PUBLIÉES EN
décembre 2004
1 243 CVE, des plus récentes aux plus anciennes.
CVE-2004-9999Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate has been used as a placeholder by multiple organizations for multiple issues, but it i…
CVE-2004-9998Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate has been used as a placeholder by multiple organizations for multiple issues, but it i…
CVE-2004-2760sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open …
6.8 MOYENNE
CVE-2004-2759Shared Sun StorEdge QFS and SAM-QFS file systems, as used in Utilization Suite 4.0 through 4.1 and Performance Suite 4.0 through 4.1, might allow local users to read portions of de…
2.1 FAIBLE
CVE-2004-2758Les systèmes Sun SunForum 3.2 et 3D 1.0 utilisant le protocole H.323 sont susceptibles de subir un plantage à distance. Un attaquant non authentifié disposant d'un accès réseau peu…
7.5 ÉLEVÉE
CVE-2004-2757Cross-site scripting (XSS) vulnerability in the failed login page in Novell iChain before 2.2 build 2.2.113 and 2.3 First Customer Ship (FCS) allows remote attackers to inject arbi…
4.3 MOYENNE
CVE-2004-2756Cross-site scripting (XSS) vulnerability in viewtopic.php in Xoops 2.x, possibly 2 through 2.0.5, allows remote attackers to inject arbitrary web script or HTML via the (1) forum a…
4.3 MOYENNE
CVE-2004-2755Cross-site scripting (XSS) vulnerability in Symantec Web Security 2.5, 3.0.0, and 3.0.1 before build 62 allows remote attackers to inject arbitrary web script or HTML via the query…
4.3 MOYENNE
CVE-2004-2754Le logiciel de forum YaBB SE, version 1.5.4 et versions antérieures, est susceptible d'être victime d'injections SQL via certains paramètres d'identifiants de membres. Un attaquant…
7.5 ÉLEVÉE
CVE-2004-2753Unspecified vulnerability in SharedX in HP-UX B.11.00, B.11.11, and B.11.22 allows local users to access unspecified files or cause a denial of service via unknown vectors related …
5.6 MOYENNE
CVE-2004-2752Cross-site scripting (XSS) vulnerability in the Downloads module in PostNuke up to 0.726, and possibly later versions, allows remote attackers to inject arbitrary HTML and web scri…
4.3 MOYENNE
CVE-2004-2751SQL injection vulnerability in the members_list module in PostNuke 0.726, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the sortby parameter.
6.8 MOYENNE
CVE-2004-2750Directory traversal vulnerability in browser.php in JBrowser 1.0 through 2.1 allows remote attackers to read arbitrary files via the directory parameter. NOTE: the provenance of t…
5.0 MOYENNE
CVE-2004-2749Directory traversal vulnerability in wra/public/wralogin in 2Wire Gateway, possibly as used in HomePortal and other product lines, allows remote attackers to read arbitrary files v…
4.3 MOYENNE
CVE-2004-2748viewreport.pl in NetIQ WebTrends Reporting Center Enterprise Edition 6.1a allows remote attackers to determine the installation path via an invalid profileid parameter, which leaks…
4.3 MOYENNE
CVE-2004-2747Directory traversal vulnerability in Pablo Software Solutions Quick 'n Easy FTP Server 1.77, and possibly earlier versions, allows remote authenticated users to determine the exist…
4.0 MOYENNE
CVE-2004-2746XTREME ASP Photo Gallery 2.0 est affecté par une faille dans sa page de connexion administrateur qui permet à un attaquant de contourner l'authentification en envoyant des commande…
7.5 ÉLEVÉE
CVE-2004-2745OwnServer d'Anteco Visual Technologies (version 1.0 et antérieures) est affecté par une faille de traversée de répertoire. Un attaquant distant peut lire n'importe quel fichier sur…
7.8 ÉLEVÉE
CVE-2004-2744Unspecified vulnerability in Tincan Limited PHPlist before 2.8.12 has unknown impact and attack vectors, related to a "security update release."
5.0 MOYENNE
CVE-2004-2743upload.cgi in Mega Upload Progress Bar before 1.45 allows remote attackers to copy or overwrite arbitrary files via unspecified parameters related to names of uploaded files.
6.4 MOYENNE
CVE-2004-2742Cross-site scripting (XSS) vulnerability in the report viewer in Crystal Enterprise 8.5, 9, and 10 allows remote attackers to inject arbitrary web script or HTML via script in the …
4.3 MOYENNE
CVE-2004-2741Cross-site scripting (XSS) vulnerability in the "help window" (help.php) in Horde Application Framework 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the…
4.3 MOYENNE
CVE-2004-2740PHP remote file inclusion vulnerability in authform.inc.php in PHProjekt 4.2.3 and earlier allows remote attackers to include arbitrary PHP code via a URL in the path_pre parameter…
4.3 MOYENNE
CVE-2004-2739Les versions 4.2.1 et antérieures de PHProjekt sont affectées par une faille dans la routine `setup.php`. Un attaquant distant non authentifié peut exploiter cette vulnérabilité vi…
7.5 ÉLEVÉE
CVE-2004-2738Cross-site scripting (XSS) vulnerability in check_user_id.php in ZeroBoard 4.1pl4 and earlier allows remote attackers to inject arbitrary web script or HTML via the user_id paramet…
4.3 MOYENNE
CVE-2004-2737NetSupport DNA HelpDesk 1.01 est affecté par une faille dans sa page de liste de problèmes qui permet à des attaquants distants d'exécuter des commandes SQL non autorisées. Un atta…
7.5 ÉLEVÉE
CVE-2004-2736Polar HelpDesk 3.0 allows remote attackers to bypass authentication by setting the UserId and UserType values in a cookie.
5.0 MOYENNE
CVE-2004-2735Cross-site scripting (XSS) vulnerability in P4DB 2.01 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) SET_PREFERENCES parameter in SetPreferences…
4.3 MOYENNE
CVE-2004-2734Les systèmes Novell NetWare 6.5 utilisant Novell Web Manager sont affectés par une erreur de configuration du serveur web Apache. Un attaquant distant et non authentifié peut conto…
10.0 ÉLEVÉE
CVE-2004-2733Web Wiz Forums 7.7a uses invalid logic to determine user privileges, which allows remote attackers to (1) block arbitrary IP addresses via pop_up_ip_blocking.asp or (2) modify topi…
5.8 MOYENNE
CVE-2004-2732nbmember.cgi in Netbilling 2.0 allows remote attackers to obtain sensitive information via the cmd=test option, which can be leveraged to determine the access key.
4.3 MOYENNE
CVE-2004-2731Multiple integer overflows in Sbus PROM driver (drivers/sbus/char/openprom.c) for the Linux kernel 2.4.x up to 2.4.27, 2.6.x up to 2.6.7, and possibly later versions, allow local u…
4.4 MOYENNE
CVE-2004-2730Sysinternals PsTools before 2.05, including (1) PsExec before 1.54, (2) PsGetsid before 1.41, (3) PsInfo before 1.61, (4) PsKill before 1.03, (5) PsList before 1.26, (6) PsLoglist …
4.6 MOYENNE
CVE-2004-2729Inetd32 Administration Tool of Hummingbird Connectivity 7.1 and 9.0 allows local users to execute arbitrary code by changing the program for handling incoming connections.
4.4 MOYENNE
CVE-2004-2728Buffer overflow in the FTP server of Hummingbird Connectivity 7.1 and 9.0 allows remote, authenticated users to cause a denial of service (application crash) via a long argument to…
3.5 FAIBLE
CVE-2004-2727Buffer overflow in MEHTTPS (HTTPMail) of MailEnable Professional 1.5 through 1.7 allows remote attackers to cause a denial of service (application crash) via a long HTTP GET reques…
4.3 MOYENNE
CVE-2004-2726HTTPMail service in MailEnable Professional 1.18 does not properly handle arguments to the Authorization header, which allows remote attackers to cause a denial of service (null de…
5.0 MOYENNE
CVE-2004-2725Multiple cross-site scripting (XSS) vulnerabilities in Aztek Forum 4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in (a) search.php,…
4.3 MOYENNE
CVE-2004-2724LionMax Chat Anywhere 2.72a est susceptible de subir un plantage pouvant figer le serveur et provoquer un pic d'utilisation du processeur pour les clients connectés. Un attaquant n…
7.1 ÉLEVÉE
CVE-2004-2723NessusWX 1.4.4 stores account passwords in plaintext in .session files, which allows local users to obtain passwords.
2.1 FAIBLE
CVE-2004-2722Nessus 2.0.10a stores account passwords in plaintext in .nessusrc files, which allows local users to obtain passwords. NOTE: the original researcher reports that the vendor has di…
2.1 FAIBLE
CVE-2004-2721The CheckGroup function in openSkat VTMF before 2.1 generates public key pairs in which the "p" variable might not be prime, which allows remote attackers to determine the private …
4.3 MOYENNE
CVE-2004-2720Cross-site scripting (XSS) vulnerability in register.asp in Snitz Forums 2000 3.4.04 and earlier allows remote attackers to inject arbitrary web script or HTML via javascript event…
4.3 MOYENNE
CVE-2004-2719Buffer overflow in the UrlToLocal function in PunyLib.dll of Foxmail 5.0.300 allows remote attackers to execute arbitrary code via a mail message with a long From field, a differen…
6.8 MOYENNE
CVE-2004-2718PHPMyChat 0.14.5 does not remove or protect setup.php3 after installation, which allows attackers to obtain sensitive information including database passwords via a direct request.
4.3 MOYENNE
CVE-2004-2717Multiple directory traversal vulnerabilities in admin.php3 in PHPMyChat 0.14.5 allow remote attackers with administrative privileges to read arbitrary files via a .. (dot dot) in t…
2.6 FAIBLE
CVE-2004-2716La version 0.14.5 de PHPMyChat est affectée par plusieurs failles d'injection SQL dans son script de gestion des utilisateurs. Un attaquant non authentifié disposant d'un accès rés…
7.5 ÉLEVÉE
CVE-2004-2715La version 0.14.5 de PHPMyChat est affectée par une faille dans son script d'édition d'utilisateurs. Un attaquant distant peut contourner l'authentification et obtenir des privilèg…
7.5 ÉLEVÉE
CVE-2004-2714Unspecified vulnerability in Window Maker 0.80.2 and earlier allows attackers to perform unknown actions via format string specifiers in a font specification in WMGLOBAL, probably …
6.0 MOYENNE
CVE-2004-2713Zone Alarm Pro 1.0 through 5.1 gives full access to %windir%\Internet Logs\* to the EVERYONE group, which allows local users to cause a denial of service by modifying the folder co…
1.9 FAIBLE