# CVEs published 2005-02-20

156 CVEs were published on February 20, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2004-1545](https://cve.now/CVE-2004-1545.md): UploadFile.php in MoniWiki 1.0.9.2 and earlier, when used with Apache mod\_mime, does not properly handle files with two file extensions, suc (no CVSS)
- [CVE-2004-1546](https://cve.now/CVE-2004-1546.md): Multiple buffer overflows in MDaemon 6.5.1 allow remote attackers to cause a denial of service (application crash) via a long (1) SAML, SOML (no CVSS)
- [CVE-2004-1547](https://cve.now/CVE-2004-1547.md): The file server in ActivePost Standard 3.1 and earlier allows remote authenticated users to cause a denial of service (application crash) vi (no CVSS)
- [CVE-2004-1548](https://cve.now/CVE-2004-1548.md): Directory traversal vulnerability in the file server in ActivePost Standard 3.1 allows remote authenticated users to upload arbitrary files (no CVSS)
- [CVE-2004-1549](https://cve.now/CVE-2004-1549.md): The conference menu in ActivePost Standard 3.1 sends passwords of password-protected rooms in cleartext, which could allow remote attackers (no CVSS)
- [CVE-2004-1550](https://cve.now/CVE-2004-1550.md): Motorola Wireless Router WR850G running firmware 4.03 allows remote attackers to bypass authentication, log on as an administrator, and obta (no CVSS)
- [CVE-2004-1551](https://cve.now/CVE-2004-1551.md): Cross-site scripting (XSS) vulnerability in the (1) email or (2) file modules in paFileDB 3.1 Final allows remote attackers to execute arbit (no CVSS)
- [CVE-2004-1552](https://cve.now/CVE-2004-1552.md): SQL injection vulnerability in aspWebCalendar allows remote attackers to execute arbitrary SQL statements via (1) the username field on the (no CVSS)
- [CVE-2004-1553](https://cve.now/CVE-2004-1553.md): SQL injection vulnerability in aspWebAlbum allows remote attackers to execute arbitrary SQL statements via (1) the username field on the log (no CVSS)
- [CVE-2004-1554](https://cve.now/CVE-2004-1554.md): PHP remote file inclusion vulnerability in livre\_include.php in @lex Guestbook allows remote attackers to execute arbitrary PHP code by modi (no CVSS)
- [CVE-2004-1555](https://cve.now/CVE-2004-1555.md): Multiple SQL injection vulnerabilities in BroadBoard Instant ASP Message Board allow remote attackers to run arbitrary SQL commands via the (no CVSS)
- [CVE-2004-1556](https://cve.now/CVE-2004-1556.md): MyWebServer 1.0.3 allows remote attackers to cause a denial of service (application crash) via a large number of connections within a short (no CVSS)
- [CVE-2004-1557](https://cve.now/CVE-2004-1557.md): MyWebServer 1.0.3 allows remote attackers to bypass authentication, modify configuration, and read arbitrary files via a direct HTTP request (no CVSS)
- [CVE-2004-1558](https://cve.now/CVE-2004-1558.md): Multiple stack-based buffer overflows in YPOPs! (aka YahooPOPS) 0.4 through 0.6 allow remote attackers to cause a denial of service (crash) (no CVSS)
- [CVE-2004-1559](https://cve.now/CVE-2004-1559.md): Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the ( (no CVSS)
- [CVE-2004-1560](https://cve.now/CVE-2004-1560.md): Microsoft SQL Server 7.0 allows remote attackers to cause a denial of service (mssqlserver service halt) via a long request to TCP port 1433 (no CVSS)
- [CVE-2004-1561](https://cve.now/CVE-2004-1561.md): Buffer overflow in Icecast 2.0.1 and earlier allows remote attackers to execute arbitrary code via an HTTP request with a large number of he (no CVSS)
- [CVE-2004-1562](https://cve.now/CVE-2004-1562.md): SQL injection vulnerability in redir\_url.php in w-Agora 4.1.6a allows remote attackers to execute arbitrary SQL commands via the key paramet (no CVSS)
- [CVE-2004-1563](https://cve.now/CVE-2004-1563.md): Multiple cross-site scripting (XSS) vulnerabilities in w-Agora 4.1.6a allow remote attackers to execute arbitrary web script or HTML via the (no CVSS)
- [CVE-2004-1564](https://cve.now/CVE-2004-1564.md): CRLF injection vulnerability in subscribe\_thread.php in w-Agora 4.1.6a allows remote attackers to perform HTTP Response Splitting attacks to (no CVSS)
- [CVE-2004-1565](https://cve.now/CVE-2004-1565.md): list.php in w-Agora 4.1.6a allows remote attackers to reveal the full path via a crafted HTTP request, possibly involving a malformed id par (no CVSS)
- [CVE-2004-1566](https://cve.now/CVE-2004-1566.md): Cross-site scripting (XSS) vulnerability in index.php in Silent Storm Portal 2.1 and 2.2 allows remote attackers to execute arbitrary web sc (no CVSS)
- [CVE-2004-1567](https://cve.now/CVE-2004-1567.md): profile.php in Silent Storm Portal 2.1 and 2.2 allows remote attackers to gain privileges by setting the mail parameter to 1, which is the v (no CVSS)
- [CVE-2004-1568](https://cve.now/CVE-2004-1568.md): Directory traversal vulnerability in ParaChat Server 5.5 allows remote attackers to read arbitrary files via a ..%5C (hex-encoded dot dot) i (no CVSS)
- [CVE-2004-1569](https://cve.now/CVE-2004-1569.md): Buffer overflow in (1) MusicConverter.exe, (2) playlist.exe, and (3) amp.exe in dBpowerAMP Audio Player 2.0 and dbPowerAmp Music Converter 1 (no CVSS)
- [CVE-2004-1570](https://cve.now/CVE-2004-1570.md): SQL injection vulnerability in bBlog 0.7.2 and 0.7.3 allows remote attackers to execute arbitrary SQL commands via the p parameter. (no CVSS)
- [CVE-2004-1571](https://cve.now/CVE-2004-1571.md): AJ-Fork 167 allows remote attackers to gain sensitive information via a direct request to (1) auto-acronyms.php, (2) auto-archive.php, (3) o (no CVSS)
- [CVE-2004-1572](https://cve.now/CVE-2004-1572.md): AJ-Fork 167 does not restrict access to directories such as (1) data, (2) inc, (3) plugins, (4) skins, or (5) tools, which allows remote att (no CVSS)
- [CVE-2004-1573](https://cve.now/CVE-2004-1573.md): The documentation for AJ-Fork 167 implies that users should set permissions for users.db.php to 777, which allows local users to execute arb (no CVSS)
- [CVE-2004-1574](https://cve.now/CVE-2004-1574.md): Buffer overflow in Vypress Messenger 3.5.1 and earlier allows remote attackers to execute arbitrary code via a message with a long first fie (no CVSS)
- [CVE-2004-1575](https://cve.now/CVE-2004-1575.md): The XML parser in Xerces-C++ 2.5.0 allows remote attackers to cause a denial of service (CPU consumption) via XML attributes in a crafted XM (no CVSS)
- [CVE-2004-1576](https://cve.now/CVE-2004-1576.md): Format string vulnerability in Judge Dredd: Dredd vs. (no CVSS)
- [CVE-2004-1577](https://cve.now/CVE-2004-1577.md): index.php in PHP Links allows remote attackers to gain sensitive information via an invalid show parameter, which reveals the full path in a (no CVSS)
- [CVE-2004-1578](https://cve.now/CVE-2004-1578.md): Cross-site scripting (XSS) vulnerability in index.php in Invision Power Board 2.0.0 allows remote attackers to execute arbitrary web script (no CVSS)
- [CVE-2004-1579](https://cve.now/CVE-2004-1579.md): index.php in CubeCart 2.0.1 allows remote attackers to gain sensitive information via an HTTP request with an invalid cat\_id parameter, whic (no CVSS)
- [CVE-2004-1580](https://cve.now/CVE-2004-1580.md): SQL injection vulnerability in index.php in CubeCart 2.0.1 allows remote attackers to execute arbitrary SQL commands via the cat\_id paramete (no CVSS)
- [CVE-2004-1581](https://cve.now/CVE-2004-1581.md): BlackBoard 1.5.1 allows remote attackers to gain sensitive information via a direct request to (1) checkdb.inc.php, (2) admin.inc.php or (3) (no CVSS)
- [CVE-2004-1582](https://cve.now/CVE-2004-1582.md): PHP remote file inclusion vulnerability in BlackBoard 1.5.1 allows remote attackers to execute arbitrary PHP code by modifying the libpath p (no CVSS)
- [CVE-2004-1583](https://cve.now/CVE-2004-1583.md): Directory traversal vulnerability in the FTP server in TriDComm 1.3 and earlier allows remote attackers to read or write arbitrary files via (no CVSS)
- [CVE-2004-1584](https://cve.now/CVE-2004-1584.md): CRLF injection vulnerability in wp-login.php in WordPress 1.2 allows remote attackers to perform HTTP Response Splitting attacks to modify e (no CVSS)
- [CVE-2004-1585](https://cve.now/CVE-2004-1585.md): Flash Messaging 5.2.0g (rev 1.1.2) and earlier allows remote attackers to cause a denial of service (application crash) via certain wide cha (no CVSS)
- [CVE-2004-1586](https://cve.now/CVE-2004-1586.md): Flash Messaging clients can ignore disconnecting commands such as "shutdown" from the Flash Messaging Server 5.2.0g (rev 1.1.2), which could (no CVSS)
- [CVE-2004-1587](https://cve.now/CVE-2004-1587.md): Buffer overflow in Monolith games including (1) Alien versus Predator 2 1.0.9.6 and earlier, (2) Blood 2 2.1 and earlier, (3) No one lives f (no CVSS)
- [CVE-2004-1588](https://cve.now/CVE-2004-1588.md): SQL injection vulnerability in GoSmart Message Board allows remote attackers to execute arbitrary SQL code via the (1) QuestionNumber and Ca (no CVSS)
- [CVE-2004-1589](https://cve.now/CVE-2004-1589.md): Cross-site scripting (XSS) vulnerability in GoSmart Message Board allows remote attackers to execute inject web script or HTML via the (1) C (no CVSS)
- [CVE-2004-1590](https://cve.now/CVE-2004-1590.md): Clientexec allows remote attackers to gain sensitive information via an HTTP request to phpinfo.php, which calls the phpinfo function. (no CVSS)
- [CVE-2004-1591](https://cve.now/CVE-2004-1591.md): The web interface for Micronet Wireless Broadband Router SP916BM running firmware before 1.9 08/04/2004 resets the password to the default p (no CVSS)
- [CVE-2004-1592](https://cve.now/CVE-2004-1592.md): PHP remote file inclusion vulnerability in index.php in ocPortal 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code by (no CVSS)
- [CVE-2004-1593](https://cve.now/CVE-2004-1593.md): Cross-site scripting (XSS) vulnerability in render.UserLayoutRootNode.uP in SCT Campus Pipeline allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2004-1594](https://cve.now/CVE-2004-1594.md): Cross-site scripting (XSS) vulnerability in FuseTalk 4.0 allows remote attackers to execute arbitrary web script via an img src tag. (no CVSS)
- [CVE-2004-1595](https://cve.now/CVE-2004-1595.md): Buffer overflow in ShixxNote 6.net build 117 allows remote attackers to execute arbitrary code via a long font field. (no CVSS)
- [CVE-2004-1596](https://cve.now/CVE-2004-1596.md): The 3COM Wireless router 3CRADSL72 running Boot Code 1.3d allows remote attackers to gain sensitive information such as passwords and router (no CVSS)
- [CVE-2004-1597](https://cve.now/CVE-2004-1597.md): RIM Blackberry 7230 running RIM Blackberry OS 3.7 SP1 allows remote attackers to cause a denial of service (device reboot and possibly data (no CVSS)
- [CVE-2004-1598](https://cve.now/CVE-2004-1598.md): Adobe Acrobat and Acrobat Reader 6.0 allow remote attackers to read arbitrary files via a PDF file that contains an embedded Shockwave (swf) (no CVSS)
- [CVE-2004-1599](https://cve.now/CVE-2004-1599.md): Cross-site scripting (XSS) vulnerability in index.php in CoolPHP 1.0-stable allows remote attackers to execute arbitrary web script or HTML (no CVSS)
- [CVE-2004-1600](https://cve.now/CVE-2004-1600.md): index.php in CoolPHP 1.0-stable allows remote attackers to gain sensitive information via an invalid op parameter, which reveals the path in (no CVSS)
- [CVE-2004-1601](https://cve.now/CVE-2004-1601.md): Directory traversal vulnerability in index.php in CoolPHP 1.0-stable allows remote attackers to access arbitrary files and execute local PHP (no CVSS)
- [CVE-2004-1602](https://cve.now/CVE-2004-1602.md): ProFTPD 1.2.x, including 1.2.8 and 1.2.10, responds in a different amount of time when a given username exists, which allows remote attacker (no CVSS)
- [CVE-2004-1603](https://cve.now/CVE-2004-1603.md): cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitra (no CVSS)
- [CVE-2004-1604](https://cve.now/CVE-2004-1604.md): cPanel 9.9.1-RELEASE-3 allows remote authenticated users to chmod arbitrary files via a symlink attack on the \_private directory, which is c (no CVSS)
- [CVE-2004-1605](https://cve.now/CVE-2004-1605.md): SalesLogix 6.1 allows remote attackers to bypass authentication by modifying the slxweb cookie to set user=Admin, teams=ADMIN!, and usertype (no CVSS)
- [CVE-2004-1606](https://cve.now/CVE-2004-1606.md): slxweb.dll in SalesLogix 6.1 allows remote attackers to cause a denial service (application crash) via an invalid HTTP request, which might (no CVSS)
- [CVE-2004-1607](https://cve.now/CVE-2004-1607.md): slxweb.dll in SalesLogix 6.1 allows remote attackers to obtain sensitive information via a (1) Library or (2) Attachment request with an inv (no CVSS)
- [CVE-2004-1608](https://cve.now/CVE-2004-1608.md): SQL injection vulnerability in SalesLogix 6.1 allows remote attackers to execute arbitrary SQL statements via the id parameter in a view ope (no CVSS)
- [CVE-2004-1609](https://cve.now/CVE-2004-1609.md): SalesLogix 6.1 includes usernames, passwords, and other sensitive information in the headers of an HTTP response, which could allow remote a (no CVSS)
- [CVE-2004-1610](https://cve.now/CVE-2004-1610.md): SalesLogix 6.1 uses client-specified pathnames for writing certain files, which might allow remote authenticated users to create arbitrary f (no CVSS)
- [CVE-2004-1611](https://cve.now/CVE-2004-1611.md): SalesLogix 6.1 does not verify if a user is authenticated before performing sensitive operations, which could allow remote attackers to (1) (no CVSS)
- [CVE-2004-1612](https://cve.now/CVE-2004-1612.md): Directory traversal vulnerability in SalesLogix 6.1 allows remote attackers to upload arbitrary files via a .. (no CVSS)
- [CVE-2004-1613](https://cve.now/CVE-2004-1613.md): Mozilla allows remote attackers to cause a denial of service (application crash from null dereference or infinite loop) via a web page that (no CVSS)
- [CVE-2004-1614](https://cve.now/CVE-2004-1614.md): Mozilla allows remote attackers to cause a denial of service (application crash from invalid memory access) via an "unusual combination of v (no CVSS)
- [CVE-2004-1615](https://cve.now/CVE-2004-1615.md): Opera allows remote attackers to cause a denial of service (invalid memory reference and application crash) via a web page or HTML email tha (no CVSS)
- [CVE-2004-1616](https://cve.now/CVE-2004-1616.md): Links allows remote attackers to cause a denial of service (memory consumption) via a web page or HTML email that contains a table with a td (no CVSS)
- [CVE-2004-1617](https://cve.now/CVE-2004-1617.md): Lynx, lynx-ssl, and lynx-cur before 2.8.6dev.8 allow remote attackers to cause a denial of service (infinite loop) via a web page or HTML em (no CVSS)
- [CVE-2004-1618](https://cve.now/CVE-2004-1618.md): Vypress Tonecast 1.3 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed mp2 stream. (no CVSS)
- [CVE-2004-1619](https://cve.now/CVE-2004-1619.md): Buffer overflow in Privateer's Bounty: Age of Sail II allows remote attackers to execute arbitrary code via a long nickname. (no CVSS)
- [CVE-2004-1620](https://cve.now/CVE-2004-1620.md): CRLF injection vulnerability in Serendipity before 0.7rc1 allows remote attackers to perform HTTP Response Splitting attacks to modify expec (no CVSS)
- [CVE-2004-1621](https://cve.now/CVE-2004-1621.md): NOTE: this issue has been disputed by the vendor. (no CVSS)
- [CVE-2004-1622](https://cve.now/CVE-2004-1622.md): SQL injection vulnerability in dosearch.php in UBB.threads 3.4.x allows remote attackers to execute arbitrary SQL statements via the Name pa (no CVSS)
- [CVE-2004-1623](https://cve.now/CVE-2004-1623.md): The WAV file property handler in Windows XP SP1 allows remote attackers to cause a denial of service (infinite loop in Explorer) via a WAV f (no CVSS)
- [CVE-2004-1624](https://cve.now/CVE-2004-1624.md): Carbon Copy 6.0.5257 does not drop system privileges when opening external programs through the help topic interface, which allows local use (no CVSS)
- [CVE-2004-1625](https://cve.now/CVE-2004-1625.md): pGina 1.7.6 and possibly older versions, when the Restart or Shutdown options are enabled on the login screen, allows remote attackers to ca (no CVSS)
- [CVE-2004-1626](https://cve.now/CVE-2004-1626.md): Buffer overflow in Ability Server 2.34, and possibly other versions, allows remote attackers to execute arbitrary code via a long STOR comma (no CVSS)
- [CVE-2004-1627](https://cve.now/CVE-2004-1627.md): Buffer overflow in Ability Server 2.25, 2.32, 2.34, and possibly other versions, allows remote attackers to execute arbitrary code via a lon (no CVSS)
- [CVE-2004-1628](https://cve.now/CVE-2004-1628.md): Format string vulnerability in log.c in rssh before 2.2.2 allows remote authenticated users to execute arbitrary code. (no CVSS)
- [CVE-2004-1629](https://cve.now/CVE-2004-1629.md): Multiple SQL injection vulnerabilities in Dwc\_articles 1.6 and earlier allow remote attackers to execute arbitrary SQL statements. (no CVSS)
- [CVE-2004-1630](https://cve.now/CVE-2004-1630.md): Cross-site scripting (XSS) vulnerability in the login form in Open WorkFlow Engine (OpenWFE) 1.4.x allows remote attackers to execute arbitr (no CVSS)
- [CVE-2004-1631](https://cve.now/CVE-2004-1631.md): Open WorkFlow Engine (OpenWFE) 1.4.x allows remote attackers to conduct port scans of remote hosts by specifying the target in an rmi:// Wor (no CVSS)
- [CVE-2004-1632](https://cve.now/CVE-2004-1632.md): Cross-site scripting (XSS) vulnerability in wiki.php in MoniWiki 1.0.8 and earlier allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2004-1633](https://cve.now/CVE-2004-1633.md): process\_bug.cgi in Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS does not check edit permissions on the keywords field, which allows remote (no CVSS)
- [CVE-2004-1634](https://cve.now/CVE-2004-1634.md): show\_bug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows com (no CVSS)
- [CVE-2004-1635](https://cve.now/CVE-2004-1635.md): Bugzilla 2.17.1 through 2.18rc2 and 2.19 from cvs, when using the insidergroup feature, does not sufficiently protect private attachments wh (no CVSS)
- [CVE-2004-1636](https://cve.now/CVE-2004-1636.md): Heap-based buffer overflow in the WvTFTPServer::new\_connection function in wvtftpserver.cc for WvTftp 0.9 allows remote attackers to execute (no CVSS)
- [CVE-2004-1637](https://cve.now/CVE-2004-1637.md): The Hawking Technologies HAR11A modem/router allows remote attackers to obtain sensitive information by connecting to port 254, which displa (no CVSS)
- [CVE-2004-1638](https://cve.now/CVE-2004-1638.md): Buffer overflow in MailCarrier 2.51 allows remote attackers to execute arbitrary code via a long (1) EHLO and possibly (2) HELO command. (no CVSS)
- [CVE-2004-1639](https://cve.now/CVE-2004-1639.md): Mozilla Firefox before 0.10, Mozilla 5.0, and Gecko 20040913 allows remote attackers to cause a denial of service (application crash or memo (no CVSS)
- [CVE-2004-1640](https://cve.now/CVE-2004-1640.md): Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 0.94 and 1.0 allow remote attackers to execute arbitrary web script and HTML vi (no CVSS)
- [CVE-2004-1641](https://cve.now/CVE-2004-1641.md): Heap-based buffer overflow in Titan FTP 3.21 and earlier allows remote attackers to cause a denial of service (crash) via a long FTP command (no CVSS)
- [CVE-2004-1642](https://cve.now/CVE-2004-1642.md): WFTPD Pro Server 3.21 allows remote authenticated users to cause a denial of service (crash) via a series of long MLIST commands. (no CVSS)
- [CVE-2004-1643](https://cve.now/CVE-2004-1643.md): WS\_FTP 5.0.2 allows remote authenticated users to cause a denial of service (CPU consumption) via a CD command that contains an invalid path (no CVSS)
- [CVE-2004-1644](https://cve.now/CVE-2004-1644.md): Xedus 1.0 allows remote attackers to cause a denial of service (refuse connections) by connecting multiple times from the same IP address. (no CVSS)
- [CVE-2004-1645](https://cve.now/CVE-2004-1645.md): Cross-site scripting (XSS) vulnerability in Xedus 1.0 allows remote attackers to execute arbitrary web script or HTML via the (1) username p (no CVSS)
- [CVE-2004-1646](https://cve.now/CVE-2004-1646.md): Directory traversal vulnerability in Xedus 1.0 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2004-1647](https://cve.now/CVE-2004-1647.md): SQL injection vulnerability in Password Protect allows remote attackers to execute arbitrary SQL statements and bypass authentication via (1 (no CVSS)
- [CVE-2004-1648](https://cve.now/CVE-2004-1648.md): Cross-site scripting (XSS) vulnerability in (1) index.asp, (2) ChangePassword.asp, (3) users\_list.asp, (4) and users\_add.asp in Password Pro (no CVSS)
- [CVE-2004-1649](https://cve.now/CVE-2004-1649.md): Buffer overflow in Microsoft Msinfo32.exe might allow local users to execute arbitrary code via a long filename in the msinfo\_file command l (no CVSS)
- [CVE-2004-1650](https://cve.now/CVE-2004-1650.md): D-Link DCS-900 Internet Camera listens on UDP port 62976 for an IP address, which allows remote attackers to change the IP address of the ca (no CVSS)
- [CVE-2004-1651](https://cve.now/CVE-2004-1651.md): Multiple cross-site scripting (XSS) vulnerabilities in the registration page in phpScheduleIt 1.0.0 RC1 allow remote attackers to inject arb (no CVSS)
- [CVE-2004-1652](https://cve.now/CVE-2004-1652.md): phpScheduleIt 1.0.0 RC1 does not clear administrative privileges if the administrator logs in as a normal user, which allows users with phys (no CVSS)
- [CVE-2004-1653](https://cve.now/CVE-2004-1653.md): The default configuration for OpenSSH enables AllowTcpForwarding, which could allow remote authenticated users to perform a port bounce, whe (no CVSS)
- [CVE-2004-1654](https://cve.now/CVE-2004-1654.md): SQL injection vulnerability in the calendar module in phpWebsite 0.9.3-4 and earlier allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2004-1655](https://cve.now/CVE-2004-1655.md): Cross-site scripting (XSS) vulnerability in phpWebsite 0.9.3-4 and earlier allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2004-1656](https://cve.now/CVE-2004-1656.md): CRLF injection vulnerability in Comersus Shopping Cart 5.0991 allows remote attackers to perform HTTP Response Splitting attacks to modify e (no CVSS)
- [CVE-2004-1657](https://cve.now/CVE-2004-1657.md): Cross-site scripting (XSS) vulnerability in the Activity and Events Viewer for Newtelligence DasBlog allows remote attackers to inject arbit (no CVSS)
- [CVE-2004-1658](https://cve.now/CVE-2004-1658.md): Kerio Personal Firewall 4.0 (KPF4) allows local users with administrative privileges to bypass the Application Security feature and execute (no CVSS)
- [CVE-2004-1659](https://cve.now/CVE-2004-1659.md): Cross-site scripting (XSS) vulnerability in index.php in CuteNews 1.3.6 and earlier allows remote attackers with Administrator, Editor, Jour (no CVSS)
- [CVE-2004-1660](https://cve.now/CVE-2004-1660.md): PHP remote file inclusion vulnerability in CuteNews 1.3.6 and earlier allows remote attackers to execute arbitrary PHP code via the cutepath (no CVSS)
- [CVE-2004-1661](https://cve.now/CVE-2004-1661.md): MailWorks Professional allows remote attackers to bypass authentication and gain privileges via a cookie that contains "auth=1" and "uId=1." (no CVSS)
- [CVE-2004-1662](https://cve.now/CVE-2004-1662.md): YaBB SE 1.5.1 allows remote attackers to obtain sensitive information via a direct HTTP request to Admin.php, which reveals the full path in (no CVSS)
- [CVE-2004-1663](https://cve.now/CVE-2004-1663.md): Engenio/LSI Logic storage controllers, as used in products such as Storagetek D280, and IBM DS4100 (formerly FastT 100) and Brocade SilkWorm (no CVSS)
- [CVE-2004-1664](https://cve.now/CVE-2004-1664.md): Call of Duty 1.4 and earlier allows remote attackers to cause a denial of service (game end) via a large (1) query or (2) reply packet, whic (no CVSS)
- [CVE-2004-1665](https://cve.now/CVE-2004-1665.md): Cross-site scripting (XSS) vulnerability in index.php in PsNews 1.1 allows remote attackers to inject arbitrary web script or HTML via the n (no CVSS)
- [CVE-2004-1666](https://cve.now/CVE-2004-1666.md): Buffer overflow in the MSN module in Trillian 0.74i allows remote MSN servers to execute arbitrary code via a long string that ends in a new (no CVSS)
- [CVE-2004-1667](https://cve.now/CVE-2004-1667.md): Off-by-one error in Halo Combat Evolved 1.04 and earlier allows remote attackers to cause a denial of service (server crash) via a long clie (no CVSS)
- [CVE-2004-1668](https://cve.now/CVE-2004-1668.md): Multiple SQL injection vulnerabilities in index.php in Subjects 2.0 Postnuke module allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2004-1669](https://cve.now/CVE-2004-1669.md): Cross-site scripting (XSS) vulnerability in MERAK Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote at (no CVSS)
- [CVE-2004-1670](https://cve.now/CVE-2004-1670.md): Multiple directory traversal vulnerabilities Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7, and possibly other versions, allow remote (no CVSS)
- [CVE-2004-1671](https://cve.now/CVE-2004-1671.md): Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to gain sensitive information via a (no CVSS)
- [CVE-2004-1672](https://cve.now/CVE-2004-1672.md): attachment.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to view other use (no CVSS)
- [CVE-2004-1673](https://cve.now/CVE-2004-1673.md): accountsettings\_add.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allow remote attackers to create (no CVSS)
- [CVE-2004-1674](https://cve.now/CVE-2004-1674.md): viewaction.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows remote attackers to (1) delete arb (no CVSS)
- [CVE-2004-1675](https://cve.now/CVE-2004-1675.md): Serv-U FTP server 4.x and 5.x allows remote attackers to cause a denial of service (application crash) via a STORE UNIQUE (STOU) command wit (no CVSS)
- [CVE-2004-1676](https://cve.now/CVE-2004-1676.md): Heap-based buffer overflow in the image sending feature in Gadu-Gadu 6.0 build 149 allows remote attackers to execute arbitrary code via a c (no CVSS)
- [CVE-2004-1677](https://cve.now/CVE-2004-1677.md): pdesk.cgi in PerlDesk allows remote attackers to gain sensitive information via an invalid lang parameter, which includes pathname informati (no CVSS)
- [CVE-2004-1678](https://cve.now/CVE-2004-1678.md): Directory traversal vulnerability in pdesk.cgi in PerlDesk allows remote attackers to read portions of arbitrary files and possibly execute (no CVSS)
- [CVE-2004-1679](https://cve.now/CVE-2004-1679.md): Directory traversal vulnerability in TwinFTP 1.0.3 R2 allows remote attackers to create arbitrary files via a .../ (triple dot) in the (1) C (no CVSS)
- [CVE-2004-1680](https://cve.now/CVE-2004-1680.md): application.cgi in the Pingtel Xpressa handset running firmware 2.1.11.24 allows remote authenticated users to cause a denial of service (Vx (no CVSS)
- [CVE-2004-1681](https://cve.now/CVE-2004-1681.md): Multiple buffer overflows in (1) phrelay-cfg, (2) phlocale, (3) pkg-installer, or (4) input-cfg in QNX Photon microGUI for QNX RTP 6.1 allow (no CVSS)
- [CVE-2004-1682](https://cve.now/CVE-2004-1682.md): Format string vulnerability in QNX 6.1 FTP client allows remote authenticated users to gain group bin privileges via format string specifier (no CVSS)
- [CVE-2004-1683](https://cve.now/CVE-2004-1683.md): A race condition in crrtrap for QNX RTP 6.1 allows local users to gain privileges by modifying the PATH environment variable to reference a (no CVSS)
- [CVE-2004-1684](https://cve.now/CVE-2004-1684.md): Zyxel P681 running ZyNOS Vt020225a contains portions of memory in an ARP request, which allows remote attackers to obtain sensitive informat (no CVSS)
- [CVE-2004-1685](https://cve.now/CVE-2004-1685.md): SMC routers SMC7004VWBR running firmware 1.00.014 and SMC7008ABR EU running firmware 1.42.003 allow remote attackers to bypass authenticatio (no CVSS)
- [CVE-2004-1686](https://cve.now/CVE-2004-1686.md): Internet Explorer 6.0 in Windows XP SP2 allows remote attackers to bypass the Information Bar prompt for ActiveX and Javascript via an XHTML (no CVSS)
- [CVE-2004-1687](https://cve.now/CVE-2004-1687.md): CRLF injection vulnerability in down.asp for Snitz Forums 2000 3.4.04 allows remote attackers to perform HTTP Response Splitting attacks to (no CVSS)
- [CVE-2004-1688](https://cve.now/CVE-2004-1688.md): Pigeon Server 3.02.0143 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a long logi (no CVSS)
- [CVE-2004-1689](https://cve.now/CVE-2004-1689.md): sudoedit (aka sudo -e) in sudo 1.6.8 opens a temporary file with root privileges, which allows local users to read arbitrary files via a sym (no CVSS)
- [CVE-2004-1690](https://cve.now/CVE-2004-1690.md): Cross-site scripting (XSS) vulnerability in the Web Server in DNS4Me 3.0.0.4 allows remote attackers to execute arbitrary web script or HTML (no CVSS)
- [CVE-2004-1691](https://cve.now/CVE-2004-1691.md): The Web Server in DNS4Me 3.0.0.4 allows remote attackers to cause a denial of service (CPU consumption and crash) via a large amount of data (no CVSS)
- [CVE-2004-1692](https://cve.now/CVE-2004-1692.md): Cross-site scripting (XSS) vulnerability in index.php in Mambo 4.5 (1.0.9) allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2004-1693](https://cve.now/CVE-2004-1693.md): PHP remote file inclusion vulnerability in Function.php in Mambo 4.5 (1.0.9) allows remote attackers to execute arbitrary PHP code by modify (no CVSS)
- [CVE-2004-1694](https://cve.now/CVE-2004-1694.md): Symantec ON Command CCM 5.4.x and iCommand 3.0.x has four default usernames and passwords, one of which is hardcoded, which allows remote at (no CVSS)
- [CVE-2004-1695](https://cve.now/CVE-2004-1695.md): EmuLive Server4 Commerce Edition Build 7560 allows remote attackers to bypass authentication for the remote administration feature via a URL (no CVSS)
- [CVE-2004-1696](https://cve.now/CVE-2004-1696.md): EmuLive Server4 Commerce Edition Build 7560 allows remote attackers to cause a denial of service (application crash) via a sequence of carri (no CVSS)
- [CVE-2004-1697](https://cve.now/CVE-2004-1697.md): The "Forgot your Password" link in Computer Associates (CA) Unicenter Management Portal 2.0 and 3.1 displays different error messages for us (no CVSS)
- [CVE-2004-1698](https://cve.now/CVE-2004-1698.md): The Base64 function in PopMessenger 1.60 (before 20 Sep 2004) and earlier allows remote attackers to cause a denial of service (application (no CVSS)
- [CVE-2004-1699](https://cve.now/CVE-2004-1699.md): SettingsBase.php in Pinnacle ShowCenter 1.51 allows remote attackers to cause a denial of service (web interface errors) via an invalid Skin (no CVSS)
- [CVE-2004-1700](https://cve.now/CVE-2004-1700.md): Cross-site scripting (XSS) vulnerability in SettingsBase.php in Pinnacle ShowCenter 1.51 build 121 allows remote attackers to inject arbitra (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-02-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.