deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-2305
Published: 2004-12-31
Description: Computer Associates eTrust Antivirus EE 6.0 through 7.0 allows remote attackers to bypass virus scanning by including a password-protected file in a ZIP file, which causes eTrust to scan only the password protected file and skip the other files.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/bid/9665; http://www.securitytracker.com/alerts/2004/Feb/1009074.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/15230
CVE: CVE-2004-2306
Published: 2004-12-31
Description: Sun Solaris 7 through 9, when Basic Security Module (BSM) is enabled and the SUNWscpu package has been removed as a result of security hardening, disables mail alerts from the audit_warn script, which might allow attackers to escape detection.
CVSS Score: 4.6 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-57483-1; http://www.ciac.org/ciac/bulletins/o-070.shtml; http://www.securityfocus.com/bid/13724
CVE: CVE-2004-2307
Published: 2004-12-31
Description: Microsoft Internet Explorer 6.0.2600 on Windows XP allows remote attackers to cause a denial of service (browser crash) via a shell: URI with double backslashes (\\) in an HTML tag such as IFRAME or A.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/358043; http://www.securityfocus.com/bid/9924; https://exchange.xforce.ibmcloud.com/vulnerabilities/15544
CVE: CVE-2004-2308
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in cPanel 9.1.0 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the dir parameter in dohtaccess.html.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/357231; http://www.securityfocus.com/bid/9853; https://exchange.xforce.ibmcloud.com/vulnerabilities/15485
CVE: CVE-2004-2309
Published: 2004-12-31
Description: Directory traversal vulnerability in Crob FTP Server 3.5.1 allows local users to browse outside the FTP root via multiple ../ (dot dot slash) in the DIR command.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/10778/; http://www.securityfocus.com/archive/1/352329; http://www.securityfocus.com/bid/9546
CVE: CVE-2004-2310
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in webadmin.nsf in Lotus Domino R6 6.5.1 allows remote attackers to inject arbitrary web script or HTML via a Domino command in the Quick Console.
CVSS Score: 4.3 (MEDIUM)
References: http://members.lycos.co.uk/r34ct/main/ibm_lotus_domino/lotus.txt; http://secunia.com/advisories/11143; http://www.osvdb.org/4306
CVE: CVE-2004-2311
Published: 2004-12-31
Description: Directory traversal vulnerability in webadmin.nsf in Lotus Domino R6 6.5.1 allows local users to create folders or determine the existence of files via a .. (dot dot) in the new folder dialog.
CVSS Score: 3.6 (LOW)
References: http://members.lycos.co.uk/r34ct/main/ibm_lotus_domino/lotus.txt; http://secunia.com/advisories/11143; http://www.securityfocus.com/bid/9900
CVE: CVE-2004-2312
Published: 2004-12-31
Description: Buffer overflow in GNU make for IBM AIX 4.3.3, when installed setgid, allows local users to gain privileges via a long CC argument.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-03/0997.html; http://archives.neohapsis.com/archives/fulldisclosure/2004-03/1124.html; http://secunia.com/advisories/11158/
CVE: CVE-2004-2313
Published: 2004-12-31
Description: Inter7 SqWebMail 3.4.1 through 3.6.1 generates different error messages for incorrect passwords versus correct passwords on non-mail-enabled accounts (such as root), which allows remote attackers to guess the root password via brute force attacks.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/352317; http://www.securityfocus.com/bid/9541; https://exchange.xforce.ibmcloud.com/vulnerabilities/15058
CVE: CVE-2004-2314
Published: 2004-12-31
Description: The Telnet listener for Novell iChain Server before 2.2 Field Patch 3b 2.2.116 does not have a password by default, which allows remote attackers to gain access.
CVSS Score: 7.5 (HIGH)
References: http://www.ciac.org/ciac/bulletins/o-080.shtml; http://www.securitytracker.com/alerts/2004/Feb/1008961.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/15068
CVE: CVE-2004-2315
Published: 2004-12-31
Description: Mbedthis AppWeb HTTP server before 1.0.2 allows remote attackers to cause a denial of service (crash) via an empty OPTIONS request.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/10710/; http://www.securityfocus.com/bid/9494; https://exchange.xforce.ibmcloud.com/vulnerabilities/14926
CVE: CVE-2004-2316
Published: 2004-12-31
Description: Mbedthis AppWeb HTTP server before 1.0.2 allows remote attackers to cause a denial of service (crash) via a GET request containing an MS-DOS device name such as COM1.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/10710/; http://www.securityfocus.com/bid/9494; https://exchange.xforce.ibmcloud.com/vulnerabilities/14926
CVE: CVE-2004-2317
Published: 2004-12-31
Description: Information leak in Mbedthis AppWeb HTTP server 1.0 through 1.1.2 allows remote attackers to obtain sensitive information via a user message that is generated when Mbedthis denies access.
CVSS Score: 5.0 (MEDIUM)
References: http://www.mbedthis.com/products/appWeb/doc/product/newFeatures.html; http://www.securityfocus.com/bid/10673; http://www.mbedthis.com/products/appWeb/doc/product/newFeatures.html
CVE: CVE-2004-2318
Published: 2004-12-31
Description: The administrative interface (surgeftpmgr.cgi) for SurgeFTP Server 1.0b through 2.2k1 allows remote attackers to cause a temporary denial of service (crash) via requests with two percent (%) signs in the CMD parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://members.lycos.co.uk/r34ct/main/surge_FTP/surge-ftp.txt; http://securitytracker.com/id?1008898; http://www.osvdb.org/3788
CVE: CVE-2004-2319
Published: 2004-12-31
Description: IBM Informix Dynamic Server (IDS) before 9.40.xC3 allows local users to (1) create or overwrite files via the /001 log file to onedcu or (2) read arbitrary files via a symlink attack on a file in /tmp to onshowaudit.
CVSS Score: 3.6 (LOW)
References: http://secunia.com/advisories/10737/; http://www-1.ibm.com/support/docview.wss?uid=swg21153336; http://www.osvdb.org/3758
CVE: CVE-2004-2320
Published: 2004-12-31
Description: The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200
References: http://dev2dev.bea.com/pub/advisory/68; http://secunia.com/advisories/10726; http://www.kb.cert.org/vuls/id/867593
CVE: CVE-2004-2321
Published: 2004-12-31
Description: BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including (1) ServerStartMBean.Password and (2) NodeManagerMBean.CertificatePassword.
CVSS Score: 2.1 (LOW)
References: http://dev2dev.bea.com/pub/advisory/1; http://www.securityfocus.com/bid/9505; http://www.securitytracker.com/alerts/2004/Jan/1008867.html
CVE: CVE-2004-2322
Published: 2004-12-31
Description: SQL injection vulnerability in the (1) announce and (2) notes modules of phpWebSite before 0.9.3-2 allows remote attackers to execute arbitrary SQL queries, as demonstrated using the ANN_id parameter to the announce module.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/10878/; http://sourceforge.net/tracker/index.php?func=detail&aid=892174&group_id=15539&atid=115539; http://www.osvdb.org/3852
CVE: CVE-2004-2323
Published: 2004-12-31
Description: DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to obtain sensitive information, including the SQL server username and password, via a GET request for source or configuration files such as Web.config.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-01/1161.html; http://secunia.com/advisories/10747; http://www.osvdb.org/3749
CVE: CVE-2004-2324
Published: 2004-12-31
Description: SQL injection vulnerability in DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to modify the backend database via the (1) table and (2) field parameters in LinkClick.aspx.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-01/1161.html; http://secunia.com/advisories/10747; http://www.osvdb.org/3750
CVE: CVE-2004-2325
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in EditModule.aspx for DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to inject arbitrary web script or HTML.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-01/1161.html; http://secunia.com/advisories/10747; http://www.osvdb.org/3751
CVE: CVE-2004-2326
Published: 2004-12-31
Description: SQL injection vulnerability in IP3 Networks NetAccess Appliance before firmware 3.1.18b13 allows remote attackers to bypass authentication via the (1) login or (2) password.  NOTE: this issue was later reported to also affect firmware 4.0.34.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/432007/100/0/threaded; http://www.securityfocus.com/bid/9858; https://exchange.xforce.ibmcloud.com/vulnerabilities/26106
CVE: CVE-2004-2327
Published: 2004-12-31
Description: Vizer Web Server 1.9.1 allows remote attackers to cause a denial of service (crash) via multiple malformed requests including (1) requests without GET, (2) GET requests without HTTP, (3) or long GET requests.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/354156; http://www.securityfocus.com/bid/9678; https://exchange.xforce.ibmcloud.com/vulnerabilities/15239
CVE: CVE-2004-2328
Published: 2004-12-31
Description: Clearswift MAILsweeper for SMTP before 4.3_13 allows remote attackers to cause a denial of service (infinite loop) via an e-mail with a crafted RAR archive attached.
CVSS Score: 5.0 (MEDIUM)
References: http://www.osvdb.org/3742; http://www.secunia.com/advisories/10732/; http://www.securityfocus.com/bid/9556
CVE: CVE-2004-2329
Published: 2004-12-31
Description: Kerio Personal Firewall (KPF) 2.1.5 allows local users to execute arbitrary code with SYSTEM privileges via the Load button in the Firewall Configuration Files option, which does not drop privileges before opening the file loading dialog box.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/10746/; http://www.osvdb.org/3748; http://www.securityfocus.com/bid/9525
CVE: CVE-2004-2330
Published: 2004-12-31
Description: ColdFusion MX 6.1 and 6.1 J2EE allows remote attackers to cause a denial of service via an HTTP request containing a large number of form fields.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/10743/; http://www.macromedia.com/devnet/security/security_zone/mpsb04-02.html; http://www.securityfocus.com/bid/9522
CVE: CVE-2004-2331
Published: 2004-12-31
Description: ColdFusion MX 6.1 and 6.1 J2EE allows local users to bypass sandbox security restrictions and obtain sensitive information by using Java reflection methods to access trusted Java objects without using the CreateObject function or cfobject tag.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-470
References: http://secunia.com/advisories/10743/; http://www.macromedia.com/devnet/security/security_zone/mpsb04-01.html; http://www.securityfocus.com/bid/9521
CVE: CVE-2004-2332
Published: 2004-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in CPAN WWW::Form before 1.13 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/10751; http://www.securiteam.com/unixfocus/5IP0L2KBPM.html; http://www.securityfocus.com/bid/9526
CVE: CVE-2004-2333
Published: 2004-12-31
Description: Bodington 2.1.0 RC1 and earlier does not secure the file upload area, which allows remote attackers to read uploaded files.
CVSS Score: 5.0 (MEDIUM)
References: http://sourceforge.net/tracker/index.php?func=detail&aid=789761&group_id=87659&atid=583930; http://www.osvdb.org/3770; http://www.secunia.com/advisories/10749/
CVE: CVE-2004-2334
Published: 2004-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in EMU Webmail 5.2.7 allow remote attackers to inject arbitrary web script or HTML via (1) a hex-encoded value to the variable parameter in emumail.fcgi, (2) the folder parameter in emumail.fcgi, or Javascript in the (3) username or (4) password field in the login page.
CVSS Score: 4.3 (MEDIUM)
References: http://members.lycos.co.uk/r34ct/main/emu/emu.txt; http://secunia.com/advisories/11110; http://securitytracker.com/id?1009397
CVE: CVE-2004-2335
Published: 2004-12-31
Description: The Macromedia installers and e-licensing client on Mac OS X, as used for Macromedia Contribute 2, Director, Dreamweaver, Fireworks, Flash, and Studio, install the AuthenticationService setuid and writable by other users, which allows local users to gain privileges by modifying the program.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/11123; http://www.macromedia.com/devnet/security/security_zone/mpsb04-03.html; http://www.securityfocus.com/bid/9862
CVE: CVE-2004-2336
Published: 2004-12-31
Description: Unknown vulnerability in Novell GroupWise and GroupWise WebAccess 6.0 through 6.5, when running with Apache Web Server 1.3 for NetWare where Apache is loaded using GWAPACHE.CONF, allows remote attackers to read directories and files on the server.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/11119; http://support.novell.com/cgi-bin/search/searchtid.cgi?/10091330.htm; http://www.securityfocus.com/bid/9864
CVE: CVE-2004-2337
Published: 2004-12-31
Description: The /.inlook/.crypt file for inlook 0.7.3 and earlier is installed with world readable permissions, which allows local users to obtain user POP3 credentials.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/10752/; http://www.osvdb.org/3771; http://www.securityfocus.com/bid/9527
CVE: CVE-2004-2338
Published: 2004-12-31
Description: OpenBSD 3.3 and 3.4 does not properly parse Accept and Deny rules without netmasks on big-endian 64-bit platforms such as SPARC64, which may allow remote attackers to bypass access restrictions.
CVSS Score: 7.5 (HIGH)
References: http://www.openbsd.org/errata33.html; http://www.openbsd.org/errata34.html; http://www.securityfocus.com/bid/9867
CVE: CVE-2004-2339
Published: 2004-12-31
Description: Microsoft Windows 2000, XP, and possibly 2003 allows local users with the SeDebugPrivilege privilege to execute arbitrary code as kernel and read or write kernel memory via the NtSystemDebugControl function, which does not verify its pointer arguments.  Note: this issue has been disputed, since Administrator privileges are typically required to exploit this issue, thus privilege boundaries are not crossed
CVSS Score: 8.4 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2004-02/0529.html; http://archives.neohapsis.com/archives/bugtraq/2004-02/0530.html; http://www.securityfocus.com/archive/1/354392
CVE: CVE-2004-2340
Published: 2004-12-31
Description: ** UNVERIFIABLE **  SQL injection vulnerability in PunkBuster Screenshot Database (PB-DB) Alpha 6 allows remote attackers to execute arbitrary SQL commands via the username and password fields of the login form.  NOTE: the original vulnerability report contains several significant inconsistencies that make it unclear whether the report is accurate, including (1) PB-DB is really the "PunkBuster Screenshot Database" and not "PunkBuster" itself; (2) there is no apparent association between PunkBuster and "Punky Brewster"; (3) the claimed source code is not anywhere in Alpha 6.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1009145; http://www.osvdb.org/18981; http://www.securityfocus.com/archive/1/354453
CVE: CVE-2004-2341
Published: 2004-12-31
Description: PHP file include injection vulnerability in isearch.inc.php for iSearch allows remote attackers to execute arbitrary code via the isearch_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securitytracker.com/alerts/2004/Feb/1008900.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/15009; http://www.securitytracker.com/alerts/2004/Feb/1008900.html
CVE: CVE-2004-2342
Published: 2004-12-31
Description: ChatterBox 2.0 allows remote attackers to cause a denial of service (server crash) via a malformed request to the server, as demonstrated using "aaaaaa".
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/10775; http://www.autistici.org/fdonato/advisory/ChatterBox2.0-adv.txt; http://www.osvdb.org/3798
CVE: CVE-2004-2343
Published: 2004-12-31
Description: Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2004-02/0043.html; http://archives.neohapsis.com/archives/bugtraq/2004-02/0064.html; http://archives.neohapsis.com/archives/bugtraq/2004-02/0120.html
CVE: CVE-2004-2344
Published: 2004-12-31
Description: Unknown vulnerability in the ASN.1/H.323/H.225 stack of VocalTec VGW120 and VGW480 allows remote attackers to cause a denial of service.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/bid/10411; http://www.securitylab.ru/45401.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/16240
CVE: CVE-2004-2345
Published: 2004-12-31
Description: Unknown multiple vulnerabilities in Oracle9i Database Server 9.0.1.4, 9.0.1.5, 9.2.0.3, and 9.2.0.4 allow local users with the ability to invoke SQL to cause a denial of service or obtain sensitive information.
CVSS Score: 6.5 (MEDIUM)
References: http://otn.oracle.com/deploy/security/pdf/2004alert64.pdf; http://www.securityfocus.com/bid/9705; https://exchange.xforce.ibmcloud.com/vulnerabilities/15271
CVE: CVE-2004-2346
Published: 2004-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Forum Web Server 1.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the Subject field in post1.htm and (2) the File Description field in postfile2.htm.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securitytracker.com/alerts/2004/Feb/1008896.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/15018; http://www.securitytracker.com/alerts/2004/Feb/1008896.html
CVE: CVE-2004-2347
Published: 2004-12-31
Description: blog.cgi in Leif M. Wright Web Blog 1.1 and 1.1.5 allows remote attackers to execute arbitrary commands via shell metacharacters such as '|' in the file parameter of ViewFile requests.
CVSS Score: 7.5 (HIGH)
References: http://leifwright.com/scripts/Blog.html; http://secunia.com/advisories/10776/; http://www.osvdb.org/3793
CVE: CVE-2004-2348
Published: 2004-12-31
Description: Sybari AntiGen for Domino 7.0 Build 722 SR2 allows remote attackers to cause a denial of service (hang) via an encrypted ZIP file with the "include full path info" option set, as used by certain variants of the Beagle/Bagle worm.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/11120/; http://securitytracker.com/id?1009437; http://www.securityfocus.com/bid/9880
CVE: CVE-2004-2349
Published: 2004-12-31
Description: Multiple SQL injection vulnerabilities in Tunez before 1.20-pre2 allow remote attackers to execute arbitrary SQL queries.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/10770/; http://sourceforge.net/tracker/index.php?func=detail&aid=879391&group_id=2266&atid=102266; http://www.securityfocus.com/bid/9565
CVE: CVE-2004-2350
Published: 2004-12-31
Description: SQL injection vulnerability in search.php for phpBB 1.0 through 2.0.6 allows remote attackers to execute arbitrary SQL and gain privileges via the search_results parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/357442; http://www.securityfocus.com/bid/9883; https://exchange.xforce.ibmcloud.com/vulnerabilities/15475
CVE: CVE-2004-2351
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in GBook for Php-Nuke 1.0 allows remote attackers to inject arbitrary web script or HTML via multiple parameters, including (1) name, (2) email, (3) city, and (4) message, which do not use the <script> and <style> tags, which are filtered by PHP-Nuke.
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1008930; http://www.securityfocus.com/archive/1/352373; http://www.securityfocus.com/bid/9559
CVE: CVE-2004-2352
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in GBook for PHP-Nuke 1.0 allows remote attackers to inject arbitrary web script or HTML via cookies that are stored in the $_COOKIE PHP variable, which is not cleansed by PHP-Nuke.
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1008930; http://www.securityfocus.com/archive/1/352373; http://www.securityfocus.com/bid/9559
CVE: CVE-2004-2353
Published: 2004-12-31
Description: BugPort before 1.099 stores its configuration file (conf/config.conf) under the web document root with a file extension that is not normally parsed by web servers, which allows remote attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/10785/; http://www.incogen.com/downloads/bugport/CHANGELOG.txt; http://www.securityfocus.com/bid/9542
CVE: CVE-2004-2354
Published: 2004-12-31
Description: SQL injection vulnerability in 4nGuestbook 0.92 for PHP-Nuke 6.5 through 6.9 allows remote attackers to modify SQL statements via the entry parameter to modules.php, which can also facilitate cross-site scripting (XSS) attacks when MySQL errors are triggered.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-03/0139.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/15478; http://archives.neohapsis.com/archives/bugtraq/2004-03/0139.html
CVE: CVE-2004-2355
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in Crafty Syntax Live Help (CSLH) before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the name field of a livehelp or chat session.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-06/0054.html; http://secunia.com/advisories/11789; http://www.craftysyntax.com/CHANGELOG.txt
CVE: CVE-2004-2356
Published: 2004-12-31
Description: Early termination vulnerability in Fizmez Web Server 1.0 allows remote attackers to cause a denial of service (crash) by connecting to the server and then disconnecting without sending any data, which triggers a null pointer dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/11141/; http://securitytracker.com/id?1009451; http://www.autistici.org/fdonato/advisory/fws1.0-adv.txt
CVE: CVE-2004-2357
Published: 2004-12-31
Description: The embedded MySQL 4.0 server for Proofpoint Protection Server does not require a password for the root user of MySQL, which allows remote attackers to read or modify the backend database.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]5297&w=2; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9182&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/15280