deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-2622
Published: 2004-12-31
Description: AClient.exe in Altiris Deployment Solution 6.x and 5.x does not require authentication from the first Deployment Server that it connects to, which allows remote malicious servers to gain administrator access.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2004-10/0211.html; http://archives.neohapsis.com/archives/bugtraq/2004-10/0266.html; http://packetstorm.linuxsecurity.com/0410-advisories/index2.html
CVE: CVE-2004-2623
Published: 2004-12-31
Description: Unknown vulnerability in Rippy the Aggregator before 0.10, when register_globals is enabled, has unknown attack vectors and impact, possibly related to the "user-controlled filter."
CVSS Score: 10.0 (HIGH)
References: http://ansuz.sooke.bc.ca/rippy/ChangeLog; http://freshmeat.net/projects/rippy/?branch_id=30091&release_id=173997; http://secunia.com/advisories/12769
CVE: CVE-2004-2624
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in "TextSearch" in WackoWiki 3.5 allows remote attackers to inject arbitrary web script or HTML via the "phrase" parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/12209; http://wackowiki.com/WackoDownload/VersionHistory?v=yrv; http://www.osvdb.org/8295
CVE: CVE-2004-2625
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in Outblaze Email allows remote attackers to inject arbitrary web script or HTML via Javascript in an attribute of an IMG tag.
CVSS Score: 5.1 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-07/0733.html; http://secunia.com/advisories/12084; http://securitytracker.com/alerts/2004/Jul/1010735.html
CVE: CVE-2004-2626
Published: 2004-12-31
Description: GUI overlay vulnerability in the Java API in Siemens S55 cellular phones allows remote attackers to send unauthorized SMS messages by overlaying a confirmation message with a malicious message.
CVSS Score: 3.7 (LOW)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]4565&w=2; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]4812&w=2; http://secunia.com/advisories/11492
CVE: CVE-2004-2627
Published: 2004-12-31
Description: Java 2 Micro Edition (J2ME) does not properly validate bytecode, which allows remote attackers to escape the Kilobyte Virtual Machine (KVM) sandbox and execute arbitrary code.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2004-10/0231.html; http://archives.neohapsis.com/archives/fulldisclosure/2004-10/0884.html; http://secunia.com/advisories/12945
CVE: CVE-2004-2628
Published: 2004-12-31
Description: Multiple directory traversal vulnerabilities in thttpd 2.07 beta 0.4, when running on Windows, allow remote attackers to read arbitrary files via a URL that contains (1) a hex-encoded backslash dot-dot sequence ("%5C..") or (2) a drive letter (such as "C:").
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0097.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9836&w=2; http://securitytracker.com/alerts/2004/Aug/1010850.html
CVE: CVE-2004-2629
Published: 2004-12-31
Description: Multiple vulnerabilities in the H.323 protocol implementation for First Virtual Communications Click to Meet Express (when used with H.323 conferencing endpoints), Click to Meet Premier, Conference Server, and V-Gate allow remote attackers to cause a denial of service, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/11192; http://support.fvc.com/eng/docs/misc_docs/H.323_Security_Bulletin.pdf; http://www.cert.org/advisories/CA-2004-01.html
CVE: CVE-2004-2630
Published: 2004-12-31
Description: The MIME transformation system (transformations/text_plain__external.inc.php) in phpMyAdmin 2.5.0 up to 2.6.0-pl1 allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9779&w=2; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1643&w=2; http://secunia.com/advisories/12813
CVE: CVE-2004-2631
Published: 2004-12-31
Description: Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2004-06/0444.html; http://archives.neohapsis.com/archives/bugtraq/2004-06/0473.html; http://eagle.kecapi.com/sec/fd/phpMyAdmin.html
CVE: CVE-2004-2632
Published: 2004-12-31
Description: phpMyAdmin 2.5.1 up to 2.5.7 allows remote attackers to modify configuration settings and gain unauthorized access to MySQL servers via modified $cfg['Servers'] variables.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2004-06/0444.html; http://archives.neohapsis.com/archives/bugtraq/2004-06/0473.html; http://eagle.kecapi.com/sec/fd/phpMyAdmin.html
CVE: CVE-2004-2633
Published: 2004-12-31
Description: Unspecified vulnerability in Sesamie 1.0 allows remote anonymous attackers to gain access to repositories of other users via unknown vectors.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/11497; http://securitytracker.com/alerts/2004/Apr/1009978.html; http://sourceforge.net/project/shownotes.php?release_id=234477
CVE: CVE-2004-2634
Published: 2004-12-31
Description: The (1) bos.rte.serv_aid or (2) bos.rte.console filesets in IBM AIX 5.1 and 5.2 allow local users to overwrite arbitrary files via a symlink attack on temporary files via unknown attack vectors.
CVSS Score: 6.2 (MEDIUM)
References: http://secunia.com/advisories/11496; http://securitytracker.com/id?1009975; http://www-1.ibm.com/support/search.wss?rs=0&q=IY55789&apar=only
CVE: CVE-2004-2635
Published: 2004-12-31
Description: An ActiveX control for McAfee Security Installer Control System 4.0.0.81 allows remote attackers to access the Windows registry via web pages that use the control's RegQueryValue() method.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/ntbugtraq/2004-q2/0026.html; http://secunia.com/advisories/11493; http://www.osvdb.org/5713
CVE: CVE-2004-2636
Published: 2004-12-31
Description: TinyWeb 1.9 allows remote attackers to read source code of scripts via "/./" in the URL.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/11731; http://securitytracker.com/alerts/2004/May/1010346.html; http://www.osvdb.org/6517
CVE: CVE-2004-2637
Published: 2004-12-31
Description: The NAT implementation in Zonet ZSR1104WE Wireless Router Runtime Code Version 2.41 converts IP addresses of inbound connections to the IP address of the router, which allows remote attackers to bypass intended security restrictions.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]4026&w=2; http://secunia.com/advisories/11499; http://securitytracker.com/id?1009967
CVE: CVE-2004-2638
Published: 2004-12-31
Description: The Admin Access With Levels plugin in osCommerce 1.5.1 allows remote attackers to access files in the "admin/" directory by modifying the in_login parameter to a non-zero value.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/11473; http://secwatch.org/advisories/1007857; http://www.osvdb.org/5717
CVE: CVE-2004-2639
Published: 2004-12-31
Description: Unspecified vulnerability in Journalness 3.0.7 and earlier allows remote attackers to create or modify posts via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/11431; http://securitytracker.com/alerts/2004/Apr/1009909.html; http://www.osvdb.org/5572
CVE: CVE-2004-2640
Published: 2004-12-31
Description: Directory traversal vulnerability in lstat.cgi in LinuxStat before 2.3.1 allows remote attackers to read arbitrary files via (1) .. (dot dot) sequences or (2) absolute paths to the template parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/12963; http://securitytracker.com/id?1011920; http://sourceforge.net/project/shownotes.php?release_id=277371
CVE: CVE-2004-2641
Published: 2004-12-31
Description: Unspecified vulnerability in Sun Fire 3800/4800/4810/6800, Sun Fire V1280, and Netra 1280 allows remote attackers to cause a denial of service (system controller hang) via IP Packets With Type of Service (TOS) Bits set.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/11439; http://securitytracker.com/id?1009888; http://sunsolve.sun.com/search/document.do?assetkey=1-26-57544-1
CVE: CVE-2004-2642
Published: 2004-12-31
Description: Yeemp 0.9.9 and earlier does not properly encrypt inbound files, which allows remote attackers to spoof the identity of the sender.
CVSS Score: 6.4 (MEDIUM)
References: http://deekoo.net/technocracy/yeemp/#advisory; http://deekoo.net/technocracy/yeemp/changes.html; http://secunia.com/advisories/12795
CVE: CVE-2004-2643
Published: 2004-12-31
Description: Directory traversal vulnerability in Microsoft cabarc allows remote attackers to overwrite files via "../" sequences in file names in a CAB archive.
CVSS Score: 3.7 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-10/0341.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1018&w=2; http://packetstormsecurity.org/0410-exploits/cabarc.txt
CVE: CVE-2004-2644
Published: 2004-12-31
Description: Unspecified vulnerability in ASN.1 Compiler (asn1c) before 0.9.7 has unknown impact and attack vectors when processing "ANY" type tags.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/12794; http://securitytracker.com/id?1011622; http://sourceforge.net/project/shownotes.php?group_id=103893&release_id=274592
CVE: CVE-2004-2645
Published: 2004-12-31
Description: Unspecified vulnerability in ASN.1 Compiler (asn1c) before 0.9.7 has unknown impact and attack vectors when processing "CHOICE" types with "indefinite length structures."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/12794; http://securitytracker.com/id?1011622; http://sourceforge.net/project/shownotes.php?group_id=103893&release_id=274592
CVE: CVE-2004-2646
Published: 2004-12-31
Description: The addUser function in UserManager.java in Free Web Chat 2.0 allows remote attackers to cause a denial of service (uncaught NullPointerException) via unknown attack vectors that cause the usrName variable to be null.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0102.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1049&w=2; http://securitytracker.com/alerts/2004/Aug/1010851.html
CVE: CVE-2004-2647
Published: 2004-12-31
Description: Free Web Chat 2.0 allows remote attackers to cause a denial of service (CPU consumption) via multiple connections from the same user.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0102.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1049&w=2; http://securitytracker.com/alerts/2004/Aug/1010851.html
CVE: CVE-2004-2648
Published: 2004-12-31
Description: FreezeX 1.00.100.0666 allows local users with administrator privileges to cause a denial of service (FreezeX application) by overwriting the db.fzx file.
CVSS Score: 1.0 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-12/0458.html; http://securitytracker.com/id?1012699; http://www.osvdb.org/12659
CVE: CVE-2004-2649
Published: 2004-12-31
Description: Eudora 6.1.0.6 allows remote attackers to obfuscate URLs displayed in the status bar by inserting a large number of characters (e.g. spaces coded as "&#32") in the middle of the URL.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2004-05/0066.html; http://secunia.com/advisories/11581; http://securitytracker.com/alerts/2004/May/1010117.html
CVE: CVE-2004-2650
Published: 2004-12-31
Description: Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error conditions in the retrieve function, which prevents a lock from being released and causes a memory leak.
CVSS Score: 4.9 (MEDIUM)
References: http://issues.apache.org/jira/browse/JAMES-268; http://james.apache.org/changelog.html; http://www.securityfocus.com/bid/15765
CVE: CVE-2004-2651
Published: 2004-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in YaCy before 0.32 allow remote attackers to inject arbitrary web script or HTML via the (1) urlmaskfilter parameter to index.html or the (2) page parameter to Wiki.html.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-12/0413.html; http://securitytracker.com/id?1012686; http://www.osvdb.org/12629
CVE: CVE-2004-2652
Published: 2004-12-31
Description: The DecodeTCPOptions function in decode.c in Snort before 2.3.0, when printing TCP/IP options using FAST output or verbose mode, allows remote attackers to cause a denial of service (crash) via packets with invalid TCP/IP options, which trigger a null dereference.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/13664; http://securitytracker.com/id?1012656; http://taosecurity.blogspot.com/2004/12/details-on-snort-dos-condition-you-may.html
CVE: CVE-2004-2653
Published: 2004-12-31
Description: Unspecified vulnerability in PD9 Software MegaBBS 2.0 and 2.1 allows attackers to gain privileges via unknown vectors involving (1) admin/userlevelmembers-edit.asp and (2) admin/edit-groups.asp.
CVSS Score: 7.5 (HIGH)
References: http://www.pd9soft.com/megabbs/forums/thread-view.asp?tid=4924; http://www.pd9soft.com/megabbs/forums/thread-view.asp?tid=4924
CVE: CVE-2004-2654
Published: 2004-12-31
Description: The clientAbortBody function in client_side.c in Squid Web Proxy Cache before 2.6 STABLE6 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors that trigger a null dereference.  NOTE: in a followup advisory, a researcher claimed that the issue was a buffer overflow that was not fixed in STABLE6. However, the vendor's bug report clearly shows that the researcher later retracted this claim, because the tested product was actually STABLE5.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/12508; http://secunia.com/advisories/12754; http://securitytracker.com/id?1011214
CVE: CVE-2004-2655
Published: 2004-12-31
Description: rdesktop 1.3.1 with xscreensaver 4.14, and possibly other versions, when running on Fedora and possibly other platforms, does not release the keyboard focus when xscreensaver starts, which causes the password to be entered into the active window when the user unlocks the screen.
CVSS Score: 5.4 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc; http://secunia.com/advisories/20226; http://secunia.com/advisories/20456
CVE: CVE-2004-2656
Published: 2004-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Slashdot Like Automated Storytelling Homepage (Slash) (aka Slashcode) before R_2_5_0_41 allow remote attackers to inject arbitrary web script or HTML via (1) the topic parameter in search.pl and (2) the filter parameter in submit.pl.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-12/0170.html; http://secunia.com/advisories/13491; http://www.osvdb.org/21874
CVE: CVE-2004-2657
Published: 2004-12-31
Description: Mozilla Firefox 1.5.0.1, and possibly other versions, preserves some records of user activity even after uninstalling, which allows local users who share a Windows profile to view the records after a new installation of Firefox, as reported for the list of Passwords Never Saved web sites.  NOTE: The vendor has disputed this issue, stating that "The uninstaller is primarily there to uninstall the application. It is not there to uninstall user data. For the moment I will stick by my module-owner decision.
CVSS Score: 1.7 (LOW)
References: http://www.securityfocus.com/archive/1/431021/100/0/threaded; http://www.securityfocus.com/archive/1/431063/100/0/threaded; https://bugzilla.mozilla.org/show_bug.cgi?id=234680
CVE: CVE-2004-2658
Published: 2004-12-31
Description: resmgr in SUSE CORE 9 does not properly identify terminal names, which allows local users to spoof terminals and login types.
CVSS Score: 2.1 (LOW)
References: http://support.novell.com/techcenter/psdb/fa6c6a3e792bf79b1d85821c689ea578.html; http://support.novell.com/techcenter/psdb/fa6c6a3e792bf79b1d85821c689ea578.html
CVE: CVE-2004-2659
Published: 2004-12-31
Description: Opera offers an Open button to verify that a user wishes to execute a downloaded file, which allows user-assisted remote attackers to construct a race condition that tricks a user into clicking Open via a request for a different mouse or keyboard action very shortly before the Open dialog appears.  NOTE: this is a different issue than CVE-2005-2407.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-362
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-07/0264.html; http://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/; http://archives.neohapsis.com/archives/fulldisclosure/2004-07/0264.html
CVE: CVE-2004-2660
Published: 2004-12-31
Description: Memory leak in direct-io.c in Linux kernel 2.6.x before 2.6.10 allows local users to cause a denial of service (memory consumption) via certain O_DIRECT (direct IO) write requests.
CVSS Score: 4.9 (MEDIUM)
References: http://linux.bkbits.net:8080/linux-2.6/cset%404182a613oVsK0-8eCWpyYFrUf8rhLA; http://secunia.com/advisories/21605; http://secunia.com/advisories/22093
CVE: CVE-2004-2661
Published: 2004-12-31
Description: Soft3304 04WebServer before 1.41 does not properly check file names, which allows remote attackers to obtain sensitive information (CGI source code).
CVSS Score: 5.0 (MEDIUM)
References: http://www.soft3304.net/04WebServer/Security.html; http://www.soft3304.net/04WebServer/Security.html
CVE: CVE-2004-2662
Published: 2004-12-31
Description: Soft3304 04WebServer before 1.41 allows remote attackers to cause a denial of service (resource consumption or crash) via certain data related to OpenSSL, which causes a thread to terminate but continue to hold resources.
CVSS Score: 5.0 (MEDIUM)
References: http://www.soft3304.net/04WebServer/Security.html; http://www.soft3304.net/04WebServer/Security.html
CVE: CVE-2004-2663
Published: 2004-12-31
Description: The (1) SetDebugging and (2) RunEgatherer methods in IBM Access Support eGatherer ActiveX control 2.0.0.16 allow remote attackers to create files with arbitrary content, as demonstrated by creating a .hta file in a Startup folder.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9324&w=2; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]4568&w=2; http://research.eeye.com/html/advisories/published/AD20040615B.html
CVE: CVE-2004-2664
Published: 2004-12-31
Description: John Lim ADOdb Library for PHP before 4.23 allows remote attackers to obtain sensitive information via direct requests to certain scripts that result in an undefined value of ADODB_DIR, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://phplens.com/lens/adodb/docs-adodb.htm#changes; http://phplens.com/lens/adodb/docs-adodb.htm#changes
CVE: CVE-2004-2665
Published: 2004-12-31
Description: Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport software in HP-UX B.11.00, B.11.04, and B.11.11 before 20040628 allows local users to cause a denial of service via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=PSD_HPSBUX01054; http://secunia.com/advisories/11970; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5694
CVE: CVE-2004-2666
Published: 2004-12-31
Description: Mantis before 20041016 provides a complete Issue History (Bug History) in the web interface regardless of view_history_threshold, which allows remote attackers to obtain sensitive information (private bug details) by visiting a bug's web page.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.mantisbugtracker.com/view.php?id=4724; http://mantisbt.cvs.sourceforge.net/mantisbt/mantisbt/history_inc.php?r1=1.24&r2=1.25; http://mantisbt.cvs.sourceforge.net/mantisbt/mantisbt/history_inc.php?view=log
CVE: CVE-2004-2667
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in Lotus Domino 6.0.x before 6.0.4 and 6.5.x before 6.5.2 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/11925; http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21171253; http://www.osvdb.org/displayvuln.php?osvdb_id=7268
CVE: CVE-2004-2668
Published: 2004-12-31
Description: SQL injection vulnerability in Interchange before 4.8.9 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://ftp.icdevgroup.org/interchange/4.8/WHATSNEW; http://www.osvdb.org/7140; http://ftp.icdevgroup.org/interchange/4.8/WHATSNEW
CVE: CVE-2004-2669
Published: 2004-12-31
Description: Multiple SQL injection vulnerabilities in Land Down Under (LDU) v701 allow remote attackers to execute arbitrary SQL commands or obtain the installation path via parameters including (1) s, w, and d in users.php, (2) id in comments.php, (3) rusername in auth.php, or (4) h in plug.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/13034; http://securitytracker.com/id?1012015; http://www.neocrome.net/index.php?m=single&id=91
CVE: CVE-2004-2670
Published: 2004-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in mod.php in eNdonesia 8.3 allow remote attackers to inject arbitrary web script or HTML via (1) the mod parameter in a viewcat operation or (2) the query parameter in a search operation in the publisher module.
CVSS Score: 6.8 (MEDIUM)
References: http://echo.or.id/adv/adv02-y3dips-2004.txt; http://secunia.com/advisories/12231; http://securitytracker.com/id?1010864
CVE: CVE-2004-2671
Published: 2004-12-31
Description: mod.php in eNdonesia 8.3 allows remote attackers to obtain sensitive information via certain direct requests, and certain requests with invalid parameter values, which reveal the path in various error messages, as demonstrated by the (1) mod and (2) cid parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://echo.or.id/adv/adv02-y3dips-2004.txt; http://secunia.com/advisories/12231; http://securitytracker.com/id?1010864
CVE: CVE-2004-2672
Published: 2004-12-31
Description: Unspecified vulnerability in ArGoSoft FTP server before 1.4.2.2 allows attackers to upload .lnk files via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.argosoft.com/rootpages/FtpServer/ChangeList.aspx; http://www.argosoft.com/rootpages/FtpServer/ChangeList.aspx
CVE: CVE-2004-2673
Published: 2004-12-31
Description: Multiple buffer overflows in ArGoSoft FTP Server before 1.4.1.6 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code via (1) a SITE ZIP command with a long first or second argument, or (2) a SITE COPY with a long argument.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/11002; http://www.argosoft.com/rootpages/FtpServer/ChangeList.aspx; http://www.osvdb.org/11334
CVE: CVE-2004-2674
Published: 2004-12-31
Description: Directory traversal vulnerability in ArGoSoft FTP Server before 1.4.1.6 allows remote authenticated users to determine the existence of arbitrary files via ".." sequences in the SITE UNZIP argument.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/11002; http://www.argosoft.com/rootpages/FtpServer/ChangeList.aspx; http://www.osvdb.org/11333
CVE: CVE-2004-2675
Published: 2004-12-31
Description: ArGoSoft FTP Server before 1.4.1.6 allows remote authenticated users to cause a denial of service (crash) via a SITE PASS command with a long password parameter, which causes the database to be corrupted.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/11002; http://www.argosoft.com/rootpages/FtpServer/ChangeList.aspx; http://www.osvdb.org/11332