CVE-2004-0340

HighCVSS 7.2/10Last modified Jun 16, 2026

Description

Stack-based buffer overflow in WFTPD Pro Server 3.21 Release 1, Pro Server 3.20 Release 2, Server 3.21 Release 1, and Server 3.10 allows local users to execute arbitrary code via long (1) LIST, (2) NLST, or (3) STAT commands.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=107801208004699&w=2
http://secunia.com/advisories/11001
http://www.securityfocus.com/bid/9767Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15340
http://marc.info/?l=bugtraq&m=107801208004699&w=2
http://secunia.com/advisories/11001
http://www.securityfocus.com/bid/9767Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15340

Timeline

Published: Nov 23, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-03412.1WFTPD Pro Server 3.21 Release 1 allocates memory for a command until a 0Ah byte (newline) is sent, which allows local users to cause a denia CVE-2004-03425.5WFTPD Pro Server 3.21 Release 1, with the XeroxDocutech option enabled, allows local users to cause a denial of service (crash) via a (1) MK CVE-2004-034310.0Multiple SQL injection vulnerabilities in YaBB SE 1.5.4 through 1.5.5b allow remote attackers to execute arbitrary SQL via (1) the msg param CVE-2004-03446.4Directory traversal vulnerability in ModifyMessage.php in YaBB SE 1.5.4 through 1.5.5b allows remote attackers to delete arbitrary files via CVE-2004-034510.0Buffer overflow in Red Faction client 1.20 and earlier allows remote servers to execute arbitrary code via a long server name.CVE-2004-03467.8Off-by-one buffer overflow in _xlate_ascii_write() in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte CVE-2004-03476.0Cross-site scripting (XSS) vulnerability in delhomepage.cgi in NetScreen-SA 5000 Series running firmware 3.3 Patch 1 (build 4797) allows rem CVE-2004-034810.0SQL injection vulnerability in viewCart.asp in SpiderSales shopping cart software allows remote attackers to execute arbitrary SQL via the u CVE-2004-03495.0Directory traversal vulnerability in GWeb HTTP Server 0.6 allows remote attackers to view arbitrary files via a .. (dot dot) in the URL.CVE-2004-03502.1SpiderSales shopping cart does not enforce a minimum length for the private key, which can make it easier for local users to obtain the priv CVE-2004-03512.1Spider Sales shopping cart stores the private key in the same database and table as the public key, which allows local users with access to CVE-2004-03525.0Cisco 11000 Series Content Services Switches (CSS) running WebNS 5.0(x) before 05.0(04.07)S, and 6.10(x) before 06.10(02.05)S allow remote a