CVE-2004-1679

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in TwinFTP 1.0.3 R2 allows remote attackers to create arbitrary files via a .../ (triple dot) in the (1) CWD, (2) STOR, or (3) RETR commands.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=109509243831121&w=2
http://secunia.com/advisories/12511/Vendor Advisory
http://www.security.org.sg/vuln/twinftp103r2.htmlVendor Advisory
http://www.securityfocus.com/bid/11159Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17323
http://marc.info/?l=bugtraq&m=109509243831121&w=2
http://secunia.com/advisories/12511/Vendor Advisory
http://www.security.org.sg/vuln/twinftp103r2.htmlVendor Advisory
http://www.securityfocus.com/bid/11159Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17323

Timeline

Published: Aug 4, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-16805.0application.cgi in the Pingtel Xpressa handset running firmware 2.1.11.24 allows remote authenticated users to cause a denial of service (Vx CVE-2004-16817.2Multiple buffer overflows in (1) phrelay-cfg, (2) phlocale, (3) pkg-installer, or (4) input-cfg in QNX Photon microGUI for QNX RTP 6.1 allow CVE-2004-168210.0Format string vulnerability in QNX 6.1 FTP client allows remote authenticated users to gain group bin privileges via format string specifier CVE-2004-16833.7A race condition in crrtrap for QNX RTP 6.1 allows local users to gain privileges by modifying the PATH environment variable to reference a CVE-2004-16845.0Zyxel P681 running ZyNOS Vt020225a contains portions of memory in an ARP request, which allows remote attackers to obtain sensitive informat CVE-2004-16857.5SMC routers SMC7004VWBR running firmware 1.00.014 and SMC7008ABR EU running firmware 1.42.003 allow remote attackers to bypass authenticatio CVE-2004-16865.0Internet Explorer 6.0 in Windows XP SP2 allows remote attackers to bypass the Information Bar prompt for ActiveX and Javascript via an XHTML CVE-2004-16875.0CRLF injection vulnerability in down.asp for Snitz Forums 2000 3.4.04 allows remote attackers to perform HTTP Response Splitting attacks to CVE-2004-16885.0Pigeon Server 3.02.0143 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a long logi CVE-2004-16892.1sudoedit (aka sudo -e) in sudo 1.6.8 opens a temporary file with root privileges, which allows local users to read arbitrary files via a sym CVE-2004-16904.3Cross-site scripting (XSS) vulnerability in the Web Server in DNS4Me 3.0.0.4 allows remote attackers to execute arbitrary web script or HTML CVE-2004-16915.0The Web Server in DNS4Me 3.0.0.4 allows remote attackers to cause a denial of service (CPU consumption and crash) via a large amount of data