Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2004-1651
Multiple cross-site scripting (XSS) vulnerabilities in the registration page in phpScheduleIt 1.0.0 RC1 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Lastname fields during new user registration, or (3) the Schedule Name field.
Affected Products: n/a
References: [{'name': '9451', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/9451'}, {'name': 'phpscheduleit-script-injection(17194)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17194'}, {'name': '20040917 Re: Multiple Vulnerabilities in phpScheduleIt', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2004-09/0216.html'}, {'name': '20040831 Multiple Vulnerabilities in phpScheduleIt', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109399590602709&w=2'}, {'name': 'phpscheduleit-xss(17193)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17193'}, {'name': '11080', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11080'}, {'name': '1011127', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011127'}]
CVE State: PUBLISHED
Explain CVE-2004-1652
phpScheduleIt 1.0.0 RC1 does not clear administrative privileges if the administrator logs in as a normal user, which allows users with physical access to gain administrative privileges.
Affected Products: n/a
References: [{'name': '20040831 Multiple Vulnerabilities in phpScheduleIt', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109399590602709&w=2'}, {'name': 'phpscheduleit-gain-privileges(17195)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17195'}]
CVE State: PUBLISHED
Explain CVE-2004-1653
The default configuration for OpenSSH enables AllowTcpForwarding, which could allow remote authenticated users to perform a port bounce, when configured with an anonymous access program such as AnonCVS.
Affected Products: n/a
References: [{'name': '20040831 SSHD / AnonCVS Nastyness', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109413637313484&w=2'}, {'name': 'openssh-port-bounce(17213)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17213'}, {'name': '1011143', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011143'}, {'name': '9562', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/9562'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20191107-0001/'}]
CVE State: PUBLISHED
Explain CVE-2004-1654
SQL injection vulnerability in the calendar module in phpWebsite 0.9.3-4 and earlier allows remote attackers to execute arbitrary SQL commands via cal_template.
Affected Products: n/a
References: [{'name': '20040901 Multiple Vulnerabilities In phpWebsite', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109413493005513&w=2'}, {'name': 'phpwebsite-calendar-module-sql-injection(17199)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17199'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gulftech.org/?node=research&article_id=00048-08312004'}, {'name': '11088', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11088'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.phpwebsite.appstate.edu/index.php?module=announce&ANN_user_op=view&ANN_id=822'}, {'name': '12438', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12438'}]
CVE State: PUBLISHED
Explain CVE-2004-1655
Cross-site scripting (XSS) vulnerability in phpWebsite 0.9.3-4 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) CM_pid parameter in the comments module or (2) the subject or message fields in the notes module.
Affected Products: n/a
References: [{'name': '20040901 Multiple Vulnerabilities In phpWebsite', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109413493005513&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gulftech.org/?node=research&article_id=00048-08312004'}, {'name': '11088', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11088'}, {'name': '1011120', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011120'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.phpwebsite.appstate.edu/index.php?module=announce&ANN_user_op=view&ANN_id=822'}, {'name': 'phpwebsite-notes-script-injection(17203)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17203'}, {'name': 'phpwebsite-comments-module-xss(17202)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17202'}, {'name': '12438', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12438'}]
CVE State: PUBLISHED
Explain CVE-2004-1656
CRLF injection vulnerability in Comersus Shopping Cart 5.0991 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the redirecturl parameter.
Affected Products: n/a
References: [{'name': '20040901 ADVISORY: http response splitting hole in Comersus shopping cart', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109405777905519&w=2'}, {'name': 'comersus-cart-response-splitting(17201)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17201'}, {'name': '11083', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11083'}]
CVE State: PUBLISHED
Explain CVE-2004-1657
Cross-site scripting (XSS) vulnerability in the Activity and Events Viewer for Newtelligence DasBlog allows remote attackers to inject arbitrary web script or HTML via the (1) User Agent or (2) Referrer HTTP headers.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://staff.newtelligence.net/clemensv/PermaLink.aspx?guid=69bce168-cb09-4f09-8d53-f0b97f11b198'}, {'name': 'dasblog-useragent-referer-xss(17174)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17174'}, {'name': '12416', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12416'}, {'name': '20040901 Cross-Site Scripting Vulnerability in Newtelligence DasBlog', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109443321830050&w=2'}, {'name': '11086', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11086'}]
CVE State: PUBLISHED
Explain CVE-2004-1658
Kerio Personal Firewall 4.0 (KPF4) allows local users with administrative privileges to bypass the Application Security feature and execute arbitrary processes by directly writing to \device\physicalmemory to restore the running kernel's SDT ServiceTable.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.security.org.sg/vuln/kerio4016.html'}, {'name': 'kerio-pf-protection-dos(17270)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17270'}, {'name': '11096', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11096'}, {'name': '12468', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12468/'}, {'name': "20040902 Kerio Personal Firewall's Application Launch Protection Can Be Disabled by Direct Service Table Restoration", 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109420310631039&w=2'}]
CVE State: PUBLISHED
Explain CVE-2004-1659
Cross-site scripting (XSS) vulnerability in index.php in CuteNews 1.3.6 and earlier allows remote attackers with Administrator, Editor, Journalist or Commenter privileges to inject arbitrary web script or HTML via the mod parameter.
Affected Products: n/a
References: [{'name': '12432', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12432'}, {'name': '11097', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11097'}, {'name': '20040902 [hackgen-2004-#001] - Non-critacal Cross-Site Scripting bug in CuteNews', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109415338521881&w=2'}, {'name': 'cutenews-mod-xss(17214)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17214'}]
CVE State: PUBLISHED
Explain CVE-2004-1660
PHP remote file inclusion vulnerability in CuteNews 1.3.6 and earlier allows remote attackers to execute arbitrary PHP code via the cutepath parameter to (1) show_archives.php or (2) show_news.php.
Affected Products: n/a
References: [{'name': '12432', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12432'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.7a69ezine.org/node/view/130'}, {'name': '20040830 RE: CuteNews News.txt writable to world', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://seclists.org/lists/bugtraq/2004/Sep/0014.html'}, {'name': 'cutenews-file-include(17288)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17288'}]
CVE State: PUBLISHED
Explain CVE-2004-1661
MailWorks Professional allows remote attackers to bypass authentication and gain privileges via a cookie that contains "auth=1" and "uId=1."
Affected Products: n/a
References: [{'name': '11095', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11095'}, {'name': '12458', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12458'}, {'name': 'mailworks-cookie-admin-access(17217)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17217'}, {'name': '20040902 MailWorks Professional - Authentication bypass', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109416709710447&w=2'}]
CVE State: PUBLISHED
Explain CVE-2004-1662
YaBB SE 1.5.1 allows remote attackers to obtain sensitive information via a direct HTTP request to Admin.php, which reveals the full path in a PHP error message.
Affected Products: n/a
References: [{'name': '20040904 FUll Path Disclosure in YABBSE', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109441750900432&w=2'}, {'name': 'yabb-admin-path-disclosure(17267)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17267'}, {'tags': ['x_refsource_MISC'], 'url': 'http://echo.or.id/adv/adv05-y3dips-2004.txt'}]
CVE State: PUBLISHED
Explain CVE-2004-1663
Engenio/LSI Logic storage controllers, as used in products such as Storagetek D280, and IBM DS4100 (formerly FastT 100) and Brocade SilkWorm Switches, allow remote attackers to cause a denial of service (freeze and possible data corruption) via crafted TCP packets.
Affected Products: n/a
References: [{'name': '12464', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12464'}, {'name': '11108', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11108'}, {'name': '20040904 Engenio/LSI Logic controllers denial of service/data corruption', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109435831811484&w=2'}, {'name': 'engenio-controller-tcp-dos(17290)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17290'}]
CVE State: PUBLISHED
Explain CVE-2004-1664
Call of Duty 1.4 and earlier allows remote attackers to cause a denial of service (game end) via a large (1) query or (2) reply packet, which is not properly handled by the buffer overflow protection mechanism. NOTE: this issue might overlap CVE-2005-0430.
Affected Products: n/a
References: [{'name': '20040905 Broadcast shutdown in Call of Duty 1.4', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109449953200587&w=2'}, {'name': 'callofduty-dos(17286)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17286'}, {'name': '11119', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11119'}]
CVE State: PUBLISHED
Explain CVE-2004-1665
Cross-site scripting (XSS) vulnerability in index.php in PsNews 1.1 allows remote attackers to inject arbitrary web script or HTML via the no parameter.
Affected Products: n/a
References: [{'name': '11124', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11124'}, {'name': '1011191', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011191'}, {'name': 'psnews-xss(17302)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17302'}, {'name': '20040905 Bug XSS in PsNews 1.1', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109458516524494&w=2'}]
CVE State: PUBLISHED
Explain CVE-2004-1666
Buffer overflow in the MSN module in Trillian 0.74i allows remote MSN servers to execute arbitrary code via a long string that ends in a newline character.
Affected Products: n/a
References: [{'name': 'trillian-msn-bo(17292)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17292'}, {'name': '11142', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11142'}, {'tags': ['x_refsource_MISC'], 'url': 'http://unsecure.altervista.org/security/trillian.htm'}, {'name': '20040908 Cerulean Studios Trillian 0.74i Buffer Overflow in MSN module exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109466618609375&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://unsecure.altervista.org/security/trillianbof.c'}, {'name': '12487', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12487'}]
CVE State: PUBLISHED
Explain CVE-2004-1667
Off-by-one error in Halo Combat Evolved 1.04 and earlier allows remote attackers to cause a denial of service (server crash) via a long client response.
Affected Products: n/a
References: [{'name': '12504', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12504'}, {'tags': ['x_refsource_MISC'], 'url': 'http://aluigi.altervista.org/adv/haloboom-adv.txt'}, {'name': '11147', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11147'}, {'name': '20040909 Off-by-one bug in Halo 1.04', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109479695022024&w=2'}, {'name': 'halo-response-offbyone-bo(17310)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17310'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.bungie.net/News/Story.aspx?link=hpc105'}]
CVE State: PUBLISHED
Explain CVE-2004-1668
Multiple SQL injection vulnerabilities in index.php in Subjects 2.0 Postnuke module allow remote attackers to execute arbitrary SQL commands via the (1) pageid, (2) subid, or (3) catid parameters.
Affected Products: n/a
References: [{'name': '11148', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11148'}, {'name': 'subjects-indexphp-sql-injection(17311)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17311'}, {'name': '20040910 SQL-Injection in Subjects 2.0 for Postnuke', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109483089621955&w=2'}, {'name': '12497', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12497'}]
CVE State: PUBLISHED
Explain CVE-2004-1669
Cross-site scripting (XSS) vulnerability in MERAK Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to execute arbitrary web script or HTML via the (1) User name parameter to accountsettings.html or (2) Search string parameter to search.html.
Affected Products: n/a
References: [{'name': 'merak-icewarp-xss(17313)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17313'}, {'name': '20040910 Multiple vulnerabilities in Icewarp Web Mail 5.2.7', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109483971420067&w=2'}, {'name': '12789', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12789'}, {'name': '11371', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11371'}]
CVE State: PUBLISHED
Explain CVE-2004-1670
Multiple directory traversal vulnerabilities Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7, and possibly other versions, allow remote attackers to (1) create arbitrary directories via a .. (dot dot) in the user parameter to viewaction.html or (2) rename arbitrary files via a ....// (doubled dot dot) in the folderold or folder parameters to folders.html.
Affected Products: n/a
References: [{'name': '20040910 Multiple vulnerabilities in Icewarp Web Mail 5.2.7', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109483971420067&w=2'}, {'name': '12789', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12789'}, {'name': '11371', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11371'}, {'name': 'merak-icewarp-create-directory(17314)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17314'}]
CVE State: PUBLISHED
Explain CVE-2004-1671
Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to gain sensitive information via a direct request to (1) accountsettings_add.html or (2) topmenu.html.
Affected Products: n/a
References: [{'name': '20040910 Multiple vulnerabilities in Icewarp Web Mail 5.2.7', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109483971420067&w=2'}, {'name': '12789', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12789'}, {'name': 'merak-icewarp-path-disclosure(17315)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17315'}, {'name': '11371', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11371'}]
CVE State: PUBLISHED
Explain CVE-2004-1672
attachment.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to view other users' attachments by specifying the username and message ID in an HTTP request.
Affected Products: n/a
References: [{'name': 'merak-icewarp-view-attachment(17316)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17316'}, {'name': '20040910 Multiple vulnerabilities in Icewarp Web Mail 5.2.7', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109483971420067&w=2'}, {'name': '12789', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12789'}, {'name': '11371', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11371'}]
CVE State: PUBLISHED
Explain CVE-2004-1673
accountsettings_add.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allow remote attackers to create text files with arbitrary content via the accountid parameter.
Affected Products: n/a
References: [{'name': 'merak-icewarp-create-file(17317)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17317'}, {'name': '20040910 Multiple vulnerabilities in Icewarp Web Mail 5.2.7', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109483971420067&w=2'}, {'name': '12789', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12789'}, {'name': '11371', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11371'}]
CVE State: PUBLISHED
Explain CVE-2004-1674
viewaction.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to (1) delete arbitrary files via the originalfolder parameter or (2) move arbitrary files via the messageid parameter.
Affected Products: n/a
References: [{'name': 'merak-icewarp-file-deletion(17976)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17976'}, {'name': '20040910 Multiple vulnerabilities in Icewarp Web Mail 5.2.7', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109483971420067&w=2'}, {'name': '12789', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12789'}, {'name': '11371', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11371'}]
CVE State: PUBLISHED
Explain CVE-2004-1675
Serv-U FTP server 4.x and 5.x allows remote attackers to cause a denial of service (application crash) via a STORE UNIQUE (STOU) command with an MS-DOS device name argument such as (1) COM1, (2) LPT1, (3) PRN, or (4) AUX.
Affected Products: n/a
References: [{'name': 'servu-stou-dos(17329)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17329'}, {'name': '12507', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12507/'}, {'name': '11155', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11155'}, {'name': '20040911 Serv-U up to 5.2 Denial of Service', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109495074211638&w=2'}]
CVE State: PUBLISHED
Explain CVE-2004-1676
Heap-based buffer overflow in the image sending feature in Gadu-Gadu 6.0 build 149 allows remote attackers to execute arbitrary code via a crafted GG_MSG_IMAGE_REPLY message.
Affected Products: n/a
References: [{'name': '11158', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11158'}, {'name': '20040912 Gadu-Gadu (all versions with image-send feature) Heap Overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109508834910733&w=2'}, {'name': '12510', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12510'}, {'name': 'gadu-gadu-image-bo(17324)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17324'}]
CVE State: PUBLISHED
Explain CVE-2004-1677
pdesk.cgi in PerlDesk allows remote attackers to gain sensitive information via an invalid lang parameter, which includes pathname information in an error message.
Affected Products: n/a
References: [{'name': '12512', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12512'}, {'name': 'perldesk-lang-file-include(17343)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17343'}, {'name': '20040912 Posible Inclusion File in Perl Desk', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109509026406554&w=2'}]
CVE State: PUBLISHED
Explain CVE-2004-1678
Directory traversal vulnerability in pdesk.cgi in PerlDesk allows remote attackers to read portions of arbitrary files and possibly execute arbitrary Perl modules via ".." sequences terminated by a %00 (null) character in the lang parameter, which can leak portions of the requested files if a compilation error message occurs.
Affected Products: n/a
References: [{'name': '12512', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12512'}, {'name': 'perldesk-directory-traversal(19712)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19712'}, {'name': '11160', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11160'}, {'name': '20040912 Posible Inclusion File in Perl Desk', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109509026406554&w=2'}]
CVE State: PUBLISHED
Explain CVE-2004-1679
Directory traversal vulnerability in TwinFTP 1.0.3 R2 allows remote attackers to create arbitrary files via a .../ (triple dot) in the (1) CWD, (2) STOR, or (3) RETR commands.
Affected Products: n/a
References: [{'name': '20040913 Directory Traversal Vulnerability in TwinFTP Server allows overwriting of files outside FTP directory', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109509243831121&w=2'}, {'name': 'twinftp-argument-directory-traversal(17323)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17323'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.security.org.sg/vuln/twinftp103r2.html'}, {'name': '12511', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12511/'}, {'name': '11159', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11159'}]
CVE State: PUBLISHED
Explain CVE-2004-1680
application.cgi in the Pingtel Xpressa handset running firmware 2.1.11.24 allows remote authenticated users to cause a denial of service (VxWorks OS crash) via a long HTTP GET request, possibly triggering a buffer overflow.
Affected Products: n/a
References: [{'name': '11161', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11161'}, {'name': '12523', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12523'}, {'name': 'A091304-2', 'tags': ['vendor-advisory', 'x_refsource_ATSTAKE'], 'url': 'http://www.atstake.com/research/advisories/2004/a091304-2.txt'}, {'name': 'xpressa-applicationcgi-dos(17346)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17346'}]
CVE State: PUBLISHED
Explain CVE-2004-1681
Multiple buffer overflows in (1) phrelay-cfg, (2) phlocale, (3) pkg-installer, or (4) input-cfg in QNX Photon microGUI for QNX RTP 6.1 allow local users to gain privileges via a long -s (server) command line parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.rfdslabs.com.br/qnx-advs-03-2004.txt'}, {'name': '20040913 [RLSA_02-2004] QNX Photon multiple buffer overflows', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109510393407597&w=2'}, {'name': '11164', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11164'}, {'name': 'qnx-rtp-photon-bo(17339)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17339'}]
CVE State: PUBLISHED
Explain CVE-2004-1682
Format string vulnerability in QNX 6.1 FTP client allows remote authenticated users to gain group bin privileges via format string specifiers in the QUOTE command.
Affected Products: n/a
References: [{'name': 'qnx-ftp-quote-format-string(17347)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17347'}, {'name': '20040913 [RLSA_03-2004] QNX ftp client format string bug', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109511327005476&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.rfdslabs.com.br/qnx-advs-04-2004.txt'}, {'name': '12533', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12533'}]
CVE State: PUBLISHED
Explain CVE-2004-1683
A race condition in crrtrap for QNX RTP 6.1 allows local users to gain privileges by modifying the PATH environment variable to reference a malicious io-graphics program before is executed by crrtrap.
Affected Products: n/a
References: [{'name': 'qnx-rtp-crttrap-race-condition(17345)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17345'}, {'name': '20040913 [RLSA_04-2004] QNX crrtrap possible race condition vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109511737504357&w=2'}, {'name': '11165', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11165'}]
CVE State: PUBLISHED
Explain CVE-2004-1684
Zyxel P681 running ZyNOS Vt020225a contains portions of memory in an ARP request, which allows remote attackers to obtain sensitive information by sniffing the network.
Affected Products: n/a
References: [{'name': '20040913 Zyxel Prestige 681 SDSL router information leak', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109510732611448&w=2'}, {'name': '9962', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/9962'}, {'name': '11167', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11167'}, {'name': 'prestige-information-disclosure(17372)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17372'}]
CVE State: PUBLISHED
Explain CVE-2004-1685
SMC routers SMC7004VWBR running firmware 1.00.014 and SMC7008ABR EU running firmware 1.42.003 allow remote attackers to bypass authentication by connecting to it from the same IP address as the administrator who is logged in, then accessing the setup_status.htm or status.HTM pages.
Affected Products: n/a
References: [{'name': '12601', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12601'}, {'name': 'smc-router-security-bypass(17443)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17443'}, {'name': '10088', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/10088'}, {'name': '11197', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11197'}, {'name': '20040915 SMC7004VWBR / SMC7008ABR "spoofing" vulnerability.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109526094614160&w=2'}]
CVE State: PUBLISHED
Explain CVE-2004-1686
Internet Explorer 6.0 in Windows XP SP2 allows remote attackers to bypass the Information Bar prompt for ActiveX and Javascript via an XHTML page that contains an Internet Explorer formatted comment between the DOCTYPE tag and the HTML tag, as demonstrated using the DesignScience MathPlayer ActiveX plugin.
Affected Products: n/a
References: [{'name': '20040915 IE6 + XP SP2 Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109539520310153&w=2'}, {'name': 'ie-information-bar-bypass(20617)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20617'}, {'name': '11200', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11200'}]
CVE State: PUBLISHED
Explain CVE-2004-1687
CRLF injection vulnerability in down.asp for Snitz Forums 2000 3.4.04 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the location parameter.
Affected Products: n/a
References: [{'name': '12590', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12590'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://forum.snitz.com/forum/topic.asp?ARCHIVE=true&TOPIC_ID=54791'}, {'name': '20040916 ADVISORY: security hole (http response splitting) in snitz forums', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109537195413691&w=2'}, {'name': '11201', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11201'}, {'name': 'snitz-response-splitting(17421)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17421'}]
CVE State: PUBLISHED
Explain CVE-2004-1688
Pigeon Server 3.02.0143 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a long login name sent to port 3103.
Affected Products: n/a
References: [{'name': '20040916 Freeze in Pigeon Server 3.02.0143', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/026515.html'}, {'name': '12585', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12585'}, {'name': '11203', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11203'}, {'name': 'pigeon-server-dos(17427)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17427'}, {'name': '20040916 Freeze in Pigeon Server 3.02.0143', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109543366631724&w=2'}]
CVE State: PUBLISHED
Explain CVE-2004-1689
sudoedit (aka sudo -e) in sudo 1.6.8 opens a temporary file with root privileges, which allows local users to read arbitrary files via a symlink attack on the temporary file before quitting sudoedit.
Affected Products: n/a
References: [{'name': '12596', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12596'}, {'name': '20040916 [sudo-announce] Sudo version 1.6.8p1 now available (fwd)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109537972929201&w=2'}, {'name': 'VU#424358', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/424358'}, {'name': '10023', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/10023'}, {'name': '11204', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11204'}, {'name': 'O-219', 'tags': ['third-party-advisory', 'government-resource', 'x_refsource_CIAC'], 'url': 'http://www.ciac.org/ciac/bulletins/o-219.shtml'}, {'name': 'sudo-sudoedit-view-files(17424)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17424'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sudo.ws/sudo/alerts/sudoedit.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.nl/0409-exploits/sudoedit.txt'}]
CVE State: PUBLISHED
Explain CVE-2004-1690
Cross-site scripting (XSS) vulnerability in the Web Server in DNS4Me 3.0.0.4 allows remote attackers to execute arbitrary web script or HTML via the URL.
Affected Products: n/a
References: [{'name': 'dns4me-xss(17425)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17425'}, {'name': '12595', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12595'}, {'name': '11213', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11213'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gulftech.org/?node=research&article_id=00049-09162004'}, {'name': '1011334', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011334'}, {'name': '20040918 RhinoSoft DNS4ME HTTP Server Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109552436811493&w=2'}]
CVE State: PUBLISHED
Explain CVE-2004-1691
The Web Server in DNS4Me 3.0.0.4 allows remote attackers to cause a denial of service (CPU consumption and crash) via a large amount of data.
Affected Products: n/a
References: [{'name': 'dns4me-dos(17426)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17426'}, {'name': '12595', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12595'}, {'name': '11213', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11213'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gulftech.org/?node=research&article_id=00049-09162004'}, {'name': '1011334', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011334'}, {'name': '20040918 RhinoSoft DNS4ME HTTP Server Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109552436811493&w=2'}]
CVE State: PUBLISHED
Explain CVE-2004-1692
Cross-site scripting (XSS) vulnerability in index.php in Mambo 4.5 (1.0.9) allows remote attackers to inject arbitrary web script or HTML via the (1) Itemid, (2) mosmsg, or (3) limit parameters.
Affected Products: n/a
References: [{'name': 'mambo-multiple-xss(20616)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20616'}, {'name': '20040918 Vulnerabilities in TUTOS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109571849713158&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://mamboforge.net/frs/shownotes.php?release_id=1672'}, {'name': '11220', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11220'}, {'name': '10179', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/10179'}]
CVE State: PUBLISHED
Explain CVE-2004-1693
PHP remote file inclusion vulnerability in Function.php in Mambo 4.5 (1.0.9) allows remote attackers to execute arbitrary PHP code by modifying the mosConfig_absolute_path parameter to reference a URL on a remote web server that contains the code.
Affected Products: n/a
References: [{'name': '1011365', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1011365'}, {'name': '20040918 Vulnerabilities in TUTOS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109571849713158&w=2'}, {'name': 'mambo-cachelibrary-execute-code(17449)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17449'}, {'name': '11220', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11220'}, {'name': '10180', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/10180'}]
CVE State: PUBLISHED
Explain CVE-2004-1694
Symantec ON Command CCM 5.4.x and iCommand 3.0.x has four default usernames and passwords, one of which is hardcoded, which allows remote attackers to gain unauthorized access.
Affected Products: n/a
References: [{'name': 'oncommand-multiple-default-accounts(17447)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17447'}, {'name': '11225', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11225'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sarc.com/avcenter/security/Content/2004.09.29.html'}, {'name': '12604', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12604'}, {'name': '20040920 Default username/password pairs in ON Command CCM 5.x database', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109571689621784&w=2'}]
CVE State: PUBLISHED
Explain CVE-2004-1695
EmuLive Server4 Commerce Edition Build 7560 allows remote attackers to bypass authentication for the remote administration feature via a URL that contains an extra leading / (slash).
Affected Products: n/a
References: [{'name': '20040921 Multiple Vulnerabilities In EmuLive Server4', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109577497718374&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gulftech.org/?node=research&article_id=00051-09202004'}, {'name': '12616', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12616'}, {'name': 'emuliveserver4-url-gain-access(17450)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17450'}, {'name': '11226', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11226'}]
CVE State: PUBLISHED
Explain CVE-2004-1696
EmuLive Server4 Commerce Edition Build 7560 allows remote attackers to cause a denial of service (application crash) via a sequence of carriage returns sent to TCP port 66.
Affected Products: n/a
References: [{'name': '20040921 Multiple Vulnerabilities In EmuLive Server4', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109577497718374&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gulftech.org/?node=research&article_id=00051-09202004'}, {'name': '12616', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12616'}, {'name': '11226', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11226'}, {'name': 'emulive-tcp-port-dos(17451)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17451'}]
CVE State: PUBLISHED
Explain CVE-2004-1697
The "Forgot your Password" link in Computer Associates (CA) Unicenter Management Portal 2.0 and 3.1 displays different error messages for users that exist and users that do not exist, which could allow remote attackers to guess valid usernames.
Affected Products: n/a
References: [{'name': '12620', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12620'}, {'name': '20040921 CA UniCenter Management Portal Username Enumeration Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109579952809320&w=2'}, {'name': 'unicenter-management-username-bruteforce(17464)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17464'}, {'name': '11229', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11229'}]
CVE State: PUBLISHED
Explain CVE-2004-1698
The Base64 function in PopMessenger 1.60 (before 20 Sep 2004) and earlier allows remote attackers to cause a denial of service (application crash) via invalid characters in a message, which causes several alert dialogs to be displayed and leads to a crash.
Affected Products: n/a
References: [{'name': 'popmessenger-base64-dos(17465)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17465'}, {'name': '11230', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11230'}, {'name': '12612', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12612/'}, {'name': '20040921 Broadcast crash in Popmessenger 1.60 (before 20 Sep 2004)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109581586128899&w=2'}]
CVE State: PUBLISHED
Explain CVE-2004-1699
SettingsBase.php in Pinnacle ShowCenter 1.51 allows remote attackers to cause a denial of service (web interface errors) via an invalid Skin parameter.
Affected Products: n/a
References: [{'name': '20040922 Pinnacle ShowCenter 1.51 possible DoS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109589167110196&w=2'}, {'name': '11232', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11232'}, {'name': 'pinnacle-showcenter-dos(17463)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17463'}, {'name': '20040921 Pinnacle ShowCenter Skin Denial of Service', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/026733.html'}]
CVE State: PUBLISHED
Explain CVE-2004-1700
Cross-site scripting (XSS) vulnerability in SettingsBase.php in Pinnacle ShowCenter 1.51 build 121 allows remote attackers to inject arbitrary HTML or web script via the Skin parameter, which is echoed in an error message.
Affected Products: n/a
References: [{'name': 'pinnacle-showcenter-xss(17708)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17708'}, {'name': '11415', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11415'}, {'name': '12613', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12613'}]
CVE State: PUBLISHED
Explain CVE-2004-1701
Heap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers to execute arbitrary code via a long SAUTH command during RSA authentication.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/common/showdoc.php?idx=387&idxseccion=10'}, {'name': '20040809 CORE-2004-0714: Cfengine RSA Authentication Heap Corruption', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109208394910086&w=2'}, {'name': 'cfengine-cfservd-command-execution(16935)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/16935'}, {'name': '10899', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/10899'}, {'name': '12251', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12251'}, {'name': '20050219 cfengine rsa heap remote exploit:   part of PTjob project', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110886670528775&w=2'}, {'name': 'GLSA-200408-08', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200408-08.xml'}]
CVE State: PUBLISHED
Explain CVE-2004-1702
The AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 does not properly check the return value of the ReceiveTransaction function, which leads to a failed malloc call and triggers to a null dereference, which allows remote attackers to cause a denial of service (crash).
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/common/showdoc.php?idx=387&idxseccion=10'}, {'name': '20040809 CORE-2004-0714: Cfengine RSA Authentication Heap Corruption', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109208394910086&w=2'}, {'name': '12251', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12251'}, {'name': 'cfengine-cfservd-dos(16937)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/16937'}, {'name': '10900', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/10900'}, {'name': 'GLSA-200408-08', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200408-08.xml'}]
CVE State: PUBLISHED
Explain CVE-2004-1703
Fusion News 3.6.1 allows remote attackers to add user accounts, if the administrator is logged in, via a comment that contains an img bbcode tag that calls index.php with the signup action, which is executed when the administrator's browser loads the page with the img tag.
Affected Products: n/a
References: [{'name': '20040729 Fusion News Yet Another Unauthorized Account Addition Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=109122824523226&w=2'}, {'name': '10836', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/10836'}, {'name': '1010829', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1010829'}, {'name': 'fusion-news-add-account(16853)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/16853'}]
CVE State: PUBLISHED