows remote attackers to execute arbitrary web script or HTML via the url parameter.
Affected Products: n/a
References: [{'name': '11514', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11514'}, {'name': '12970', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12970'}, {'name': '20041024 Two Vulnerabilities in OpenWFE Web Client', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109876304705234&w=2'}, {'name': 'openwfe-login-form-xss(17853)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17853'}]
CVE State: PUBLISHED
Explain CVE-2004-1631
Open WorkFlow Engine (OpenWFE) 1.4.x allows remote attackers to conduct port scans of remote hosts by specifying the target in an rmi:// Worklist URL, then using the response times to infer the results.
Affected Products: n/a
References: [{'name': '11514', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11514'}, {'name': 'openwfe-rmi-obtain-information(17852)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17852'}, {'name': '12970', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12970'}, {'name': '20041024 Two Vulnerabilities in OpenWFE Web Client', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109876304705234&w=2'}]
CVE State: PUBLISHED
Explain CVE-2004-1632
Cross-site scripting (XSS) vulnerability in wiki.php in MoniWiki 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the arguments to wiki.php.
Affected Products: n/a
References: [{'name': '12975', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12975'}, {'name': 'moniwiki-wiki-xss(17835)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17835'}, {'name': '20041025 STG Security Advisory: [SSA-20041022-08] MoniWiki XSS vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109873622006103&w=2'}, {'name': '11516', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11516'}]
CVE State: PUBLISHED
Explain CVE-2004-1633
process_bug.cgi in Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS does not check edit permissions on the keywords field, which allows remote authenticated users to modify the keywords in a bug via the keywordaction parameter.
Affected Products: n/a
References: [{'name': '20041025 [BUGZILLA] Vulnerabilities in Bugzilla 2.16.6 and 2.18rc2', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109872095201238&w=2'}, {'name': 'bugzilla-bug-change(17840)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17840'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=252638'}]
CVE State: PUBLISHED
Explain CVE-2004-1634
show_bug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows comments and attachment summaries which are marked as private, which allows remote attackers to gain sensitive information.
Affected Products: n/a
References: [{'name': '20041025 [BUGZILLA] Vulnerabilities in Bugzilla 2.16.6 and 2.18rc2', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109872095201238&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=263780'}, {'name': 'bugzilla-xml-information-disclosure(17841)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17841'}, {'name': '11511', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11511'}]
CVE State: PUBLISHED
Explain CVE-2004-1635
Bugzilla 2.17.1 through 2.18rc2 and 2.19 from cvs, when using the insidergroup feature, does not sufficiently protect private attachments when there are changes to the metadata, such as filename, description, MIME type, or review flags, which allows remote authenticated users to obtain sensitive information when (1) viewing the bug activity log or (2) receiving bug change notification mails.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=253544'}, {'name': '20041025 [BUGZILLA] Vulnerabilities in Bugzilla 2.16.6 and 2.18rc2', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109872095201238&w=2'}, {'name': 'bugzila-metadata-information-disclosure(17842)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17842'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=250605'}, {'name': '11511', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11511'}]
CVE State: PUBLISHED
Explain CVE-2004-1636
Heap-based buffer overflow in the WvTFTPServer::new_connection function in wvtftpserver.cc for WvTftp 0.9 allows remote attackers to execute arbitrary code via a long option string in a TFTP packet.
Affected Products: n/a
References: [{'name': '20041026 wvtfpd remote root heap overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109885074513940&w=2'}, {'name': 'wvtfpd-wvtftpservercc-bo(17869)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17869'}, {'name': '11525', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11525'}, {'name': '12986', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12986'}]
CVE State: PUBLISHED
Explain CVE-2004-1637
The Hawking Technologies HAR11A modem/router allows remote attackers to obtain sensitive information by connecting to port 254, which displays a management interface and information on established connections.
Affected Products: n/a
References: [{'name': 'har11a-gain-unauth-access(17877)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17877'}, {'name': '20041026 Hawking Technologies HAR11A router considered insecure', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109882884617886&w=2'}, {'name': '11543', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11543'}]
CVE State: PUBLISHED
Explain CVE-2004-1638
Buffer overflow in MailCarrier 2.51 allows remote attackers to execute arbitrary code via a long (1) EHLO and possibly (2) HELO command.
Affected Products: n/a
References: [{'name': '20041026 MailCarrier 2.51 SMTP server Buffer Overflow [PoC included]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109880961630050&w=2'}, {'name': 'mailcarrier-ehlo-helo-bo(17861)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17861'}, {'name': '12999', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12999'}, {'name': '11535', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11535'}]
CVE State: PUBLISHED
Explain CVE-2004-1639
Mozilla Firefox before 0.10, Mozilla 5.0, and Gecko 20040913 allows remote attackers to cause a denial of service (application crash or memory consumption) via a large binary file with a .html extension.
Affected Products: n/a
References: [{'name': '20041026 Rendering large binary file as HTML makes Mozilla Firefox stop responding or crash', 'tags': ['mailing-list', 'x_refsource_VULNWATCH'], 'url': 'http://archives.neohapsis.com/archives/vulnwatch/2004-q4/0017.html'}, {'name': '20041026 Rendering large binary file as HTML makes Mozilla Firefox stop responding', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109886388528179&w=2'}, {'name': 'mozilla-html-dos(17839)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17839'}]
CVE State: PUBLISHED
Explain CVE-2004-1640
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 0.94 and 1.0 allow remote attackers to execute arbitrary web script and HTML via the (1) terme parameter to search.php or (2) letter parameter to letter.php.
Affected Products: n/a
References: [{'name': 'xoops-dictionary-letter-xss(17154)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17154'}, {'name': '9394', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/9394'}, {'tags': ['x_refsource_MISC'], 'url': 'http://cyruxnet.org/modulo_dic_xoops.htm'}, {'name': '11064', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11064'}, {'name': '20040828 Cross Site Scripting in XOOPS Version 2.x Dictionary module', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109394077209963&w=2'}, {'name': 'xoops-dictionary-search-xss(17152)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17152'}, {'name': '12424', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12424'}, {'name': '9393', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/9393'}]
CVE State: PUBLISHED
Explain CVE-2004-1641
Heap-based buffer overflow in Titan FTP 3.21 and earlier allows remote attackers to cause a denial of service (crash) via a long FTP command such as (1) CWD, (2) STAT, or (3) LIST.
Affected Products: n/a
References: [{'name': 'titan-long-command-bo(17172)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17172'}, {'name': '11069', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11069'}, {'name': '20040829 [vulnwatch] Titan FTP Server Long Command Heap Overflow Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109396159332523&w=2'}, {'name': '12419', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12419'}]
CVE State: PUBLISHED
Explain CVE-2004-1642
WFTPD Pro Server 3.21 allows remote authenticated users to cause a denial of service (crash) via a series of long MLIST commands.
Affected Products: n/a
References: [{'name': 'wftpd-mlst-command-dos(17169)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17169'}, {'name': '12420', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12420'}, {'name': '20040829 [vulnwatch] WFTPD Pro Server 3.21 MLST Command Denial of Service Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109396193723317&w=2'}, {'name': '11067', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11067'}]
CVE State: PUBLISHED
Explain CVE-2004-1643
WS_FTP 5.0.2 allows remote authenticated users to cause a denial of service (CPU consumption) via a CD command that contains an invalid path with a "../" sequence.
Affected Products: n/a
References: [{'name': '12406', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12406'}, {'name': '11065', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11065'}, {'name': 'wsftp-file-parsing-dos(17155)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17155'}, {'name': '20040829 [vulnwatch] WS_FTP Server Denial of Service Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109389890712888&w=2'}]
CVE State: PUBLISHED
Explain CVE-2004-1644
Xedus 1.0 allows remote attackers to cause a denial of service (refuse connections) by connecting multiple times from the same IP address.
Affected Products: n/a
References: [{'name': '20040830 Multiple Vulnerabilities In Xedus Webserver', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109394018411394&w=2'}, {'name': 'xedus-mult-connection-dos(17165)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17165'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gulftech.org/?node=research&article_id=00047-08302004'}, {'name': '12418', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12418'}, {'name': '11071', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11071'}]
CVE State: PUBLISHED
Explain CVE-2004-1645
Cross-site scripting (XSS) vulnerability in Xedus 1.0 allows remote attackers to execute arbitrary web script or HTML via the (1) username parameter to test.x, (2) username parameter to TestServer.x, or (3) param parameter to testgetrequest.x.
Affected Products: n/a
References: [{'name': '20040830 Multiple Vulnerabilities In Xedus Webserver', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109394018411394&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gulftech.org/?node=research&article_id=00047-08302004'}, {'name': 'xedus-test-xss(17166)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17166'}, {'name': '12418', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12418'}, {'name': '11071', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11071'}]
CVE State: PUBLISHED
Explain CVE-2004-1646
Directory traversal vulnerability in Xedus 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
Affected Products: n/a
References: [{'name': '20040830 Multiple Vulnerabilities In Xedus Webserver', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109394018411394&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gulftech.org/?node=research&article_id=00047-08302004'}, {'name': 'xedus-dotdot-directory-traversal(17167)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17167'}, {'name': '12418', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12418'}, {'name': '11071', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11071'}]
CVE State: PUBLISHED
Explain CVE-2004-1647
SQL injection vulnerability in Password Protect allows remote attackers to execute arbitrary SQL statements and bypass authentication via (1) admin or Pass parameter to index_next.asp, (2) LoginId, OPass, or NPass to CPassChangePassword.asp, (3) users_edit.asp, or (4) users_add.asp.
Affected Products: n/a
References: [{'name': '11073', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11073'}, {'name': '20040830 Password Protect XSS and SQL-Injection vulnerabilities.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109414967003192&w=2'}, {'name': 'password-protect-sql-injection(17188)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17188'}, {'name': '12407', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12407'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.criolabs.net/advisories/passprotect.txt'}]
CVE State: PUBLISHED
Explain CVE-2004-1648
Cross-site scripting (XSS) vulnerability in (1) index.asp, (2) ChangePassword.asp, (3) users_list.asp, (4) and users_add.asp in Password Protect allows remote attackers to inject arbitrary web script or HTML via the ShowMsg parameter.
Affected Products: n/a
References: [{'name': 'password-protect-showmsg-xss(17187)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17187'}, {'name': '11073', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11073'}, {'name': '20040830 Password Protect XSS and SQL-Injection vulnerabilities.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109414967003192&w=2'}, {'name': '12407', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12407'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.criolabs.net/advisories/passprotect.txt'}]
CVE State: PUBLISHED
Explain CVE-2004-1649
Buffer overflow in Microsoft Msinfo32.exe might allow local users to execute arbitrary code via a long filename in the msinfo_file command line parameter.  NOTE: this issue might not cross security boundaries, so it may be REJECTED in the future.
Affected Products: n/a
References: [{'name': 'msinfo-msinfofile-bo(17153)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17153'}, {'name': '20040831 MSInfo  Buffer Overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109413415205017&w=2'}, {'name': '20040830 MSInfo  Buffer Overflow', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=109391133831787&w=2'}, {'name': '20040830 MSInfo  Buffer Overflow', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2004-August/025902.html'}]
CVE State: PUBLISHED
Explain CVE-2004-1650
D-Link DCS-900 Internet Camera listens on UDP port 62976 for an IP address, which allows remote attackers to change the IP address of the camera via a UDP broadcast packet.
Affected Products: n/a
References: [{'name': '1011100', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011100'}, {'name': '11072', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11072'}, {'name': '20040831 D-Link DCS-900 IP camera remote exploit that change the IP', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109396893820049&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://miscname.com/public/dcs-900/'}, {'name': '12425', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12425'}, {'name': 'dlink-dcs900-ip-modification(17171)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17171'}]
CVE State: PUBLISHED