deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-0290
Published: 2004-11-23
Description: Buffer overflow in Purge Jihad 2.0.1 and earlier allows remote game servers to execute arbitrary code via an information packet that contains large (1) battle type and (2) map name fields.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4362&w=2; http://purge.worthplaying.com/phpbb/viewtopic.php?t=1167; http://www.securityfocus.com/bid/9671
CVE: CVE-2004-0291
Published: 2004-11-23
Description: SQL injection vulnerability in post.php for YaBB SE 1.5.4 and 1.5.5 allows remote attackers to obtain hashed passwords via the quote parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2985&w=2; http://www.securityfocus.com/bid/9674; https://exchange.xforce.ibmcloud.com/vulnerabilities/15224
CVE: CVE-2004-0292
Published: 2004-11-23
Description: Buffer overflow in KarjaSoft Sami HTTP Server 1.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3205&w=2; http://www.security-protocols.com/modules.php?name=News&file=article&sid=1746; http://www.securityfocus.com/bid/9679
CVE: CVE-2004-0293
Published: 2004-11-23
Description: Directory traversal vulnerability in ShopCartCGI 2.3 allows remote attackers to retrieve arbitrary files via a .. (dot dot) in a HTTP request to (1) gotopage.cgi or (2) genindexpage.cgi.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7450&w=2; http://www.securityfocus.com/bid/9670; http://www.zone-h.org/en/advisories/read/id=3962/
CVE: CVE-2004-0294
Published: 2004-11-23
Description: YaBB 1 SP 1.3.1 displays different error messages when a user exists or not, which makes it easier for remote attackers to identify valid users and conduct a brute force password guessing attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-203
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4745&w=2; http://www.securityfocus.com/bid/9677; https://exchange.xforce.ibmcloud.com/vulnerabilities/15236
CVE: CVE-2004-0295
Published: 2004-11-23
Description: TsFtpSrv.exe in Broker FTP 6.1.0.0 allows remote attackers to cause a denial of service (CPU consumption) via an open idle connection.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7241&w=2; http://www.securiteam.com/windowsntfocus/5IP0B0AC1I.html; http://www.securityfocus.com/bid/9680
CVE: CVE-2004-0296
Published: 2004-11-23
Description: TsFtpSrv.exe in Broker FTP 6.1.0.0 allows remote attackers to cause a TsFtpSrv.exe to exit with an exception by opening and immediately closing a connection.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7241&w=2; http://www.securiteam.com/windowsntfocus/5IP0B0AC1I.html; http://www.securityfocus.com/bid/9680
CVE: CVE-2004-0297
Published: 2004-11-23
Description: Buffer overflow in the Lightweight Directory Access Protocol (LDAP) daemon (iLDAP.exe 3.9.15.10) in Ipswitch IMail Server 8.03 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via an LDAP message with a large tag length.
CVSS Score: 10.0 (HIGH)
References: http://www.idefense.com/application/poi/display?id=74; http://www.ipswitch.com/support/imail/releases/imail_professional/im805HF2.html; http://www.kb.cert.org/vuls/id/972334
CVE: CVE-2004-0298
Published: 2004-11-23
Description: CesarFTP 0.99e allows remote attackers to cause a denial of service (CPU consumption) via a long RETR parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8250&w=2; http://www.securityfocus.com/bid/9666; https://exchange.xforce.ibmcloud.com/vulnerabilities/15252
CVE: CVE-2004-0299
Published: 2004-11-23
Description: Buffer overflow in smallftpd 0.99 allows local users to cause a denial of service (crash) via an FTP request with a large number of "/" (slash) characters.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8375&w=2; http://www.securityfocus.com/bid/9684; https://exchange.xforce.ibmcloud.com/vulnerabilities/15262
CVE: CVE-2004-0300
Published: 2004-11-23
Description: SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access via (1) the cat parameter in shop.php, (2) the id parameter in more.php, (3) the cat_manufacturer parameter in shop_by_brand.php, or (4) the id parameter in listing.php.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3185&w=2; http://secunia.com/advisories/10902/; http://securitytracker.com/alerts/2004/Feb/1009092.html
CVE: CVE-2004-0301
Published: 2004-11-23
Description: Cross-site scripting (XSS) vulnerability in more.php for Online Store Kit 3.0 allows remote attackers to inject arbitrary HTML via the id parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/10902/; http://securitytracker.com/alerts/2004/Feb/1009079.html; http://www.securityfocus.com/bid/9676
CVE: CVE-2004-0302
Published: 2004-11-23
Description: Directory traversal vulnerability in OWLS 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the (1) file parameter in index.php, (2) editfile in glossary.php, or (3) editfile in newmultiplechoice.php.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5706&w=2; http://www.securityfocus.com/bid/9689; http://www.zone-h.org/en/advisories/read/id=3973/
CVE: CVE-2004-0303
Published: 2004-11-23
Description: OWLS 1.0 allows remote attackers to retrieve arbitrary files via absolute pathnames in (1) the file parameter in /glossaries/index.php, (2) the filename parameter in /readings/index.php, or (3) the filename parameter in /multiplechoice/resultsignore.php, as demonstrated using /etc/passwd.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5706&w=2; http://www.securityfocus.com/bid/9689; http://www.zone-h.org/en/advisories/read/id=3973/
CVE: CVE-2004-0304
Published: 2004-11-23
Description: SQL injection vulnerability in browse_items.asp in WebCortex WebStores 2000 6.0 allows remote attackers to gain unauthorized access and execute arbitrary commands via the Search_Text parameter.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5226&w=2; http://www.s-quadra.com/advisories/Adv-20040218.txt; http://www.securityfocus.com/bid/7766
CVE: CVE-2004-0305
Published: 2004-11-23
Description: Cross-site scripting (XSS) vulnerability in error.asp in WebCortex WebStores 2000 6.0 allows remote attackers to execute arbitrary script as other users and steal session IDs via the Message_id parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5226&w=2; http://www.securityfocus.com/bid/9693; https://exchange.xforce.ibmcloud.com/vulnerabilities/15254
CVE: CVE-2004-0306
Published: 2004-11-23
Description: Cisco ONS 15327 before 4.1(3), ONS 15454 before 4.6(1), ONS 15454 SD before 4.1(3), and Cisco ONS 15600 before 1.3(0) enable TFTP service on UDP port 69 by default, which allows remote attackers to GET or PUT ONS system files on the current active TCC in the /flash0 or /flash1 directories.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/cisco-sa-20040219-ONS.shtml; http://www.securityfocus.com/bid/9699; https://exchange.xforce.ibmcloud.com/vulnerabilities/15264
CVE: CVE-2004-0307
Published: 2004-11-23
Description: Cisco ONS 15327 before 4.1(3), ONS 15454 before 4.6(1), and ONS 15454 SD before 4.1(3) allows remote attackers to cause a denial of service (reset) by not sending the ACK portion of the TCP three-way handshake and sending an invalid response instead.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/cisco-sa-20040219-ONS.shtml; http://www.osvdb.org/4009; http://www.securityfocus.com/bid/9699
CVE: CVE-2004-0309
Published: 2004-11-23
Description: Stack-based buffer overflow in the SMTP service support in vsmon.exe in Zone Labs ZoneAlarm before 4.5.538.001, ZoneLabs Integrity client 4.0 before 4.0.146.046, and 4.5 before 4.5.085, allows remote attackers to execute arbitrary code via a long RCPT TO argument.
CVSS Score: 10.0 (HIGH)
References: http://download.zonelabs.com/bin/free/securityAlert/8.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7427&w=2; http://www.ciac.org/ciac/bulletins/o-084.shtml
CVE: CVE-2004-0310
Published: 2004-11-23
Description: Cross-site scripting (XSS) vulnerability in LiveJournal 1.0 and 1.1 allows remote attackers to execute Javascript as other users via the stylesheet, which does not strip the semicolon or parentheses, as demonstrated using a background:url.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0820&w=2; http://www.securityfocus.com/bid/9700; https://exchange.xforce.ibmcloud.com/vulnerabilities/15268
CVE: CVE-2004-0311
Published: 2004-11-23
Description: American Power Conversion (APC) Web/SNMP Management SmartSlot Card 3.0 through 3.0.3 and 3.21 are shipped with a default password of TENmanUFactOryPOWER, which allows remote attackers to gain unauthorized access.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1367&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3565&w=2; http://nam-en.apc.com/cgi-bin/nam_en.cfg/php/enduser/std_adp.php?p_faqid=3131&p_created=[PII_REDACTED]
CVE: CVE-2004-0312
Published: 2004-11-23
Description: Linksys WAP55AG 1.07 allows remote attackers with access to an SNMP read only community string to gain access to read/write communtiy strings via a query for OID 1.3.6.1.4.1.3955.2.1.13.1.2.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4233&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2131&w=2; http://www.securityfocus.com/bid/9688
CVE: CVE-2004-0313
Published: 2004-11-23
Description: Buffer overflow in PSOProxy 0.91 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP request, as demonstrated using a long (1) GET argument or (2) method name.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0261&w=2; http://www.securityfocus.com/bid/9706; https://exchange.xforce.ibmcloud.com/vulnerabilities/15275
CVE: CVE-2004-0314
Published: 2004-11-23
Description: Cross-site scripting (XSS) vulnerability in done.jsp in WebzEdit 1.9 and earlier allows remote attackers to execute arbitrary script as other users via the message parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4146&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/15289; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4146&w=2
CVE: CVE-2004-0315
Published: 2004-11-23
Description: Buffer overflow in Avirt Voice 4.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long GET request on port 1080.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9841&w=2; http://www.securityfocus.com/bid/9721; https://exchange.xforce.ibmcloud.com/vulnerabilities/15288
CVE: CVE-2004-0316
Published: 2004-11-23
Description: Buffer overflow in Avirt Soho 4.3 allows remote attackers to cause a denial of service (crash) via (1) a large GET request to port 1080 or (2) a large GET request of % characters to port 8080.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1194&w=2; http://www.securityfocus.com/bid/9722; http://www.securityfocus.com/bid/9723
CVE: CVE-2004-0317
Published: 2004-11-23
Description: Buffer overflow in eauth in Load Sharing Facility 4.x, 5.x, and 6.x allows local users or remote attackers within the LSF cluster to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long LSF_From_PC parameter.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1236&w=2; http://www.securityfocus.com/bid/9719; https://exchange.xforce.ibmcloud.com/vulnerabilities/15282
CVE: CVE-2004-0318
Published: 2004-11-23
Description: Load Sharing Facility (LSF) 4.x, 5.x, and 6.x uses the LSF_EAUTH_UID environment variable, if it exists, instead of the real UID of the user, which could allow remote attackers within the local cluster to gain privileges.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3557&w=2; http://www.securityfocus.com/bid/9724; https://exchange.xforce.ibmcloud.com/vulnerabilities/15278
CVE: CVE-2004-0319
Published: 2004-11-23
Description: Cross-site scripting (XSS) vulnerability in the font tag in ezBoard 7.3u allows remote attackers to execute arbitrary script as other users, as demonstrated using the background:url in a (1) font color or (2) font face argument.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7140&w=2; http://www.securityfocus.com/bid/9725; https://exchange.xforce.ibmcloud.com/vulnerabilities/15287
CVE: CVE-2004-0320
Published: 2004-11-23
Description: Unknown vulnerability in nCipher Hardware Security Modules (HSM) 1.67.x through 1.99.x allows local users to access secrets stored in the module's run-time memory via certain sequences of commands.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8249&w=2; http://www.osvdb.org/4055; http://www.securityfocus.com/bid/9717
CVE: CVE-2004-0321
Published: 2004-11-23
Description: Team Factor 1.25 and earlier allows remote attackers to cause a denial of service (crash) via a packet that uses a negative number to specify the size of the data block that follows, which causes Team Factor to read unallocated memory.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2888&w=2; http://www.securityfocus.com/bid/9708; http://www.zone-h.org/advisories/read/id=4006
CVE: CVE-2004-0326
Published: 2004-11-23
Description: Buffer overflow in the web proxy for GateKeeper Pro 4.7 allows remote attackers to execute arbitrary code via a long GET request.
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-February/017703.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0728&w=2; http://www.securityfocus.com/bid/9716
CVE: CVE-2004-0327
Published: 2004-11-23
Description: Directory traversal vulnerability in functions.php in PhpNewsManager 1.46 allows remote attackers to retrieve arbitrary files via ..  (dot dot) sequences in the clang parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1000&w=2; http://www.securityfocus.com/bid/9720; http://www.zone-h.org/advisories/read/id=4024
CVE: CVE-2004-0328
Published: 2004-11-23
Description: Gigabyte Gn-B46B 2.4Ghz wireless broadband router firmware 1.003.00 allows local users on the same local network as the router to bypass authentication by using a copy of the router's html menu on a separate system.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7942&w=2; http://www.securityfocus.com/bid/9740; https://exchange.xforce.ibmcloud.com/vulnerabilities/15313
CVE: CVE-2004-0329
Published: 2004-11-23
Description: FreeChat 1.1.1a allows remote attackers to cause a denial of service (crash) via certain unexpected strings, as demonstrated using "aaaaa".
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1074&w=2; http://www.securityfocus.com/bid/9744; https://exchange.xforce.ibmcloud.com/vulnerabilities/15321
CVE: CVE-2004-0330
Published: 2004-11-23
Description: Buffer overflow in Serv-U ftp before 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4399&w=2; http://www.cnhonker.com/advisory/serv-u.mdtm.txt; http://www.securityfocus.com/bid/9751
CVE: CVE-2004-0331
Published: 2004-11-23
Description: Heap-based buffer overflow in Dell OpenManage Web Server 3.4.0 allows remote attackers to cause a denial of service (crash) via a HTTP POST with a long application variable.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9143&w=2; http://sh0dan.org/files/domadv.txt; http://www.securityfocus.com/bid/9750
CVE: CVE-2004-0332
Published: 2004-11-23
Description: Extremail 1.5.9 does not check passwords correctly when they are all digits or begin with a digit, which allows remote attackers to gain privileges.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7850&w=2; http://www.securityfocus.com/bid/9754; https://exchange.xforce.ibmcloud.com/vulnerabilities/15329
CVE: CVE-2004-0333
Published: 2004-11-23
Description: Buffer overflow in the UUDeview package, as used in WinZip 6.2 through WinZip 8.1 SR-1, and possibly other packages, allows remote attackers to execute arbitrary code via a MIME archive with certain long MIME parameters.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/10995; http://secunia.com/advisories/11019; http://www.ciac.org/ciac/bulletins/o-092.shtml
CVE: CVE-2004-0334
Published: 2004-11-23
Description: InnoMedia VideoPhone allows remote attackers to bypass Basic Authorization via an HTTP request to (1) videophone_admindetail.asp, (2) videophone_syscfg.asp, (3) videophone_upgrade.asp, or (4) videophone_sysctrl.asp that contains a trailing / (slash).  NOTE: the original report mentioned AXIS 2100 Network Camera, but this was likely a cut-and-paste error.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1784&w=2; http://securitytracker.com/alerts/2004/Mar/1009522.html; http://www.osvdb.org/4809
CVE: CVE-2004-0335
Published: 2004-11-23
Description: LAN SUITE Web Mail 602Pro, when configured to use the "Directory browsing" feature, allows remote attackers to obtain a directory listing via an HTTP request to (1) index.html, (2) cgi-bin/, or (3) users/.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-03/0096.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0302&w=2; http://www.securityfocus.com/bid/9780
CVE: CVE-2004-0336
Published: 2004-11-23
Description: LAN SUITE Web Mail 602Pro allows remote attackers to gain sensitive information via the mail login form, which contains the path to the mail directory.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-03/0096.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0302&w=2; http://www.securityfocus.com/bid/9781
CVE: CVE-2004-0337
Published: 2004-11-23
Description: Cross-site scripting (XSS) vulnerability in LAN SUITE Web Mail 602Pro allows remote attackers to execute arbitrary script or HTML as other users via a URL to index.html, followed by a / (slash) and the desired script.  NOTE: the vendor states that this bug could not be reproduced, so this issue may be REJECTed in the future.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-03/0096.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0302&w=2; http://www.securityfocus.com/bid/9777
CVE: CVE-2004-0338
Published: 2004-11-23
Description: SQL injection vulnerability in search.php for Invision Board Forum allows remote attackers to execute arbitrary SQL queries via the st parameter.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8834&w=2; http://www.securityfocus.com/bid/9766; https://exchange.xforce.ibmcloud.com/vulnerabilities/15343
CVE: CVE-2004-0339
Published: 2004-11-23
Description: Cross-site scripting (XSS) vulnerability in ViewTopic.php in phpBB, possibly 2.0.6c and earlier, allows remote attackers to execute arbitrary script or HTML as other users via the postorder parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0700&w=2; http://www.securityfocus.com/bid/9765; https://exchange.xforce.ibmcloud.com/vulnerabilities/15348
CVE: CVE-2004-0340
Published: 2004-11-23
Description: Stack-based buffer overflow in WFTPD Pro Server 3.21 Release 1, Pro Server 3.20 Release 2, Server 3.21 Release 1, and Server 3.10 allows local users to execute arbitrary code via long (1) LIST, (2) NLST, or (3) STAT commands.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4699&w=2; http://secunia.com/advisories/11001; http://www.securityfocus.com/bid/9767
CVE: CVE-2004-0341
Published: 2004-11-23
Description: WFTPD Pro Server 3.21 Release 1 allocates memory for a command until a 0Ah byte (newline) is sent, which allows local users to cause a denial of service (CPU consumption) by continuing to send a long command that does not contain a newline.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4976&w=2; http://secunia.com/advisories/11001; http://www.osvdb.org/4115
CVE: CVE-2004-0342
Published: 2004-11-23
Description: WFTPD Pro Server 3.21 Release 1, with the XeroxDocutech option enabled, allows local users to cause a denial of service (crash) via a (1) MKD or (2) XMKD command that causes an absolute path of 260 characters to be used, which overwrites a cookie with a null character, possibly due to an off-by-one error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-193
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4976&w=2; http://secunia.com/advisories/11001; http://www.osvdb.org/4116
CVE: CVE-2004-0343
Published: 2004-11-23
Description: Multiple SQL injection vulnerabilities in YaBB SE 1.5.4 through 1.5.5b allow remote attackers to execute arbitrary SQL via (1) the msg parameter in ModifyMessage.php or (2) the postid parameter in ModifyMessage.php.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3083&w=2; http://www.securityfocus.com/bid/9774; https://exchange.xforce.ibmcloud.com/vulnerabilities/15354
CVE: CVE-2004-0344
Published: 2004-11-23
Description: Directory traversal vulnerability in ModifyMessage.php in YaBB SE 1.5.4 through 1.5.5b allows remote attackers to delete arbitrary files via a .. (dot dot) in the attachOld parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3083&w=2; http://www.securityfocus.com/bid/9774; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3083&w=2
CVE: CVE-2004-0345
Published: 2004-11-23
Description: Buffer overflow in Red Faction client 1.20 and earlier allows remote servers to execute arbitrary code via a long server name.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1923&w=2; http://www.securityfocus.com/bid/9775; https://exchange.xforce.ibmcloud.com/vulnerabilities/15353
CVE: CVE-2004-0346
Published: 2004-11-23
Description: Off-by-one buffer overflow in _xlate_ascii_write() in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-193
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7240&w=2; http://www.securityfocus.com/bid/9782; https://exchange.xforce.ibmcloud.com/vulnerabilities/15387
CVE: CVE-2004-0347
Published: 2004-11-23
Description: Cross-site scripting (XSS) vulnerability in delhomepage.cgi in NetScreen-SA 5000 Series running firmware 3.3 Patch 1 (build 4797) allows remote authenticated users to execute arbitrary script as other users via the row parameter.
CVSS Score: 6.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018120.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4112&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2190&w=2
CVE: CVE-2004-0348
Published: 2004-11-23
Description: SQL injection vulnerability in viewCart.asp in SpiderSales shopping cart software allows remote attackers to execute arbitrary SQL via the userId parameter.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5486&w=2; http://www.s-quadra.com/advisories/Adv-20040303.txt; http://www.securityfocus.com/bid/9799
CVE: CVE-2004-0349
Published: 2004-11-23
Description: Directory traversal vulnerability in GWeb HTTP Server 0.6 allows remote attackers to view arbitrary files via a .. (dot dot) in the URL.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7397&w=2; http://www.securityfocus.com/bid/9742; https://exchange.xforce.ibmcloud.com/vulnerabilities/15381