CVE-2004-2334

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in EMU Webmail 5.2.7 allow remote attackers to inject arbitrary web script or HTML via (1) a hex-encoded value to the variable parameter in emumail.fcgi, (2) the folder parameter in emumail.fcgi, or Javascript in the (3) username or (4) password field in the login page.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://members.lycos.co.uk/r34ct/main/emu/emu.txtExploit, Vendor Advisory
http://secunia.com/advisories/11110Vendor Advisory
http://securitytracker.com/id?1009397Exploit
http://www.osvdb.org/4204Exploit
http://www.osvdb.org/4972Exploit
http://www.securityfocus.com/bid/9861Exploit
http://www.zone-h.com/advisories/read/id=4141Exploit, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15451
https://exchange.xforce.ibmcloud.com/vulnerabilities/15452
http://members.lycos.co.uk/r34ct/main/emu/emu.txtExploit, Vendor Advisory
http://secunia.com/advisories/11110Vendor Advisory
http://securitytracker.com/id?1009397Exploit
http://www.osvdb.org/4204Exploit
http://www.osvdb.org/4972Exploit
http://www.securityfocus.com/bid/9861Exploit
http://www.zone-h.com/advisories/read/id=4141Exploit, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15451
https://exchange.xforce.ibmcloud.com/vulnerabilities/15452

Timeline

Published: Dec 31, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-23357.2The Macromedia installers and e-licensing client on Mac OS X, as used for Macromedia Contribute 2, Director, Dreamweaver, Fireworks, Flash, CVE-2004-23365.0Unknown vulnerability in Novell GroupWise and GroupWise WebAccess 6.0 through 6.5, when running with Apache Web Server 1.3 for NetWare where CVE-2004-23372.1The /.inlook/.crypt file for inlook 0.7.3 and earlier is installed with world readable permissions, which allows local users to obtain user CVE-2004-23387.5OpenBSD 3.3 and 3.4 does not properly parse Accept and Deny rules without netmasks on big-endian 64-bit platforms such as SPARC64, which may CVE-2004-23398.4Microsoft Windows 2000, XP, and possibly 2003 allows local users with the SeDebugPrivilege privilege to execute arbitrary code as kernel and CVE-2004-23407.5** UNVERIFIABLE ** SQL injection vulnerability in PunkBuster Screenshot Database (PB-DB) Alpha 6 allows remote attackers to execute arbitra CVE-2004-23417.5PHP file include injection vulnerability in isearch.inc.php for iSearch allows remote attackers to execute arbitrary code via the isearch_pa CVE-2004-23425.0ChatterBox 2.0 allows remote attackers to cause a denial of service (server crash) via a malformed request to the server, as demonstrated us CVE-2004-23437.2Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives s CVE-2004-23445.0Unknown vulnerability in the ASN.1/H.323/H.225 stack of VocalTec VGW120 and VGW480 allows remote attackers to cause a denial of service.CVE-2004-23456.5Unknown multiple vulnerabilities in Oracle9i Database Server 9.0.1.4, 9.0.1.5, 9.2.0.3, and 9.2.0.4 allow local users with the ability to in CVE-2004-23464.3Multiple cross-site scripting (XSS) vulnerabilities in Forum Web Server 1.6 and earlier allow remote attackers to inject arbitrary web scrip