CVE-2004-2548

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to inject arbitrary web script or HTML via (a) a URI containing the script, or (b) the username field in the login form. NOTE: it is possible that the first attack vector is resultant from the error message issue (CVE-2004-2547).

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0056.htmlExploit, Patch
http://secunia.com/advisories/11772Patch, Vendor Advisory
http://www.exploitlabs.com/files/advisories/EXPL-A-2004-002-surgmail.txtExploit
http://www.netwinsite.com/surgemail/help/updates.htm
http://www.osvdb.org/6746Exploit
http://www.securityfocus.com/bid/10483Exploit, Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/16320
http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0056.htmlExploit, Patch
http://secunia.com/advisories/11772Patch, Vendor Advisory
http://www.exploitlabs.com/files/advisories/EXPL-A-2004-002-surgmail.txtExploit
http://www.netwinsite.com/surgemail/help/updates.htm
http://www.osvdb.org/6746Exploit
http://www.securityfocus.com/bid/10483Exploit, Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/16320

Timeline

Published: Dec 31, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-25495.0Nortel Wireless LAN (WLAN) Access Point (AP) 2220, 2221, and 2225 allow remote attackers to cause a denial of service (service crash) via a CVE-2004-25504.3Multiple cross-site scripting (XSS) vulnerabilities in unspecified Perl scripts in SandSurfer before 1.7.1 allow remote attackers to inject CVE-2004-25517.5Multiple SQL injection vulnerabilities in Layton HelpBox 3.0.1 allow remote attackers to execute arbitrary SQL commands via (1) the sys_comm CVE-2004-25524.6Buffer overflow in XBoard 4.2.7 and earlier might allow local users to execute arbitrary code via a long -icshost command line argument. NOT CVE-2004-25536.0The Ignition Project ignitionServer 0.1.2 through 0.1.2-R2 allows remote authenticated users with local IRC operator privileges to obtain gl CVE-2004-25547.2Novell Client Firewall (NCF) 2.0, as based on the Agnitum Outpost Firewall, allows local users to execute arbitrary code with SYSTEM privile CVE-2004-25552.1Riverdeep FoolProof Security 3.9.x on Windows 98 and Windows ME uses weak cryptography (arithmetic and XOR operations) to relate the Control CVE-2004-25565.0NetGear WG602 (aka WG602v1) Wireless Access Point firmware 1.04.0 and 1.5.67 has a hardcoded account of username "super" and password "57773 CVE-2004-25575.0NetGear WG602 (aka WG602v1) Wireless Access Point 1.7.14 has a hardcoded account of username "superman" and password "21241036", which allow CVE-2004-25587.5Unspecified vulnerability in IBM Tivoli SecureWay Policy Director 3.8, Access Manager for e-business 3.9 to 5.1, Access Manager Identity Man CVE-2004-25597.5DokuWiki before 2004-10-19 allows remote attackers to access administrative functionality including (1) Mediaselectiondialog, (2) Recent cha CVE-2004-25607.5DokuWiki before 2004-10-19, when used on a web server that permits execution based on file extension, allows remote attackers to execute arb