# CVEs published 2004-03-18

113 CVEs were published on March 18, 2004: 0 critical, 1 high. Days are UTC.

- [CVE-2004-0079](https://cve.now/CVE-2004-0079.md): The do\_change\_cipher\_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service ( (CVSS 7.5)
- [CVE-2004-0081](https://cve.now/CVE-2004-0081.md): OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infi (no CVSS)
- [CVE-2004-0112](https://cve.now/CVE-2004-0112.md): The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of (no CVSS)
- [CVE-2004-0236](https://cve.now/CVE-2004-0236.md): SQL injection vulnerability in login.asp in thePHOTOtool allows remote attackers to gain unauthorized access via the password field. (no CVSS)
- [CVE-2004-0237](https://cve.now/CVE-2004-0237.md): Directory traversal vulnerability in index.php in Aprox PHP Portal allows remote attackers to read arbitrary files via a full pathname in th (no CVSS)
- [CVE-2004-0238](https://cve.now/CVE-2004-0238.md): Multiple buffer overflows in Overkill (0verkill) 0.15pre3 might allow local users to execute arbitrary code in the client via a long HOME en (no CVSS)
- [CVE-2004-0239](https://cve.now/CVE-2004-0239.md): SQL injection vulnerability in showphoto.php in PhotoPost PHP Pro 4.6 and earlier allows remote attackers to gain unauthorized access via th (no CVSS)
- [CVE-2004-0240](https://cve.now/CVE-2004-0240.md): Directory traversal vulnerability in X-Cart 3.4.3 allows remote attackers to view arbitrary files via a .. (no CVSS)
- [CVE-2004-0241](https://cve.now/CVE-2004-0241.md): X-Cart 3.4.3 allows remote attackers to execute arbitrary commands via the perl\_binary argument in (1) upgrade.php or (2) general.php. (no CVSS)
- [CVE-2004-0242](https://cve.now/CVE-2004-0242.md): X-Cart 3.4.3 allows remote attackers to gain sensitive information via a mode parameter with (1) phpinfo command or (2) perlinfo command. (no CVSS)
- [CVE-2004-0243](https://cve.now/CVE-2004-0243.md): AIX 4.3.3 through AIX 5.1, when direct remote login is disabled, displays a different message if the password is correct, which allows remot (no CVSS)
- [CVE-2004-0244](https://cve.now/CVE-2004-0244.md): Cisco 6000, 6500, and 7600 series systems with Multilayer Switch Feature Card 2 (MSFC2) and a FlexWAN or OSM module allow local users to cau (no CVSS)
- [CVE-2004-0245](https://cve.now/CVE-2004-0245.md): Web Crossing 4.x and 5.x allows remote attackers to cause a denial of service (crash) by sending a HTTP POST request with a large or negativ (no CVSS)
- [CVE-2004-0246](https://cve.now/CVE-2004-0246.md): Multiple PHP remote file inclusion vulnerabilities in (1) fonctions.lib.php, (2) derniers\_commentaires.php, and (3) admin.php in Les Comment (no CVSS)
- [CVE-2004-0247](https://cve.now/CVE-2004-0247.md): The client and server of Chaser 1.50 and earlier allow remote attackers to cause a denial of service (crash via exception) via a UDP packet (no CVSS)
- [CVE-2004-0248](https://cve.now/CVE-2004-0248.md): Cross-site scripting vulnerability (XSS) in PHPX 3.2.3 allows remote attackers to execute arbitrary script as other users by injecting arbit (no CVSS)
- [CVE-2004-0249](https://cve.now/CVE-2004-0249.md): PHPX 2.0 through 3.2.4 allows remote attackers to gain access to other accounts by modifying the cookie's PXL variable to reference another (no CVSS)
- [CVE-2004-0250](https://cve.now/CVE-2004-0250.md): SQL injection vulnerability in PhotoPost PHP Pro 4.6 and earlier allows remote attackers to gain privileges via (1) the product parameter in (no CVSS)
- [CVE-2004-0251](https://cve.now/CVE-2004-0251.md): Cross-site scripting (XSS) vulnerability in rxgoogle.cgi allows remote attackers to execute arbitrary script as other users via the query pa (no CVSS)
- [CVE-2004-0252](https://cve.now/CVE-2004-0252.md): TYPSoft FTP Server 1.10 allows remote attackers to cause a denial of service (CPU consumption) via an empty USER name. (no CVSS)
- [CVE-2004-0253](https://cve.now/CVE-2004-0253.md): IBM Cloudscape 5.1 running jdk 1.4.2\_03 allows remote attackers to execute arbitrary programs or cause a denial of service via certain SQL c (no CVSS)
- [CVE-2004-0254](https://cve.now/CVE-2004-0254.md): Cross-site scripting (XSS) vulnerability in Discuz! Board 2.x and 3.x allows remote attackers to execute arbitrary script as other users via (no CVSS)
- [CVE-2004-0255](https://cve.now/CVE-2004-0255.md): Xlight 1.52, with log to screen enabled, allows remote attackers to cause a denial of service by requesting a long directory consisting of . (no CVSS)
- [CVE-2004-0258](https://cve.now/CVE-2004-0258.md): Multiple buffer overflows in RealOne Player, RealOne Player 2.0, RealOne Enterprise Desktop, and RealPlayer Enterprise allow remote attacker (no CVSS)
- [CVE-2004-0259](https://cve.now/CVE-2004-0259.md): The check\_referer() function in Formmail.php 5.0 and earlier allows remote attackers to bypass access restrictions via an empty or spoofed H (no CVSS)
- [CVE-2004-0260](https://cve.now/CVE-2004-0260.md): The AddToMailingList function in CactuSoft CactuShop 5.0 Lite contains a backdoor that allows remote attackers to delete arbitrary files via (no CVSS)
- [CVE-2004-0262](https://cve.now/CVE-2004-0262.md): Stack-based buffer overflow in The Palace 3.5 and earlier client allows remote attackers to execute arbitrary code via a link to a palace:// (no CVSS)
- [CVE-2004-0264](https://cve.now/CVE-2004-0264.md): palmhttpd for PalmOS allows remote attackers to cause a denial of service (crash) by establishing two simultaneous HTTP connections, which e (no CVSS)
- [CVE-2004-0265](https://cve.now/CVE-2004-0265.md): Cross-site scripting (XSS) vulnerability in modules.php for Php-Nuke 6.x-7.1.0 allows remote attackers to execute arbitrary script as other (no CVSS)
- [CVE-2004-0266](https://cve.now/CVE-2004-0266.md): SQL injection vulnerability in the "public message" capability (public\_message) for Php-Nuke 6.x to 7.1.0 allows remote attackers to obtain (no CVSS)
- [CVE-2004-0267](https://cve.now/CVE-2004-0267.md): The (1) inoregupdate, (2) uniftest, or (3) unimove scripts in eTrust InoculateIT for Linux 6.0 allow local users to overwrite arbitrary file (no CVSS)
- [CVE-2004-0268](https://cve.now/CVE-2004-0268.md): Multiple buffer overflows in EvolutionX 3921 and 3935 allow remote attackers to cause a denial of service (hang) via (1) a long cd command t (no CVSS)
- [CVE-2004-0269](https://cve.now/CVE-2004-0269.md): SQL injection vulnerability in PHP-Nuke 6.9 and earlier, and possibly 7.x, allows remote attackers to inject arbitrary SQL code and gain sen (no CVSS)
- [CVE-2004-0271](https://cve.now/CVE-2004-0271.md): Multiple cross-site scripting vulnerabilities (XSS) in MaxWebPortal allow remote attackers to execute arbitrary web script as other users vi (no CVSS)
- [CVE-2004-0272](https://cve.now/CVE-2004-0272.md): SQL injection vulnerability in MaxWebPortal allows remote attackers to inject arbitrary SQL code and gain sensitive information via the Send (no CVSS)
- [CVE-2004-0275](https://cve.now/CVE-2004-0275.md): SQL injection vulnerability in calendar\_download.php in BosDates 3.2 and earlier allows remote attackers to obtain sensitive information and (no CVSS)
- [CVE-2004-0277](https://cve.now/CVE-2004-0277.md): Format string vulnerability in Dream FTP 1.02 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary co (no CVSS)
- [CVE-2004-0278](https://cve.now/CVE-2004-0278.md): Ratbag game engine, as used in products such as Dirt Track Racing, Leadfoot, and World of Outlaws Spring Cars, allows remote attackers to ca (no CVSS)
- [CVE-2004-0279](https://cve.now/CVE-2004-0279.md): AIM Sniff (aimSniff.pl) 0.9b allows local users to overwrite arbitrary files via a symlink attack on /tmp/AS.log. (no CVSS)
- [CVE-2004-0280](https://cve.now/CVE-2004-0280.md): Caucho Technology Resin 2.1.12 allows remote attackers to view JSP source via an HTTP request to a .jsp file that ends in a "%20" (encoded s (no CVSS)
- [CVE-2004-0281](https://cve.now/CVE-2004-0281.md): Caucho Technology Resin 2.1.12 allows remote attackers to gain sensitive information and view the contents of the /WEB-INF/ directory via an (no CVSS)
- [CVE-2004-0282](https://cve.now/CVE-2004-0282.md): Crob FTP daemon 3.5.2 allows remote attackers to cause a denial of service (crash) by repeatedly connecting to and disconnecting from the se (no CVSS)
- [CVE-2004-0283](https://cve.now/CVE-2004-0283.md): Mailmgr 1.2.3 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/mailmgr.unsort, (2) /tmp/mailmgr.tmp, or (3) (no CVSS)
- [CVE-2004-0284](https://cve.now/CVE-2004-0284.md): Microsoft Internet Explorer 6.0, Outlook 2002, and Outlook 2003 allow remote attackers to cause a denial of service (CPU consumption), if "D (no CVSS)
- [CVE-2004-0285](https://cve.now/CVE-2004-0285.md): PHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2) AllMyLinks, and (3) AllMyGuests allow remote a (no CVSS)
- [CVE-2004-0286](https://cve.now/CVE-2004-0286.md): Buffer overflow in RobotFTP 1.0 and 2.0 beta 1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary c (no CVSS)
- [CVE-2004-0287](https://cve.now/CVE-2004-0287.md): Xlight FTP server 1.52 allows remote authenticated users to cause a denial of service (crash) via a RETR command with a long argument contai (no CVSS)
- [CVE-2004-0288](https://cve.now/CVE-2004-0288.md): Buffer overflow in the UdmDocToTextBuf function in mnoGoSearch 3.2.13 through 3.2.15 could allow remote attackers to execute arbitrary code (no CVSS)
- [CVE-2004-0289](https://cve.now/CVE-2004-0289.md): Buffer overflow in sdbscan in SignatureDB 0.1.1 allows local users to cause a denial of service (segmentation fault) via a database file tha (no CVSS)
- [CVE-2004-0290](https://cve.now/CVE-2004-0290.md): Buffer overflow in Purge Jihad 2.0.1 and earlier allows remote game servers to execute arbitrary code via an information packet that contain (no CVSS)
- [CVE-2004-0291](https://cve.now/CVE-2004-0291.md): SQL injection vulnerability in post.php for YaBB SE 1.5.4 and 1.5.5 allows remote attackers to obtain hashed passwords via the quote paramet (no CVSS)
- [CVE-2004-0292](https://cve.now/CVE-2004-0292.md): Buffer overflow in KarjaSoft Sami HTTP Server 1.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitr (no CVSS)
- [CVE-2004-0293](https://cve.now/CVE-2004-0293.md): Directory traversal vulnerability in ShopCartCGI 2.3 allows remote attackers to retrieve arbitrary files via a .. (no CVSS)
- [CVE-2004-0294](https://cve.now/CVE-2004-0294.md): YaBB 1 SP 1.3.1 displays different error messages when a user exists or not, which makes it easier for remote attackers to identify valid us (no CVSS)
- [CVE-2004-0295](https://cve.now/CVE-2004-0295.md): TsFtpSrv.exe in Broker FTP 6.1.0.0 allows remote attackers to cause a denial of service (CPU consumption) via an open idle connection. (no CVSS)
- [CVE-2004-0296](https://cve.now/CVE-2004-0296.md): TsFtpSrv.exe in Broker FTP 6.1.0.0 allows remote attackers to cause a TsFtpSrv.exe to exit with an exception by opening and immediately clos (no CVSS)
- [CVE-2004-0298](https://cve.now/CVE-2004-0298.md): CesarFTP 0.99e allows remote attackers to cause a denial of service (CPU consumption) via a long RETR parameter. (no CVSS)
- [CVE-2004-0299](https://cve.now/CVE-2004-0299.md): Buffer overflow in smallftpd 0.99 allows local users to cause a denial of service (crash) via an FTP request with a large number of "/" (sla (no CVSS)
- [CVE-2004-0300](https://cve.now/CVE-2004-0300.md): SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access via (1) the (no CVSS)
- [CVE-2004-0301](https://cve.now/CVE-2004-0301.md): Cross-site scripting (XSS) vulnerability in more.php for Online Store Kit 3.0 allows remote attackers to inject arbitrary HTML via the id pa (no CVSS)
- [CVE-2004-0302](https://cve.now/CVE-2004-0302.md): Directory traversal vulnerability in OWLS 1.0 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2004-0303](https://cve.now/CVE-2004-0303.md): OWLS 1.0 allows remote attackers to retrieve arbitrary files via absolute pathnames in (1) the file parameter in /glossaries/index.php, (2) (no CVSS)
- [CVE-2004-0304](https://cve.now/CVE-2004-0304.md): SQL injection vulnerability in browse\_items.asp in WebCortex WebStores 2000 6.0 allows remote attackers to gain unauthorized access and exec (no CVSS)
- [CVE-2004-0305](https://cve.now/CVE-2004-0305.md): Cross-site scripting (XSS) vulnerability in error.asp in WebCortex WebStores 2000 6.0 allows remote attackers to execute arbitrary script as (no CVSS)
- [CVE-2004-0308](https://cve.now/CVE-2004-0308.md): Unknown vulnerability in Cisco ONS 15327 before 4.1(3), ONS 15454 before 4.6(1), ONS 15454 SD before 4.1(3), and Cisco ONS15600 before 1.3(0 (no CVSS)
- [CVE-2004-0310](https://cve.now/CVE-2004-0310.md): Cross-site scripting (XSS) vulnerability in LiveJournal 1.0 and 1.1 allows remote attackers to execute Javascript as other users via the sty (no CVSS)
- [CVE-2004-0311](https://cve.now/CVE-2004-0311.md): American Power Conversion (APC) Web/SNMP Management SmartSlot Card 3.0 through 3.0.3 and 3.21 are shipped with a default password of TENmanU (no CVSS)
- [CVE-2004-0312](https://cve.now/CVE-2004-0312.md): Linksys WAP55AG 1.07 allows remote attackers with access to an SNMP read only community string to gain access to read/write communtiy string (no CVSS)
- [CVE-2004-0313](https://cve.now/CVE-2004-0313.md): Buffer overflow in PSOProxy 0.91 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP re (no CVSS)
- [CVE-2004-0314](https://cve.now/CVE-2004-0314.md): Cross-site scripting (XSS) vulnerability in done.jsp in WebzEdit 1.9 and earlier allows remote attackers to execute arbitrary script as othe (no CVSS)
- [CVE-2004-0315](https://cve.now/CVE-2004-0315.md): Buffer overflow in Avirt Voice 4.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a lo (no CVSS)
- [CVE-2004-0316](https://cve.now/CVE-2004-0316.md): Buffer overflow in Avirt Soho 4.3 allows remote attackers to cause a denial of service (crash) via (1) a large GET request to port 1080 or ( (no CVSS)
- [CVE-2004-0317](https://cve.now/CVE-2004-0317.md): Buffer overflow in eauth in Load Sharing Facility 4.x, 5.x, and 6.x allows local users or remote attackers within the LSF cluster to cause a (no CVSS)
- [CVE-2004-0318](https://cve.now/CVE-2004-0318.md): Load Sharing Facility (LSF) 4.x, 5.x, and 6.x uses the LSF\_EAUTH\_UID environment variable, if it exists, instead of the real UID of the user (no CVSS)
- [CVE-2004-0319](https://cve.now/CVE-2004-0319.md): Cross-site scripting (XSS) vulnerability in the font tag in ezBoard 7.3u allows remote attackers to execute arbitrary script as other users, (no CVSS)
- [CVE-2004-0321](https://cve.now/CVE-2004-0321.md): Team Factor 1.25 and earlier allows remote attackers to cause a denial of service (crash) via a packet that uses a negative number to specif (no CVSS)
- [CVE-2004-0322](https://cve.now/CVE-2004-0322.md): Multiple cross-site scripting (XSS) vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to execute arbitrary script as other users v (no CVSS)
- [CVE-2004-0323](https://cve.now/CVE-2004-0323.md): Multiple SQL injection vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to inject arbitrary SQL and gain privileges via the (1) p (no CVSS)
- [CVE-2004-0324](https://cve.now/CVE-2004-0324.md): Confirm 0.62 and earlier could allow remote attackers to execute arbitrary code via an e-mail header that contains shell metacharacters such (no CVSS)
- [CVE-2004-0325](https://cve.now/CVE-2004-0325.md): TYPSoft FTP Server 1.10 allows remote authenticated users to cause a denial of service (CPU consumption) via "//../" arguments to (1) mkd, ( (no CVSS)
- [CVE-2004-0326](https://cve.now/CVE-2004-0326.md): Buffer overflow in the web proxy for GateKeeper Pro 4.7 allows remote attackers to execute arbitrary code via a long GET request. (no CVSS)
- [CVE-2004-0327](https://cve.now/CVE-2004-0327.md): Directory traversal vulnerability in functions.php in PhpNewsManager 1.46 allows remote attackers to retrieve arbitrary files via .. (no CVSS)
- [CVE-2004-0328](https://cve.now/CVE-2004-0328.md): Gigabyte Gn-B46B 2.4Ghz wireless broadband router firmware 1.003.00 allows local users on the same local network as the router to bypass aut (no CVSS)
- [CVE-2004-0329](https://cve.now/CVE-2004-0329.md): FreeChat 1.1.1a allows remote attackers to cause a denial of service (crash) via certain unexpected strings, as demonstrated using "aaaaa". (no CVSS)
- [CVE-2004-0330](https://cve.now/CVE-2004-0330.md): Buffer overflow in Serv-U ftp before 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to th (no CVSS)
- [CVE-2004-0331](https://cve.now/CVE-2004-0331.md): Heap-based buffer overflow in Dell OpenManage Web Server 3.4.0 allows remote attackers to cause a denial of service (crash) via a HTTP POST (no CVSS)
- [CVE-2004-0332](https://cve.now/CVE-2004-0332.md): Extremail 1.5.9 does not check passwords correctly when they are all digits or begin with a digit, which allows remote attackers to gain pri (no CVSS)
- [CVE-2004-0333](https://cve.now/CVE-2004-0333.md): Buffer overflow in the UUDeview package, as used in WinZip 6.2 through WinZip 8.1 SR-1, and possibly other packages, allows remote attackers (no CVSS)
- [CVE-2004-0334](https://cve.now/CVE-2004-0334.md): InnoMedia VideoPhone allows remote attackers to bypass Basic Authorization via an HTTP request to (1) videophone\_admindetail.asp, (2) videop (no CVSS)
- [CVE-2004-0335](https://cve.now/CVE-2004-0335.md): LAN SUITE Web Mail 602Pro, when configured to use the "Directory browsing" feature, allows remote attackers to obtain a directory listing vi (no CVSS)
- [CVE-2004-0337](https://cve.now/CVE-2004-0337.md): Cross-site scripting (XSS) vulnerability in LAN SUITE Web Mail 602Pro allows remote attackers to execute arbitrary script or HTML as other u (no CVSS)
- [CVE-2004-0338](https://cve.now/CVE-2004-0338.md): SQL injection vulnerability in search.php for Invision Board Forum allows remote attackers to execute arbitrary SQL queries via the st param (no CVSS)
- [CVE-2004-0339](https://cve.now/CVE-2004-0339.md): Cross-site scripting (XSS) vulnerability in ViewTopic.php in phpBB, possibly 2.0.6c and earlier, allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2004-0340](https://cve.now/CVE-2004-0340.md): Stack-based buffer overflow in WFTPD Pro Server 3.21 Release 1, Pro Server 3.20 Release 2, Server 3.21 Release 1, and Server 3.10 allows loc (no CVSS)
- [CVE-2004-0341](https://cve.now/CVE-2004-0341.md): WFTPD Pro Server 3.21 Release 1 allocates memory for a command until a 0Ah byte (newline) is sent, which allows local users to cause a denia (no CVSS)
- [CVE-2004-0342](https://cve.now/CVE-2004-0342.md): WFTPD Pro Server 3.21 Release 1, with the XeroxDocutech option enabled, allows local users to cause a denial of service (crash) via a (1) MK (no CVSS)
- [CVE-2004-0343](https://cve.now/CVE-2004-0343.md): Multiple SQL injection vulnerabilities in YaBB SE 1.5.4 through 1.5.5b allow remote attackers to execute arbitrary SQL via (1) the msg param (no CVSS)
- [CVE-2004-0344](https://cve.now/CVE-2004-0344.md): Directory traversal vulnerability in ModifyMessage.php in YaBB SE 1.5.4 through 1.5.5b allows remote attackers to delete arbitrary files via (no CVSS)
- [CVE-2004-0345](https://cve.now/CVE-2004-0345.md): Buffer overflow in Red Faction client 1.20 and earlier allows remote servers to execute arbitrary code via a long server name. (no CVSS)
- [CVE-2004-0346](https://cve.now/CVE-2004-0346.md): Off-by-one buffer overflow in \_xlate\_ascii\_write() in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte (no CVSS)
- [CVE-2004-0348](https://cve.now/CVE-2004-0348.md): SQL injection vulnerability in viewCart.asp in SpiderSales shopping cart software allows remote attackers to execute arbitrary SQL via the u (no CVSS)
- [CVE-2004-0349](https://cve.now/CVE-2004-0349.md): Directory traversal vulnerability in GWeb HTTP Server 0.6 allows remote attackers to view arbitrary files via a .. (no CVSS)
- [CVE-2004-0350](https://cve.now/CVE-2004-0350.md): SpiderSales shopping cart does not enforce a minimum length for the private key, which can make it easier for local users to obtain the priv (no CVSS)
- [CVE-2004-0351](https://cve.now/CVE-2004-0351.md): Spider Sales shopping cart stores the private key in the same database and table as the public key, which allows local users with access to (no CVSS)
- [CVE-2004-0352](https://cve.now/CVE-2004-0352.md): Cisco 11000 Series Content Services Switches (CSS) running WebNS 5.0(x) before 05.0(04.07)S, and 6.10(x) before 06.10(02.05)S allow remote a (no CVSS)
- [CVE-2004-0353](https://cve.now/CVE-2004-0353.md): Multiple buffer overflows in auth\_ident() function in auth.c for GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to (no CVSS)
- [CVE-2004-0354](https://cve.now/CVE-2004-0354.md): Multiple format string vulnerabilities in GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to execute arbitrary code (no CVSS)
- [CVE-2004-0355](https://cve.now/CVE-2004-0355.md): Invision Power Board 1.3 Final allows remote attackers to gain sensitive information by selecting a file for "Personal Photo" that is not an (no CVSS)
- [CVE-2004-0357](https://cve.now/CVE-2004-0357.md): Stack-based buffer overflows in SL Mail Pro 2.0.9 allow remote attackers to execute arbitrary code via (1) user.dll, (2) loadpageadmin.dll o (no CVSS)
- [CVE-2004-0358](https://cve.now/CVE-2004-0358.md): Cross-site scripting (XSS) vulnerability in VirtuaNews Admin Panel Pro 1.0.3 allows remote attackers to execute arbitrary script as other us (no CVSS)
- [CVE-2004-0359](https://cve.now/CVE-2004-0359.md): Cross-site scripting (XSS) vulnerability in index.php for Invision Power Board 1.3 final allows remote attackers to execute arbitrary script (no CVSS)
- [CVE-2004-0360](https://cve.now/CVE-2004-0360.md): Unknown vulnerability in passwd(1) in Solaris 8.0 and 9.0 allows local users to gain privileges via unknown attack vectors. (no CVSS)
- [CVE-2004-0361](https://cve.now/CVE-2004-0361.md): The Javascript engine in Safari 1.2 and earlier allows remote attackers to cause a denial of service (segmentation fault) by creating a new (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2004-03-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.