yahoo-inc/cve-impacts huggingface dataset:
CVE-2004-2134: Oracle toplink mapping workBench uses a weak encryption algorithm for passwords, which allows local users to decrypt the passwords.
Key phrases: decrypt the passwords, weak encryption algorithm, decrypt password
CVE-2004-2135: cryptoloop on Linux kernel 2.6.x, when used on certain file systems with a block size 1024 or greater, has certain "IV computation" weaknesses that allow watermarked files to be detected without decryption.
Key phrases: be detected without decryption
CVE-2004-2136: dm-crypt on Linux kernel 2.6.x, when used on certain file systems with a block size 1024 or greater, has certain "IV computation" weaknesses that allow watermarked files to be detected without decryption.
Key phrases: be detected without decryption, iv computation weaknesses
CVE-2004-2137: Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" setting, leaks the BCC recipients of the message to the addresses listed in the To and CC fields, which may allow remote attackers to obtain sensitive information.
Key phrases: obtain sensitive information
CVE-2004-2138: Cross-site scripting (XSS) vulnerability in AWSguest.php in AllWebScripts MySQLGuest allows remote attackers to inject arbitrary HTML and PHP code via the (1) Name, (2) Email, (3) Homepage or (4) Comments field.
Key phrases: inject arbitrary HTML, inject arbitrary HTML and PHP code via the, cross-site scripting (xss)
CVE-2004-2139: Unknown vulnerability in Adminedit.pl YaBB 1 Gold before 1.3.2 allows attackers to execute arbitrary code via settings.pl.
Key phrases: execute arbitrary code, execute arbitrary code via settings.pl, unknown
CVE-2004-2140: CRLF injection vulnerability in YaBB 1 Gold before 1.3.2 allows remote attackers to modify text file contents via the subject variable.
Key phrases: modify text file contents via the subject variable, crlf injection
CVE-2004-2142: Unknown vulnerability in the remote tape support (remote.c) in the RMT client for Jorg Schilling sdd 1.28 and 1.31 has unknown impact and attack vectors.
Key phrases: unknown, unknown impact
CVE-2004-2143: SQL injection vulnerability in the ReMOSitory Server add-on module to Mambo Portal 4.5.1 (1.09) and earlier allows remote attackers to execute arbitrary SQL commands via the filecatid parameter in the com_remository option.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the filecatid parameter, sql injection, arbitrary sql commands
CVE-2004-2144: Baal Smart Forms before 3.2 allows remote attackers to bypass authentication and obtain system access via a direct request to regadmin.php.
Key phrases: bypass authentication, obtain system access, bypass authentication and obtain system access via a, baal smart forms
CVE-2004-2145: SQL injection vulnerability in PD9 Software MegaBBS 2 and 2.1 allows remote attackers to execute arbitrary SQL commands via the (1) sortdir or (2) criteria parameter to ladder-log.asp or the (3) memberid or (4) teamid parameter to view-profile.asp.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the (1, sql injection, arbitrary sql commands
CVE-2004-2146: CRLF injection vulnerability in PD9 Software MegaBBS 2 and 2.1 allows attackers to conduct HTTP response splitting attacks via the fid parameter in a writenew action to thread-post.asp.
Key phrases: conduct HTTP response splitting attacks via the fid, crlf injection, http response splitting
CVE-2004-2147: Unknown versions of Symantec Norton AntiVirus and Microsoft Outlook allow attackers to cause a denial of service (crash) via malformed e-mail messages (1) without a body or (2) without a carriage return ("\\n") separating the headers from the body.
Key phrases: denial of service (crash), cause a denial of service (crash), malformed e-mail messages
CVE-2004-2148: Unknown local vulnerability in the "change user" feature of Slava Astashonok Fprobe 1.0.5 and earlier has unknown impact and attack vectors.
Key phrases: unknown local, unknown impact
CVE-2004-2149: Buffer overflow in the prepared statements API in libmysqlclient for MySQL 4.1.3 beta and 4.1.4 allows remote attackers to cause a denial of service via a large number of placeholders.
Key phrases: cause a denial of service via a large, buffer overflow
CVE-2004-2150: Nettica Corporation INTELLIPEER Email Server 1.01 displays different error messages for valid and invalid account names, which allows remote attackers to determine valid account names.
Key phrases: determine valid account names
CVE-2004-2151: Chatman 1.1.1 RC1 and earlier allows remote attackers to cause a denial of service (memory consumption or application crash) via a very large data size.
Key phrases: denial of service (memory consumption or application crash), cause a denial of service (memory consumption, large data size
CVE-2004-2152: Cross-site scripting (XSS) vulnerability in 'raw' page output mode for MediaWiki 1.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML.
Key phrases: inject arbitrary web script or HTML, cross-site scripting (xss)
CVE-2004-2153: Multiple unknown vulnerabilities in Real Estate Management Software 1.0 have unknown impact and attack vectors.
Key phrases: multiple unknown, unknown impact
CVE-2004-2154: CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive.
Key phrases: bypass intended ACLs via a printer name containing uppercase
CVE-2004-2155: Online-bookmarks before 0.4.6 allows remote attackers to bypass its authentication mechanism via a direct request to (1) config/*, (2) bookmarks.php, (3) footer.php, (4) main.php, (5) tree.php, or (6) functions.php.
Key phrases: bypass its authentication, bypass its authentication mechanism via a direct request, bypass authentication
CVE-2004-2156: Multiple unknown vulnerabilities in Online Recruitment Agency 1.0 have unknown impact and attack vectors.
Key phrases: multiple unknown, unknown impact
CVE-2004-2157: Cross-site scripting (XSS) vulnerability in Comment.php in Serendipity 0.7 beta1, and possibly other versions before 0.7-beta3, allows remote attackers to inject arbitrary HTML and PHP code via the (1) email or (2) username field.
Key phrases: inject arbitrary HTML, inject arbitrary HTML and PHP code via the, cross-site scripting (xss)
CVE-2004-2158: SQL injection vulnerability in Serendipity 0.7-beta1 allows remote attackers to execute arbitrary SQL commands via the entry_id parameter to (1) exit.php or (2) comment.php.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the entry_id parameter, sql injection
CVE-2004-2159: Multiple buffer overflows in XMLStarlet Command Line XML Toolkit 0.9.3 have unknown impact and attack vectors via (1) xml_elem.c and (2) xml_select.c.
Key phrases: multiple buffer overflows, unknown impact
CVE-2004-2160: Format string vulnerability in xml_elem.c for XMLStarlet Command Line XML Toolkit 0.9.3 may allow attackers to cause a denial of service or execute arbitrary code.
Key phrases: execute arbitrary code, cause a denial of service or execute arbitrary, format string
CVE-2004-2161: SQL injection vulnerability in file_overview.php in TUTOS 1.1 allows remote attackers to execute arbitrary SQL commands via the link_id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the link_id parameter, sql injection
CVE-2004-2162: Multiple cross-site scripting (XSS) vulnerabilities in TUTOS 1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the search field of the Address Module or (2) the t parameter to app_new.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via (, cross-site scripting (xss)
CVE-2004-2163: login_radius on OpenBSD 3.2, 3.5, and possibly other versions does not verify the shared secret in a response packet from a RADIUS server, which allows remote attackers to bypass authentication by spoofing server replies.
Key phrases: bypass authentication, bypass authentication by spoofing server replies
CVE-2004-2164: shoprestoreorder.asp in VP-ASP 5.0 does not close the database connection when a user restores a previous order, which allows remote attackers to cause a denial of service (connection consumption).
Key phrases: denial of service (connection consumption), cause a denial of service (connection consumption
CVE-2004-2165: Lords of the Realm III 1.01 and earlier, when in the lobby stage, allows remote attackers to cause a denial of service (crash from unallocated memory write) via a long user nickname.
Key phrases: denial of service (crash from unallocated memory write), cause a denial of service (crash from, long user nickname
CVE-2004-2166: The print-from-email feature in the Canon ImageRUNNER (iR) 5000i and C3200 digital printer, when not using IP address range filtering, allows remote attackers to print arbitrary text without authentication via a text/plain email to TCP port 25.
Key phrases: print arbitrary text, print arbitrary text without authentication via a text
CVE-2004-2167: Multiple buffer overflows in LaTeX2rtf 1.9.15, and possibly other versions, allow remote attackers to execute arbitrary code via (1) the expandmacro function, and possibly (2) Environments and (3) TranslateCommand.
Key phrases: execute arbitrary code, execute arbitrary code via (1) the, buffer overflows
CVE-2004-2168: BaSoMail 1.24 allows remote attackers to cause a denial of service (CPU consumption) via multiple connections to TCP port (1) 25 (SMTP) or (2) 110 (POP3).
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, cpu consumption
CVE-2004-2169: Application Access Server (A-A-S) 1.0.37 and earlier allows remote authenticated users to cause a denial of service (application crash) via a long file request.
Key phrases: denial of service (application crash), cause a denial of service (application crash
CVE-2004-2170: Directory traversal vulnerability in sample_showcode.html in Caravan 2.00/03d and earlier allows remote attackers to read arbitrary files via the fname parameter.
Key phrases: read arbitrary files, read arbitrary files via the fname parameter, directory traversal
CVE-2004-2171: Cross-site scripting (XSS) vulnerability in Cherokee before 0.4.8 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting error page.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-2172: EarlyImpact ProductCart uses a weak encryption scheme to encrypt passwords, which allows remote attackers to obtain the password via a chosen plaintext attack.
Key phrases: obtain the password, obtain the password via a chosen plaintext attack, earlyimpact, weak encryption scheme
CVE-2004-2173: SQL injection vulnerability in advSearch_h.asp in EarlyImpact ProductCart allows remote attackers to execute arbitrary SQL commands via the priceUntil parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the priceUntil parameter, sql injection, earlyimpact
CVE-2004-2174: Cross-site scripting (XSS) vulnerability in Custva.asp in EarlyImpact ProductCart allows remote attackers to inject arbitrary Javascript via the redirectUrl parameter.
Key phrases: inject arbitrary Javascript, inject arbitrary Javascript via the redirectUrl parameter, cross-site scripting (xss)
CVE-2004-2175: Multiple SQL injection vulnerabilities in ReviewPost PHP Pro allow remote attackers to execute arbitrary SQL commands via the (1) product parameter to showproduct.php or (2) cat parameter to showcat.php.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the (1, sql injection, arbitrary sql commands
CVE-2004-2176: The Internet Connection Firewall (ICF) in Microsoft Windows XP SP2 is configured by default to trust sessmgr.exe, which allows local users to use sessmgr.exe to create a local listening port that bypasses the ICF access controls.
Key phrases: use sessmgr.exe to create a local listening port
CVE-2004-2177: Cross-site scripting (XSS) vulnerability in DevoyBB Web Forum 1.0.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unknown, cross-site scripting (xss), unknown vectors
CVE-2004-2178: SQL injection vulnerability in DevoyBB Web Forum 1.0.0 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unknown vectors, sql injection
CVE-2004-2179: asycpict.dll, as used in Microsoft products such as Front Page 97 and 98, allows remote attackers to cause a denial of service (hang) via a JPEG image with maximum height and width values.
Key phrases: denial of service (hang), cause a denial of service (hang)
CVE-2004-2180: Multiple cross-site scripting (XSS) vulnerabilities in WowBB Forum 1.61 allow remote attackers to inject arbitrary web script or HTML via the (1) country parameter to view_user.php, (2) show parameter to view_forum.php, (3) letter parameter to view_user.php, (4) highlight parameter to view_topic.php, (5) show parameter to index.php, (6) q parameter to search.php, (7) Referer header to admin.php, or the (8) user_email parameter to login.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-2181: Multiple SQL injection vulnerabilities in WowBB Forum 1.61 allow remote attackers to execute arbitrary SQL commands via the (1) sort_by or (2) page parameters to view_user.php, or the (3) forum_id parameter to view_topic.php.  NOTE: the sort_by vector was later reported to be present in WowBB 1.65.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the (1, sql injection, sort_by vector
CVE-2004-2182: Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server.
Key phrases: hijack user sessions by pre-setting the, session fixation
CVE-2004-2183: Unknown vulnerability in WeHelpBUS 0.1 allows remote attackers to execute arbitrary shell commands via the query string.
Key phrases: execute arbitrary shell commands, execute arbitrary shell commands via the query string, unknown
CVE-2004-2184: Directory traversal vulnerability in Digicraft Yak! server 2.0 through 2.1.2 allows remote attackers to read or write arbitrary files via "../" or "..\\" sequences in commands such as (1) dir or (2) put.
Key phrases: write arbitrary files, read or write arbitrary files via ".., directory traversal
CVE-2004-2185: Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki 1.3.5 allow remote attackers to execute arbitrary scripts and/or SQL queries via (1) the UnicodeConverter extension, (2) raw page views, (3) SpecialIpblocklist, (4) SpecialEmailuser, (5) SpecialMaintenance, and (6) ImagePage.
Key phrases: execute arbitrary scripts, execute arbitrary scripts and/or SQL queries via (, cross-site scripting (xss), raw page views, specialipblocklist, specialemailuser, specialmaintenance
CVE-2004-2186: SQL injection vulnerability in MediaWiki 1.3.5 allows remote attackers to execute arbitrary SQL commands via SpecialMaintenance.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via SpecialMaintenance, sql injection
CVE-2004-2187: Unknown vulnerability in ImagePage for MediaWiki 1.3.5, related to "filename validation," has unknown impact and attack vectors.
Key phrases: unknown vulnerability in imagepage for mediawiki, unknown impact
CVE-2004-2188: Cross-site scripting (XSS) vulnerability in DMXReady Site Chassis Manager allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unknown, cross-site scripting (xss)
CVE-2004-2189: SQL injection vulnerability in DMXReady Site Chassis Manager allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unknown vectors, sql injection
CVE-2004-2190: Directory traversal vulnerability in Unzoo 4.4-2 has unknown impact and attack vectors.
Key phrases: directory traversal, unknown impact
CVE-2004-2191: Cross-site scripting (XSS) vulnerability in ttt-webmaster.php in Turbo Traffic Trader PHP 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) msg[0] or (2) siteurl parameters.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-2192: SQL injection vulnerability in tttadmin/settings.php in Turbo Traffic Trader PHP 1.0 allows remote attackers to execute arbitrary SQL commands via the ttt_admin parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the ttt_admin parameter, sql injection, arbitrary sql commands
CVE-2004-2193: Cross-site scripting (XSS) vulnerability in trade.php for CJOverkill 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the (1) tms[0] or (2) url parameters.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-2194: MailEnable Professional Edition before 1.53 and Enterprise Edition before 1.02 allows remote attackers to cause a denial of service (crash) via malformed (1) SMTP or (2) IMAP commands.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2004-2195: PHP remote file inclusion vulnerability in index.php in Zanfi CMS lite 1.1 allows remote attackers to execute arbitrary PHP code via the inc parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the inc parameter, php remote file inclusion, arbitrary php code
CVE-2004-2196: Zanfi CMS lite 1.1 allows remote attackers to obtain the full path of the web server via direct requests without required arguments to (1) adm_pages.php, (2) corr_pages.php, (3) del_block.php, (4) del_page.php, (5) footer.php, (6) home.php, and others.
Key phrases: obtain the full path of the web server, direct requests
CVE-2004-2197: kdocker.cpp in kdocker 0.1 through 0.8 does not properly check the ownership of files, which could allow local users to execute arbitrary programs.
Key phrases: execute arbitrary programs
CVE-2004-2198: account.asp in DUware DUclassmate 1.0 through 1.1 allows remote attackers to change the passwords for arbitrary users by modifying the MM_recordId parameter on the "My Account" page.
Key phrases: change the passwords for arbitrary users by modifying
CVE-2004-2199: Cross-site scripting (XSS) vulnerability in DUware DUclassified 4.0 allows remote attackers to inject arbitrary web script or HTML via the message text.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-2200: Cross-site scripting (XSS) vulnerability in DUware DUforum 3.0 through 3.1 allows remote attackers to inject arbitrary web script or HTML via via the message text.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via via, cross-site scripting (xss)
CVE-2004-2201: SQL injection vulnerability in DUware DUforum 3.0 through 3.1 allows remote attackers to execute arbitrary SQL commands via the FOR_ID parameter in messages.asp, (2) MSG_ID parameter in messageDetail.asp, or (3) password parameter in the login form.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the FOR_ID parameter, sql injection
CVE-2004-2202: Multiple SQL injection vulnerabilities in DUware DUclassified 4.0 through 4.2 allows remote attackers to bypass authentication and execute other commands on the server's underlying database via the (1) cat_id or (2) sub_id parameters in adDetail.asp, or (2) the password parameter in the login form.
Key phrases: bypass authentication, bypass authentication and execute other commands on the, sql injection, execute commands
CVE-2004-2203: Ansel 1.2 through 2.0 uses insecure default permissions, which allows remote attackers to gain access to web readable directories.
Key phrases: gain access, gain access to web readable directories, insecure default permissions
CVE-2004-2204: Macromedia ColdFusion MX 6.0 and 6.1 application server, when running with the CreateObject function or CFOBJECT tag enabled, allows local users to conduct unauthorized activities and obtain administrative passwords by creating CFML scripts that use CreateObject or CFOBJECT.
Key phrases: obtain administrative passwords, conduct unauthorized activities and obtain administrative passwords by
CVE-2004-2205: Unknown vulnerability in Veritas Cluster Server 1.0.1 through 4.0 allows local users to gain root access via unspecified vectors.
Key phrases: gain root access, gain root access via unspecified vectors, unknown
CVE-2004-2206: SQL injection vulnerability in NatterChat 1.12 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unknown vectors, sql injection
CVE-2004-2207: Cross-site scripting (XSS) vulnerability in Ideal Science IdealBB 1.4.9 through 1.5.3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unknown, cross-site scripting (xss), unknown vectors
CVE-2004-2208: CRLF injection vulnerability in Ideal Science IdealBB 1.4.9 through 1.5.3 allows remote attackers to conduct HTTP response splitting attacks via unknown vectors.
Key phrases: conduct HTTP response splitting attacks via unknown vectors, crlf injection, http response splitting
CVE-2004-2209: SQL injection vulnerability in Ideal Science IdealBB 1.4.9 through 1.5.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unknown vectors, sql injection
CVE-2004-2210: Multiple cross-site scripting (XSS) vulnerabilities in Express-Web Content Management System (CMS) allow remote attackers to steal cookie-based authentication information and possibly perform other exploits via the (1) n, (2) b, (3) e, or (4) a parameters to default.asp, (5) the Referer header in an HTTP request to login.asp, or (6) the email parameter to subscribe/default.asp.
Key phrases: steal cookie-based authentication information and possibly, cross-site scripting (xss)
CVE-2004-2211: Cross-site scripting (XSS) vulnerability in AliveSites Forums 2.0 allows remote attackers to inject arbitrary web script or HTML via the (1) forum_id, (2) method, or (3) forum_title parameters to post.asp, (4) the forum_title parameter to forum.asp, or (5) the id parameter to post.asp.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-2212: SQL injection vulnerability in forum.asp in AliveSites Forums 2.0 allows remote attackers to execute arbitrary SQL commands via the forum_id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the forum_id parameter, sql injection
CVE-2004-2213: Mbedthis AppWeb HTTP server before 1.1.3 allows remote attackers to obtain the source code for scripts via a (1) trailing dot (".") or (2) trailing space in an HTTP request.
Key phrases: obtain the source code for scripts via a
CVE-2004-2214: Mbedthis AppWeb HTTP server before 1.1.3 allows remote attackers to bypass access restrictions via a URI with mixed case characters.
Key phrases: bypass access restrictions, bypass access restrictions via a URI with mixed, uri with mixed case characters
CVE-2004-2215: RXVT-Unicode 3.4 and 3.5 does not properly close file descriptors, which allows local users to access the terminals of other users and possibly gain privileges.
Key phrases: gain privileges, access the terminals of other users and possibly, file descriptors
CVE-2004-2216: Unknown vulnerability in Sun Java System Web Server 6.0 SP7 and earlier and 6.1 SP1 and earlier, and Application Server 7 Update 4 and earlier, allows remote attackers to cause a denial of service (crash) via a malformed client certificate.
Key phrases: denial of service (crash), cause a denial of service (crash), unknown
CVE-2004-2217: Multiple unknown vulnerabilities in yhttpd in yChat before 0.7 allow remote attackers to cause a denial of service (segmentation fault) via unknown vectors.
Key phrases: denial of service (segmentation fault), cause a denial of service (segmentation fault, multiple unknown, unknown vectors
CVE-2004-2218: SQL injection vulnerability in pmwh.php in PHPMyWebHosting 0.3.4 and earlier allows remote attackers to modify SQL statements via the password parameter.
Key phrases: modify SQL statements via the password parameter, sql injection
CVE-2004-2219: Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar to facilitate phishing attacks via Javascript that uses an invalid URI, modifies the Location field, then uses history.back to navigate to the previous domain, aka NullyFake.
Key phrases: spoof the address bar to facilitate phishing attacks, invalid uri, spoofing
CVE-2004-2220: F-Secure Anti-Virus for Microsoft Exchange 6.30 and 6.31 does not properly detect certain password-protected files in a ZIP file, which allows remote attackers to bypass anti-virus protection.
Key phrases: bypass anti-virus protection
CVE-2004-2221: Buffer overflow in SoftCart.exe in Mercantec SoftCart 4.00b allows remote attackers to execute arbitrary code via a long parameter in an HTTP GET request.
Key phrases: execute arbitrary code, execute arbitrary code via a long parameter in, buffer overflow
CVE-2004-2222: Directory traversal vulnerability in index.php in FsPHPGallery before 1.2 allows remote attackers to list arbitrary directories via the dir parameter.
Key phrases: list arbitrary directories, list arbitrary directories via the dir parameter, directory traversal
CVE-2004-2223: FsPHPGallery before 1.2 allows remote attackers to cause a denial of service via an image with a large size attribute, which causes a crash when the server attempts to resize the image.
Key phrases: cause a denial of service via an image, large size attribute, crash
CVE-2004-2224: Appfoundry Message Foundry 2.75 .0003 allows remote attackers to cause a denial of service (crash) via an HTTP GET request that contains MS-DOS device names such as com1.
Key phrases: denial of service (crash), cause a denial of service (crash), ms-dos device names
CVE-2004-2225: Mozilla Firefox before 0.10.1 allows remote attackers to delete arbitrary files in the download directory via a crafted data: URI that is not properly handled when the user clicks the Save button.
Key phrases: delete arbitrary files, delete arbitrary files in the download directory via, arbitrary file download
CVE-2004-2226: Mozilla Mail 1.7.1 and 1.7.3, and Thunderbird before 0.9, when HTML-Mails is enabled, allows remote attackers to determine valid e-mail addresses via an HTML e-mail that references a Cascading Style Sheets (CSS) document on the attacker's server.
Key phrases: determine valid e-mail addresses via an, html-mails
CVE-2004-2227: Mozilla Firefox before 1.0 truncates long filenames in the file download dialog box, which makes it easier for remote attackers to trick users into downloading files with dangerous extensions.
Key phrases: dangerous extensions
CVE-2004-2228: Mozilla Firefox before 1.0 is installed with world-writable permissions on Mac OS X, which allows local users to gain privileges.
Key phrases: gain privileges, world-writable permissions
CVE-2004-2229: Multiple unknown vulnerabilities in Oracle 9i Lite Mobile Server 5.0.0.0.0 through 5.0.2.9.0 allow remote authenticated users to gain privileges.
Key phrases: gain privileges, multiple unknown
CVE-2004-2230: Heap-based buffer overflow in isakmpd on OpenBSD 3.4 through 3.6 allows local users to cause a denial of service (panic) and corrupt memory via IPSEC credentials on a socket.
Key phrases: denial of service (panic), cause a denial of service (panic), heap-based buffer overflow, corrupt memory, heap based buffer overflow
CVE-2004-2231: Zero G Software InstallAnywhere 5.0.6, 5.0.7, and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) persistent_state or (2) env.properties.X temporary files.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2004-2232: SQL injection vulnerability in sql.php in the Glossary module in Moodle 1.4.1 and earlier allows remote attackers to modify SQL statements.
Key phrases: modify SQL statements, sql injection
CVE-2004-2233: Unknown "front page vulnerability with Moodle servers" for Moodle before 1.3.2 has unknown impact and attack vectors.
Key phrases: front page vulnerability with moodle servers, unknown impact
CVE-2004-2234: Unknown vulnerability in Moodle before 1.2 allows teachers to log in as administrators.
Key phrases: log in as administrators, unknown
CVE-2004-2235: Unknown vulnerability in Moodle before 1.2 has unknown impact and attack vectors, related to improper filtering of text.
Key phrases: unknown, unknown impact
CVE-2004-2236: Unknown vulnerability in Moodle before 1.3.3 has unknown impact and attack vectors, related to language setting.
Key phrases: unknown, unknown impact
CVE-2004-2237: Unknown vulnerability in Moodle before 1.3.4 has unknown impact and attack vectors, related to "strings in Moodle texts."
Key phrases: unknown vulnerability in moodle before, unknown impact
CVE-2004-2238: Format string vulnerability in vsybase.c in vpopmail 5.4.2 and earlier has unknown impact and attack vectors.  NOTE: in a followup post, it was observed that the source code used constants that, when compiled, became static format strings.  Thus this is not a vulnerability
Key phrases: format string, unknown impact
CVE-2004-2239: Buffer overflow in vsybase.c in vpopmail 5.4.2 and earlier might allow attackers to cause a denial of service or execute arbitrary code.
Key phrases: execute arbitrary code, cause a denial of service or execute arbitrary, buffer overflow
CVE-2004-2240: Multiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via (1) the query string in read.php or (2) unknown vectors in file.php.
Key phrases: modify SQL statements via (1) the, sql injection, unknown vectors
CVE-2004-2241: Cross-site scripting (XSS) vulnerability in Phorum 5.0.11 and earlier allows remote attackers to inject arbitrary HTML or web script via search.php. NOTE: some sources have reported that the affected file is read.php, but this is inconsistent with the vendor's patch.
Key phrases: inject arbitrary HTML or web, inject arbitrary HTML or web script via search.php, cross-site scripting (xss)
CVE-2004-2242: Cross-site scripting (XSS) vulnerability in search.php in Phorum, possibly 5.0.7 beta and earlier, allows remote attackers to inject arbitrary HTML or web script via the subject parameter.
Key phrases: inject arbitrary HTML or web, inject arbitrary HTML or web script via the, cross-site scripting (xss)
CVE-2004-2243: Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorum_uriauth parameter, as demonstrated using profile.php.  NOTE: the affected version was reported to be 4.3.7, but this may be erroneous.
Key phrases: hijack sessions of other users by stealing and
CVE-2004-2244: The XML parser in Oracle 9i Application Server Release 2 9.0.3.0 and 9.0.3.1, 9.0.2.3 and earlier, and Release 1 1.0.2.2 and 1.0.2.2.2, and Database Server Release 2 9.2.0.1 and later, allows remote attackers to cause a denial of service (CPU and memory consumption) via a SOAP message containing a crafted DTD.
Key phrases: denial of service (CPU and memory consumption), cause a denial of service (CPU and
CVE-2004-2245: Cross-site scripting (XSS) vulnerability in Goollery 0.03 allows remote attackers to inject arbitrary HTML or web script via the (1) page parameter to viewalbum.php or (2) btopage parameter to viewpic.php.
Key phrases: inject arbitrary HTML or web, inject arbitrary HTML or web script via the, cross-site scripting (xss)
CVE-2004-2246: Cross-site scripting (XSS) vulnerability in Goollery before 0.04b allows remote attackers to inject arbitrary HTML or web script via the conversation_id parameter to viewpic.php.
Key phrases: inject arbitrary HTML or web, inject arbitrary HTML or web script via the, cross-site scripting (xss)
CVE-2004-2247: Unknown vulnerability in the "admin of paypal email addresses" in AudienceConnect before 1.0.beta.21 has unknown impact and attack vectors.
Key phrases: unknown, admin of paypal email addresses, unknown impact
CVE-2004-2248: Unknown vulnerability in RemoteEditor before 0.1.1 has unknown impact and attack vectors, related to "oversize submissions."
Key phrases: unknown, unknown impact
CVE-2004-2249: Unknown vulnerability in the "access code" in SecureEditor before 0.1.2 has unknown impact and attack vectors, possibly involving a bypass of IP address restrictions.
Key phrases: bypass of IP address restrictions, unknown, unknown impact
CVE-2004-2250: Unknown vulnerability in the "access code" in RemoteEditor before 0.1.6 has unknown impact and attack vectors, possibly involving a bypass of IP address restrictions.
Key phrases: bypass of IP address restrictions, unknown, unknown impact
CVE-2004-2251: The PPTP server in Astaro Security Linux before 4.024 provides information about its version, which makes it easier for remote attackers to construct specialized attacks.
CVE-2004-2252: The firewall in Astaro Security Linux before 4.024 sends responses to SYN-FIN packets, which makes it easier for remote attackers to obtain information about the system and construct specialized attacks.
Key phrases: obtain information, syn-fin packets, specialized
CVE-2004-2253: Directory traversal vulnerability in user.cgi in SurgeLDAP 1.0g and earlier allows remote attackers to read arbitrary files via a .. in the page parameter of the show command.
Key phrases: read arbitrary files, read arbitrary files via a .. in the, directory traversal
CVE-2004-2254: SurgeLDAP 1.0g (Build 12), and possibly other versions before 1.0h, allows remote attackers to bypass authentication for the administration interface via a direct request to admin.cgi with a modified utoken parameter.
Key phrases: bypass authentication, bypass authentication for the administration interface via a
CVE-2004-2255: Directory traversal vulnerability in phpMyFAQ 1.3.12 allows remote attackers to read arbitrary files, and possibly execute local PHP files, via the action variable, which is used as part of a template filename.
Key phrases: read arbitrary files, directory traversal
CVE-2004-2256: Directory traversal vulnerability in phpMyFAQ 1.4.0 alpha allows remote attackers to read arbitrary files, and possibly execute local PHP files, via .. sequences in the lang (language) variable.
Key phrases: read arbitrary files, directory traversal
CVE-2004-2257: phpMyFAQ 1.4.0 allows remote attackers to access the Image Manager to upload or delete images without authorization via a direct request.
Key phrases: access the Image Manager to upload or delete, direct request
CVE-2004-2258: Xconfig in Hummingbird Exceed before 9.0.0.1, when the Screen Definition is password-protected, allows local users to access certain options by switching to another tab, then switching back to the original tab.
Key phrases: access certain options by switching to another tab
CVE-2004-2259: vsftpd before 1.2.2, when under heavy load, allows attackers to cause a denial of service (crash) via a SIGCHLD signal during a malloc or free call, which is not re-entrant.
Key phrases: denial of service (crash), cause a denial of service (crash), re-entrant
CVE-2004-2260: Opera Browser 7.23, and other versions before 7.50, updates the address bar as soon as the user clicks a link, which allows remote attackers to redirect to other sites via the onUnload attribute.
Key phrases: redirect to other sites via the onUnload attribute, onunload attribute
CVE-2004-2261: Cross-site scripting (XSS) vulnerability in e107 allows remote attackers to inject arbitrary script or HTML via the "login name/author" field in the (1) news submit or (2) article submit functions.
Key phrases: inject arbitrary script or HTML, inject arbitrary script or HTML via the ", cross-site scripting (xss)
CVE-2004-2262: ImageManager in e107 before 0.617 does not properly check the types of uploaded files, which allows remote attackers to execute arbitrary code by uploading a PHP file via the upload parameter to images.php.
Key phrases: execute arbitrary code, execute arbitrary code by uploading a PHP file, file upload
CVE-2004-2263: SQL injection vulnerability in the valid function in fr_left.php in PlaySMS 0.7 and earlier allows remote attackers to modify SQL statements via the vc2 cookie.
Key phrases: modify SQL statements via the vc2 cookie, sql injection
CVE-2004-2264: Format string bug in the open_altfile function in filename.c for GNU less 382, 381, and 358 might allow local users to cause a denial of service or possibly execute arbitrary code via format strings in the LESSOPEN environment variable. NOTE: since less is not setuid or setgid, then this is not a vulnerability unless there are plausible scenarios under which privilege boundaries could be crossed
Key phrases: execute arbitrary code, cause a denial of service or possibly execute, format string bug
CVE-2004-2265: UUDeview 0.5.20 and earlier handles temporary files insecurely during decoding, with unknown attack vectors and impact.
CVE-2004-2266: SQL injection vulnerability in Ansel 2.1 and earlier allows remote attackers to modify SQL statements via the image parameter.
Key phrases: modify SQL statements via the image parameter, sql injection
CVE-2004-2267: Cross-site scripting (XSS) vulnerability in Ansel 2.1 and earlier allows remote attackers to inject arbitrary HTML or web script via the album name.
Key phrases: inject arbitrary HTML or web, inject arbitrary HTML or web script via the, cross-site scripting (xss)
CVE-2004-2268: PimenGest2 before 1.1.1 allows remote attackers to obtain the database password via debug information in rowLatex.inc.php.
Key phrases: obtain the database, obtain the database password via debug information in
CVE-2004-2269: Stack-based buffer overflow in pads.c in Passive Asset Detection System (Pads) might allow local users to execute arbitrary code via a long report file name argument. NOTE: since Pads is not normally installed setuid, this may not be a vulnerability.
Key phrases: execute arbitrary code, execute arbitrary code via a long report file, stack-based buffer overflow, stack based buffer overflow
CVE-2004-2270: Unknown vulnerability in IBM Parallel Environment (PE) 3.2 and 4.1 allows attackers to execute arbitrary commands as root via unknown vectors in the sample code.
Key phrases: execute arbitrary commands, execute arbitrary commands as root via unknown vectors
CVE-2004-2271: Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.
Key phrases: execute arbitrary code, execute arbitrary code via a long HTTP GET, buffer overflow
CVE-2004-2272: Buffer overflow in the sockFinger_DataArrival function in efFingerD 0.2.12 allows remote attackers to cause a denial of service (daemon crash) via a long finger command.
Key phrases: denial of service (daemon crash), cause a denial of service (daemon crash, buffer overflow
CVE-2004-2273: efFingerD 0.2.12 allows remote attackers to cause a denial of service (daemon crash) via a packet with a single byte, which triggers a "Wrong protocol or connection state" error.
Key phrases: denial of service (daemon crash), cause a denial of service (daemon crash
CVE-2004-2274: Unknown vulnerability in Jigsaw before 2.2.4 has unknown impact and attack vectors, possibly related to the parsing of the URI.
Key phrases: unknown, unknown impact
CVE-2004-2275: i-mall.cgi in I-Mall Commerce allows remote attackers to execute arbitrary commands via shell metacharacters via the p parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters via the
CVE-2004-2276: F-Secure Anti-Virus 5.41 and 5.42 on Windows, Client Security 5.50 and 5.52, 4.60 for Samba Servers, and 4.52 and earlier for Linux does not properly detect certain viruses in a PKZip archive, which allows viruses such as Sober.D and Sober.G to bypass initial detection.
Key phrases: bypass initial detection
CVE-2004-2277: Buffer overflow in aGSM Half-Life client allows remote Half-Life servers to cause a denial of service (crash) and possibly execute arbitrary code via a long server response.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2004-2278: Unknown cross-site scripting (XSS) vulnerability in the web GUI in vHost before 3.10r1 has unknown impact and attack vectors.
Key phrases: unknown cross-site scripting (xss), unknown impact
CVE-2004-2279: Cross-site scripting (XSS) vulnerability in Invision Power Board 1.3 Final allows remote attackers to execute arbitrary script as other users via the pop parameter in a chat action to index.php.
Key phrases: execute arbitrary script, execute arbitrary script as other users via the, cross-site scripting (xss)
CVE-2004-2280: Buffer overflow in IBM Lotus Notes 6.5.x before 6.5.3 and 6.0.x before 6.0.5 allows remote attackers to cause a denial of service (crash) via unknown vectors related to Java applets, as identified by KSPR62F4KN.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow, unknown vectors
CVE-2004-2281: Multiple unknown vulnerabilities in IBM Lotus Notes 6.5.x before 6.5.4 and 6.0.x before 6.0.5 have unknown impact and attack vectors, related to Java applets, as identified by (1) KSPR5YS6GR and (2) KSPR62F4D3.
Key phrases: multiple unknown, unknown impact
CVE-2004-2282: DansGuardian before 2.7.7-2 allows remote attackers to bypass URL filters via a ".." in the request.
Key phrases: bypass URL filters, bypass URL filters via a "..", url filters
CVE-2004-2283: Unknown vulnerability in DansGuardian before 2.6.1-13 allows remote attackers to bypass URL filters via a crafted request that causes a page to be added to the clean page cache.
Key phrases: bypass URL filters, bypass URL filters via a crafted request that, unknown
CVE-2004-2284: The read_list_from_file function in vacation.pl for OpenWebmail before 2.32 20040629 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename argument.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in a
CVE-2004-2286: Integer overflow in the duplication operator in ActivePerl allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large multiplier, which may trigger a buffer overflow.
Key phrases: execute arbitrary code, denial of service (crash), cause a denial of service (crash), integer overflow, buffer overflow
CVE-2004-2287: Directory traversal vulnerability in explorer.php in DSM Light Web File Browser 2.0 allows remote attackers to read arbitrary files via .. (dot dot) in the wdir parameter.
Key phrases: read arbitrary files, read arbitrary files via .. (dot dot, directory traversal
CVE-2004-2288: Cross-site scripting (XSS) vulnerability in index.php in Jelsoft vBulletin allows remote attackers to spoof parts of a website via the loc parameter.
Key phrases: spoof parts of a website via the loc, cross-site scripting (xss), spoofing
CVE-2004-2289: Microsoft Windows XP Explorer allows local users to execute arbitrary code via a system folder with a Desktop.ini file containing a .ShellClassInfo specifier with a CLSID value that is associated with an executable file.
Key phrases: execute arbitrary code, execute arbitrary code via a system folder with
CVE-2004-2290: Microsoft Windows XP Explorer allows attackers to execute arbitrary code via a HTML and script in a self-executing folder that references an executable file within the folder, which is automatically executed when a user accesses the folder.
Key phrases: execute arbitrary code, execute arbitrary code via a HTML and script, self-executing folder
CVE-2004-2291: Microsoft Windows Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code via an embedded script that uses Shell Helper objects and a shortcut (link) to execute the target script.
Key phrases: execute arbitrary code, execute arbitrary code via an embedded script that, shell helper objects, shortcut (link)
CVE-2004-2292: Buffer overflow in Alt-N MDaemon 7.0.1 allows remote attackers to cause a denial of service (application crash) via a long STATUS command to the IMAP server.
Key phrases: denial of service (application crash), cause a denial of service (application crash, buffer overflow
CVE-2004-2293: Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.0 to 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) eid parameter or (2) query parameter to the Encyclopedia module, (3) preview_review function in the Reviews module as demonstrated by the url, cover, rlanguage, and hits parameters, or (4) savecomment function in the Reviews module, as demonstrated using the uname parameter.  NOTE: the Faq/categories and Encyclopedia/ltr issues are already covered by CVE-2005-1023.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2004-2294: Canonicalize-before-filter error in the send_review function in the Reviews module for PHP-Nuke 6.0 to 7.3 allows remote attackers to inject arbitrary web script or HTML via hex-encoded XSS sequences in the text parameter, which is checked for dangerous sequences before it is canonicalized, leading to a cross-site scripting (XSS) vulnerability.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via hex, canonicalize-before-filter error, cross-site scripting (xss)
CVE-2004-2295: SQL injection vulnerability in the Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to execute arbitrary SQL commands via the order parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the order parameter, sql injection, arbitrary sql commands
CVE-2004-2296: The preview_review function in the Reviews module in PHP-Nuke 6.0 to 7.3, when running on Windows systems, allows remote attackers to obtain sensitive information via an invalid date parameter, which generates an error message.
Key phrases: obtain sensitive information, obtain sensitive information via an invalid date parameter
CVE-2004-2297: The Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a large, out-of-range score parameter.
Key phrases: denial of service (CPU and memory consumption), cause a denial of service (CPU and
CVE-2004-2298: Novell Internet Messaging System (NIMS) 2.6 and 3.0, and NetMail 3.1 and 3.5, is installed with a default NMAP authentication credential, which allows remote attackers to read and write mail store data if the administrator does not change the credential by using the NMAP Credential Generator.
Key phrases: read and write mail store data if the
CVE-2004-2299: Buffer overflow in Omnicron OmniHTTPd 3.0a and earlier allows remote attackers to execute arbitrary code via an HTTP GET request with a long Range header.
Key phrases: execute arbitrary code, execute arbitrary code via an HTTP GET request, buffer overflow
CVE-2004-2300: Buffer overflow in snmpd in ucd-snmp 4.2.6 and earlier, when installed setuid root, allows local users to execute arbitrary code via a long -p command line argument.  NOTE: it is not clear whether there are any standard configurations in which snmpd is installed setuid or setgid. If not, then this issue should not be included in CVE.
Key phrases: execute arbitrary code, execute arbitrary code via a long -p command, buffer overflow