CVE Cross Reference 2004

Current CVEs

(Based on CVE version 20061101 and SANS Top 20 version 7.)
  CVE # CVE Description SAINT®® Tutorial SAINT®® Vuln. ID SANS Top 20
YELLOW CVE-2004-0005 Multiple buffer overflows in Gaim 0.75 allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) octal encoding in yahoo_decode that causes a null byte to be written beyond the buffer, (2) octal encoding in yahoo_decode that causes a pointer to reference memory beyond the terminating null byte, (3) a quoted printable string to the gaim_quotedp_decode MIME decoder that causes a null byte to be written beyond the buffer, and (4) quoted printable encoding in gaim_quotedp_decode that causes a pointer to reference memory beyond the terminating null byte. Gaim vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_gaim  
YELLOW CVE-2004-0006 Multiple buffer overflows in Gaim 0.75 and earlier, and Ultramagnetic before 0.81, allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) cookies in a Yahoo web connection, (2) a long name parameter in the Yahoo login web page, (3) a long value parameter in the Yahoo login page, (4) a YMSG packet, (5) the URL parser, and (6) HTTP proxy connect. Gaim vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_gaim  
YELLOW CVE-2004-0007 Buffer overflow in the Extract Info Field Function for (1) MSN and (2) YMSG protocol handlers in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code. Gaim vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_gaim  
YELLOW CVE-2004-0008 Integer overflow in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a directIM packet that triggers a heap-based buffer overflow. Gaim vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_gaim  
BROWN CVE-2004-0009 Apache-SSL 1.3.28+1.52 and earlier, with SSLVerifyClient set to 1 or 3 and SSLFakeBasicAuth enabled, allows remote attackers to forge a client certificate by using basic authentication with the "one-line DN" of the target user. Apache SSL module vulnerabilities
 web_mod_apachesslvuln  
RED CVE-2004-0011 Buffer overflow in fsp before 2.81.b18 allows remote users to execute arbitrary code. File Service Protocol
 ftp_fsp  
RED CVE-2004-0016 The calendar module for phpgroupware 0.9.14 does not enforce the "save extension" feature for holiday files, which allows remote attackers to create and execute PHP files. phpGroupWare vulnerabilities
 web_prog_php_groupware  
RED CVE-2004-0017 Multiple SQL injection vulnerabilities in the (1) calendar and (2) infolog modules for phpgroupware 0.9.14 allow remote attackers to perform unauthorized database operations. phpGroupWare vulnerabilities
 web_prog_php_groupware  
RED CVE-2004-0030 PHP remote file inclusion vulnerability in (1) functions.php, (2) authentication_index.php, and (3) config_gedcom.php for PHPGEDVIEW 2.61 allows remote attackers to execute arbitrary PHP code by modifying the PGV_BASE_DIRECTORY parameter to reference a URL on a remote web server that contains the code. PHP injection
 web_prog_php_phpgedviewfunctions  
RED CVE-2004-0031 PHPGEDVIEW 2.61 allows remote attackers to reinstall the software and change the administrator password via a direct HTTP request to editconfig.php. PHP injection
 web_prog_php_phpgedviewfunctions  
RED CVE-2004-0032 Cross-site scripting (XSS) vulnerability in search.php in PHPGEDVIEW 2.61 allows remote attackers to inject arbitrary HTML and web script via the firstname parameter. PHP injection
 web_prog_php_phpgedviewfunctions  
RED CVE-2004-0033 admin.php in PHPGEDVIEW 2.61 allows remote attackers to obtain sensitive information via an action parameter with a phpinfo command. PHP injection
 web_prog_php_phpgedviewfunctions  
RED CVE-2004-0036 SQL injection vulnerability in calendar.php for vBulletin Forum 2.3.x before 2.3.4 allows remote attackers to steal sensitive information via the eventid parameter. vBulletin vulnerabilities
 web_prog_sql_vbulletin  
RED CVE-2004-0038 McAfee ePolicy Orchestrator (ePO) 2.5.1 Patch 13 and 3.0 SP2a Patch 3 allows remote attackers to execute arbitrary commands via certain HTTP POST requests to the spipe/file handler on ePO TCP port 81. McAfee ePolicy Orchestrator
 web_tool_epolicy  
RED CVE-2004-0045 Buffer overflow in the ARTpost function in art.c in the control message handling code for INN 2.4.0 may allow remote attackers to execute arbitrary code. innd vulnerabilities
 misc_inndvuln  
RED CVE-2004-0054 Multiple vulnerabilities in the H.323 protocol implementation for Cisco IOS 11.3T through 12.2T allow remote attackers to cause a denial of service and possibly execute arbitrary code, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol. H323 vulnerabilities

Note: Authentication is required to detect this vulnerability		 net_h323  
RED CVE-2004-0056 Multiple vulnerabilities in the H.323 protocol implementation for Nortel Networks Business Communications Manager (BCM), Succession 1000 IP Trunk and IP Peer Networking, and 802.11 Wireless IP Gateway allow remote attackers to cause a denial of service and possibly execute arbitrary code, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol. H323 vulnerabilities

Note: Authentication is required to detect this vulnerability		 net_h323  
RED CVE-2004-0065 Multiple SQL injection vulnerabilities in phpGedView before 2.65 allow remote attackers to execute arbitrary SQL via (1) timeline.php and (2) placelist.php. SQL injection
 web_prog_sql_phpgedview  
YELLOW CVE-2004-0066 phpGedView before 2.65 allows remote attackers to obtain the absolute path of the web server via malformed parameters to (1) indilist.php, (2) famlist.php, (3) placelist.php, (4) imageview.php, (5) timeline.php, (6) clippings.php, (7) login.php, and (8) gdbi.php. Cross site scripting
 web_prog_php_gedviewxss  
YELLOW CVE-2004-0067 Multiple cross-site scripting (XSS) vulnerabilities in phpGedView before 2.65 allow remote attackers to inject arbitrary HTML or web script via (1) descendancy.php, (2) index.php, (3) individual.php, (4) login.php, (5) relationship.php, (6) source.php, (7) imageview.php, (8) calendar.php, (9) gedrecord.php, (10) login.php, and (11) gdbi_interface.php. NOTE: some aspects of vector 10 were later reported to affect 4.1. Cross site scripting
 web_prog_php_gedviewxss  
RED CVE-2004-0068 PHP remote file inclusion vulnerability in config.php for PhpDig 1.6.5 and earlier allows remote attackers to execute arbitrary PHP code by modifying the $relative_script_path parameter to reference a URL on a remote web server that contains the code. PHP injection
 web_prog_php_phpdig  
RED CVE-2004-0072 Directory traversal vulnerability in Accipiter Direct Server 6.0 allows remote attackers to read arbitrary files via encoded \.. (backslash .., "%5c%2e%2e") sequences in an HTTP request. http server read access
 web_server_read  
RED CVE-2004-0079 The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference. OpenSSL vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 misc_openssl  
RED CVE-2004-0081 OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool. OpenSSL vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 misc_openssl  
RED CVE-2004-0082 The mksmbpasswd shell script (mksmbpasswd.sh) in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password with an uninitialized buffer, which could enable the account with a more easily guessable password. Samba vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 win_samba  
YELLOW CVE-2004-0091 NOTE: this issue has been disputed by the vendor. vBulletin vulnerabilities
 web_prog_php_vbulletin  
RED CVE-2004-0112 The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read. OpenSSL vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 misc_openssl  
RED CVE-2004-0113 Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server. Apache SSL module vulnerabilities
 web_server_apache_ssldos  
RED CVE-2004-0116 An Activation function in the RPCSS Service involved with DCOM activation for Microsoft Windows 2000, XP, and 2003 allows remote attackers to cause a denial of service (memory consumption) via an activation request with a large length field. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_rpcrunlib  
RED CVE-2004-0117 Unknown vulnerability in the H.323 protocol implementation in Windows 98, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_ms04011  
RED CVE-2004-0118 The component for the Virtual DOS Machine (VDM) subsystem in Windows NT 4.0 and Windows 2000 does not properly validate system structures, which allows local users to access protected kernel memory and execute arbitrary code. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_ms04011  
RED CVE-2004-0119 The Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_ms04011  
RED CVE-2004-0120 The Microsoft Secure Sockets Layer (SSL) library, as used in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service via malformed SSL messages. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_ms04011  
BROWN CVE-2004-0121 Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs. Outlook and Outlook Express

Note: Authentication is required to detect this vulnerability		 mail_client_outlookxp  
BROWN CVE-2004-0122 Microsoft MSN Messenger 6.0 and 6.1 does not properly handle certain requests, which allows remote attackers to read arbitrary files. MSN Messenger vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_msnmsgrread  
RED CVE-2004-0123 Double free vulnerability in the ASN.1 library as used in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service and possibly execute arbitrary code. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_ms04011  
RED CVE-2004-0124 The DCOM RPC interface for Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause network communications via an "alter context" call that contains additional data, aka the "Object Identity Vulnerability." Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_rpcrunlib  
RED CVE-2004-0127 Directory traversal vulnerability in editconfig_gedcom.php for phpGedView 2.65.1 and earlier allows remote attackers to read arbitrary files or execute arbitrary PHP programs on the server via .. (dot dot) sequences in the gedcom_config parameter. PHP injection
 web_prog_php_phpgedviewconf  
RED CVE-2004-0128 PHP remote file inclusion vulnerability in the GEDCOM configuration script for phpGedView 2.65.1 and earlier allows remote attackers to execute arbitrary PHP code by modifying the PGV_BASE_DIRECTORY parameter to reference a URL on a remote web server that contains a malicious theme.php script. PHP injection
 web_prog_php_phpgedviewconf  
RED CVE-2004-0129 Directory traversal vulnerability in export.php in phpMyAdmin 2.5.5 and earlier allows remote attackers to read arbitrary files via .. (dot dot) sequences in the what parameter. http cgi access
 web_prog_php_myadminexport  
RED CVE-2004-0169 QuickTime Streaming Server in MacOS X 10.2.8 and 10.3.2 allows remote attackers to cause a denial of service (crash) via DESCRIBE requests with long User-Agent fields, which causes an Assert error to be triggered in the BufferIsFull function. Darwin vulnerabilities
 web_server_darwin
web_server_quicktime		  
RED CVE-2004-0174 Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-accessed listening socket." Apache vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_server_apache_version  
RED CVE-2004-0182 Mailman before 2.0.13 allows remote attackers to cause a denial of service (crash) via an email message with an empty subject field. Mailman vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 mail_misc_mailman  
RED CVE-2004-0185 Buffer overflow in the skey_challenge function in ftpd.c for wu-ftp daemon (wu-ftpd) 2.6.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a s/key (SKEY) request with a long name. FTP vulnerabilities
 ftp_wuftpd
ftp_wuftpold		  
BROWN CVE-2004-0189 The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") characterm, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists. Squid vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_proxy_squid  
YELLOW CVE-2004-0191 Mozilla before 1.4.2 executes Javascript events in the context of a new page while it is being loaded, allowing it to interact with the previous page (zombie document) and enable cross-domain and cross-site scripting (XSS) attacks, as demonstrated using onmousemove events. Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 web_client_mozilla  
YELLOW CVE-2004-0194 Stack-based buffer overflow in the OutputDebugString function for Adobe Acrobat Reader 5.1 allows remote attackers to execute arbitrary code via a PDF document with XML Forms Data Format (XFDF) data. Adobe Acrobat vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_acroread  
BROWN CVE-2004-0197 Buffer overflow in Microsoft Jet Database Engine 4.0 allows remote attackers to execute arbitrary code via a specially-crafted database query. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_jet  
BROWN CVE-2004-0199 Help and Support Center in Microsoft Windows XP and Windows Server 2003 SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code, as demonstrated using certain hcp:// URLs that access the DVD Upgrade capability (dvdupgrd.htm). Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_hcp  
YELLOW CVE-2004-0200 Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_gdiplus  
BROWN CVE-2004-0201 Heap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CVE-2003-1041. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_htmlhelp  
YELLOW CVE-2004-0203 Cross-site scripting (XSS) vulnerability in Outlook Web Access for Exchange Server 5.5 Service Pack 4 allows remote attackers to insert arbitrary script and spoof content in HTML email or web caches via an HTML redirect query. Outlook Web Access
 mail_web_owa  
RED CVE-2004-0204 Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx. http cgi access
 web_prog_cgi_crystalimage  
RED CVE-2004-0205 Buffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arbitrary code via the redirect function. http IIS access
 web_server_iis_redirect  
RED
!		 CVE-2004-0206 Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute arbitrary code or locally gain privileges via a malicious message or application that involves an "unchecked buffer," possibly a buffer overflow. NetDDE vulnerability

Note: Authentication is required to detect this vulnerability unless dangerous checks are enabled		 win_patch_netdde  
YELLOW CVE-2004-0207 "Shatter" style vulnerability in the Window Management application programming interface (API) for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to gain privileges by using certain API functions to change properties of privileged programs using the SetWindowLong and SetWIndowLongPtr API functions. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_wmf  
YELLOW CVE-2004-0208 The Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain privileges via a malicious program that modified some system structures in a way that is not properly validated by privileged operating system functions. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_wmf  
YELLOW CVE-2004-0209 Unknown vulnerability in the Graphics Rendering Engine processes of Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats that involve "an unchecked buffer." Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_wmf  
YELLOW CVE-2004-0210 The POSIX component of Microsoft Windows NT and Windows 2000 allows local users to execute arbitrary code via certain parameters, possibly by modifying message length values and causing a buffer overflow. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_posixbo  
YELLOW CVE-2004-0211 The kernel for Microsoft Windows Server 2003 does not reset certain values in CPU data structures, which allows local users to cause a denial of service (system crash) via a malicious program. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_wmf  
BROWN CVE-2004-0212 Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code via a .job file containing long parameters, as demonstrated using Internet Explorer and accessing a .job file on an anonymous share. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_taskbo  
YELLOW CVE-2004-0213 Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly accessing the context sensitive help and bypassing the GUI, then sending another message to winhlp32 in order to open a user-selected file, a different vulnerability than CVE-2003-0908. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_utility  
YELLOW CVE-2004-0214 Buffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of service (application crash) and possibly execute arbitrary code via long share names, as demonstrated using Samba. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_shellapp  
YELLOW CVE-2004-0216 Integer overflow in the Install Engine (inseng.dll) for Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious website or HTML email with a long .CAB file name, which triggers the integer overflow when calculating a buffer length and leads to a heap-based buffer overflow. Internet Explorer vulnerabilities

Note: Authentication is required to detect this vulnerability		 win_patch_ie_css  
RED CVE-2004-0230 TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP. TCP reset
Windows updates needed

Note: Authentication is required to detect this vulnerability		 misc_tcpreset
win_patch_ipv6dos
win_patch_tcpip		  
RED CVE-2004-0239 SQL injection vulnerability in showphoto.php in PhotoPost PHP Pro 4.6 and earlier allows remote attackers to gain unauthorized access via the photo variable. PhotoPost vulnerabilities
 web_prog_php_photopost  
RED CVE-2004-0240 Directory traversal vulnerability in X-Cart 3.4.3 allows remote attackers to view arbitrary files via a .. (dot dot) in the shop_closed_file argument to auth.php. http cgi access
 web_prog_php_xcart  
RED CVE-2004-0241 X-Cart 3.4.3 allows remote attackers to execute arbitrary commands via the perl_binary argument in (1) upgrade.php or (2) general.php. http cgi access
 web_prog_php_xcartadminexe  
YELLOW CVE-2004-0242 X-Cart 3.4.3 allows remote attackers to gain sensitive information via a mode parameter with (1) phpinfo command or (2) perlinfo command. http cgi info
 web_prog_php_xcartadmininfo  
YELLOW CVE-2004-0248 Cross-site scripting vulnerability (XSS) in PHPX 3.2.3 allows remote attackers to execute arbitrary script as other users by injecting arbitrary HTML or script into (1) keywords argument of main.inc.php, (2) body argument of help.inc.php, or (3) the subject field in Personal Messages and Forum. PHPX vulnerabilities
 web_prog_php_phpxxss  
RED CVE-2004-0249 PHPX 2.0 through 3.2.4 allows remote attackers to gain access to other accounts by modifying the cookie's PXL variable to reference another userID. PHPX vulnerabilities
 web_prog_php_phpx  
YELLOW CVE-2004-0250 SQL injection vulnerability in PhotoPost PHP Pro 4.6 and earlier allows remote attackers to gain privileges via (1) the product parameter in showproduct.php or (2) the cat parameter in showcat.php. ReviewPost vulnerabilities
 web_prog_php_reviewpost  
RED CVE-2004-0252 TYPSoft FTP Server 1.10 allows remote attackers to cause a denial of service (CPU consumption) via an empty USER name. TYPSoft FTP vulnerabilities
 ftp_typsoft  
RED CVE-2004-0255 Xlight 1.52, with log to screen enabled, allows remote attackers to cause a denial of service by requesting a long directory consisting of . (dot) and / (slash) characters, which causes the server to crash when the administrator views the log file, possibly triggering a buffer overflow. Xlight FTP Server
 ftp_xlight  
YELLOW CVE-2004-0258 Multiple buffer overflows in RealOne Player, RealOne Player 2.0, RealOne Enterprise Desktop, and RealPlayer Enterprise allow remote attackers to execute arbitrary code via malformed (1) .RP, (2) .RT, (3) .RAM, (4) .RPM or (5) .SMIL files. RealPlayer vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_reallinux
misc_realplayer		  
RED CVE-2004-0269 SQL injection vulnerability in PHP-Nuke 6.9 and earlier, and possibly 7.x, allows remote attackers to inject arbitrary SQL code and gain sensitive information via (1) the category variable in the Search module or (2) the admin variable in the Web_Links module. SQL injection
 web_prog_sql_modules  
RED CVE-2004-0271 Multiple cross-site scripting vulnerabilities (XSS) in MaxWebPortal allow remote attackers to execute arbitrary web script as other users via (1) the sub_name parameter of dl_showall.asp, (2) the SendTo parameter in Personal Messages, (3) the HTTP_REFERER for down.asp, or (4) the image name of an Avatar in the register form. MaxWebPortal vulnerabilities
 web_prog_asp_maxwebportal  
RED CVE-2004-0272 SQL injection vulnerability in MaxWebPortal allows remote attackers to inject arbitrary SQL code and gain sensitive information via the SendTo parameter in Personal Messages. MaxWebPortal vulnerabilities
 web_prog_asp_maxwebportal  
YELLOW CVE-2004-0273 Directory traversal vulnerability in RealOne Player, RealOne Player 2.0, and RealOne Enterprise Desktop allows remote attackers to upload arbitrary files via an RMP file that contains .. (dot dot) sequences in a .rjs skin file. RealPlayer vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_reallinux
misc_realplayer		  
RED CVE-2004-0276 The get_real_string function in Monkey HTTP Daemon (monkeyd) 0.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an HTTP request with a sequence of "%" characters and a missing Host field. Monkey HTTP Daemon
 web_server_monkey  
RED CVE-2004-0282 Crob FTP daemon 3.5.2 allows remote attackers to cause a denial of service (crash) by repeatedly connecting to and disconnecting from the server. Crob FTP vulnerabilities
 ftp_crob  
RED CVE-2004-0285 PHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2) AllMyLinks, and (3) AllMyGuests allow remote attackers to execute arbitrary PHP code via a URL in the _AMVconfig[cfg_serverpath] parameter. PHP injection
 web_prog_php_allmyguestsinfo
web_prog_php_allmylinksfooter
web_prog_php_allmyvisitorsinfo		  
BROWN CVE-2004-0286 Buffer overflow in RobotFTP 1.0 and 2.0 beta 1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long username. RobotFTP Server
 ftp_robotftp  
RED CVE-2004-0287 Xlight FTP server 1.52 allows remote authenticated users to cause a denial of service (crash) via a RETR command with a long argument containing a large number of / (slash) characters, possibly triggering a buffer overflow. Xlight FTP Server
 ftp_xlight  
BROWN CVE-2004-0291 SQL injection vulnerability in post.php for YaBB SE 1.5.4 and 1.5.5 allows remote attackers to obtain hashed passwords via the quote parameter. vulnerable web program
 web_prog_sql_yabbse  
RED CVE-2004-0292 Buffer overflow in KarjaSoft Sami HTTP Server 1.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request. Sami HTTP Server
 web_server_sami  
RED CVE-2004-0297 Buffer overflow in the Lightweight Directory Access Protocol (LDAP) daemon (iLDAP.exe 3.9.15.10) in Ipswitch IMail Server 8.03 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via an LDAP message with a large tag length. IMail vulnerabilities
 mail_misc_imailldap  
RED CVE-2004-0298 CesarFTP 0.99e allows remote attackers to cause a denial of service (CPU consumption) via a long RETR parameter. CesarFTP vulnerabilities
 ftp_cesar  
RED CVE-2004-0322 Multiple cross-site scripting (XSS) vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to execute arbitrary script as other users via the (1) member parameter in member.php, (2) uid parameter in u2uadmin.php, (3) user parameter in editprofile.php, (4) an onmouseover event in an align tag when bbcode is allowed, or (5) img tag where bbcode is allowed. XMB vulnerabilities
 web_prog_php_xmb  
RED CVE-2004-0323 Multiple SQL injection vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to inject arbitrary SQL and gain privileges via the (1) ppp parameter in viewthread.php, (2) desc parameter in misc.php, (3) tpp parameter in forumdisplay.php, (4) ascdesc parameter in forumdisplay.php, or (5) the addon parameter in stats.php. NOTE: it has also been shown that item (3) is also in XMB 1.9 beta. XMB vulnerabilities
 web_prog_php_xmb  
RED CVE-2004-0325 TYPSoft FTP Server 1.10 allows remote authenticated users to cause a denial of service (CPU consumption) via "//../" arguments to (1) mkd, (2) xmkd, (3) dele, (4) size, (5) retr, (6) stor, (7) appe, (8) rnfr, (9) rnto, (10) rmd, or (11) xrmd, as demonstrated using "//../qwerty". TYPSoft FTP vulnerabilities
 ftp_typsoft  
RED CVE-2004-0326 Buffer overflow in the web proxy for GateKeeper Pro 4.7 allows remote attackers to execute arbitrary code via a long GET request. GateKeeper vulnerabilities
 web_proxy_gatekeeper  
RED CVE-2004-0330 Buffer overflow in Serv-U ftp before 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM command. Serv U vulnerabilities
 ftp_servu  
RED CVE-2004-0331 Heap-based buffer overflow in Dell OpenManage Web Server 3.4.0 allows remote attackers to cause a denial of service (crash) via a HTTP POST with a long application variable. Dell OpenManage
 web_server_openmanage  
YELLOW CVE-2004-0339 Cross-site scripting (XSS) vulnerability in ViewTopic.php in phpBB, possibly 2.0.6c and earlier, allows remote attackers to execute arbitrary script or HTML as other users via the postorder parameter. Cross site scripting
 web_prog_php_phpbbpostorder  
RED CVE-2004-0340 Stack-based buffer overflow in WFTPD Pro Server 3.21 Release 1, Pro Server 3.20 Release 2, Server 3.21 Release 1, and Server 3.10 allows local users to execute arbitrary code via long (1) LIST, (2) NLST, or (3) STAT commands. WFTPD vulnerabilities
 ftp_wftpd  
RED CVE-2004-0341 WFTPD Pro Server 3.21 Release 1 allocates memory for a command until a 0Ah byte (newline) is sent, which allows local users to cause a denial of service (CPU consumption) by continuing to send a long command that does not contain a newline. WFTPD vulnerabilities
 ftp_wftpd  
RED CVE-2004-0342 WFTPD Pro Server 3.21 Release 1, with the XeroxDocutech option enabled, allows local users to cause a denial of service (crash) via a (1) MKD or (2) XMKD command that causes an absolute path of 260 characters to be used, which overwrites a cookie with a null character, possibly due to an off-by-one error. WFTPD vulnerabilities
 ftp_wftpd  
BROWN CVE-2004-0343 Multiple SQL injection vulnerabilities in YaBB SE 1.5.4 through 1.5.5b allow remote attackers to execute arbitrary SQL via (1) the msg parameter in ModifyMessage.php or (2) the postid parameter in ModifyMessage.php. vulnerable web program
 web_prog_sql_yabbse  
BROWN CVE-2004-0344 Directory traversal vulnerability in ModifyMessage.php in YaBB SE 1.5.4 through 1.5.5b allows remote attackers to delete arbitrary files via a .. (dot dot) in the attachOld parameter. vulnerable web program
 web_prog_sql_yabbse  
BROWN CVE-2004-0346 Off-by-one buffer overflow in _xlate_ascii_write() in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command. ProFTPD vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 ftp_proftp  
RED CVE-2004-0348 SQL injection vulnerability in viewCart.asp in SpiderSales shopping cart software allows remote attackers to execute arbitrary SQL via the userId parameter. SQL injection
 web_prog_sql_spider  
RED CVE-2004-0350 SpiderSales shopping cart does not enforce a minimum length for the private key, which can make it easier for local users to obtain the private key by factoring. SQL injection
 web_prog_sql_spider  
RED CVE-2004-0351 Spider Sales shopping cart stores the private key in the same database and table as the public key, which allows local users with access to the database to decrypt data. SQL injection
 web_prog_sql_spider  
RED CVE-2004-0353 Multiple buffer overflows in auth_ident() function in auth.c for GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to gain privileges via a long string. Anubis vulnerabilities
 mail_misc_anubis  
RED CVE-2004-0354 Multiple format string vulnerabilities in GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to execute arbitrary code via format string specifiers in strings passed to (1) the info function in log.c, (2) the anubis_error function in errs.c, or (3) the ssl_error function in ssl.c. Anubis vulnerabilities
 mail_misc_anubis  
YELLOW CVE-2004-0359 Cross-site scripting (XSS) vulnerability in index.php for Invision Power Board 1.3 final allows remote attackers to execute arbitrary script as other users via the (1) c, (2) f, (3) showtopic, (4) showuser, or (5) username parameters. Cross site scripting
 web_prog_php_invisioncss  
BROWN CVE-2004-0363 Stack-based buffer overflow in the SymSpamHelper ActiveX component (symspam.dll) in Norton AntiSpam 2004, as used in Norton Internet Security 2004, allows remote attackers to execute arbitrary code via a long parameter to the LaunchCustomRuleWizard method. Norton vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_symspam  
BROWN CVE-2004-0364 The WrapNISUM ActiveX component (WrapUM.dll) in Norton Internet Security 2004 is marked safe for scripting, which allows remote attackers to execute arbitrary programs via the LaunchURL method. Norton vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_wrapum  
RED
!		 CVE-2004-0368 Double free vulnerability in dtlogin in CDE on Solaris, HP-UX, and other operating systems allows remote attackers to execute arbitrary code via a crafted XDMCP packet. dtlogin vulnerabilities
 misc_dtlogin  
YELLOW CVE-2004-0371 Heimdal 0.6.x before 0.6.1 and 0.5.x before 0.5.3 does not properly perform certain consistency checks for cross-realm requests, which allows remote attackers with control of a realm to impersonate others in the cross-realm trust path. Kerberos detected

Note: Authentication is required to detect this vulnerability		 misc_kerberospkg  
RED CVE-2004-0376 oftpd 0.3.6 and earlier allows remote attackers to cause a denial of service (crash) via a PORT command with a large value. oftpd vulnerabilities
 ftp_oftpdport  
BROWN CVE-2004-0380 The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability." Outlook and Outlook Express

Note: Authentication is required to detect this vulnerability		 mail_client_oemhtml  
YELLOW CVE-2004-0381 mysqlbug in MySQL allows local users to overwrite arbitrary files via a symlink attack on the failed-mysql-bugreport temporary file. MySQL vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_mysql_version  
RED CVE-2004-0385 Heap-based buffer overflow in Oracle 9i Application Server Web Cache 9.0.4.0.0, 9.0.3.1.0, 9.0.2.3.0, and 9.0.0.4.0 allows remote attackers to execute arbitrary code via a long HTTP request method header to the Web Cache listener. NOTE: due to the vagueness of the Oracle advisory, it is not clear whether there are additional issues besides this overflow, although the advisory alludes to multiple "vulnerabilities." Oracle Web Cache
 database_oracle_webcache  
YELLOW CVE-2004-0387 Stack-based buffer overflow in the RT3 plugin, as used in RealPlayer 8, RealOne Player, RealOne Player 10 beta, and RealOne Player Enterprise, allows remote attackers to execute arbitrary code via a malformed .R3T file. RealPlayer vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_reallinux
misc_realplayer		  
YELLOW CVE-2004-0388 The mysqld_multi script in MySQL allows local users to overwrite arbitrary files via a symlink attack. MySQL vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_mysql_version  
BROWN CVE-2004-0389 RealNetworks Helix Universal Server 9.0.1 and 9.0.2 allows remote attackers to cause a denial of service (crash) via malformed requests that trigger a null dereference, as demonstrated using (1) GET_PARAMETER or (2) DESCRIBE requests. RealServer vulnerabilities
 misc_realserver  
RED
!		 CVE-2004-0399 Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify option is true, allows remote attackers to cause a denial of service and possibly execute arbitrary code during sender verification. Exim vulnerability
 mail_smtp_exim
mail_smtp_eximextreme		  
RED
!		 CVE-2004-0400 Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code during the header check. Exim vulnerability
 mail_smtp_exim
mail_smtp_eximextreme		  
RED CVE-2004-0412 Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server. Mailman vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 mail_misc_mailman  
BROWN CVE-2004-0420 The Windows Shell application in Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by spoofing the type of a file via a CLSID specifier in the filename, as demonstrated using Internet Explorer 6.0.2800.1106 on Windows XP. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_shellclsid  
BROWN CVE-2004-0426 rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, which allows remote attackers to write files outside of the module's path. rsyncd vulnerabilities
 misc_rsyncdwrite  
RED
!		 CVE-2004-0430 Stack-based buffer overflow in AppleFileServer for Mac OS X 10.3.3 and earlier allows remote attackers to execute arbitrary code via a LoginExt packet for a Cleartext Password User Authentication Method (UAM) request with a PathName argument that includes an AFPName type string that is longer than the associated length field. Apple Filing Protocol
 misc_afp  
YELLOW CVE-2004-0431 Integer overflow in Apple QuickTime (QuickTime.qts) before 6.5.1 allows attackers to execute arbitrary code via a large "number of entries" field in the sample-to-chunk table data for a .mov movie file, which leads to a heap-based buffer overflow. QuickTime vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_quicktime  
BROWN CVE-2004-0432 ProFTPD 1.2.9 treats the Allow and Deny directives for CIDR based ACL entries as if they were AllowAll, which could allow FTP clients to bypass intended access restrictions. ProFTPD vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 ftp_proftp  
BROWN CVE-2004-0434 k5admind (kadmind) for Heimdal allows remote attackers to execute arbitrary code via a Kerberos 4 compatibility administration request whose framing length is less than 2, which leads to a heap-based buffer overflow. Kerberos detected
 misc_kadmind  
RED CVE-2004-0437 Titan FTP Server version 3.01 build 163, and possibly other versions before build 169, allows remote authenticated users to cause a denial of service (crash) by disconnecting from the system during a "LIST -L" command, which causes Titan to access an invalid socket. Titan FTP vulnerabilities
 ftp_titan  
BROWN CVE-2004-0444 Multiple vulnerabilities in SYMDNS.SYS for Symantec Norton Internet Security and Professional 2002 through 2004, Norton Personal Firewall 2002 through 2004, Norton AntiSpam 2004, Client Firewall 5.01 and 5.1.1, and Client Security 1.0 through 2.0 allow remote attackers to cause a denial of service or execute arbitrary code via (1) a manipulated length byte in the first-level decoding routine for NetBIOS Name Service (NBNS) that modifies an index variable and leads to a stack-based buffer overflow, (2) a heap-based corruption problem in an NBNS response that is missing certain RR fields, and (3) a stack-based buffer overflow in the DNS component via a Resource Record (RR) with a long canonical name (CNAME) field composed of many smaller components. Norton vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_nortonnbns  
BROWN CVE-2004-0445 The SYMDNS.SYS driver in Symantec Norton Internet Security and Professional 2002 through 2004, Norton Personal Firewall 2002 through 2004, Norton AntiSpam 2004, Client Firewall 5.01 and 5.1.1, and Client Security 1.0 through 2.0 allows remote attackers to cause a denial of service (CPU consumption from infinite loop) via a DNS response with a compressed name pointer that points to itself. Norton vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_nortonnbns  
BROWN CVE-2004-0455 Buffer overflow in cgi.c in www-sql before 0.5.7 allows local users to execute arbitrary code via a web page that is processed by www-sql. http potential problems
 web_prog_cgi_wwwsql  
YELLOW CVE-2004-0457 The mysqlhotcopy script in mysql 4.0.20 and earlier, when using the scp method from the mysql-server package, allows local users to overwrite arbitrary files via a symlink attack on temporary files. MySQL vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_mysql_version  
RED
!		 CVE-2004-0460 Buffer overflow in the logging capability for the DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via multiple hostname options in (1) DISCOVER, (2) OFFER, (3) REQUEST, (4) ACK, or (5) NAK messages, which can generate a long string when writing to a log file. dhcpd vulnerabilities
 misc_dhcp  
RED CVE-2004-0461 The DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13, when compiled in environments that do not provide the vsnprintf function, uses C include files that define vsnprintf to use the less safe vsprintf function, which can lead to buffer overflow vulnerabilities that enable a denial of service (server crash) and possibly execute arbitrary code. dhcpd vulnerabilities
 misc_dhcp  
BROWN CVE-2004-0462 The built-in web servers for multiple networking devices do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session with the same server. HTTPS cookie vulnerabilities
 web_security_httpssecure  
RED CVE-2004-0469 Buffer overflow in the ISAKMP functionality for Check Point VPN-1 and FireWall-1 NG products, before VPN-1/FireWall-1 R55 HFA-03, R54 HFA-410 and NG FP3 HFA-325, or VPN-1 SecuRemote/SecureClient R56, may allow remote attackers to execute arbitrary code during VPN tunnel negotiation. Check Point Firewall vulnerabilities
 misc_firewall_checkpoint_isakmp  
RED CVE-2004-0470 BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remove intended access restrictions for the associated web application. WebLogic vulnerabilities
 web_dev_weblogic  
RED CVE-2004-0471 BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service (service shutdown). WebLogic vulnerabilities
 web_dev_weblogic  
BROWN CVE-2004-0476 Buffer overflow in 3Com OfficeConnect Remote 812 ADSL Router 1.1.9.4 allows remote attackers to cause a denial of service (reboot or packet loss) via a long string containing Telnet escape characters to the Telnet port. OfficeConnect vulnerabilities
 net_ocrtelnet  
BROWN CVE-2004-0477 Unknown vulnerability in 3Com OfficeConnect Remote 812 ADSL Router allows remote attackers to bypass authentication via repeated attempts using any username and password. NOTE: this identifier was inadvertently re-used for another issue due to a typo; that issue was assigned CVE-2004-0447. This candidate is ONLY for the ADSL router bypass. OfficeConnect vulnerabilities
 net_ocrhttp  
YELLOW CVE-2004-0478 Unknown versions of Mozilla allow remote attackers to cause a denial of service (high CPU/RAM consumption) using Javascript with an infinite loop that continues to add input to a form, possibly as the result of inserting control characters, as demonstrated using an embedded ctrl-U. Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 web_client_mozilla  
BROWN CVE-2004-0488 Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN. Apache SSL module vulnerabilities
 web_mod_ssl
web_mod_ssltwo		  
BROWN CVE-2004-0492 Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied. Apache module vulnerabilities
 web_mod_proxy  
RED CVE-2004-0493 The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters. Apache vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_server_apache_version  
YELLOW CVE-2004-0500 Buffer overflow in the MSN protocol plugins (1) object.c and (2) slp.c for Gaim before 0.82 allows remote attackers to cause a denial of service and possibly execute arbitrary code via MSNSLP protocol messages that are not properly handled in a strncpy call. Gaim vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_gaim  
YELLOW CVE-2004-0519 Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via multiple attack vectors, including the mailbox parameter in compose.php. SquirrelMail vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 mail_web_squirrel  
YELLOW CVE-2004-0520 Cross-site scripting (XSS) vulnerability in mime.php for SquirrelMail before 1.4.3 allows remote attackers to insert arbitrary HTML and script via the content-type mail header, as demonstrated using read_body.php. SquirrelMail vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 mail_web_squirrel  
RED CVE-2004-0521 SQL injection vulnerability in SquirrelMail before 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, with unknown impact, probably via abook_database.php. SquirrelMail vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 mail_web_squirrel  
RED CVE-2004-0522 Gallery 1.4.3 and earlier allows remote attackers to bypass authentication and obtain Gallery administrator privileges. Gallery vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_galleryversion  
YELLOW CVE-2004-0523 Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root. Kerberos detected

Note: Authentication is required to detect this vulnerability		 misc_kerberospkg  
BROWN CVE-2004-0541 Buffer overflow in the ntlm_check_auth (NTLM authentication) function for Squid Web Proxy Cache 2.5.x and 3.x, when compiled with NTLM handlers enabled, allows remote attackers to execute arbitrary code via a long password ("pass" variable). Squid NTLM vulnerabilities
 web_proxy_squidntlm  
BROWN CVE-2004-0542 PHP before 4.3.7 on Win32 platforms does not properly filter all shell metacharacters, which allows local or remote attackers to execute arbitrary code, overwrite files, and access internal environment variables via (1) the "%", "|", or ">" characters to the escapeshellcmd function, or (2) the "%" character to the escapeshellarg function. PHP vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_version  
BROWN CVE-2004-0549 The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object. Internet Explorer vulnerabilities

Note: Authentication is required to detect this vulnerability		 win_patch_ie_modal  
YELLOW CVE-2004-0550 Buffer overflow in Real Networks RealPlayer 10 allows remote attackers to execute arbitrary code via a URL with a large number of "." (period) characters. RealPlayer vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_reallinux
misc_realplayer		  
RED CVE-2004-0551 Cisco CatOS 5.x before 5.5(20) through 8.x before 8.2(2) and 8.3(2)GLX, as used in Catalyst switches, allows remote attackers to cause a denial of service (system crash and reload) by sending invalid packets instead of the final ACK portion of the three-way handshake to the (1) Telnet, (2) HTTP, or (3) SSH services, aka "TCP-ACK DoS attack." Cisco CatOS vulnerabilities

Note: A valid SNMP read community string is required to detect this vulnerability		 net_cisco_tcpack  
RED
!		 CVE-2004-0558 The Internet Printing Protocol (IPP) implementation in CUPS before 1.1.21 allows remote attackers to cause a denial of service (service hang) via a certain UDP packet to the IPP port. CUPS vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check unless dangerous checks are enabled		 printer_cups
printer_cupszero		  
RED CVE-2004-0560 Integer overflow in gopher daemon (gopherd) 3.0.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted content of a certain size that triggers the overflow. gopher vulnerabilities
 misc_gopher  
RED CVE-2004-0561 Format string vulnerability in the log routine for gopher daemon (gopherd) 3.0.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code. gopher vulnerabilities
 misc_gopher  
BROWN CVE-2004-0566 Integer overflow in imgbmp.cxx for Windows 2000 allows remote attackers to execute arbitrary code via a BMP image with a large bfOffBits value. Internet Explorer vulnerabilities

Note: Authentication is required to detect this vulnerability		 win_patch_ie_modal  
RED CVE-2004-0567 The Windows Internet Naming Service (WINS) in Windows NT Server 4.0 SP 6a, NT Terminal Server 4.0 SP 6, Windows 2000 Server SP3 and SP4, and Windows Server 2003 does not properly validate the computer name value in a WINS packet, which allows remote attackers to execute arbitrary code or cause a denial of service (server crash), which results in an "unchecked buffer" and possibly triggers a buffer overflow, aka the "Name Validation Vulnerability." WINS vulnerability
 win_patch_winsrep  
BROWN CVE-2004-0568 HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file (.ht), web site, or Telnet URL contained in an e-mail message, triggering a buffer overflow. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_hyperterm  
RED CVE-2004-0569 The RPC Runtime Library for Microsoft Windows NT 4.0 allows remote attackers to read active memory or cause a denial of service (system crash) via a malicious message, possibly related to improper length values. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_ntrpc  
BROWN CVE-2004-0571 Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Table Conversion Vulnerability," a different vulnerability than CVE-2004-0901. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_wordpadwfwc  
YELLOW CVE-2004-0572 Buffer overflow in the Windows Program Group Converter (grpconv.exe) may allow remote attackers to execute arbitrary code via a shell: URL with a long filename and a .grp extension, which is not properly handled when the shell capability launches grpconv.exe. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_shellapp  
YELLOW CVE-2004-0573 Buffer overflow in the converter for Microsoft WordPerfect 5.x on Office 2000, Office XP, Office 2003, and Works Suites 2001 through 2004 allows remote attackers to execute arbitrary code via a malicious document or website. Microsoft Office vulnerabilities

Note: Authentication is required to detect this vulnerability		 win_patch_wpconv  
RED CVE-2004-0574 The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an "unchecked buffer," leading to off-by-one and heap-based buffer overflows. Microsoft NNTP vulnerabilities
 misc_msnntp  
YELLOW CVE-2004-0575 Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_zipfolder  
RED
!		 CVE-2004-0576 The radius daemon (radiusd) for GNU Radius 1.1, when compiled with the -enable-snmp option, allows remote attackers to cause a denial of service (server crash) via malformed SNMP messages containing an invalid OID. RADIUS SNMP vulnerability
 net_snmp_radius  
RED CVE-2004-0577 WinGate 5.2.3 build 901 and 6.0 beta 2 build 942, and other versions such as 5.0.5, allows remote attackers to read arbitrary files from the root directory via a URL request to the wingate-internal directory. WinGate proxy vulnerability
 web_proxy_wingate  
RED CVE-2004-0578 WinGate 5.2.3 build 901 and 6.0 beta 2 build 942, and other versions such as 5.0.5, allows remote attackers to read arbitrary files via leading slash (//) characters in a URL request to the wingate-internal directory. WinGate proxy vulnerability
 web_proxy_wingate  
YELLOW CVE-2004-0584 Unknown vulnerability in Horde IMP 3.2.3 and earlier, before a "security fix," does not properly validate input, which allows remote attackers to execute arbitrary script as other users via script or HTML in an e-mail message, possibly triggering a cross-site scripting (XSS) vulnerability. Horde IMP vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 mail_web_imp  
BROWN CVE-2004-0589 Cisco IOS 11.1(x) through 11.3(x) and 12.0(x) through 12.2(x), when configured for BGP routing, allows remote attackers to cause a denial of service (device reload) via malformed BGP (1) OPEN or (2) UPDATE messages. Cisco vulnerabilities

Note: A valid SNMP read community string is required to detect this vulnerability		 net_cisco_bgp  
YELLOW CVE-2004-0591 Cross-site scripting (XSS) vulnerability in the print_header_uc function for SqWebMail 4.0.4 and earlier, and possibly 3.x, allows remote attackers to inject arbitrary web script or HRML via (1) e-mail headers or (2) a message with a "message/delivery-status" MIME Content-Type. SqWebMail vulnerabilities
 mail_web_sqxss  
BROWN CVE-2004-0594 The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete. PHP vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_version  
BROWN CVE-2004-0595 The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities. PHP vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_version  
YELLOW CVE-2004-0597 Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking. libpng vulnerabilities
MSN Messenger vulnerabilities
Windows updates needed

Note: Authentication is required to detect this vulnerability		 misc_libpng
misc_msnpng
win_patch_msgpng		  
BROWN CVE-2004-0598 The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference. libpng vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_libpng  
BROWN CVE-2004-0599 Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image. libpng vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_libpng  
RED CVE-2004-0600 Buffer overflow in the Samba Web Administration Tool (SWAT) in Samba 3.0.2 to 3.0.4 allows remote attackers to execute arbitrary code via an invalid base-64 character during HTTP basic authentication. SWAT vulnerabilities
 web_tool_swatbasic  
RED
!		 CVE-2004-0608 The Unreal Engine, as used in DeusEx 1.112fm and earlier, Devastation 390 and earlier, Mobile Forces 20000 and earlier, Nerf Arena Blast 1.2 and earlier, Postal 2 1337 and earlier, Rune 107 and earlier, Tactical Ops 3.4.0 and earlier, Unreal 1 226f and earlier, Unreal II XMP 7710 and earlier, Unreal Tournament 451b and earlier, Unreal Tournament 2003 2225 and earlier, Unreal Tournament 2004 before 3236, Wheel of Time 333b and earlier, and X-com Enforcer, allows remote attackers to execute arbitrary code via a UDP packet containing a secure query with a long value, which overwrites memory. unreal game engine
 misc_unreal
misc_unrealsecure		  
BROWN CVE-2004-0613 osTicket allows remote attackers to view sensitive uploaded files and possibly execute arbitrary code via an HTTP request that uploads a PHP file to the ticket attachments directory. http potential problems
 web_prog_php_osticket  
BROWN CVE-2004-0616 The BT Voyager 2000 Wireless ADSL Router has a default public SNMP community name, which allows remote attackers to obtain sensitive information such as the password, which is stored in plaintext. Guessable Read Community
 net_snmp_read  
YELLOW CVE-2004-0617 Cross-site scripting (XSS) vulnerability in ArbitroWeb 0.6 allows remote attackers to inject arbitrary script or HTML via the rawURL parameter. Cross site scripting
 web_proxy_arbitroxss  
YELLOW CVE-2004-0620 Cross-site scripting (XSS) vulnerability in (1) newreply.php or (2) newthread.php in vBulletin 3.0.1 allows remote attackers to inject arbitrary HTML or script as other users via the Edit-panel. vBulletin vulnerabilities
 web_prog_php_vbulletin  
RED CVE-2004-0621 admin.php in Newsletter ZWS allows remote attackers to gain administrative privileges via a list_user operation with the ulevel parameter set to 1 (administrator level), which lists all users and their passwords. web application access
 web_prog_php_zws  
RED
!		 CVE-2004-0626 The tcp_find_option function of the netfilter subsystem in Linux kernel 2.6, when using iptables and TCP options rules, allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a large option length that produces a negative integer after a casting operation to the char type. Linux TCP options
 misc_linuxtcpopt  
RED CVE-2004-0627 The check_scramble_323 function in MySQL 4.1.x before 4.1.3, and 5.0, allows remote attackers to bypass authentication via a zero-length scrambled string. MySQL vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_mysql_version  
RED CVE-2004-0628 Stack-based buffer overflow in MySQL 4.1.x before 4.1.3, and 5.0, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long scramble string. MySQL vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_mysql_version  
YELLOW CVE-2004-0629 Buffer overflow in the ActiveX component (pdf.ocx) for Adobe Acrobat 5.0.5 and Acrobat Reader, and possibly other versions, allows remote attackers to execute arbitrary code via a URI for a PDF file with a null terminator (%00) followed by a long string. Adobe Acrobat vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_acrobat
misc_acroread		  
YELLOW CVE-2004-0632 Adobe Reader 6.0 does not properly handle null characters when splitting a filename path into components, which allows remote attackers to execute arbitrary code via a file with a long extension that is not normally handled by Reader, triggering a buffer overflow. Adobe Acrobat vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_acroread  
BROWN CVE-2004-0636 Buffer overflow in the goaway function in the aim:goaway URI handler for AOL Instant Messenger (AIM) 5.5, including 5.5.3595, allows remote attackers to execute arbitrary code via a long Away message. AOL Instant Messenger

Note: Authentication is required to detect this vulnerability		 misc_aim  
BROWN CVE-2004-0637 Oracle Database Server 8.1.7.4 through 9.2.0.4 allows local users to execute commands with additional privileges via the ctxsys.driload package, which is publicly accessible. Oracle Database vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_oracle_version  
BROWN CVE-2004-0638 Buffer overflow in the KSDWRTB function in the dbms_system package (dbms_system.ksdwrt) for Oracle 9i Database Server Release 2 9.2.0.3 and 9.2.0.4, 9i Release 1 9.0.1.4 and 9.0.1.5, and 8i Release 1 8.1.7.4, allows remote authorized users to execute arbitrary code via a long second argument. Oracle Database vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_oracle_version  
YELLOW CVE-2004-0639 Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in read_body.php, (2) the $senderNames_part variable in mailbox_display.php, and possibly other vectors including (3) the $event_title variable or (4) the $event_text variable. SquirrelMail vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 mail_web_squirrel  
YELLOW CVE-2004-0641 Thomson SpeedTouch 510 ADSL Router with firmware GV8BAA3.270, and possibly earlier versions, generates predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoof or hijack TCP connections. TCP sequence number prediction
 misc_tcpseq  
YELLOW CVE-2004-0642 Double free vulnerabilities in the error handling code for ASN.1 decoders in the (1) Key Distribution Center (KDC) library and (2) client library for MIT Kerberos 5 (krb5) 1.3.4 and earlier may allow remote attackers to execute arbitrary code. Kerberos detected

Note: Authentication is required to detect this vulnerability		 misc_kerberospkg  
YELLOW CVE-2004-0643 Double free vulnerability in the krb5_rd_cred function for MIT Kerberos 5 (krb5) 1.3.1 and earlier may allow local users to execute arbitrary code. Kerberos detected

Note: Authentication is required to detect this vulnerability		 misc_kerberospkg  
YELLOW CVE-2004-0644 The asn1buf_skiptail function in the ASN.1 decoder library for MIT Kerberos 5 (krb5) 1.2.2 through 1.3.4 allows remote attackers to cause a denial of service (infinite loop) via a certain BER encoding. Kerberos detected

Note: Authentication is required to detect this vulnerability		 misc_kerberospkg  
YELLOW CVE-2004-0648 Mozilla (Suite) before 1.7.1, Firefox before 0.9.2, and Thunderbird before 0.7.2 allow remote attackers to launch arbitrary programs via a URI referencing the shell: protocol. Mozilla Thunderbird vulnerabilities
Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 mail_client_thunderbird
web_client_firefox
web_client_mozilla		  
RED CVE-2004-0650 UploadServlet in Cisco Collaboration Server (CCS) running ServletExec before 3.0E allows remote attackers to upload and execute arbitrary files via a direct call to the UploadServlet URL. Cisco Collaboration Server
 web_prog_jsp_ccsupload  
YELLOW CVE-2004-0660 Cross-site scripting (XSS) vulnerability in (1) show_archives.php, (2) show_news.php, and possibly other php files in CuteNews 1.3.1 allows remote attackers to inject arbitrary script or HTML via the id parameter. Cross site scripting
 web_prog_php_cutenewsxss  
YELLOW CVE-2004-0662 PowerPortal 1.x allows remote attackers to gain sensitive information via invalid or missing parameters in HTTP requests to (1) resize.php or (2) modules.php, which reveals the path in an error message. PowerPortal vulnerabilities
 web_prog_php_powerportal  
YELLOW CVE-2004-0663 Cross-site scripting (XSS) vulnerability in modules.php in PowerPortal 1.x allows remote attackers to inject arbitrary script or HTML via the (1) id parameter to the (a) private_messages module; (2) search parameter to the (b) links and (c) content modules; and (3) files parameter to the gallery module. PowerPortal vulnerabilities
 web_prog_php_powerportalxss  
YELLOW CVE-2004-0664 Directory traversal vulnerability in modules.php in PowerPortal 1.x allows remote attackers to list arbitrary directories via a .. (dot dot) in the files parameter. PowerPortal vulnerabilities
 web_prog_php_powerportal  
YELLOW CVE-2004-0675 Cross-site scripting (XSS) vulnerability in (1) cart32.exe or (2) c32web.exe in Cart32 shopping cart allows remote attackers to execute arbitrary web script via the cart32 parameter to a GetLatestBuilds command. Cross site scripting
 web_prog_cgi_cart32xss  
RED CVE-2004-0676 Directory traversal vulnerability in Fastream NETFile FTP/Web Server 6.7.2.1085 and earlier allows remote attackers to create or delete arbitrary files via .. (dot dot) and // (double slash) sequences in the filename parameter. Fastream NETFile vulnerabilities
 web_server_netfile  
RED CVE-2004-0677 Fastream NETFile FTP Server 6.7.2.1085 and earlier allows remote attackers to cause a denial of service (temporary hang) via the cd command with an unusual argument, possibly due to multiple leading slashes and/or an access to the floppy drive ("A"). Fastream NETFile vulnerabilities
 web_server_netfile  
BROWN CVE-2004-0680 Zoom X3 ADSL modem has a terminal running on port 254 that can be accessed using the default HTML management password, even if the password has been changed for the HTTP interface, which could allow remote attackers to gain unauthorized access. Conexant modem backdoor
 net_conexant  
YELLOW CVE-2004-0681 Multiple cross-site scripting (XSS) vulnerabilities in (1) comersus_customerAuthenticateForm.asp, (2) comersus_backoffice_message.asp, (3) comersus_supportError.asp, or (4) comersus_message.asp in Comersus Cart 5.09 allow remote attackers to execute web script as other users via the message parameter. Comersus Cart vulnerabilities
 web_prog_asp_comersus  
YELLOW CVE-2004-0682 comersus_gatewayPayPal.asp in Comersus Cart 5.09, and possibly other versions before 5.098, allows remote attackers to change the prices of items by directly modifying them in the URL. Comersus Cart vulnerabilities
 web_prog_asp_comersus  
RED
!		 CVE-2004-0684 WebSphere Edge Component Caching Proxy in WebSphere Edge Server 5.02, with the JunctionRewrite directive enabled, allows remote attackers to cause a denial of service via an HTTP GET request without any parameters. WebSphere Edge Server
 web_dev_websphereproxy  
RED CVE-2004-0686 Buffer overflow in Samba 2.2.x to 2.2.9, and 3.0.0 to 3.0.4, when the "mangling method = hash" option is enabled in smb.conf, has unknown impact and attack vectors. Samba vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 win_samba  
RED CVE-2004-0695 Stack-based buffer overflow in the FTP service for 4D WebSTAR 5.3.2 and earlier allows remote attackers to execute arbitrary code via a long FTP command. 4D WebSTAR vulnerabilities
 ftp_webstar  
YELLOW CVE-2004-0696 The ShellExample.cgi script in 4D WebSTAR 5.3.2 and earlier allows remote attackers to list arbitrary directories via a URL with the desired path and a "*" (asterisk) character. 4D WebSTAR httpd vulnerabilities
 web_server_webstar  
YELLOW CVE-2004-0697 Unknown vulnerability in 4D WebSTAR 5.3.2 and earlier allows remote attackers to read the php.ini configuration file and possibly obtain sensitive information. 4D WebSTAR httpd vulnerabilities
 web_server_webstar  
YELLOW CVE-2004-0698 4D WebSTAR 5.3.2 and earlier allows local users to read and modify arbitrary files via a symlink attack. 4D WebSTAR httpd vulnerabilities
 web_server_webstar  
BROWN CVE-2004-0700 Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function. Apache SSL module vulnerabilities
 web_mod_sslproxy  
BROWN CVE-2004-0702 DBI in Bugzilla 2.17.1 through 2.17.7 displays the database password in an error message when the SQL server is not running, which could allow remote attackers to gain sensitive information. Bugzilla vulnerabilities
 web_prog_cgi_bugzilla  
BROWN CVE-2004-0703 Unknown vulnerability in the administrative controls in Bugzilla 2.17.1 through 2.17.7 allows users with "grant membership" privileges to grant memberships to groups that the user does not control. Bugzilla vulnerabilities
 web_prog_cgi_bugzilla  
BROWN CVE-2004-0704 Unknown vulnerability in (1) duplicates.cgi and (2) buglist.cgi in Bugzilla 2.16.x before 2.16.6, 2.18 before 2.18rc1, when configured to hide products, allows remote attackers to view hidden products. Bugzilla vulnerabilities
 web_prog_cgi_bugzilla  
YELLOW CVE-2004-0705 Multiple cross-site scripting (XSS) vulnerabilities in (1) editcomponents.cgi, (2) editgroups.cgi, (3) editmilestones.cgi, (4) editproducts.cgi, (5) editusers.cgi, and (6) editversions.cgi in Bugzilla 2.16.x before 2.16.6, and 2.18 before 2.18rc1, allow remote attackers to execute arbitrary JavaScript as other users via a URL parameter. Bugzilla vulnerabilities
 web_prog_cgi_bugzilla  
BROWN CVE-2004-0706 Bugzilla 2.17.5 through 2.17.7 embeds the password in an image URL, which could allow local users to view the password in the web server log files. Bugzilla vulnerabilities
 web_prog_cgi_bugzilla  
BROWN CVE-2004-0707 SQL injection vulnerability in editusers.cgi in Bugzilla 2.16.x before 2.16.6, and 2.18 before 2.18rc1, allows remote attackers with privileges to grant membership to any group to execute arbitrary SQL. Bugzilla vulnerabilities
 web_prog_cgi_bugzilla  
BROWN CVE-2004-0711 The URL pattern matching feature in BEA WebLogic Server 6.x matches illegal patterns ending in "*" as wildcards as if they were the legal "/*" pattern, which could cause WebLogic 7.x to allow remote attackers to bypass intended access restrictions because the illegal patterns are properly rejected. WebLogic vulnerabilities
 web_dev_weblogic  
BROWN CVE-2004-0712 The configuration tools (1) config.sh in Unix or (2) config.cmd in Windows for BEA WebLogic Server 8.1 through SP2 create a log file that contains the administrative username and password in cleartext, which could allow local users to gain privileges. WebLogic vulnerabilities
 web_dev_weblogic  
BROWN CVE-2004-0713 The remove method in a stateful Enterprise JavaBean (EJB) in BEA WebLogic Server and WebLogic Express version 8.1 through SP2, 7.0 through SP4, and 6.1 through SP6, does not properly check EJB permissions before unexporting a bean, which allows remote authenticated users to remove EJB objects from remote views before the security exception is thrown. WebLogic vulnerabilities
 web_dev_weblogic  
RED CVE-2004-0714 Cisco Internetwork Operating System (IOS) 12.0S through 12.3T attempts to process SNMP solicited operations on improper ports (UDP 162 and a randomly chosen UDP port), which allows remote attackers to cause a denial of service (device reload and memory corruption). Cisco SNMP vulnerability

Note: A valid SNMP read community string is required to detect this vulnerability		 net_cisco_snmpdos  
BROWN CVE-2004-0715 The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 through SP4 does not properly clear member relationships when a group is deleted, which can cause a new group with the same name to have the members of the old group, which allows group members to gain privileges. WebLogic vulnerabilities
 web_dev_weblogic  
RED
!		 CVE-2004-0716 Buffer overflow in the DCE daemon (DCED) for the DCE endpoint mapper (epmap) on HP-UX 11 allows remote attackers to execute arbitrary code via a request with a small fragment length and a large amount of data. dced vulnerabilities
 misc_dced  
YELLOW CVE-2004-0718 The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability. Mozilla vulnerabilities
Netscape Navigator vulnerabilities

Note: Authentication is required to detect this vulnerability		 web_client_firefox
web_client_mozilla
web_client_netscape		  
YELLOW CVE-2004-0722 Integer overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6, and possibly earlier versions, allows remote attackers to execute arbitrary code. Mozilla vulnerabilities
Netscape Navigator vulnerabilities

Note: Authentication is required to detect this vulnerability		 web_client_mozilla
web_client_netscape		  
YELLOW CVE-2004-0727 Microsoft Internet Explorer 6.0.2800.1106 on Microsoft Windows XP SP2, and other versions including 5.01 and 5.5, allows remote web servers to bypass zone restrictions and execute arbitrary code in the local computer zone by redirecting a function to another function with the same name, as demonstrated by SimilarMethodNameRedir, aka the "Similar Method Name Redirection Cross Domain Vulnerability." Internet Explorer vulnerabilities

Note: Authentication is required to detect this vulnerability		 win_patch_ie_css  
YELLOW CVE-2004-0730 Multiple cross-site scripting (XSS) vulnerabilities in PhpBB 2.0.8 allow remote attackers to inject arbitrary web script or HTML via (1) the cat_title parameter in index.php, (2) the faq[0][0] parameter in lang_faq.php as accessible from faq.php, or (3) the faq[0][0] parameter in lang_bbcode.php as accessible from faq.php. Cross site scripting
 web_prog_php_bbxsscattitle
web_prog_php_bbxssfaq		  
RED CVE-2004-0732 SQL injection vulnerability in index.php in the Search module for Php-Nuke allows remote attackers to execute arbitrary SQL statements via the instory parameter. SQL injection
 web_prog_sql_phpnukesearch  
RED CVE-2004-0734 Web_Store.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter. vulnerable web program
 web_prog_cgi_webstore  
RED CVE-2004-0738 Multiple SQL injection vulnerabilities in the Search module in Php-Nuke allow remote attackers to execute arbitrary SQL via the (1) min or (2) categ parameters. SQL injection
 web_prog_sql_phpnukesearch  
RED CVE-2004-0747 Buffer overflow in Apache 2.0.50 and earlier allows local users to gain apache privileges via a .htaccess file that causes the overflow during expansion of environment variables. Apache vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_server_apache_version  
BROWN CVE-2004-0748 mod_ssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (CPU consumption) by aborting an SSL connection in a way that causes an Apache child process to enter an infinite loop. Apache SSL module vulnerabilities
 web_mod_ssltwo  
BROWN CVE-2004-0751 The char_buffer_read function in the mod_ssl module for Apache 2.x, when using reverse proxying to an SSL server, allows remote attackers to cause a denial of service (segmentation fault). Apache SSL module vulnerabilities
 web_mod_ssltwo  
YELLOW CVE-2004-0754 Integer overflow in Gaim before 0.82 allows remote attackers to cause a denial of service and possibly execute arbitrary code via the size variable in Groupware server messages. Gaim vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_gaim  
YELLOW CVE-2004-0757 Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code. Mozilla Thunderbird vulnerabilities
Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 mail_client_thunderbird
web_client_firefox
web_client_mozilla		  
YELLOW CVE-2004-0758 Mozilla 1.5 through 1.7 allows a CA certificate to be imported even when their DN is the same as that of the built-in CA root certificate, which allows remote attackers to cause a denial of service to SSL pages because the malicious certificate is treated as invalid. Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 web_client_mozilla  
YELLOW CVE-2004-0759 Mozilla before 1.7 allows remote web servers to read arbitrary files via Javascript that sets the value of an <input type="file"> tag. Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 web_client_mozilla  
YELLOW CVE-2004-0760 Mozilla allows remote attackers to cause Mozilla to open a URI as a different MIME type than expected via a null character (%00) in an FTP URI. Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 web_client_mozilla  
YELLOW CVE-2004-0761 Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote attackers to use certain redirect sequences to spoof the security lock icon that makes a web page appear to be encrypted. Mozilla Thunderbird vulnerabilities
Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 mail_client_thunderbird
web_client_firefox
web_client_mozilla		  
YELLOW CVE-2004-0762 Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box. Mozilla Thunderbird vulnerabilities
Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 mail_client_thunderbird
web_client_firefox
web_client_mozilla		  
YELLOW CVE-2004-0763 Mozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the "onunload" method. Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 web_client_firefox  
YELLOW CVE-2004-0764 Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the "chrome" flag and XML User Interface Language (XUL) files. Mozilla Thunderbird vulnerabilities
Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 mail_client_thunderbird
web_client_firefox
web_client_mozilla		  
YELLOW CVE-2004-0765 The cert_TestHostName function in Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, only checks the hostname portion of a certificate when the hostname portion of the URI is not a fully qualified domain name (FQDN), which allows remote attackers to spoof trusted certificates. Mozilla Thunderbird vulnerabilities
Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 mail_client_thunderbird
web_client_firefox
web_client_mozilla		  
YELLOW CVE-2004-0772 Double free vulnerabilities in error handling code in krb524d for MIT Kerberos 5 (krb5) 1.2.8 and earlier may allow remote attackers to execute arbitrary code. Kerberos detected

Note: Authentication is required to detect this vulnerability		 misc_kerberospkg  
RED CVE-2004-0774 RealNetworks Helix Universal Server 9.0.2 for Linux and 9.0.3 for Windows allows remote attackers to cause a denial of service (CPU and memory exhaustion) via a POST request with a Content-Length header set to -1. RealServer vulnerabilities
 misc_realserver  
BROWN CVE-2004-0777 Format string vulnerability in the auth_debug function in Courier-IMAP 1.6.0 to 2.2.1, when login debugging (DEBUG_LOGIN) is enabled, allows remote attackers to execute arbitrary code. Courier IMAP vulnerabilities
 mail_imap_courier  
YELLOW CVE-2004-0779 The (1) Mozilla 1.6, (2) Firebird 0.7 and (3) Firefox 0.8 web browsers do not properly verify that cached passwords for SSL encrypted sites are only sent via SSL encrypted sessions to the site, which allows a remote attacker to cause a cached password to be sent in cleartext to a spoofed site. Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 web_client_firefox
web_client_mozilla		  
YELLOW CVE-2004-0781 Cross-site scripting (XSS) vulnerability in list.cgi in the Icecast internal web server (icecast-server) 1.3.12 and earlier allows remote attackers to inject arbitrary web script via the UserAgent parameter. icecast vulnerability
 web_server_icecast  
YELLOW CVE-2004-0784 The smiley theme functionality in Gaim before 0.82 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of the tar file that is dragged to the smiley selector. Gaim vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_gaim  
YELLOW CVE-2004-0785 Multiple buffer overflows in Gaim before 0.82 allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) Rich Text Format (RTF) messages, (2) a long hostname for the local system as obtained from DNS, or (3) a long URL that is not properly handled by the URL decoder. Gaim vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_gaim  
RED CVE-2004-0786 The IPv6 URI parsing routines in the apr-util library for Apache 2.0.50 and earlier allow remote attackers to cause a denial of service (child process crash) via a certain URI, as demonstrated using the Codenomicon HTTP Test Tool. Apache vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_server_apache_version  
RED CVE-2004-0790 Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_ipv6dos
win_patch_tcpip		  
BROWN CVE-2004-0792 Directory traversal vulnerability in the sanitize_path function in util.c for rsync 2.6.2 and earlier, when chroot is disabled, allows attackers to read or write certain files. rsyncd vulnerabilities
 misc_rsyncdpath  
RED CVE-2004-0794 Multiple signal handler race conditions in lukemftpd (aka tnftpd before 20040810) allow remote authenticated attackers to cause a denial of service or execute arbitrary code. signal handling problems
 ftp_heimdalsig
ftp_lukemsig
ftp_tnsig		  
BROWN CVE-2004-0796 SpamAssassin 2.5x, and 2.6x before 2.64, allows remote attackers to cause a denial of service via certain malformed messages. SpamAssassin vulnerabilities

Note: Authentication is required to detect this vulnerability		 mail_misc_spamassassin  
BROWN CVE-2004-0798 Buffer overflow in the _maincfgret.cgi script for Ipswitch WhatsUp Gold before 8.03 Hotfix 1 allows remote attackers to execute arbitrary code via a long instancename parameter. WhatsUp Gold vulnerabilities
 web_tool_whatsup  
RED CVE-2004-0807 Samba 3.0.6 and earlier allows remote attackers to cause a denial of service (infinite loop and memory exhaustion) via certain malformed requests that cause new processes to be spawned and enter an infinite loop. Samba vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 win_samba  
BROWN CVE-2004-0808 The process_logon_packet function in the nmbd server for Samba 3.0.6 and earlier, when domain logons are enabled, allows remote attackers to cause a denial of service via a SAM_UAS_CHANGE request with a length value that is larger than the number of structures that are provided. Samba vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 win_samba  
RED CVE-2004-0809 The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK requests for a location that allows WebDAV authoring access. Apache module vulnerabilities
 web_mod_dav  
RED CVE-2004-0811 Unknown vulnerability in Apache 2.0.51 prevents "the merging of the Satisfy directive," which could allow attackers to obtain access to restricted resources contrary to the specified authentication configuration. Apache vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_server_apache_version  
RED CVE-2004-0815 The unix_clean_name function in Samba 2.2.x through 2.2.11, and 3.0.x before 3.0.2a, trims certain directory names down to absolute paths, which could allow remote attackers to bypass the specified share restrictions and read, write, or list arbitrary files via "/.////" style sequences in pathnames. Samba vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 win_samba  
YELLOW CVE-2004-0820 Winamp before 5.0.4 allows remote attackers to execute arbitrary script in the Local computer zone via script in HTML files that are referenced from XML files contained in a .wsz skin file. Winamp vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_winamp  
RED CVE-2004-0825 QuickTime Streaming Server in Mac OS X Server 10.2.8, 10.3.4, and 10.3.5 allows remote attackers to cause a denial of service (application deadlock) via a certain sequence of operations. Darwin vulnerabilities
 web_server_quicktime  
RED CVE-2004-0826 Heap-based buffer overflow in Netscape Network Security Services (NSS) library allows remote attackers to execute arbitrary code via a modified record length field in an SSLv2 client hello message. Network Security Services
 misc_sslv2bo  
RED CVE-2004-0829 smbd in Samba before 2.2.11 allows remote attackers to cause a denial of service (daemon crash) by sending a FindNextPrintChangeNotify request without a previous FindFirstPrintChangeNotify, as demonstrated by the SMB client in Windows XP SP2. Samba vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 win_samba  
BROWN CVE-2004-0832 The (1) ntlm_fetch_string and (2) ntlm_get_string functions in Squid 2.5.6 and earlier, with NTLM authentication enabled, allow remote attackers to cause a denial of service (application crash) via an NTLMSSP packet that causes a negative value to be passed to memcpy. Squid NTLM vulnerabilities
 web_proxy_squidntlmdos  
YELLOW CVE-2004-0835 MySQL 3.x before 3.23.59, 4.x before 4.0.19, 4.1.x before 4.1.2, and 5.x before 5.0.1, checks the CREATE/INSERT rights of the original table instead of the target table in an ALTER TABLE RENAME operation, which could allow attackers to conduct unauthorized activities. MySQL vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_mysql_version  
RED CVE-2004-0836 Buffer overflow in the mysql_real_connect function in MySQL 4.x before 4.0.21, and 3.x before 3.23.49, allows remote DNS servers to cause a denial of service and possibly execute arbitrary code via a DNS response with a large address length (h_length). MySQL vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_mysql_version  
YELLOW CVE-2004-0837 MySQL 4.x before 4.0.21, and 3.x before 3.23.49, allows attackers to cause a denial of service (crash or hang) via multiple threads that simultaneously alter MERGE table UNIONs. MySQL vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_mysql_version  
YELLOW CVE-2004-0839 Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html". Internet Explorer vulnerabilities

Note: Authentication is required to detect this vulnerability		 win_patch_ie_css  
RED CVE-2004-0840 The SMTP (Simple Mail Transfer Protocol) component of Microsoft Windows XP 64-bit Edition, Windows Server 2003, Windows Server 2003 64-bit Edition, and the Exchange Routing Engine component of Exchange Server 2003, allows remote attackers to execute arbitrary code via a malicious DNS response message containing length values that are not properly validated. Microsoft mail server vulnerabilities
 mail_smtp_microsoft  
YELLOW CVE-2004-0841 Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop actions in a popup window, aka "HijackClick 3" and the "Script in Image Tag File Download Vulnerability." Internet Explorer vulnerabilities

Note: Authentication is required to detect this vulnerability		 win_patch_ie_css  
YELLOW CVE-2004-0842 Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability." Internet Explorer vulnerabilities

Note: Authentication is required to detect this vulnerability		 win_patch_ie_css  
YELLOW CVE-2004-0843 Internet Explorer 5.5 and 6 does not properly handle plug-in navigation, which allows remote attackers to alter displayed address bars and thereby spoof web pages, facilitating phishing attacks, aka the "Plug-in Navigation Address Bar Spoofing Vulnerability." Internet Explorer vulnerabilities

Note: Authentication is required to detect this vulnerability		 win_patch_ie_css  
YELLOW CVE-2004-0844 Internet Explorer 6 on Double Byte Character Set (DBCS) systems allows remote attackers to alter displayed address bars and spoof web pages via a URL containing special characters, facilitating phishing attacks, aka the "Address Bar Spoofing on Double Byte Character Set Systems Vulnerability." Internet Explorer vulnerabilities

Note: Authentication is required to detect this vulnerability		 win_patch_ie_css  
YELLOW CVE-2004-0845 Internet Explorer 5.01, 5.5, and 6 does not properly cache SSL content, which allows remote attackers to obtain information or spoof content via a web site with the same host name as the target web site, whose content is cached and reused when the user visits the target web site. Internet Explorer vulnerabilities

Note: Authentication is required to detect this vulnerability		 win_patch_ie_css  
YELLOW CVE-2004-0846 Unknown vulnerability in Microsoft Excel 2000, 2002, 2001 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via a malicious file containing certain parameters that are not properly validated. Microsoft Office vulnerabilities

Note: Authentication is required to detect this vulnerability		 win_patch_excel  
RED CVE-2004-0847 The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing a (1) "\" (backslash) or (2) "%5C" (encoded backslash), aka "Path Validation Vulnerability." ASP NET vulnerabilities
 web_server_iis_dotnetauth  
YELLOW CVE-2004-0848 Buffer overflow in Microsoft Office XP allows remote attackers to execute arbitrary code via a link with a URL file location containing long inputs after (1) "%00 (null byte) in .doc filenames or (2) "%0a" (carriage return) in .rtf filenames. Microsoft Office vulnerabilities

Note: Authentication is required to detect this vulnerability		 win_patch_officexp  
RED CVE-2004-0849 Integer overflow in the asn_decode_string() function defined in asn1.c in radiusd for GNU Radius 1.1 and 1.2 before 1.2.94, when compiled with the --enable-snmp option, allows remote attackers to cause a denial of service (daemon crash) via certain SNMP requests. RADIUS SNMP vulnerability
 net_snmp_radius  
BROWN CVE-2004-0866 Internet Explorer 6.0 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk, and .sch.uk, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session. Cookie Injection

Note: Authentication is required to detect this vulnerability		 web_client_iecookieinj  
BROWN CVE-2004-0867 Mozilla Firefox 0.9.2 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk, and .sch.uk, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session. NOTE: it was later reported that 2.x is also affected. Cookie Injection

Note: Authentication is required to detect this vulnerability		 web_client_ffcookieinj
web_client_mozcookieinj		  
BROWN CVE-2004-0869 Internet Explorer does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka "Cross Security Boundary Cookie Injection." Cookie Injection

Note: Authentication is required to detect this vulnerability		 web_client_iecookieinj  
BROWN CVE-2004-0871 Mozilla does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka "Cross Security Boundary Cookie Injection." Cookie Injection

Note: Authentication is required to detect this vulnerability		 web_client_ffcookieinj
web_client_mozcookieinj		  
YELLOW CVE-2004-0875 Multiple cross-site scripting (XSS) vulnerabilities in Phpgroupware (aka webdistro) 0.9.16.002 and earlier allow remote attackers to insert arbitrary HTML or web script, as demonstrated with a request to the wiki module. phpGroupWare vulnerabilities
 web_prog_php_groupware  
RED CVE-2004-0882 Buffer overflow in the QFILEPATHINFO request handler in Samba 3.0.x through 3.0.7 may allow remote attackers to execute arbitrary code via a TRANSACT2_QFILEPATHINFO request with a small "maximum data bytes" value. Samba vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 win_samba  
BROWN CVE-2004-0885 The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration. Apache SSL module vulnerabilities
 web_mod_ssltwo  
YELLOW CVE-2004-0891 Buffer overflow in the MSN protocol handler for gaim 0.79 to 1.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an "unexpected sequence of MSNSLP messages" that results in an unbounded copy operation that writes to the wrong buffer. Gaim vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_gaim  
YELLOW CVE-2004-0893 The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability." Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_kernelpe  
YELLOW CVE-2004-0894 LSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to gain privileges via a specially-designed program. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_kernelpe  
YELLOW CVE-2004-0897 The Indexing Service for Microsoft Windows XP and Server 2003 does not properly validate the length of a message, which allows remote attackers to execute arbitrary code via a buffer overflow attack. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_indexing  
RED CVE-2004-0899 The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition, with DHCP logging enabled, does not properly validate the length of certain messages, which allows remote attackers to cause a denial of service (application crash) via a malformed DHCP message, aka "Logging Vulnerability." Windows DHCP vulnerabilities
 misc_ntdhcp  
RED CVE-2004-0900 The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages, which allows remote attackers to execute arbitrary code via a malformed DHCP message, aka the "DHCP Request Vulnerability." Windows DHCP vulnerabilities
 misc_ntdhcp  
BROWN CVE-2004-0901 Microsoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file sent by email or malicious web site, aka "Font Conversion Vulnerability," a different vulnerability than CVE-2004-0571. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_wordpadwfwc  
YELLOW CVE-2004-0902 Multiple heap-based buffer overflows in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via (1) the "Send page" functionality, (2) certain responses from a malicious POP3 server, or (3) a link containing a non-ASCII hostname. Mozilla Thunderbird vulnerabilities
Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 mail_client_thunderbird
web_client_firefox
web_client_mozilla		  
YELLOW CVE-2004-0903 Stack-based buffer overflow in the writeGroup function in nsVCardObj.cpp for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to execute arbitrary code via malformed VCard attachments that are not properly handled when previewing a message. Mozilla Thunderbird vulnerabilities
Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 mail_client_thunderbird
web_client_firefox
web_client_mozilla		  
YELLOW CVE-2004-0904 Integer overflow in the bitmap (BMP) decoder for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote attackers to execute arbitrary code via wide bitmap files that trigger heap-based buffer overflows. Mozilla Thunderbird vulnerabilities
Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 mail_client_thunderbird
web_client_firefox
web_client_mozilla		  
YELLOW CVE-2004-0905 Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to perform cross-domain scripting and possibly execute arbitrary code by convincing a user to drag and drop javascript: links to a frame or page in another domain. Mozilla Thunderbird vulnerabilities
Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 mail_client_thunderbird
web_client_firefox
web_client_mozilla		  
YELLOW CVE-2004-0906 The XPInstall installer in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 sets insecure permissions for certain installed files within xpi packages, which could allow local users to overwrite arbitrary files or execute arbitrary code. Mozilla Thunderbird vulnerabilities
Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 mail_client_thunderbird
web_client_firefox
web_client_mozilla		  
YELLOW CVE-2004-0907 The Linux install .tar.gz archives for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8, create certain files with insecure permissions, which could allow local users to overwrite those files and execute arbitrary code. Mozilla Thunderbird vulnerabilities
Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 mail_client_thunderbird
web_client_firefox
web_client_mozilla		  
YELLOW CVE-2004-0908 Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows untrusted Javascript code to read and write to the clipboard, and possibly obtain sensitive information, via script-generated events such as Ctrl-Ins. Mozilla Thunderbird vulnerabilities
Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 mail_client_thunderbird
web_client_firefox
web_client_mozilla		  
YELLOW CVE-2004-0909 Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 may allow remote attackers to trick users into performing unexpected actions, including installing software, via signed scripts that request enhanced abilities using the enablePrivilege parameter, then modify the meaning of certain security-relevant dialog messages. Mozilla Thunderbird vulnerabilities
Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 mail_client_thunderbird
web_client_firefox
web_client_mozilla		  
BROWN CVE-2004-0911 telnetd for netkit 0.17 and earlier, and possibly other versions, on Debian GNU/Linux allows remote attackers to cause a denial of service (free of an invalid pointer), a different vulnerability than CVE-2001-0554. netkit telnet vulnerability
 shell_telnet_netkit  
BROWN CVE-2004-0917 The default installation of Vignette Application Portal installs the diagnostic utility without authentication requirements, which allows remote attackers to gain sensitive information, such as server and OS version, and conduct unauthorized activities via an HTTP request to /diag. http cgi info
 web_prog_file_portaldiag  
RED CVE-2004-0918 The asn_parse_header function (asn1.c) in the SNMP module for Squid Web Proxy Cache before 2.4.STABLE7 allows remote attackers to cause a denial of service (server restart) via certain SNMP packets with negative length fields that trigger a memory allocation error. Squid vulnerabilities
 web_proxy_squidsnmp  
YELLOW CVE-2004-0923 CUPS 1.1.20 and earlier records authentication information for a device URI in the error_log file, which allows local users to obtain user names and passwords. CUPS vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 printer_cupsversion  
YELLOW CVE-2004-0926 Heap-based buffer overflow in Apple QuickTime on Mac OS 10.2.8 through 10.3.5 may allow remote attackers to execute arbitrary code via a certain BMP image. QuickTime vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_quicktime  
YELLOW CVE-2004-0928 The Microsoft IIS Connector in JRun 4.0 and Macromedia ColdFusion MX 6.0, 6.1, and 6.1 J2EE allows remote attackers to bypass authentication and view source files, such as .asp, .pl, and .php files, via an HTTP request that ends in ";.cfm". JRun vulnerabilities
 web_dev_jrun_semi  
RED CVE-2004-0930 The ms_fnmatch function in Samba 3.0.4 and 3.0.7 and possibly other versions allows remote authenticated users to cause a denial of service (CPU consumption) via a SAMBA request that contains multiple * (wildcard) characters. Samba vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 win_samba  
BROWN CVE-2004-0940 Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error. Apache vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_server_apache_version  
RED CVE-2004-0953 Buffer overflow in the C2S module in the open source Jabber 2.x server (Jabberd) allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long username. Jabber vulnerabilities
 misc_jabber  
YELLOW CVE-2004-0957 Unknown vulnerability in MySQL 3.23.58 and earlier, when a local user has privileges for a database whose name includes a "_" (underscore), grants privileges to other databases that have similar names, which can allow the user to conduct unauthorized activities. MySQL vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_mysql_version  
BROWN CVE-2004-0958 php_variables.c in PHP before 5.0.2 allows remote attackers to read sensitive memory contents via (1) GET, (2) POST, or (3) COOKIE GPC variables that end in an open bracket character, which causes PHP to calculate an incorrect string length. PHP vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_version  
BROWN CVE-2004-0959 rfc1867.c in PHP before 5.0.2 allows local users to upload files to arbitrary locations via a PHP script with a certain MIME header that causes the "$_FILES" array to be modified. PHP vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_version  
YELLOW CVE-2004-0963 Buffer overflow in Microsoft Word 2002 (10.6612.6714) SP3, and possibly other versions, allows remote attackers to cause a denial of service (application exception) and possibly execute arbitrary code in winword.exe via certain unexpected values in a .doc file, including (1) an offset that triggers an out-of-bounds memory access, (2) a certain value that causes a large memory copy as triggered by an integer conversion error, and other values. Microsoft Office vulnerabilities

Note: Authentication is required to detect this vulnerability		 win_patch_word  
BROWN CVE-2004-0985 Internet Explorer 6.x on Windows XP SP2 allows remote attackers to execute arbitrary code, as demonstrated using a document with a draggable file type such as .xml, .doc, .py, .cdf, .css, .pdf, or .ppt, and using ADODB.Connection and ADODB.recordset to write to a .hta file that is interpreted in the Local Zone by HTML Help. Internet Explorer vulnerabilities

Note: Authentication is required to detect this vulnerability		 win_patch_ie_shellexp  
RED
!		 CVE-2004-0987 Buffer overflow in the process_menu function in yardradius 1.0.20 allows remote attackers to execute arbitrary code. RADIUS vulnerabilities
 misc_yard  
YELLOW CVE-2004-0988 Integer overflow on Apple QuickTime before 6.5.2, when running on Windows systems, allows remote attackers to cause a denial of service (memory consumption) via certain inputs that cause a large memory operation. QuickTime vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_quicktime  
YELLOW CVE-2004-0996 main.c in cscope 15-4 and 15-5 creates temporary files with predictable filenames, which allows local users to overwrite arbitrary files via a symlink attack. MacOSX vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_macosx_version  
BROWN CVE-2004-1003 Trend ScanMail allows remote attackers to obtain potentially sensitive information or disable the anti-virus capability via the smency.nsf file. http cgi info
 web_prog_file_smency  
BROWN CVE-2004-1006 Format string vulnerability in the log functions in dhcpd for dhcp 2.x allows remote DNS servers to execute arbitrary code via certain DNS messages, a different vulnerability than CVE-2002-0702. dhcpd vulnerabilities
 misc_dhcp  
RED CVE-2004-1011 Stack-based buffer overflow in Cyrus IMAP Server 2.2.4 through 2.2.8, with the imapmagicplus option enabled, allows remote attackers to execute arbitrary code via a long (1) PROXY or (2) LOGIN command, a different vulnerability than CVE-2004-1015. Cyrus imap version
 mail_imap_cyrus  
RED CVE-2004-1012 The argument parser of the PARTIAL command in Cyrus IMAP Server 2.2.6 and earlier allows remote authenticated users to execute arbitrary code via a certain command ("body[p") that is treated as a different command ("body.peek") and causes an index increment error that leads to an out-of-bounds memory corruption. Cyrus imap version
 mail_imap_cyrus  
RED CVE-2004-1013 The argument parser of the FETCH command in Cyrus IMAP Server 2.2.x through 2.2.8 allows remote authenticated users to execute arbitrary code via certain commands such as (1) "body[p", (2) "binary[p", or (3) "binary[p") that cause an index increment error that leads to an out-of-bounds memory corruption. Cyrus imap version
 mail_imap_cyrus  
RED CVE-2004-1015 Buffer overflow in proxyd for Cyrus IMAP Server 2.2.9 and earlier, with the imapmagicplus option enabled, may allow remote attackers to execute arbitrary code, a different vulnerability than CVE-2004-1011. Cyrus imap version
 mail_imap_cyrus  
BROWN CVE-2004-1018 Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or (3) an "integer overflow/underflow" in the unpack function. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion. PHP vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_version  
BROWN CVE-2004-1019 The deserialization code in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to cause a denial of service and execute arbitrary code via untrusted data to the unserialize function that may trigger "information disclosure, double-free and negative reference index array underflow" results. PHP vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_version  
BROWN CVE-2004-1020 The addslashes function in PHP 4.3.9 does not properly escape a NULL (/0) character, which may allow remote attackers to read arbitrary files in PHP applications that contain a directory traversal vulnerability in require or include statements, but are otherwise protected by the magic_quotes_gpc mechanism. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion. PHP vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_version  
YELLOW CVE-2004-1029 The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages. Java Plugin vulnerability

Note: Authentication is required to detect this vulnerability		 web_client_javaplugin  
YELLOW CVE-2004-1036 Cross-site scripting (XSS) vulnerability in the decoding of encoded text in certain headers in mime.php for SquirrelMail 1.4.3a and earlier, and 1.5.1-cvs before 23rd October 2004, allows remote attackers to execute arbitrary web script or HTML. SquirrelMail vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 mail_web_squirrel  
RED CVE-2004-1037 The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string. vulnerable web program
 web_prog_cgi_twikisearch  
BROWN CVE-2004-1039 The NFS mountd service on SCO UnixWare 7.1.1, 7.1.3, 7.1.4, and 7.0.1, and possibly other versions, when run from inetd, allows remote attackers to cause a denial of service (memory exhaustion) via a series of requests, which causes inetd to launch a separate process for each request. UnixWare mountd vulnerability
 rpc_mountduw  
YELLOW CVE-2004-1043 Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to execute arbitrary code by using the "Related Topics" command in the Help ActiveX Control (hhctrl.ocx) to open a Help popup window containing the PCHealth tools.htm file in the local zone and injecting Javascript to be executed, as demonstrated using "writehta.txt" and the ADODB recordset, which saves a .HTA file to the local system, aka the "HTML Help ActiveX control Cross Domain Vulnerability." Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_htmlhelpcross  
YELLOW CVE-2004-1049 Integer overflow in the LoadImage API of the USER32 Lib for Microsoft Windows allows remote attackers to execute arbitrary code via a .bmp, .cur, .ico or .ani file with a large image size field, which leads to a buffer overflow, aka the "Cursor and Icon Format Handling Vulnerability." Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_cursor  
YELLOW CVE-2004-1050 Heap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute arbitrary code via long (1) SRC or (2) NAME attributes in IFRAME, FRAME, and EMBED elements, as originally discovered using the mangleme utility, aka "the IFRAME vulnerability" or the "HTML Elements Vulnerability." Internet Explorer vulnerabilities

Note: Authentication is required to detect this vulnerability		 win_patch_ie_srcbo  
YELLOW CVE-2004-1055 Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PmaAbsoluteUri parameter, (2) the zero_rows parameter in read_dump.php, (3) the confirm form, or (4) an error message generated by the internal phpMyAdmin parser. phpMyAdmin vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_myadminver  
RED CVE-2004-1060 Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Don't Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_tcpip  
YELLOW CVE-2004-1061 Cross-site scripting (XSS) vulnerability in Bugzilla before 2.18, including 2.16.x before 2.16.11, allows remote attackers to inject arbitrary HTML and web script via forced error messages, as demonstrated using the action parameter. Bugzilla vulnerabilities
 web_prog_cgi_bugzilla  
BROWN CVE-2004-1063 PHP 4.x to 4.3.9, and PHP 5.x to 5.0.2, when running in safe mode on a multithreaded Unix webserver, allows local users to bypass safe_mode_exec_dir restrictions and execute commands outside of the intended safe_mode_exec_dir via shell metacharacters in the current directory name. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion. PHP vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_version  
BROWN CVE-2004-1064 The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which could allow attackers to bypass safe mode. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion. PHP vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_version  
BROWN CVE-2004-1065 Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary code via a long section name in an image file. PHP vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_version  
YELLOW CVE-2004-1075 Cross-site scripting (XSS) vulnerability in standard_error_message.dtml for Zwiki after 0.10.0rc1 to 0.36.2 allows remote attackers to inject arbitrary HTML and web script via a malformed URL, which is not properly cleansed when generating an error message. Cross site scripting
 web_server_css  
RED CVE-2004-1077 Citrix Program Neighborhood Agent for Win32 8.00.24737 and earlier and MetaFrame Presentation Server client for WinCE before 8.33 allows remote servers to create arbitrary shortcuts on the client via a full UNC path in the AppInStartmenu directive. Citrix Neighborhood Agent

Note: Authentication is required to detect this vulnerability		 misc_citrixagent  
RED CVE-2004-1078 Stack-based buffer overflow in the client for Citrix Program Neighborhood Agent for Win32 8.00.24737 and earlier and Citrix MetaFrame Presentation Server client for WinCE before 8.33 allows remote attackers to execute arbitrary code via a long cached icon filename in the InName XML element. Citrix Neighborhood Agent

Note: Authentication is required to detect this vulnerability		 misc_citrixagent  
RED CVE-2004-1080 The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42, aka the "Association Context Vulnerability." WINS vulnerability
 win_patch_winsrep  
YELLOW CVE-2004-1082 mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials. MacOS Apache vulnerabilities
 web_server_apache_machfs  
YELLOW CVE-2004-1083 Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which allows remote attackers to read .DS_Store files and files beginning with ".ht" using alternate capitalization. MacOS Apache vulnerabilities
 web_server_apache_machfs  
YELLOW CVE-2004-1084 Apache for Apple Mac OS X 10.2.8 and 10.3.6 allows remote attackers to read files and resource fork content via HTTP requests to certain special file names related to multiple data streams in HFS+, which bypass Apache file handles. MacOS Apache vulnerabilities
 web_server_apache_machfs  
YELLOW CVE-2004-1094 Buffer overflow in InnerMedia DynaZip DUNZIP32.dll file version 5.00.03 and earlier allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename, as demonstrated using (1) a .rjs (skin) file in RealPlayer 10 through RealPlayer 10.5 (6.0.12.1053), RealOne Player 1 and 2, (2) the Restore Backup function in CheckMark Software Payroll 2004/2005 3.9.6 and earlier, (3) CheckMark MultiLedger before 7.0.2, (4) dtSearch 6.x and 7.x, (5) mcupdmgr.exe and mghtml.exe in McAfee VirusScan 10 Build 10.0.21 and earlier, (6) IBM Lotus Notes before 6.5.5, and other products. NOTE: it is unclear whether this is the same vulnerability as CVE-2004-0575, although the data manipulations are the same. RealPlayer vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_reallinux
misc_realplayer		  
BROWN CVE-2004-1097 Format string vulnerability in the cherokee_logger_ncsa_write_string function in Cherokee 0.4.17 and earlier, when authenticating via auth_pam, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via format string specifiers in the URL. Cherokee vulnerabilities
 web_server_cherokee  
YELLOW CVE-2004-1100 Cross-site scripting (XSS) vulnerability in mailpost.exe in MailPost 5.1.1sv, and possibly earlier versions, when debug mode is enabled, allows remote attackers to execute arbitrary web script or HTML via the append parameter. Cross site scripting
 web_prog_cgi_mailpostxss  
YELLOW CVE-2004-1101 mailpost.exe in MailPost 5.1.1sv, and possibly earlier versions, allows remote attackers to cause a denial of service (server crash), leak sensitive pathname information in the resulting error message, and execute a cross-site scripting (XSS) attack via an HTTP request that contains a / (backslash) and arbitrary webscript before the requested file, which leaks the pathname and does not quote the script in the resulting Visual Basic error message. Cross site scripting
 web_prog_cgi_mailpostxss  
YELLOW CVE-2004-1103 MailPost 5.1.1sv, and possibly earlier versions, when debug mode is enabled, allows remote attackers to gain sensitive information via the debug parameter, which reveals information such as the path to the web root and the web server version. web program information disclosure
 web_prog_cgi_mailpost  
YELLOW CVE-2004-1106 Cross-site scripting (XSS) vulnerability in Gallery 1.4.4-pl3 and earlier allows remote attackers to execute arbitrary web script or HTML via "specially formed URLs," possibly via the include parameter in index.php. Gallery vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_galleryversion  
BROWN CVE-2004-1111 Cisco IOS 2.2(18)EW, 12.2(18)EWA, 12.2(14)SZ, 12.2(18)S, 12.2(18)SE, 12.2(18)SV, 12.2(18)SW, and other versions without the "no service dhcp" command, keep undeliverable DHCP packets in the queue instead of dropping them, which allows remote attackers to cause a denial of service (dropped traffic) via multiple undeliverable DHCP packets that exceed the input queue size. Cisco DHCP vulnerabilities

Note: A valid SNMP read community string is required to detect this vulnerability		 net_cisco_dhcp  
YELLOW CVE-2004-1119 Stack-based buffer overflow in IN_CDDA.dll in Winamp 5.05, and possibly other versions including 5.06, allows remote attackers to execute arbitrary code via a certain .m3u playlist file. Winamp vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_winamp  
RED CVE-2004-1123 Darwin Streaming Server 5.0.1, and possibly earlier versions, allows remote attackers to cause a denial of service (server crash) via a DESCRIBE request with a location that contains a null byte. Darwin vulnerabilities
 web_server_darwin
web_server_quicktime		  
RED CVE-2004-1128 Buffer overflow in CMailCOM.dll in CMailServer 5.2 allows remote attackers to execute arbitrary code via an attachment with a long filename. CMailServer vulnerability
 mail_web_cmailserver  
RED CVE-2004-1129 SQL injection vulnerability in (1) fdelmail.asp, (2) addressc.asp, and possibly (3) postmail.asp and (4) fmvmail.asp in CMailServer 5.2 allow remote attackers to inject arbitrary SQL commands and delete mail metadata or e-mail addresses of contacts via the indexOfMail parameter. CMailServer vulnerability
 mail_web_cmailserver  
RED CVE-2004-1130 Cross-site scripting (XSS) vulnerability in admin.asp in CMailServer 5.2 allows remote attackers to execute arbitrary web script or HTML via personal information fields, such as (1) username, (2) name, or (3) comments. CMailServer vulnerability
 mail_web_cmailserver  
RED CVE-2004-1133 Multiple cross-site scripting (XSS) vulnerabilities in Microsoft W3Who ISAPI (w3who.dll) allow remote attackers to inject arbitrary HTML and web script via (1) HTTP headers such as "Connection" or (2) invalid parameters whose values are echoed in the resulting error message. vulnerable web program
 web_prog_cgi_w3who  
RED CVE-2004-1134 Buffer overflow in the Microsoft W3Who ISAPI (w3who.dll) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long query string. vulnerable web program
 web_prog_cgi_w3who  
RED CVE-2004-1135 Multiple buffer overflows in WS_FTP Server 5.03 2004.10.14 allow remote attackers to cause a denial of service (service crash) via long (1) SITE, (2) XMKD, (3) MKD, and (4) RNFR commands. WS FTP vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 ftp_wsftpver  
BROWN CVE-2004-1143 The password generation in mailman before 2.1.5 generates only 5 million unique passwords, which makes it easier for remote attackers to guess passwords via a brute force attack. Mailman vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 mail_misc_mailman  
YELLOW CVE-2004-1146 Multiple cross-site scripting (XSS) vulnerabilities in (1) main.c and (2) login.c for CVSTrac before 1.1.5 allow remote attackers to inject arbitrary HTML and web script. Cross site scripting
 web_prog_cgi_cvstracxss  
BROWN CVE-2004-1147 phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands via shell metacharacters. phpMyAdmin vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_myadminver  
BROWN CVE-2004-1148 phpMyAdmin before 2.6.1, when configured with UploadDir functionality, allows remote attackers to read arbitrary files via the sql_localfile parameter. phpMyAdmin vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_myadminver  
YELLOW CVE-2004-1150 Stack-based buffer overflow in the in_cdda.dll plugin for Winamp 5.0 through 5.08c allows attackers to execute arbitrary code via a cda:// URL with a long (1) device name or (2) sound track number, as demonstrated with a .m3u or .pls playlist file. Winamp vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_winamp  
YELLOW CVE-2004-1153 Format string vulnerability in Adobe Acrobat Reader 6.0.0 through 6.0.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an .ETD document containing format string specifiers in (1) title or (2) baseurl fields. Adobe Acrobat vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_acroread  
RED CVE-2004-1154 Integer overflow in the Samba daemon (smbd) in Samba 2.x and 3.0.x through 3.0.9 allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a Samba request with a large number of security descriptors that triggers a heap-based buffer overflow. Samba vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 win_samba  
YELLOW CVE-2004-1156 Mozilla before 1.7.6, and Firefox before 1.0.1, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability. Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 web_client_firefox
web_client_mozilla		  
YELLOW CVE-2004-1160 Netscape 7.x to 7.2, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability. Netscape Navigator vulnerabilities

Note: Authentication is required to detect this vulnerability		 web_client_netscape  
YELLOW CVE-2004-1166 CRLF injection vulnerability in Microsoft Internet Explorer 6.0.2800.1106 and earlier allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline ("%0a") before the FTP command, which causes the commands to be inserted into the resulting FTP session, as demonstrated using a PORT command. Internet Explorer vulnerabilities

Note: Authentication is required to detect this vulnerability		 win_patch_ie_06aug  
RED
!		 CVE-2004-1168 Stack-based buffer overflow in the WebDav handler in MaxDB WebTools 7.5.00.18 and earlier allows remote attackers to execute arbitrary code via a long Overwrite header. MaxDB WebTools vulnerabilities
 web_tool_maxdb  
RED
!		 CVE-2004-1169 MaxDB WebTools 7.5.00.18 and earlier allows remote attackers to cause a denial of service (application crash) via an HTTP GET request for a file that does not exist, followed by two carriage returns, which causes a NULL dereference. MaxDB WebTools vulnerabilities
 web_tool_maxdb  
RED
!		 CVE-2004-1172 Stack-based buffer overflow in the Agent Browser in Veritas Backup Exec 8.x before 8.60.3878 Hotfix 68, and 9.x before 9.1.4691 Hotfix 40, allows remote attackers to execute arbitrary code via a registration request with a long hostname. Veritas Backup Exec

Note: Authentication is recommended to improve the accuracy of this check unless dangerous checks are enabled		 misc_backupexec
misc_backupexechost		  
YELLOW CVE-2004-1177 Cross-site scripting (XSS) vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page. Mailman vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 mail_misc_mailman  
BROWN CVE-2004-1182 hfaxd in HylaFAX before 4.2.1, when installed with a "weak" hosts.hfaxd file, allows remote attackers to authenticate and bypass intended access restrictions via a crafted (1) username or (2) hostname that satisfies a regular expression that is matched against a hosts.hfaxd entry without a password. HylaFAX vulnerabilities
 misc_hylafax  
YELLOW CVE-2004-1184 The EPSF pipe support in enscript 1.6.3 allows remote attackers or local users to execute arbitrary commands via shell metacharacters. MacOSX vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_macosx_version  
YELLOW CVE-2004-1185 Enscript 1.6.3 does not sanitize filenames, which allows remote attackers or local users to execute arbitrary commands via crafted filenames. MacOSX vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_macosx_version  
YELLOW CVE-2004-1186 Multiple buffer overflows in enscript 1.6.3 allow remote attackers or local users to cause a denial of service (application crash). MacOSX vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_macosx_version  
BROWN CVE-2004-1189 The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow. Kerberos detected
 misc_kadmind  
RED CVE-2004-1192 Format string vulnerability in the lprintf function in Citadel/UX 6.27 and earlier allows remote attackers to execute arbitrary code via format string specifiers sent to the server. Citadel UX vulnerabilities
 misc_citadel  
YELLOW CVE-2004-1202 Cross-site scripting (XSS) vulnerability in parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to inject arbitrary web script or HTML via the file parameter. Cross site scripting
 web_prog_php_cms  
YELLOW CVE-2004-1203 parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to gain sensitive information via an invalid file parameter, which reveals the web server's installation path. Cross site scripting
 web_prog_php_cms  
RED CVE-2004-1205 codebrowserpntm.php in PnTresMailer 6.03 allows remote attackers to gain sensitive information via an invalid filetohighlight parameter, which reveals the full path in an error message. vulnerable web program
 web_prog_cgi_pntm  
RED CVE-2004-1206 Directory traversal vulnerability in codebrowserpntm.php in pnTresMailer 6.0.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the filetodownload parameter. vulnerable web program
 web_prog_cgi_pntm  
YELLOW CVE-2004-1211 Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via long arguments to the (1) EXAMINE, (2) SUBSCRIBE, (3) STATUS, (4) APPEND, (5) CHECK, (6) CLOSE, (7) EXPUNGE, (8) FETCH, (9) RENAME, (10) DELETE, (11) LIST, (12) SEARCH, (13) CREATE, or (14) UNSUBSCRIBE commands. Mercury vulnerabilities
 mail_imap_mercury  
RED CVE-2004-1212 Directory traversal vulnerability in btdownload.php in Blog Torrent preview 0.8 allows remote attackers to download arbitrary files via a .. (dot dot) in the file argument. vulnerable web program
 web_prog_php_btdownload  
YELLOW CVE-2004-1213 Cross-site scripting (XSS) vulnerability in index.php in Advanced Guestbook 2.3.1, 2.2, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the entry parameter. Cross site scripting
 web_prog_php_advgbxss  
BROWN CVE-2004-1219 paFileDB 3.1, when using sessions authentication and while the administrator logs on, allows remote attackers to read the administrator's password hash and conduct brute force password guessing attacks by listing the contents of the sessions directory and reading the associated file for the administrator session. web application access
 web_prog_php_pafiledbsess  
RED CVE-2004-1221 Directory traversal vulnerability in weblibs.pl in WebLibs 1.0 allows remote attackers to read arbitrary files via .. sequences in the TextFile parameter. vulnerable web program
 web_prog_cgi_weblibs  
RED CVE-2004-1222 weblibs.pl in WebLibs 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the TextFile parameter. vulnerable web program
 web_prog_cgi_weblibs  
RED CVE-2004-1225 SQL injection vulnerability in SugarCRM Sugar Sales before 2.0.1a allows remote attackers to execute arbitrary SQL commands and gain privileges via the record parameter in a DetailView action to index.php, and record parameters in other functionality. vulnerable web program
 web_prog_php_sugarsales  
RED CVE-2004-1226 SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to gain sensitive information via certain requests to scripts that contain invalid input, which reveals the path in an error message, as demonstrated using phprint.php with an empty module parameter. vulnerable web program
 web_prog_php_sugarsales  
RED CVE-2004-1227 Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to read arbitrary files and possibly execute arbitrary PHP code via .. (dot dot) sequences in the (1) module, (2) action, or (3) theme parameters to index.php, (4) the theme parameter to Login.php, and possibly other parameters or scripts. vulnerable web program
 web_prog_php_sugarsales  
RED CVE-2004-1228 The install scripts in SugarCRM Sugar Sales 2.0.1c and earlier are not removed after installation, which allows attackers to obtain the MySQL administrative password in cleartext from an installation form, or to cause a denial of service by changing database settings to the default. vulnerable web program
 web_prog_php_sugarsales  
YELLOW CVE-2004-1244 Windows Media Player 9 allows remote attackers to execute arbitrary code via a PNG file containing large (1) width or (2) height values, aka the "PNG Processing Vulnerability." Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_wmppng  
YELLOW CVE-2004-1305 The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allow remote attackers to cause a denial of service via (1) the frame number set to zero, which causes an invalid memory address to be used and leads to a kernel crash, or (2) the rate number set to zero, which leads to resource exhaustion and hang. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_cursor  
RED CVE-2004-1315 viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm. phpBB vulnerabilities
 web_prog_php_phpbbhighlight  
YELLOW CVE-2004-1316 Heap-based buffer overflow in MSG_UnEscapeSearchUrl in nsNNTPProtocol.cpp for Mozilla 1.7.3 and earlier allows remote attackers to cause a denial of service (application crash) via an NNTP URL (news:) with a trailing '\' (backslash) character, which prevents a string from being NULL terminated. Mozilla Thunderbird vulnerabilities
Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 mail_client_thunderbird
web_client_mozilla		  
YELLOW CVE-2004-1318 Cross-site scripting (XSS) vulnerability in namazu.cgi for Namazu 2.0.13 and earlier allows remote attackers to inject arbitrary HTML and web script via a query that starts with a tab ("%09") character, which prevents the rest of the query from being properly sanitized. Cross site scripting
 web_prog_cgi_namazuxss  
YELLOW CVE-2004-1319 The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_dhtmledit  
RED CVE-2004-1320 Asante FM2008 running firmware 1.06 is shipped with a default username and password, which could allow remote attackers to gain unauthorized access. default device password
 net_asantepass  
RED CVE-2004-1321 The configuration backup in Asante FM2008 running firmware 1.06 stores the username and password in cleartext, which could allow remote attackers to gain unauthorized access. default device password
 net_asantepass  
BROWN CVE-2004-1351 Unknown vulnerability in the rwho daemon (in.rwhod) for Solaris 7 through 9 allows remote attackers to execute arbitrary code. Sun rwhod vulnerability
 misc_sunrwhod  
BROWN CVE-2004-1362 The PL/SQL module for the Oracle HTTP Server in Oracle Application Server 10g, when using the WE8ISO8859P1 character set, does not perform character conversions properly, which allows remote attackers to bypass access restrictions for certain procedures via an encoded URL with "%FF" encoded sequences that are improperly converted to "Y" characters. Oracle vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_oracle_ias  
BROWN CVE-2004-1363 Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check is performed. Oracle Database vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_oracle_version  
BROWN CVE-2004-1364 Directory traversal vulnerability in extproc in Oracle 9i and 10g allows remote attackers to access arbitrary libraries outside of the $ORACLE_HOME\bin directory. Oracle Database vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_oracle_version  
BROWN CVE-2004-1365 Extproc in Oracle 9i and 10g does not require authentication to load a library or execute a function, which allows local users to execute arbitrary commands as the Oracle user. Oracle Database vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_oracle_version  
BROWN CVE-2004-1366 Oracle 10g Database Server stores the password for the SYSMAN account in cleartext in the world-readable emoms.properties file, which could allow local users to gain DBA privileges. Oracle Database vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_oracle_version  
BROWN CVE-2004-1367 Oracle 10g Database Server, when installed with a password that contains an exclamation point ("!") for the (1) DBSNMP or (2) SYSMAN user, generates an error that logs the password in the world-readable postDBCreation.log file, which could allow local users to obtain that password and use it against SYS or SYSTEM accounts, which may have been installed with the same password. Oracle Database vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_oracle_version  
BROWN CVE-2004-1368 ISQL*Plus in Oracle 10g Application Server allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the load.uix script. Oracle iSQLPlus vulnerabilities
 database_oracle_isqlplus  
BROWN CVE-2004-1369 The TNS Listener in Oracle 10g allows remote attackers to cause a denial of service (listener crash) via a malformed service_register_NSGR request containing a value that is used as an invalid offset for a pointer that references incorrect memory. Oracle TNS Listener
 database_oracle_tns  
BROWN CVE-2004-1370 Multiple SQL injection vulnerabilities in PL/SQL procedures that run with definer rights in Oracle 9i and 10g allow remote attackers to execute arbitrary SQL commands and gain privileges via (1) DBMS_EXPORT_EXTENSION, (2) WK_ACL.GET_ACL, (3) WK_ACL.STORE_ACL, (4) WK_ADM.COMPLETE_ACL_SNAPSHOT, (5) WK_ACL.DELETE_ACLS_WITH_STATEMENT, or (6) DRILOAD.VALIDATE_STMT. Oracle vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_oracle_ias  
BROWN CVE-2004-1371 Stack-based buffer overflow in Oracle 9i and 10g allows remote attackers to execute arbitrary code via a long token in the text of a wrapped procedure. Oracle Database vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_oracle_version  
RED
!		 CVE-2004-1373 Format string vulnerability in SHOUTcast 1.9.4 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via format string specifiers in a content URL, as demonstrated in the filename portion of a .mp3 file. shoutcast vulnerabilities
 misc_shoutcast
misc_shoutcastx		  
YELLOW CVE-2004-1380 Firefox before 1.0 and Mozilla before 1.7.5 allows inactive (background) tabs to launch dialog boxes, which can allow remote attackers to spoof the dialog boxes from web sites in other windows and facilitate phishing attacks, aka the "Dialog Box Spoofing Vulnerability." Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 web_client_firefox
web_client_mozilla		  
YELLOW CVE-2004-1381 Firefox before 1.0 and Mozilla before 1.7.5 allow inactive (background) tabs to focus on input being entered in the active tab, as originally reported using form fields, which allows remote attackers to steal sensitive data that is intended for other sites, which could facilitate phishing attacks. Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 web_client_firefox
web_client_mozilla		  
RED CVE-2004-1383 Multiple SQL injection vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to execute arbitrary SQL statements via the (1) order, (2) project_id, (3) pro_main, or (4) hours_id parameters to index.php or (5) ticket_id to viewticket_details.php. phpGroupWare vulnerabilities
 web_prog_php_groupware  
YELLOW CVE-2004-1384 Multiple cross-site scripting (XSS) vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) kp3, (2) type, (3) msg, (4) forum_id, (5) pos, (6) cats_app, (7) cat_id, (8) msgball[msgnum], (9) fldball[acctnum] parameters to index.php or (10) ticket_id to viewticket_details.php. phpGroupWare vulnerabilities
 web_prog_php_groupware  
YELLOW CVE-2004-1385 phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpected characters in the session ID such as shell metacharacters, (2) an invalid appname parameter to preferences.php or (3) an invalid menuaction parameter to index.php, which reveals the web server path in an error message. phpGroupWare vulnerabilities
 web_prog_php_groupware  
YELLOW CVE-2004-1396 Winamp 5.07 and possibly other versions, allows remote attackers to cause a denial of service (application crash or CPU consumption) via (1) an mp4 or m4a playlist file that contains invalid tag data or (2) an invalid .nsv or .nsa file. Winamp vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_winamp  
BROWN CVE-2004-1405 MediaWiki 1.3.8 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code. MediaWiki vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_mediawiki  
RED CVE-2004-1406 SQL injection vulnerability in ikonboard.cgi in Ikonboard 3.1.0 through 3.1.3 allows remote attackers to inject arbitrary SQL commands via the (1) st or (2) keywords parameter. SQL injection
 web_prog_sql_ikonboard  
RED CVE-2004-1407 Multiple directory traversal vulnerabilities in singapore Image Gallery Web Application 0.9.10 allow remote attackers to (1) read arbitrary files via the showThumb method for thumb.php, or (2) delete arbitrary files via admin.class.php. vulnerable web program
 web_prog_php_singapore  
RED CVE-2004-1408 The addImage method for admin.class.php in Image Gallery Web Application 0.9.10 does not properly check filenames, which allows remote attackers to upload and execute arbitrary files. vulnerable web program
 web_prog_php_singapore  
RED CVE-2004-1409 Multiple cross-site scripting vulnerabilities in Image Gallery Web Application 0.9.10 allow remote attackers to inject arbitrary web script or HTML. vulnerable web program
 web_prog_php_singapore  
RED CVE-2004-1423 Multiple PHP remote file inclusion vulnerabilities in Sean Proctor PHP-Calendar before 0.10.1, as used in Commonwealth of Massachusetts Virtual Law Office (VLO) and other products, allow remote attackers to execute arbitrary PHP code via a URL in the phpc_root_path parameter to (1) includes/calendar.php or (2) includes/setup.php. PHP injection
 web_prog_php_calendar  
RED CVE-2004-1426 Directory traversal vulnerability in index.php in KorWeblog 1.6.2-cvs and earlier allows remote attackers to read arbitrary files and execute arbitrary PHP files via .. (dot dot) sequences in the lng parameter. PHP injection
 web_prog_php_korweblog  
RED CVE-2004-1427 PHP remote file inclusion vulnerability in main.inc in KorWeblog 1.6.2-cvs and earlier allows remote attackers to execute arbitrary PHP code by modifying the G_PATH parameter to reference a URL on a remote web server that contains the code, as demonstrated in index.php when using .. (dot dot) sequences in the lng parameter to cause main.inc to be loaded. PHP injection
 web_prog_php_korweblog  
YELLOW CVE-2004-1428 ArGoSoft FTP before 1.4.2.1 generates an error message if the user name does not exist instead of prompting for a password, which allows remote attackers to determine valid usernames. ArGoSoft FTP vulnerabilities
 ftp_argosoft  
BROWN CVE-2004-1429 ArGoSoft FTP 1.4.2.4 and earlier does not limit the number of times that a bad password can be entered, which makes it easier for remote attackers to guess passwords via a brute force attack. ArGoSoft FTP vulnerabilities
 ftp_argosoft  
RED CVE-2004-1439 Buffer overflow in BlackJumboDog 3.x allows remote attackers to execute arbitrary code via long FTP commands such as (1) USER, (2) PASS, (3) RETR,(4) CWD, (5) XMKD, and (6) XRMD. BlackJumboDog FTP vulnerability
 ftp_bjd  
YELLOW CVE-2004-1442 Cross-site scripting (XSS) vulnerability in db2www CGI interpreter in IBM Net.Data 7 and 7.2 allows remote attackers to inject arbitrary web script or HTML via a macro filename, which is not properly handled by error emssages such as "DTWP001E." Cross site scripting
 web_prog_cgi_db2wwwxss  
YELLOW CVE-2004-1443 Cross-site scripting (XSS) vulnerability in the inline MIME viewer in Horde-IMP (Internet Messaging Program) 3.2.4 and earlier, when used with Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via an e-mail message. Horde IMP vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 mail_web_imp  
YELLOW CVE-2004-1445 A race condition in nessus-adduser in Nessus 2.0.11 and possibly earlier versions, if the TMPDIR environment variable is not set, allows local users to gain privileges. Nessus vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_nessusgui  
YELLOW CVE-2004-1449 Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7 allows remote attackers to determine the location of files on a user's hard drive by obscuring a file upload control and tricking the user into dragging text into that control. Mozilla Thunderbird vulnerabilities
Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 mail_client_thunderbird
web_client_firefox
web_client_mozilla		  
YELLOW CVE-2004-1450 Unknown vulnerability in LiveConnect in Mozilla 1.7 beta allows remote attackers to read arbitrary files in known locations. Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 web_client_mozilla  
YELLOW CVE-2004-1451 Mozilla before 1.6 does not display the entire URL in the status bar when a link contains %00, which could allow remote attackers to trick users into clicking on unknown or untrusted sites and facilitate phishing attacks. Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 web_client_mozilla  
BROWN CVE-2004-1454 Cisco IOS 12.0S, 12.2, and 12.3, with Open Shortest Path First (OSPF) enabled, allows remote attackers to cause a denial of service (device reload) via a malformed OSPF packet. Cisco vulnerabilities

Note: A valid SNMP read community string is required to detect this vulnerability		 net_cisco_ios  
RED CVE-2004-1456 filediff in CVStrac allows remote attackers to execute arbitrary commands via shell metacharacters in rcsinfo. vulnerable web program
 web_prog_cgi_cvstrac  
RED CVE-2004-1464 Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection to the Telnet or reverse Telnet port. Cisco telnet vulnerabilities

Note: A valid SNMP read community string is required to detect this vulnerability		 net_cisco_telnet  
YELLOW CVE-2004-1465 Multiple buffer overflows in WinZip 9.0 and earlier may allow attackers to execute arbitrary code via multiple vectors, including the command line. WinZip vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_compress_winzip  
RED CVE-2004-1466 The set_time_limit function in Gallery before 1.4.4_p2 deletes non-image files in a temporary directory every 30 seconds after they have been uploaded using save_photos.php, which allows remote attackers to upload and execute execute arbitrary scripts before they are deleted, if the temporary directory is under the web root. Gallery vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_galleryversion  
BROWN CVE-2004-1478 JRun 4.0 does not properly generate and handle the JSESSIONID, which allows remote attackers to perform a session fixation attack and hijack a user's HTTP session. JRun vulnerabilities
 web_dev_jrun_jsessionid  
YELLOW CVE-2004-1479 DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2004-0928. Reason: This candidate is a duplicate of CVE-2004-0928. Notes: All CVE users should reference CVE-2004-0928 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. JRun vulnerabilities
 web_dev_jrun_semi  
YELLOW CVE-2004-1481 Integer overflow in pnen3260.dll in RealPlayer 8 through 10.5 (6.0.12.1040) and earlier, and RealOne Player 1 or 2 on Windows or Mac OS, allows remote attackers to execute arbitrary code via a SMIL file and a .rm movie file with a large length field for the data chunk, which leads to a heap-based buffer overflow. RealPlayer vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_reallinux
misc_realplayer		  
RED CVE-2004-1496 Directory traversal vulnerability in Web Forums Server 1.6 and 2.0 Power Pack allows remote attackers to read arbitrary files via a URL containing (1) "..\" (dot dot backslash), (2) "../" (dot dot slash), (3) "/%2E%2E%5C" (encoded dot dot backslash), or (4) "%2E%2E%2F" (encoded dot dot slash). http server read access
 web_server_read  
RED CVE-2004-1504 The displaycontent function in config.php for Just Another Flat file (JAF) CMS 3.0RC allows remote attackers to gain sensitive information via a blank show parameter, which reveals the installation path in an error message, as demonstrated using index.php. vulnerable web program
 web_cms_jaf  
RED CVE-2004-1505 Directory traversal vulnerability in index.php in Just Another Flat file (JAF) CMS 3.0RC allows remote attackers to read arbitrary files and possibly execute PHP code via a .. (dot dot) in the show parameter. vulnerable web program
 web_cms_jaf  
YELLOW CVE-2004-1506 Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar allow remote attackers to inject arbitrary web script via (1) view_entry.php, (2) view_d.php, (3) usersel.php, (4) datesel.php, (5) trailer.php, or (6) styles.php, as demonstrated using img srg tags. Cross site scripting
 web_prog_php_webcalxss  
RED CVE-2004-1515 SQL injection vulnerability in (1) ttlast.php and (2) last10.php in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL statements via the fsel parameter, as demonstrated using last.php. SQL injection
vBulletin vulnerabilities
 web_prog_sql_vblast
web_prog_sql_vbulletin		  
YELLOW CVE-2004-1516 CRLF injection vulnerability in index.php in phpWebSite 0.9.3-4 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the block_username parameter in the user module. HTTP Response Splitting
 web_prog_php_websitesplit  
RED CVE-2004-1518 SQL injection vulnerability in follow.php in Phorum 5.0.12 and earlier allows remote authenticated users to execute arbitrary SQL command via the forum_id parameter. SQL injection
 web_prog_sql_phorumfollow  
RED CVE-2004-1519 SQL injection vulnerability in bug.php in phpBugTracker 0.9.1 allows remote attackers to execute arbitrary SQL commands via (1) the bug_id parameter in a viewvotes operation or (2) the project parameter in an add operation. SQL injection
 web_prog_sql_phpbt  
RED CVE-2004-1520 Stack-based buffer overflow in IPSwitch IMail 8.13 allows remote authenticated users to execute arbitrary code via a long IMAP DELETE command. IMail vulnerabilities
 mail_imap_imail  
RED CVE-2004-1530 SQL injection vulnerability in the Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the (1) eid or (2) cid parameters. SQL injection
 web_prog_sql_eventcal  
RED CVE-2004-1531 SQL injection vulnerability in post.php in Invision Power Board (IPB) 2.0.0 through 2.0.2 allows remote attackers to execute arbitrary SQL commands via the qpid parameter. SQL injection
 web_prog_sql_ipbpost  
RED CVE-2004-1533 Buffer overflow in pop3svr.exe for DMS POP3 1.5.3.27 and earlier allows remote attackers to cause a denial of service (service crash) via a long (1) username or (2) password. DMS POP3 vulnerabilities
 mail_pop_dms  
RED CVE-2004-1536 SQL injection vulnerability in index.php in the ibProArcade module for Invision Power Board (IPB) 1.x and 2.x allows remote attackers to execute arbitrary SQL commands via the cat parameter. SQL injection
 web_prog_sql_ipbarcade  
YELLOW CVE-2004-1537 Cross-site scripting (XSS) vulnerability in popup.php in PHPKIT 1.6.03 through 1.6.1 allows remote attackers to execute arbitrary web script via the img parameter. Cross site scripting
 web_prog_php_kitxss  
RED CVE-2004-1538 SQL injection vulnerability in include.php in PHPKIT 1.6.03 through 1.6.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. SQL injection
 web_prog_sql_phpkit  
RED CVE-2004-1546 Multiple buffer overflows in MDaemon 6.5.1 allow remote attackers to cause a denial of service (application crash) via a long (1) SAML, SOML, SEND, or MAIL command to the SMTP server or (2) LIST command to the IMAP server. MDaemon vulnerabilities
 mail_imap_mdaemon
mail_smtp_mdaemon		  
RED CVE-2004-1547 The file server in ActivePost Standard 3.1 and earlier allows remote authenticated users to cause a denial of service (application crash) via a long filename, possibly triggering a buffer overflow. ActivePost vulnerabilities
 misc_activepost  
RED CVE-2004-1548 Directory traversal vulnerability in the file server in ActivePost Standard 3.1 allows remote authenticated users to upload arbitrary files via a .. (dot dot) in the filename. ActivePost vulnerabilities
 misc_activepost  
RED CVE-2004-1552 SQL injection vulnerability in aspWebCalendar allows remote attackers to execute arbitrary SQL statements via (1) the username field on the login page or (2) the eventid parameter to calendar.asp. SQL injection
 web_prog_sql_webcalendar  
RED CVE-2004-1553 SQL injection vulnerability in aspWebAlbum allows remote attackers to execute arbitrary SQL statements via (1) the username field on the login page or (2) the cat parameter to album.asp. NOTE: it was later reported that vector 1 affects aspWebAlbum 3.2, and the vector involves the txtUserName parameter in a processlogin action to album.asp, as reachable from the login action. SQL injection
 web_prog_sql_webalbum  
RED CVE-2004-1555 Multiple SQL injection vulnerabilities in BroadBoard Instant ASP Message Board allow remote attackers to run arbitrary SQL commands via the (1) keywords parameter to search.asp, (2) handle parameter to profile.asp, (3) txtUserHandle parameter to reg2.asp or (4) txtUserEmail parameter to forgot.asp. SQL injection
 web_prog_sql_broadboard  
RED
!		 CVE-2004-1558 Multiple stack-based buffer overflows in YPOPs! (aka YahooPOPS) 0.4 through 0.6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) POP3 USER command or (2) SMTP request. YahooPOPs vulnerabilities
 mail_pop_yahoopops
mail_smtp_yahoopops		  
RED CVE-2004-1561 Buffer overflow in Icecast 2.0.1 and earlier allows remote attackers to execute arbitrary code via an HTTP request with a large number of headers. icecast vulnerability
 web_server_icecast  
YELLOW CVE-2004-1563 Multiple cross-site scripting (XSS) vulnerabilities in w-Agora 4.1.6a allow remote attackers to execute arbitrary web script or HTML via the (1) thread parameter to download_thread.php, (2) loginuser parameter to login.php, or (3) userid parameter to forgot_password.php. Cross site scripting
 web_prog_php_wagoraxss  
YELLOW CVE-2004-1564 CRLF injection vulnerability in subscribe_thread.php in w-Agora 4.1.6a allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the thread parameter. HTTP Response Splitting
 web_prog_php_wagorasplit  
RED
!		 CVE-2004-1574 Buffer overflow in Vypress Messenger 3.5.1 and earlier allows remote attackers to execute arbitrary code via a message with a long first field. Vypress Messenger vulnerabilities
 misc_vypress  
YELLOW CVE-2004-1578 Cross-site scripting (XSS) vulnerability in index.php in Invision Power Board 2.0.0 allows remote attackers to execute arbitrary web script or HTML via the Referer field in the HTTP header. Cross site scripting
 web_prog_php_ipbreferer  
RED CVE-2004-1579 index.php in CubeCart 2.0.1 allows remote attackers to gain sensitive information via an HTTP request with an invalid cat_id parameter, which reveals the full path in a PHP error message. SQL injection
 web_prog_sql_cubecart  
RED CVE-2004-1580 SQL injection vulnerability in index.php in CubeCart 2.0.1 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter. SQL injection
 web_prog_sql_cubecart  
RED CVE-2004-1581 BlackBoard 1.5.1 allows remote attackers to gains sensitive information via a direct request to (1) checkdb.inc.php, (2) admin.inc.php or (3) cp.inc.php, which reveals the path in a PHP error message. PHP injection
 web_prog_php_blackboard  
RED CVE-2004-1582 PHP remote file inclusion vulnerability in BlackBoard 1.5.1 allows remote attackers to execute arbitrary PHP code by modifying the libpath parameter (incorrectly called "libpach") to reference a URL on a remote web server that contains _more.php, as demonstrated using checkdb.inc.php. PHP injection
 web_prog_php_blackboard  
RED CVE-2004-1583 Directory traversal vulnerability in the FTP server in TriDComm 1.3 and earlier allows remote attackers read or write arbitrary files via a .. (dot dot) in FTP commands such as (1) DIR, (2) GET, or (3) PUT. FTP server directory traversal
 ftp_traversal  
YELLOW CVE-2004-1589 Cross-site scripting (XSS) vulnerability in GoSmart Message Board allows remote attackers to execute inject web script or HTML via the (1) Category parameter to Forum.asp or (2) MainMessageID parameter to ReplyToQuestion.asp. Cross site scripting
 web_prog_php_gosmartxss  
RED CVE-2004-1592 PHP remote file inclusion vulnerability in index.php in ocPortal 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the req_path parameter to reference a URL on a remote web server that contains a malicious funcs.php script. PHP injection
 web_prog_php_ocportal  
BROWN CVE-2004-1596 The 3COM Wireless router 3CRADSL72 running Boot Code 1.3d allows remote attackers to gain sensitive information such as passwords and router settings via a direct HTTP request to app_sta.stm. 3Com Wireless ADSL Router
 net_appsta  
YELLOW CVE-2004-1598 Adobe Acrobat and Acrobat Reader 6.0 allow remote attackers to read arbitrary files via a PDF file that contains an embedded Shockwave (swf) file that references files outside of the temporary directory. Adobe Acrobat vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_acrobat
misc_acroread		  
YELLOW CVE-2004-1599 Cross-site scripting (XSS) vulnerability in index.php in CoolPHP 1.0-stable allows remote attackers to execute arbitrary web script or HTML via the (1) query or (2) nick parameters. Cross site scripting
 web_prog_php_coolxss  
RED CVE-2004-1600 index.php in CoolPHP 1.0-stable allows remote attackers to gain sensitive information via an invalid op parameter, which reveals the path in an error message. vulnerable web program
 web_prog_php_cool  
RED CVE-2004-1601 Directory traversal vulnerability in index.php in CoolPHP 1.0-stable allows remote attackers to access arbitrary files and execute local PHP scripts via a .. (dot dot) in the op parameter. vulnerable web program
 web_prog_php_cool  
BROWN CVE-2004-1602 ProFTPD 1.2.x, including 1.2.8 and 1.2.10, responds in a different amount of time when a given username exists, which allows remote attackers to identify valid usernames by timing the server response. ProFTPD vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 ftp_proftp  
RED CVE-2004-1605 SalesLogix 6.1 allows remote attackers to bypass authentication by modifying the slxweb cookie to set user=Admin, teams=ADMIN!, and usertype=Administrator. web application access
 web_prog_cgi_slxauth  
RED CVE-2004-1606 slxweb.dll in SalesLogix 6.1 allows remote attackers to cause a denial service (application crash) via an invalid HTTP request, which might also leak sensitive information in the ErrorLogMsg cookie. web application access
 web_prog_cgi_slxauth  
RED CVE-2004-1607 slxweb.dll in SalesLogix 6.1 allows remote attackers to obtain sensitive information via a (1) Library or (2) Attachment request with an invalid file parameter, which reveals the path in an error message. web application access
 web_prog_cgi_slxauth  
RED CVE-2004-1608 SQL injection vulnerability in SalesLogix 6.1 allows remote attackers to execute arbitrary SQL statements via the id parameter in a view operation. SQL injection
 web_prog_sql_slxweb  
YELLOW CVE-2004-1611 SalesLogix 6.1 does not verify if a user is authenticated before performing sensitive operations, which could allow remote attackers to (1) execute arbitrary SLX commands on the server or spoof the server via a man-in-the-middle (MITM) attack, or (2) obtain the database password via a GetConnection request to TCP port 1707. SalesLogix vulnerabilities
 misc_saleslogix  
YELLOW CVE-2004-1612 Directory traversal vulnerability in SalesLogix 6.1 allows remote attackers to upload arbitrary files via a .. (dot dot) in a ProcessQueueFile request. SalesLogix vulnerabilities
 misc_saleslogix  
RED CVE-2004-1620 CRLF injection vulnerability in Serendipity before 0.7rc1 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the url parameter in (1) index.php and (2) exit.php, or (3) the HTTP Referer field in comment.php. Serendipity vulnerabilities
 web_prog_php_serendipity  
RED CVE-2004-1622 SQL injection vulnerability in dosearch.php in UBB.threads 3.4.x allows remote attackers to execute arbitrary SQL statements via the Name parameter. UBB threads vulnerabilities
 web_prog_php_ubb  
RED CVE-2004-1626 Buffer overflow in Ability Server 2.34, and possibly other versions, allows remote attackers to execute arbitrary code via a long STOR command. Ability Server FTP vulnerabilities
 ftp_ability  
RED CVE-2004-1627 Buffer overflow in Ability Server 2.25, 2.32, 2.34, and possibly other versions, allows remote attackers to execute arbitrary code via a long APPE command. Ability Server FTP vulnerabilities
 ftp_ability  
YELLOW CVE-2004-1632 Cross-site scripting (XSS) vulnerability in wiki.php in MoniWiki 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the arguments to wiki.php. Cross site scripting
 web_prog_php_moniwikixss  
RED CVE-2004-1633 process_bug.cgi in Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS does not check edit permissions on the keywords field, which allows remote authenticated users to modify the keywords in a bug via the keywordaction parameter. Bugzilla vulnerabilities
 web_prog_cgi_bugzilla  
RED CVE-2004-1634 show_bug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows comments and attachment summaries which are marked as private, which allows remote attackers to gain sensitive information. Bugzilla vulnerabilities
 web_prog_cgi_bugzilla  
RED CVE-2004-1635 Bugzilla 2.17.1 through 2.18rc2 and 2.19 from cvs, when using the insidergroup feature, does not sufficiently protect private attachments when there are changes to the metadata, such as filename, description, MIME type, or review flags, which allows remote authenticated users to obtain sensitive information when (1) viewing the bug activity log or (2) receiving bug change notification mails. Bugzilla vulnerabilities
 web_prog_cgi_bugzilla  
RED
!		 CVE-2004-1638 Buffer overflow in MailCarrier 2.51 allows remote attackers to execute arbitrary code via a long (1) EHLO and possibly (2) HELO command. MailCarrier vulnerabilities
 mail_smtp_carrier  
YELLOW CVE-2004-1639 Mozilla Firefox before 0.10, Mozilla 5.0, and Gecko 20040913 allows remote attackers to cause a denial of service (application crash or memory consumption) via a large binary file with a .html extension. Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 web_client_firefox
web_client_mozilla		  
RED CVE-2004-1641 Heap-based buffer overflow in Titan FTP 3.21 and earlier allows remote attackers to cause a denial of service (crash) via a long FTP command such as (1) CWD, (2) STAT, or (3) LIST. Titan FTP vulnerabilities
 ftp_titan  
RED CVE-2004-1642 WFTPD Pro Server 3.21 allows remote authenticated users to cause a denial of service (crash) via a series of long MLIST commands. WFTPD vulnerabilities
 ftp_wftpd  
RED CVE-2004-1643 WS_FTP 5.0.2 allows remote authenticated users to cause a denial of service (CPU consumption) via a CD command that contains an invalid path with a "../" sequence. WS FTP vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 ftp_wsftpver  
BROWN CVE-2004-1644 Xedus 1.0 allows remote attackers to cause a denial of service (refuse connections) by connecting multiple times from the same IP address. peer to peer file sharing
 misc_p2p_xedus  
YELLOW CVE-2004-1645 Cross-site scripting (XSS) vulnerability in Xedus 1.0 allows remote attackers to execute arbitrary web script or HTML via the (1) username parameter to test.x, (2) username parameter to TestServer.x, or (3) param parameter to testgetrequest.x. Cross site scripting
 web_server_xedusxss  
BROWN CVE-2004-1646 Directory traversal vulnerability in Xedus 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the URL. peer to peer file sharing
 misc_p2p_xedus  
RED CVE-2004-1647 SQL injection vulnerability in Password Protect allows remote attackers to execute arbitrary SQL statements and bypass authentication via (1) admin or Pass parameter to index_next.asp, (2) LoginId, OPass, or NPass to CPassChangePassword.asp, (3) users_edit.asp, or (4) users_add.asp. SQL injection
 web_prog_sql_passprotect  
YELLOW CVE-2004-1648 Cross-site scripting (XSS) vulnerability in (1) index.asp, (2) ChangePassword.asp, (3) users_list.asp, (4) and users_add.asp in Password Protect allows remote attackers to inject arbitrary web script or HTML via the ShowMsg parameter. Cross site scripting
 web_prog_asp_passprotxss  
RED CVE-2004-1654 SQL injection vulnerability in the calendar module in phpWebsite 0.9.3-4 and earlier allows remote attackers to execute arbitrary SQL commands via cal_template. SQL injection
 web_prog_sql_phpwebsite  
YELLOW CVE-2004-1655 Cross-site scripting (XSS) vulnerability in phpWebsite 0.9.3-4 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) CM_pid parameter in the comments module or (2) the subject or message fields in the notes module. Cross site scripting
 web_prog_php_websitexss  
RED CVE-2004-1660 PHP remote file inclusion vulnerability in CuteNews 1.3.6 and earlier allows remote attackers to execute arbitrary PHP code via the cutepath parameter to (1) show_archives.php or (2) show_news.php. PHP injection
 web_prog_php_showarchives  
RED CVE-2004-1661 MailWorks Professional allows remote attackers to bypass authentication and gain privileges via a cookie that contains "auth=1" and "uId=1." web application access
 web_prog_php_mailworks  
YELLOW CVE-2004-1665 Cross-site scripting (XSS) vulnerability in index.php in PsNews 1.1 allows remote attackers to inject arbitrary web script or HTML via the no parameter. Cross site scripting
 web_prog_php_psnewsxss  
YELLOW CVE-2004-1666 Buffer overflow in the MSN module in Trillian 0.74i allows remote MSN servers to execute arbitrary code via a long string that ends in a newline character. Trillian vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_trillian  
RED CVE-2004-1668 Multiple SQL injection vulnerabilities in index.php in Subjects 2.0 Postnuke module allow remote attackers to execute arbitrary SQL commands via the (1) pageid, (2) subid, or (3) catid parameters. SQL injection
 web_prog_sql_subjects  
YELLOW CVE-2004-1669 Cross-site scripting (XSS) vulnerability in MERAK Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to execute arbitrary web script or HTML via the (1) User name parameter to accountsettings.html or (2) Search string parameter to search.html. IceWarp vulnerabilities
 mail_web_icewarp  
YELLOW CVE-2004-1670 Multiple directory traversal vulnerabilities Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7, and possibly other versions, allow remote attackers to (1) create arbitrary directories via a .. (dot dot) in the user parameter to viewaction.html or (2) rename arbitrary files via a ....// (doubled dot dot) in the folderold or folder parameters to folders.html. IceWarp vulnerabilities
 mail_web_icewarp  
YELLOW CVE-2004-1671 Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to gain sensitive information via a direct request to (1) accountsettings_add.html or (2) topmenu.html. IceWarp vulnerabilities
 mail_web_icewarp  
YELLOW CVE-2004-1672 attachment.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to view other users' attachments by specifying the username and message ID in an HTTP request. IceWarp vulnerabilities
 mail_web_icewarp  
YELLOW CVE-2004-1673 accountsettings_add.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allow remote attackers to create text files with arbitrary content via the accountid parameter. IceWarp vulnerabilities
 mail_web_icewarp  
YELLOW CVE-2004-1674 viewaction.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to (1) delete arbitrary files via the originalfolder parameter or (2) move arbitrary files via the messageid parameter. IceWarp vulnerabilities
 mail_web_icewarp  
RED
!		 CVE-2004-1675 Serv-U FTP server 4.x and 5.x allows remote attackers to cause a denial of service (application crash) via a STORE UNIQUE (STOU) command with an MS-DOS device name argument such as (1) COM1, (2) LPT1, (3) PRN, or (4) AUX. Serv U vulnerabilities
 ftp_servu
ftp_servudos		  
RED CVE-2004-1677 pdesk.cgi in PerlDesk allows remote attackers to gain sensitive information via an invalid lang parameter, which includes pathname information in an error message. vulnerable web program
 web_prog_cgi_pdesk  
RED CVE-2004-1678 Directory traversal vulnerability in pdesk.cgi in PerlDesk allows remote attackers to read portions of arbitrary files and possibly execute arbitrary Perl modules via ".." sequences terminated by a %00 (null) character in the lang parameter, which can leak portions of the requested files if a compilation error message occurs. vulnerable web program
 web_prog_cgi_pdesk  
YELLOW CVE-2004-1687 CRLF injection vulnerability in down.asp for Snitz Forums 2000 3.4.04 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the location parameter. HTTP Response Splitting
 web_prog_asp_snitzsplit  
YELLOW CVE-2004-1690 Cross-site scripting (XSS) vulnerability in the Web Server in DNS4Me 3.0.0.4 allows remote attackers to execute arbitrary web script or HTML via the URL. Cross site scripting
 web_server_css  
RED CVE-2004-1695 EmuLive Server4 Commerce Edition Build 7560 allows remote attackers to bypass authentication for the remote administration feature via a URL that contains an extra leading / (slash). EmuLive vulnerabilities
 web_server_emulive  
RED CVE-2004-1696 EmuLive Server4 Commerce Edition Build 7560 allows remote attackers to cause a denial of service (application crash) via a sequence of carriage returns sent to TCP port 66. EmuLive vulnerabilities
 web_server_emulive  
RED CVE-2004-1701 Heap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers to execute arbitrary code via a long SAUTH command during RSA authentication. CFEngine detected

Note: Authentication is required to detect this vulnerability		 misc_cfengine  
RED CVE-2004-1702 The AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 does not properly check the return value of the ReceiveTransaction function, which leads to a failed malloc call and triggers to a null dereference, which allows remote attackers to cause a denial of service (crash). CFEngine detected

Note: Authentication is required to detect this vulnerability		 misc_cfengine  
RED
!		 CVE-2004-1705 Buffer overflow in Citadel/UX 6.23 and earlier allows remote attackers to cause a denial of service via a long username. Citadel UX vulnerabilities
 misc_citadel
misc_citadelux		  
RED CVE-2004-1715 Directory traversal vulnerability in MIMEsweeper for Web before 5.0.4 allows remote attackers or local users to read arbitrary files via "..\\", "..\", and similar dot dot sequences in the URL. http server read access
 web_server_read  
YELLOW CVE-2004-1719 Multiple cross-site scripting (XSS) vulnerabilities in Merak Webmail Server 5.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) category, (2) cserver, (3) ext, (4) global, (5) showgroups, (6) or showlite parameters to address.html, or the (7) spage or (8) autoresponder parameters to settings.html, the (9) folder parameter to readmail.html, or the (10) attachmentpage_text_error parameter to attachment.html, (11) folder, (12) ct, or (13) cv parameters to calendar.html, (14) an <img> tag, or (15) the subject of an e-mail message. IceWarp vulnerabilities
 mail_web_icewarp  
YELLOW CVE-2004-1720 The (1) address.html and possibly (2) calendar.html pages in Merak Mail Server 5.2.7 allow remote attackers to gain sensitive information via an invalid HTTP request, which reveals the installation path. NOTE: it is unclear whether the calendar.html is an exposure, since the path is leaked in web logs that may only be available to the administrators, who would have access to the path through legitimate means. IceWarp vulnerabilities
 mail_web_icewarp  
YELLOW CVE-2004-1721 The (1) function.php or (2) function.view.php scripts in Merak Mail Server 5.2.7 allow remote attackers to read arbitrary PHP files via a direct HTTP request to port 32000. IceWarp vulnerabilities
 mail_web_icewarp  
YELLOW CVE-2004-1722 SQL injection vulnerability in calendar.html in Merak Mail Server 5.2.7 allows remote attackers to execute arbitrary SQL statements via the schedule parameter. IceWarp vulnerabilities
 mail_web_icewarp  
YELLOW CVE-2004-1730 Cross-site scripting (XSS) vulnerability in Mantis bugtracker allows remote attackers to inject arbitrary web script or HTML via (1) the return parameter to login_page.php, (2) e-mail field in signup.php, (3) action parameter to login_select_proj_page.php, or (4) hide_status parameter to view_all_set.php. Mantis vulnerabilities
 web_prog_php_mantis  
RED CVE-2004-1731 signup_page.php in Mantis bugtracker allows remote attackers to send e-mail bombs by creating multiple users and providing the same e-mail address. Mantis vulnerabilities
 web_prog_php_mantis  
RED CVE-2004-1734 PHP remote file inclusion vulnerability in Mantis 0.19.0a allows remote attackers to execute arbitrary PHP code by modifying the (1) t_core_path parameter to bug_api.php or (2) t_core_dir parameter to relationship_api.php to reference a URL on a remote web server that contains the code. Mantis vulnerabilities
 web_prog_php_mantis  
YELLOW CVE-2004-1738 Cross-site scripting (XSS) vulnerability in page.php in JShop allows remote attackers to inject arbitrary web script or HTML via the xPage parameter. Cross site scripting
 web_prog_php_jshopxss  
RED CVE-2004-1740 Music daemon (musicd) 0.0.3 and earlier allows remote attackers to read arbitrary files by calling LOAD with a full pathname, then calling SHOWLIST. musicd vulnerabilities
 misc_musicd  
RED CVE-2004-1741 Music daemon (musicd) 0.0.3 and earlier allows remote attackers to cause a denial of service (crash) by calling LOAD with a binary file as an argument, then calling SHOWLIST. musicd vulnerabilities
 misc_musicd  
RED CVE-2004-1742 Directory traversal vulnerability in WebAPP 0.9.9 allows remote attackers to view arbitrary files via a .. (dot dot) in the viewcat parameter. vulnerable web program
 web_prog_cgi_webapp  
RED CVE-2004-1743 Easy File Sharing (EFS) Webserver 1.25 allows remote attackers to view arbitrary files via an HTTP request for the disk_c virtual folder. Easy File Sharing Web Server
 web_server_efsws  
RED CVE-2004-1744 Easy File Sharing (EFS) Webserver 1.25 allows remote attackers to cause a denial of service (CPU consumption or crash) via many large HTTP requests. Easy File Sharing Web Server
 web_server_efsws  
BROWN CVE-2004-1756 BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may accept a certificate chain even if the trust manager rejects it, which allows remote attackers to spoof other users or servers. WebLogic vulnerabilities
 web_dev_weblogic  
BROWN CVE-2004-1759 Cisco voice products, when running the IBM Director Agent on IBM servers before OS 2000.2.6, allows remote attackers to cause a denial of service (CPU consumption) via arbitrary packets to TCP port 14247, as demonstrated using port scanning. Cisco voice products
 net_cisco_ibmdirectoragent  
BROWN CVE-2004-1760 The default installation of Cisco voice products, when running the IBM Director Agent on IBM servers before OS 2000.2.6, does not require authentication, which allows remote attackers to gain administrator privileges by connecting to TCP port 14247. Cisco voice products
 net_cisco_ibmdirectoragent  
BROWN CVE-2004-1763 Buffer overflow in hsrun.exe for HAHTsite Scenario Server 5.1 Patch 06 (build 91) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long project name. HAHTsite Scenario Server
 web_cms_haht  
BROWN CVE-2004-1765 Off-by-one buffer overflow in ModSecurity (mod_security) 1.7.4 for Apache 2.x, when SecFilterScanPost is enabled, allows remote attackers to execute arbitrary code via crafted POST requests. Apache module vulnerabilities
 web_mod_security  
RED CVE-2004-1769 The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass. http cgi access
 web_prog_cgi_cpanel  
BROWN CVE-2004-1774 Buffer overflow in the SDO_CODE_SIZE procedure of the MD2 package (MDSYS.MD2.SDO_CODE_SIZE) in Oracle 10g before 10.1.0.2 Patch 2 allows local users to execute arbitrary code via a long LAYER parameter. Oracle Database vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_oracle_version  
YELLOW CVE-2004-1776 Cisco IOS 12.1(3) and 12.1(3)T allows remote attackers to read and modify device configuration data via the cable-docsis read-write community string used by the Data Over Cable Service Interface Specification (DOCSIS) standard. Cisco IOS SNMP access
 net_snmp_ios  
RED CVE-2004-1783 Directory traversal vulnerability in Net2Soft Flash FTP Server 1.0 allows remote attackers to read and create arbitrary files via a /.. (slash dot dot). FTP server directory traversal
 ftp_traversal  
YELLOW CVE-2004-1790 Cross-site scripting (XSS) vulnerability in the web management interface in Edimax AR-6004 ADSL Routers allows remote attackers to inject arbitrary web script or HTML via the URL. Cross site scripting
 web_server_css  
RED CVE-2004-1791 The web management interface in Edimax AR-6004 ADSL Routers uses a default administrator name and password, which also appear as the default login text for the management interface, which allows remote attackers to gain access. default device password
 net_edimax  
YELLOW CVE-2004-1798 RealOne player 6.0.11.868 allows remote attackers to execute arbitrary script in the "My Computer" zone via a Synchronized Multimedia Integration Language (SMIL) presentation with a "file:javascript:" URL, which is executed in the security context of the previously loaded URL, a different vulnerability than CVE-2003-0726. RealPlayer vulnerabilities

Note: Authentication is required to detect this vulnerability		 misc_reallinux
misc_realplayer		  
RED CVE-2004-1801 Directory traversal vulnerability in PWebServer 0.3.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the URL. http server read access
 web_server_read  
BROWN CVE-2004-1805 Format string vulnerability in games using the Epic Games Unreal Engine 436 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in class names. unreal game engine
 misc_unreal  
YELLOW CVE-2004-1809 Cross-site scripting (XSS) vulnerability in phpBB 2.0.6d and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) postdays parameter to viewtopic.php or (2) topicdays parameter to viewforum.php. Cross site scripting
 web_prog_php_phpbbpostdays  
BROWN CVE-2004-1811 The SSL HTTP Server in HP Web-enabled Management Software 5.0 through 5.92, with anonymous access enabled, allows remote attackers to compromise the trusted certificates by uploading their own certificates. Compaq Insight Manager http server
 web_tool_cimhttp  
RED CVE-2004-1813 VocalTec VGW4/8 Gateway 8.0 allows remote attackers to bypass authentication via an HTTP request to home.asp with a trailing slash (/). VocalTec Gateway vulnerabilities
 net_vgw48auth  
RED CVE-2004-1814 Directory traversal vulnerability in VocalTec VGW4/8 Gateway 8.0 allows remote attackers to read protected files via .. (dot dot) sequences in an HTTP request, as demonstrated using home.asp. VocalTec Gateway vulnerabilities
 net_vgw48auth  
BROWN CVE-2004-1815 Unknown vulnerability in ColdFusion MX 6.0 and 6.1, and JRun 4.0, when a SOAP web service expects an array of objects as an argument, allows remote attackers to cause a denial of service (memory consumption). JRun vulnerabilities
http Cold Fusion

Note: Authentication is recommended to improve the accuracy of this check		 web_dev_jrun_version
web_prog_cfm_mx		  
YELLOW CVE-2004-1817 Cross-site scripting (XSS) vulnerability in modules.php in Php-Nuke 7.1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) Your Name field, (2) e-mail field, (3) nicname field, (4) fname parameter, (5) ratenum parameter, or (6) search field. Cross site scripting
 web_prog_php_nukexss  
RED CVE-2004-1820 PHP remote file inclusion vulnerability in displaycategory.php in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to execute arbitrary PHP code by modifying the basepath parameter to reference a URL on a remote web server that contains fileFunctions.php. PHP injection
 web_prog_php_myphpnuke  
YELLOW CVE-2004-1823 Multiple cross-site scripting (XSS) vulnerabilities in Jelsoft vBulletin 2.0 beta 3 through 3.0 can4 allows remote attackers to inject arbitrary web script or HTML via the (1) page parameter to showthread.php or (2) order parameter to forumdisplay.php. vBulletin vulnerabilities
 web_prog_php_vbulletin  
YELLOW CVE-2004-1824 Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin before 3.0 allows remote attackers to inject arbitrary web script or HTML via the what parameter to memberlist.php. vBulletin vulnerabilities
 web_prog_php_vbulletin  
YELLOW CVE-2004-1825 Cross-site scripting (XSS) vulnerability in index.php in Mambo Open Source 4.5 stable 1.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) return or (2) mos_change_template parameters. Mambo vulnerabilities
 web_cms_mambo  
RED CVE-2004-1826 SQL injection vulnerability in index.php in Mambo Open Source 4.5 stable 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. Mambo vulnerabilities
 web_cms_mambo  
RED CVE-2004-1835 Multiple SQL injection vulnerabilities in index.php in Invision Gallery 1.0.1 allow remote attackers to execute arbitrary SQL via the (1) img, (2) cat, (3) sort_key, (4) order_key, (5) user, or (6) album parameters. SQL injection
 web_prog_sql_invisiongallery  
RED CVE-2004-1838 Directory traversal vulnerability in xweb 1.0 allows remote attackers to download arbitrary files via a .. (dot dot) in the URL. http server read access
 web_server_read  
RED CVE-2004-1848 Ipswitch WS_FTP Server 4.0.2 allows remote attackers to cause a denial of service (disk consumption) and bypass file size restrictions via a REST command with a large size argument, followed by a STOR of a smaller file. WS FTP vulnerabilities
 ftp_wsftp  
BROWN CVE-2004-1851 Dameware Mini Remote Control 4.1.0.0 uses insufficiently random data to create the encryption key, which makes it easier for remote attackers to obtain sensitive information via brute force guessing. Dameware vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 misc_damewareminirc  
BROWN CVE-2004-1852 DameWare Mini Remote Control 3.x before 3.74 and 4.x before 4.2 transmits the Blowfish encryption key in plaintext, which allows remote attackers to gain sensitive information. Dameware vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 misc_damewareminirc  
RED CVE-2004-1856 devices_update_printer_fw_upload.hts in HP Web JetAdmin 7.5.2546, when no password is set, allows remote attackers to upload arbitrary files to the printer directory. JetAdmin vulnerabilities
 web_tool_jetadminhts  
RED CVE-2004-1857 Directory traversal vulnerability in setinfo.hts in HP Web Jetadmin 7.5.2546 allows remote authenticated attackers to read arbitrary files via a .. (dot dot) in the setinclude parameter. JetAdmin vulnerabilities
 web_tool_jetadminhts  
RED CVE-2004-1858 HP Web Jetadmin 7.5.2546 allows remote attackers to cause a denial of service (crash) via a malformed request, possibly due to a stricmp() error from an invalid use of the "$" character. JetAdmin vulnerabilities
 web_tool_jetadminhts  
RED CVE-2004-1859 Directory traversal vulnerability in Trend Micro Interscan Web Viruswall in InterScan VirusWall 3.5x allows remote attackers to read arbitrary files via a .. (dot dot) in the URL. http cgi access
 web_proxy_viruswall  
YELLOW CVE-2004-1862 Multiple cross-site scripting (XSS) vulnerabilities in Extreme Messageboard (XMB) 1.8 SP3 and 1.9 beta allow remote attackers to inject arbitrary web script or HTML via the (1) xmbuser parameter to xmb.php, (2) folder parameter to u2u.php, (3) viewmost, replymost, or latest parameter to stats.php, (4) message or icons parameter to post.php, (5) threadlist, pagelinks, forumlist, navigation, or (6) forumdisplay parameter to forumdisplay.php. XMB vulnerabilities
 web_prog_php_xmb  
YELLOW CVE-2004-1863 Multiple cross-site scripting (XSS) vulnerabilities in XMB (aka extreme message board) 1.9 beta (aka Nexus beta) allow remote attackers to inject arbitrary web script or HTML via (1) the u2uheader parameter in editprofile.php, the restrict parameter in (2) member.php, (3) misc.php, and (4) today.php, and (5) an arbitrary parameter in phpinfo.php. XMB vulnerabilities
 web_prog_php_xmb  
RED CVE-2004-1864 SQL injection vulnerability in Extreme Messageboard (XMB) 1.9 beta allows remote attackers to execute arbitrary SQL commands via the restrict parameter to (1) member.php, (2) misc.php, or (3) today.php. XMB vulnerabilities
 web_prog_php_xmb  
RED CVE-2004-1870 Multiple SQL injection vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to gain users' passwords via the (1) photo parameter to addfav.php, (2) photo parameter to comments.php, (3) credit parameter to comments.php, (4) cat parameter to index.php, (5) ppuser parameter to showgallery.php, (6) cat parameter to showgallery.php, (7) cat parameter to uploadphoto.php, (8) albumid parameter to useralbums.php, or (9) albumid parameter to useralbums.php. PhotoPost vulnerabilities
 web_prog_php_photopost  
RED CVE-2004-1871 Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ppuser, (2) password, (3) stype, (4) perpage, (5) sort, (6) page, (7) si, or (8) cat parameters to showmembers.php, or the (9) photo name, (10) photo description, (11) album name, or (12) album description fields. PhotoPost vulnerabilities
 web_prog_php_photopost  
RED CVE-2004-1878 LINBOX LIN:BOX allows remote attackers to bypass authentication, obtain sensitive information, or gain access via a direct request to admin/user.pl preceded by // (double leading slash). Linbox vulnerabilities
 web_tool_linbox  
RED CVE-2004-1881 SQL injection vulnerability in (1) mailorder.asp or (2) payonline.asp in CactuShop 5.x allows remote attackers to execute arbitrary SQL commands via the strItems parameter. SQL injection
 web_prog_sql_cactushop  
YELLOW CVE-2004-1882 Cross-site scripting (XSS) vulnerability in popuplargeimage.asp in CactuShop 5.x allows remote attackers to inject arbitrary web script or HTML via the strImageTag parameter. Cross site scripting
 web_prog_asp_cactushopxss  
RED CVE-2004-1883 Multiple buffer overflows in Ipswitch WS_FTP Server 4.0.2 (1) allow remote authenticated users to execute arbitrary code by causing a large error string to be generated by the ALLO handler, or (2) may allow remote FTP administrators to execute arbitrary code by causing a long hostname or username to be inserted into a reply to a STAT command while a file is being transferred. WS FTP vulnerabilities
 ftp_wsftp  
RED CVE-2004-1884 Ipswitch WS_FTP Server 4.0.2 has a backdoor XXSESS_MGRYY username with a default password, which allows remote attackers to gain access. WS FTP vulnerabilities
 ftp_wsftp  
RED CVE-2004-1885 Ipswitch WS_FTP Server 4.0.2 allows remote authenticated users to execute arbitrary programs as SYSTEM by using the SITE command to modify certain iFtpSvc options that are handled by iftpmgr.exe. WS FTP vulnerabilities
 ftp_wsftp  
RED CVE-2004-1886 DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2004-1848. Reason: This candidate is a duplicate of CVE-2004-1848. Notes: All CVE users should reference CVE-2004-1848 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. WS FTP vulnerabilities
 ftp_wsftp  
RED CVE-2004-1888 display.cgi in Aborior Encore WebForum allows remote to execute arbitrary commands via shell metacharacters in the file variable. http cgi access
 web_prog_cgi_encore  
BROWN CVE-2004-1892 Stack-based buffer overflow in DecodeBase16 function, as used in the (1) IRC module and (2) web server in eMule 0.42d, allows remote attackers to execute arbitrary code via a long string. peer to peer file sharing
 misc_p2p_emule  
RED CVE-2004-1893 Dreamweaver MX, when "Using Driver On Testing Server" or "Using DSN on Testing Server" is selected, uploads the mmhttpdb.asp script to the web site but does not require authentication, which allows remote attackers to obtain sensitive information and possibly execute arbitrary SQL commands via a direct request to mmhttpdb.asp. http cgi access
 web_prog_asp_mmhttpdb  
RED CVE-2004-1897 Administration interface in Monit 1.4 through 4.2 allows remote attackers to cause a denial of service (segmentation fault) by sending a Basic Authentication request without a password, which causes Monit to decrement a null pointer and perform an out-of-bounds read. monit vulnerabilities
 web_tool_monit  
RED CVE-2004-1898 Stack-based buffer overflow in the administration interface in Monit 1.4 through 4.2 allows remote attackers to execute arbitrary code via a long username. monit vulnerabilities
 web_tool_monit  
RED CVE-2004-1899 The administration interface in Monit 1.4 through 4.2 allows remote attackers to cause an off-by-one overflow via a POST that contains 1024 bytes. monit vulnerabilities
 web_tool_monit  
YELLOW CVE-2004-1913 Cross-site scripting (XSS) vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to inject arbitrary web script or HTML via the eid parameter. Cross site scripting
 web_prog_php_nukecalendar  
RED CVE-2004-1914 SQL injection vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to execute arbitrary SQL commands via the eid parameter. SQL injection
 web_prog_sql_nukecalendar  
RED CVE-2004-1920 X-Micro WLAN 11b Broadband Router 1.2.2, 1.2.2.3, 1.2.2.4, and 1.6.0.0 has a hardcoded "super" username and password, which could allow remote attackers to gain access. default device password
 net_xmicropass  
YELLOW CVE-2004-1924 Multiple cross-site scripting (XSS) vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via via the (1) theme parameter to tiki-switch_theme.php, (2) find and priority parameters to messu-mailbox.php, (3) flag, priority, flagval, sort_mode, or find parameters to messu-read.php, (4) articleId parameter to tiki-read_article.php, (5) parentId parameter to tiki-browse_categories.php, (6) comments_threshold parameter to tiki-index.php (7) articleId parameter to tiki-print_article.php, (8) galleryId parameter to tiki-list_file_gallery.php, (9) galleryId parameter to tiki-upload_file.php, (10) faqId parameter to tiki-view_faq.php, (11) chartId parameter to tiki-view_chart.php, or (12) surveyId parameter to tiki-survey_stats_survey.php. Cross site scripting
 web_prog_php_tikixss  
RED CVE-2004-1925 Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sort_mode parameter in (1) tiki-usermenu.php, (2) tiki-list_file_gallery.php, (3) tiki-directory_ranking.php, (4) tiki-browse_categories.php, (5) tiki-index.php, (6) tiki-user_tasks.php, (7) tiki-directory_ranking.php, (8) tiki-directory_search.php, (9) tiki-file_galleries.php, (10) tiki-list_faqs.php, (11) tiki-list_trackers.php, (12) tiki-list_blogs.php, or via the offset parameter in (13) tiki-usermenu.php, (14) tiki-browse_categories.php, (15) tiki-index.php, (16) tiki-user_tasks.php, (17) tiki-list_faqs.php, (18) tiki-list_trackers.php, or (19) tiki-list_blogs.php. SQL injection
 web_prog_sql_tiki  
RED CVE-2004-1932 SQL injection vulnerability in (1) auth.php and (2) admin.php in PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account via base64-encoded SQL in the admin parameter. SQL injection
 web_prog_sql_phpnukeadmin  
RED CVE-2004-1934 PHP remote file inclusion vulnerability in affich.php in Gemitel 3.50 allows remote attackers to execute arbitrary PHP code via the base parameter. PHP injection
 web_prog_php_affich  
RED CVE-2004-1943 PHP remote file inclusion vulnerability in album_portal.php in phpBB modified by Przemo 1.8 allows remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter. PHP injection
 web_prog_php_albumportal  
RED CVE-2004-1952 SQL injection vulnerability in Advanced Guestbook 2.2 allows remote attackers to execute arbitrary SQL commands and gain privileges via the password. SQL injection
 web_prog_sql_guestbookadv  
RED CVE-2004-1966 Multiple SQL injection vulnerabilities in Open Bulletin Board (OpenBB) 1.0.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) FID parameter in board.php, (2) sortorder, perpage, or id parameters in member.php, (3) forums parameter in search.php, or (4) PID or FID parameters in post.php. SQL injection
 web_prog_sql_openbb  
RED CVE-2004-1970 Samsung SmartEther SS6215S switch, and possibly other Samsung switches, allows remote attackers and local users to gain administrative access by providing the admin username followed by a password that is the maximum allowed length, then pressing the enter key after the resulting error message. Samsung switch authentication bypass
 net_samsungauth  
RED CVE-2004-1991 Directory traversal vulnerability in Aldo's Web Server (aweb) 1.5 allows remote attackers to view arbitrary files via a .. (dot dot) in an HTTP GET request. http server read access
 web_server_read  
RED CVE-2004-1992 Buffer overflow in Serv-U FTP server before 5.0.0.6 allows remote attackers to cause a denial of service (crash) via a long -l parameter, which triggers an out-of-bounds read. Serv U vulnerabilities
 ftp_servu  
RED CVE-2004-1993 The patch to the checklogin function in omail.pl for omail webmail 0.98.5 is incomplete, which allows remote attackers to execute arbitrary commands via shell metacharacters such as "`" (backticks) in the password. oMail Webmail vulnerability
 mail_web_omail  
RED CVE-2004-2003 Buffer overflow in the ssl_prcert function in the SSLway filter (sslway.c) for DeleGate 8.9.2 and earlier allows remote attackers to execute arbitrary code via a certificate with a long (1) subject or (2) issuer name field. DeleGate vulnerabilities
 web_proxy_delegate  
RED CVE-2004-2010 PHP remote file inclusion vulnerability in index.php in phpShop 0.7.1 and earlier allows remote attackers to execute arbitrary PHP code by modifying the base_dir parameter to reference a URL on a remote web server that contains phpshop.cfg. PHP injection
 web_prog_php_shop  
YELLOW CVE-2004-2020 Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 6.x through 7.3 allow remote attackers inject arbitrary HTML or web script into the (1) optionbox parameter in the News module, (2) date parameter in the Statistics module, (3) year, month, and month_1 parameters in the Stories_Archive module, (4) mode, order, and thold parameters in the Surveys module, or (5) a SQL statement to index.php, as processed by mainfile.php. Cross site scripting
 web_prog_php_nukexss  
RED CVE-2004-2023 SQL injection vulnerability in login.php in Zen Cart 1.1.2d, 1.1.4 before patch 1, and possibly other versions allows remote attackers to execute arbitrary SQL via the (1) admin_name or (2) admin_pass parameters. SQL injection
 web_prog_sql_zencart  
RED CVE-2004-2027 Buffer overflow in Icecast 2.0.0 and earlier allows remote attackers to cause a denial of service (crash) via a long Basic Authorization header that triggers an out-of-bounds read. icecast vulnerability
 web_server_icecast  
RED CVE-2004-2036 SQL injection vulnerability in the art_print function in print.inc.php in unknown versions of jPortal before 2.3.1 allows remote attackers to inject arbitrary SQL commands via the id parameter. SQL injection
 web_prog_sql_jportalprint  
YELLOW CVE-2004-2040 Multiple cross-site scripting (XSS) vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary web script or HTML via the (1) LAN_407 parameter to clock_menu.php, (2) "email article to a friend" field, (3) "submit news" field, or (4) avmsg parameter to usersettings.php. Cross site scripting
 web_prog_php_e107xss  
RED CVE-2004-2042 Multiple SQL injection vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary SQL code and gain sensitive information via (1) content parameter to content.php, (2) content_id parameter to content.php, or (3) list parameter to news.php. SQL injection
 web_prog_sql_e107  
RED CVE-2004-2047 Directory traversal vulnerability in EasyWeb FileManager 1.0 RC-1 for PostNuke allows remote attackers to retrieve arbitrary files via a .. (dot dot) in the pathext parameter. vulnerable web program
 web_prog_php_easyweb  
RED CVE-2004-2048 radmin in eSeSIX Thintune thin clients running firmware 2.4.38 and earlier starts a process port 25072 that can be accessed with a default "jstwo" password, which allows remote attackers to gain access. ThinTune vulnerabilities
 misc_thintune  
RED CVE-2004-2049 eSeSIX Thintune thin clients running firmware 2.4.38 and earlier store sensitive usernames and passwords in cleartext in configuration files for the keeper library, which allows attackers to gain access. ThinTune vulnerabilities
 misc_thintune  
RED CVE-2004-2050 eSeSIX Thintune thin clients running firmware 2.4.38 and earlier allow local users to gain privileges by pressing CTRL-SHIFT-ALT-DEL and entering the "maertsJ" password, which is hard-coded into lshell. ThinTune vulnerabilities
 misc_thintune  
RED CVE-2004-2051 The Phoenix browser in eSeSIX Thintune thin clients running firmware 2.4.38 and earlier allows local users to read arbitrary files via a file:/// URL. ThinTune vulnerabilities
 misc_thintune  
RED CVE-2004-2052 eSeSIX Thintune thin clients running firmware 2.4.38 and earlier accept any password that begins with the actual password, which makes it easier for users to conduct brute force password guessing. ThinTune vulnerabilities
 misc_thintune  
YELLOW CVE-2004-2055 Cross-site scripting (XSS) vulnerability in search.php for PhpBB 2.0.4 and 2.0.9 allows remote attackers to inject arbitrary HTMl or web script via the search_author parameter. Cross site scripting
 web_prog_php_bbxsssearch  
RED CVE-2004-2056 SQL injection vulnerability in action.php in Nucleus CMS 3.01 allows remote attackers execute arbitrary SQL statements via the itemid parameter. SQL injection
 web_prog_sql_nucleus  
RED CVE-2004-2062 SQL injection vulnerability in antiboard.php in AntiBoard 0.7.2 and earlier allows remote attackers to execute arbitrary SQL via the (1) thread_id, (2) parent_id, or (3) mode parameters. SQL injection
 web_prog_sql_antiboard  
BROWN CVE-2004-2069 sshd.c in OpenSSH 3.6.1p2 and 3.7.1p2 and possibly other versions, when using privilege separation, does not properly signal the non-privileged process when a session has been terminated after exceeding the LoginGraceTime setting, which leaves the connection open and allows remote attackers to cause a denial of service (connection consumption). OpenSSH vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 shell_ssh_openssh  
YELLOW CVE-2004-2071 Macallan Mail Solution 2.8.4.6 (Build 260), and possibly earlier versions, allows remote attackers to bypass authentication in the web interface via an HTTP GET request with two slashes ("//") after the server name. MacAllan Mail vulnerabilities
 mail_web_macallan  
RED CVE-2004-2086 Stack-based buffer overflow in results.stm for Sambar Server before the 6.0 production release allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP POST request with a long query parameter. Sambar vulnerabilities
 web_server_sambar  
YELLOW CVE-2004-2102 Cross-site scripting (XSS) vulnerability in FREESCO 2.05, a modified version of thttpd, allows remote attackers to inject arbitrary web script or HTML via the test parameter. thttpd vulnerabilities
 web_server_thttpdxss  
BROWN CVE-2004-2107 Finjan SurfinGate 6.0 and 7.0, when running in proxy mode, does not authenticate FHTTP commands on TCP port 3141, which allows remote attackers to use the finjan-parameter-type header to (1) restart the service, (2) use the getlastmsg command to view log information, or (3) use the online command to force a policy update from the database server. Finjan SurfinGate vulnerabilities
 web_proxy_surfingate  
RED CVE-2004-2111 Stack-based buffer overflow in the site chmod command in Serv-U FTP Server before 4.2 allows remote attackers to execute arbitrary code via a long filename. Serv U vulnerabilities
 ftp_servu  
RED CVE-2004-2112 Directory traversal vulnerability in BremsServer 1.2.4 allows remote attackers to read arbitrary files via ".." (dot dot) sequences in the URL. http server read access
 web_server_read  
YELLOW CVE-2004-2113 Cross-site scripting (XSS) vulnerability in BremsServer 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the URL. Cross site scripting
 web_server_css  
YELLOW CVE-2004-2115 Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request. Oracle iSQLPlus vulnerabilities
 database_oracle_isqlplusxss  
RED CVE-2004-2116 Directory traversal vulnerability in Tiny Server 1.1 allows remote attackers to read or download arbitrary files via a .. (dot dot) in the URL. http server read access
 web_server_read  
YELLOW CVE-2004-2119 Cross-site scripting (XSS) vulnerability in Tiny Server 1.1 allows remote attackers to inject arbitrary web script or HTML via the URL. Cross site scripting
 web_server_css  
RED CVE-2004-2121 Multiple directory traversal vulnerabilities in Borland Web Server (BWS) 1.0b3 and earlier allow remote attackers to read and download arbitrary files via (1) multi-dot "......" sequences, or (2) "%5c%2e%2e" (encoded "\..") sequences, in the URL. http server read access
 web_server_read  
RED CVE-2004-2124 The register_globals simulation capability in Gallery 1.3.1 through 1.4.1 allows remote attackers to modify the HTTP_POST_VARS variable and conduct a PHP remote file inclusion attack via the GALLERY_BASEDIR parameter, a different vulnerability than CVE-2002-1412. PHP injection
 web_prog_php_galleryinit  
RED CVE-2004-2127 Directory traversal vulnerability in Web Blog 1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file variable. http cgi access
 web_prog_cgi_blog  
RED CVE-2004-2139 Unknown vulnerability in Adminedit.pl YaBB 1 Gold before 1.3.2 allows attackers to execute arbitrary code via settings.pl. vulnerable web program
 web_prog_cgi_adminedit  
YELLOW CVE-2004-2141 DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2004-1827. Reason: This candidate is a duplicate of CVE-2004-1827. Notes: All CVE users should reference CVE-2004-1827 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Cross site scripting
 web_prog_cgi_yabbshadowxss  
RED CVE-2004-2144 Baal Smart Forms before 3.2 allows remote attackers to bypass authentication and obtain system access via a direct request to regadmin.php. web application access
 web_prog_php_baal  
YELLOW CVE-2004-2146 CRLF injection vulnerability in PD9 Software MegaBBS 2 and 2.1 allows attackers to conduct HTTP response splitting attacks via the fid parameter in a writenew action to thread-post.asp. HTTP Response Splitting
 web_prog_asp_megabbssplit  
RED CVE-2004-2149 Buffer overflow in the prepared statements API in libmysqlclient for MySQL 4.1.3 beta and 4.1.4 allows remote attackers to cause a denial of service via a large number of placeholders. MySQL vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 database_mysql_version  
YELLOW CVE-2004-2152 Cross-site scripting (XSS) vulnerability in 'raw' page output mode for MediaWiki 1.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML. MediaWiki vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_mediawiki  
YELLOW CVE-2004-2171 Cross-site scripting (XSS) vulnerability in Cherokee before 0.4.8 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting error page. Cross site scripting
 web_server_css  
YELLOW CVE-2004-2175 Multiple SQL injection vulnerabilities in ReviewPost PHP Pro allow remote attackers to execute arbitrary SQL commands via the (1) product parameter to showproduct.php or (2) cat parameter to showcat.php. ReviewPost vulnerabilities
 web_prog_php_reviewpost  
BROWN CVE-2004-2182 Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server. JRun vulnerabilities
 web_dev_jrun_jsessionid  
RED CVE-2004-2184 Directory traversal vulnerability in Digicraft Yak! server 2.0 through 2.1.2 allows remote attackers to read or write arbitrary files via "../" or "..\" sequences in commands such as (1) dir or (2) put. Yak FTP vulnerabilities
 ftp_yakpass  
YELLOW CVE-2004-2185 Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki 1.3.5 allow remote attackers to execute arbitrary scripts and/or SQL queries via (1) the UnicodeConverter extension, (2) raw page views, (3) SpecialIpblocklist, (4) SpecialEmailuser, (5) SpecialMaintenance, and (6) ImagePage. MediaWiki vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_mediawiki  
RED CVE-2004-2186 SQL injection vulnerability in MediaWiki 1.3.5 allows remote attackers to execute arbitrary SQL commands via SpecialMaintenance. MediaWiki vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_mediawiki  
BROWN CVE-2004-2187 Unknown vulnerability in ImagePage for MediaWiki 1.3.5, related to "filename validation," has unknown impact and attack vectors. MediaWiki vulnerabilities

Note: Authentication is recommended to improve the accuracy of this check		 web_prog_php_mediawiki  
YELLOW CVE-2004-2191 Cross-site scripting (XSS) vulnerability in ttt-webmaster.php in Turbo Traffic Trader PHP 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) msg[0] or (2) siteurl parameters. Cross site scripting
 web_prog_php_tttxss  
RED CVE-2004-2195 PHP remote file inclusion vulnerability in index.php in Zanfi CMS lite 1.1 allows remote attackers to execute arbitrary PHP code via the inc parameter. PHP injection
 web_prog_php_zanfi  
YELLOW CVE-2004-2213 Mbedthis AppWeb HTTP server before 1.1.3 allows remote attackers to obtain the source code for scripts via a (1) trailing dot (".") or (2) trailing space in an HTTP request. AppWeb vulnerabilities
 web_server_appweb  
YELLOW CVE-2004-2214 Mbedthis AppWeb HTTP server before 1.1.3 allows remote attackers to bypass access restrictions via a URI with mixed case characters. AppWeb vulnerabilities
 web_server_appweb  
RED CVE-2004-2218 SQL injection vulnerability in pmwh.php in PHPMyWebHosting 0.3.4 and earlier allows remote attackers to modify SQL statements via the password parameter. SQL injection
 web_prog_sql_pmwh  
YELLOW CVE-2004-2222 Directory traversal vulnerability in index.php in FsPHPGallery before 1.2 allows remote attackers to list arbitrary directories via the dir parameter. web program information disclosure
 web_prog_php_fsgallery  
YELLOW CVE-2004-2227 Mozilla Firefox before 1.0 truncates long filenames in the file download dialog box, which makes it easier for remote attackers to trick users into downloading files with dangerous extensions. Mozilla vulnerabilities

Note: Authentication is required to detect this vulnerability		 web_client_firefox  
RED CVE-2004-2240 Multiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via (1) the query string in read.php or (2) unknown vectors in file.php. SQL injection
 web_prog_sql_phorum  
YELLOW CVE-2004-2242 Cross-site scripting (XSS) vulnerability in search.php in Phorum, possibly 5.0.7 beta and earlier, allows remote attackers to inject arbitrary HTML or web script via the subject parameter. Cross site scripting
 web_prog_php_phorumsearch  
RED CVE-2004-2253 Directory traversal vulnerability in user.cgi in SurgeLDAP 1.0g and earlier allows remote attackers to read arbitrary files via a .. in the page parameter of the show command. http cgi access
 web_prog_cgi_surgeldap  
RED CVE-2004-2257 phpMyFAQ 1.4.0 allows remote attackers to access the Image Manager to upload or delete images without authorization via a direct request. web application access
 web_prog_php_myfaq  
BROWN CVE-2004-2271 Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request. MiniShare vulnerability
 web_server_minishare  
RED CVE-2004-2275 i-mall.cgi in I-Mall Commerce allows remote attackers to execute arbitrary commands via shell metacharacters via the p parameter. vulnerable web program
 web_prog_cgi_imall  
YELLOW CVE-2004-2279 Cross-site scripting (XSS) vulnerability in Invision Power Board 1.3 Final allows remote attackers to execute arbitrary script as other users via the pop parameter in a chat action to index.php. Invision Power Board
 web_prog_php_ipbversion  
BROWN CVE-2004-2284 The read_list_from_file function in vacation.pl for OpenWebmail before 2.32 20040629 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename argument. http potential problems
 web_prog_cgi_vacation  
YELLOW CVE-2004-2289 Microsoft Windows XP Explorer allows local users to execute arbitrary code via a system folder with a Desktop.ini file containing a .ShellClassInfo specifier with a CLSID value that is associated with an executable file. Windows updates needed

Note: Authentication is required to detect this vulnerability		 win_patch_explorercom  
YELLOW CVE-2004-2292 Buffer overflow in Alt-N MDaemon 7.0.1 allows remote attackers to cause a denial of service (application crash) via a long STATUS command to the IMAP server. MDaemon vulnerabilities
 mail_imap_mdaemon  
YELLOW CVE-2004-2294 Canonicalize-before-filter error in the send_review function in the Reviews module for PHP-Nuke 6.0 to 7.3 allows remote attackers to inject arbitrary web script or HTML via hex-encoded XSS sequences in the text parameter, which is checked for dangerous sequences before it is canonicalized, leading to a cross-site scripting (XSS) vulnerability. Cross site scripting
 web_prog_php_nukexsshex  
RED CVE-2004-2299 Buffer overflow in Omnicron OmniHTTPd 3.0a and earlier allows remote attackers to execute arbitrary code via an HTTP GET request with a long Range header. OmniHTTPd vulnerabilities
 web_server_omni  
YELLOW CVE-2004-2317 Information leak in Mbedthis AppWeb HTTP server 1.0 through 1.1.2 allows remote attackers to obtain sensitive information via a user message that is generated when Mbedthis denies access. AppWeb vulnerabilities
 web_server_appweb  
YELLOW CVE-2004-2320 The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting. WebLogic vulnerabilities
Cross site tracing
 web_dev_weblogic
web_server_trace		  
RED CVE-2004-2341 PHP file include injection vulnerability in isearch.inc.php for iSearch allows remote attackers to execute arbitrary code via the isearch_path parameter. PHP injection
 web_prog_php_isearch  
RED CVE-2004-2347 blog.cgi in Leif M. Wright Web Blog 1.1 and 1.1.5 allows remote attackers to execute arbitrary commands via shell metacharacters such as '|' in the file parameter of ViewFile requests. http cgi access
 web_prog_cgi_blog  
RED CVE-2004-2350 SQL injection vulnerability in search.php for phpBB 1.0 through 2.0.6 allows remote attackers to execute arbitrary SQL and gain privileges via the search_results parameter. SQL injection
 web_prog_sql_phpbbsearch  
RED CVE-2004-2357 The embedded MySQL 4.0 server for Proofpoint Protection Server does not require a password for the root user of MySQL, which allows remote attackers to read or modify the backend database. MySQL missing password
 database_mysql_pass  
YELLOW CVE-2004-2363 Validate-Before-Canonicalize vulnerability in the checkURI function in functions.inc.php in PHPX 3.0 through 3.2.6 allows remote attackers to conduct cross-site scripting (XSS) attacks via hex-encoded tags, which bypass the check for literal "<", ">", "(", and ")" characters, as demonstrated using the limit parameter to forums.php and a variety of other vectors. PHPX vulnerabilities
 web_prog_php_phpxusersxss  
RED CVE-2004-2364 Cross-site request forgery (CSRF) vulnerability in PHPX 3.0 through 3.2.6 allows remote attackers to execute arbitrary commands via URLs that are automatically executed on behalf of the administrator, as demonstrated using (1) admin/page.php, (2) admin/news.php, (3) admin/user.php, (4) admin/images.php, (5) admin/page.php, or (6) admin/forums.php. PHPX vulnerabilities
 web_prog_php_phpx  
YELLOW CVE-2004-2369 Directory traversal vulnerability in webadmin.nsf for Lotus Domino R6 6.5.1 allows attackers to create and detect directories via a .. (dot dot) in the directory creation command. Lotus Domino HTTP vulnerability
 web_server_lotus_webadminnsf  
YELLOW CVE-2004-2379 Multiple cross-site scripting (XSS) vulnerabilities in @Mail 3.64 for Windows allow remote attackers to inject arbitrary web script or HTML via (1) the Displayed Name attribute in util.pl and (2) the Folder attribute in showmail.pl. AtMail vulnerabilities
 mail_web_atmail  
RED CVE-2004-2381 HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause denial of service (memory usage and application crash) via HTTP requests with a large Content-Length. Jetty vulnerabilities
 web_dev_jetty  
BROWN CVE-2004-2388 rexecd for AIX 4.3.3 does not properly use a local copy of the pwd structure when calling getpwnam, which may cause the structure to be overwritten by the authenticate function and assign privileges to the wrong user. AIX rexecd vulnerability
 shell_r_aixrexec