CVE-2004-2161

The CVE-2004-2161 issue affects TUTOS 1.1, where an SQL injection vulnerability exists in file_overview.php via the link_id parameter. This vulnerability allows a remote attacker to execute arbitrary SQL commands, enabling potential data disclosure or manipulation. Public advisories in the connec...

CVE-2004-2206

CVE-2004-2206 describes a SQL injection vulnerability in NatterChat 1.12 that allows remote attackers to execute arbitrary SQL commands via unknown vectors. The entry notes a CVSS v2 base score of 7.5 ( HIGH ) with network attack vector, low complexity, no authentication, and partial impacts to c...

CVE-2004-2198

The CVE-2004-2198 entry relates to DUware DUclassmate 1.0–1.1, where an attacker can remotely change arbitrary user passwords by tampering with the MM_recordId parameter on the My Account page. The connected data also note related issues in DUware products (e.g., DUclassmate, DUclassified, DUforu...

CVE-2004-2178

SQL injection vulnerability in DevoyBB Web Forum 1.0.0 allows remote attackers to execute arbitrary SQL commands via unknown vectors...

CVE-2004-2165

CVE-2004-2165 affects Lords of the Realm III (versions

CVE-2004-2195

Zanfi CMS Lite 1.1 is affected by a PHP remote file inclusion in index.php via the inc parameter, leading to arbitrary PHP code execution. The issue is a file inclusion vulnerability in Zanfi CMS Lite’s index.php that allows an attacker to have the remote script include and run attacker-controlle...

CVE-2004-2208

IdealBB (Ideal Science) web bulletin board versions 1.4.9–1.5.3 are affected by a CRLF injection vulnerability that enables HTTP response splitting. The CVE-2004-2208 entries across NVD, Red Hat, CVE listing, and OpenVAS describe this as a remote issue with unknown vectors, impacting integrity (I...

CVE-2004-2174

CVE-2004-2174 describes a cross-site scripting (XSS) vulnerability in Custva.asp within EarlyImpact ProductCart, where remote attackers can inject arbitrary JavaScript via the redirectUrl parameter. The NVD entry lists the affected product as EarlyImpact ProductCart and cites a MEDIUM severity (C...

CVE-2004-2188

CVE-2004-2188 is an XSS vulnerability in DMXReady Site Chassis Manager. The available sources (NVD/Red Hat/CVE listing) confirm remote attackers can inject arbitrary web script or HTML via unknown vectors. The exact vulnerable component/file, affected versions, and root cause are not explicitly e...

CVE-2004-2204

Macromedia ColdFusion MX 6.0 and 6.1 application server, when running with the CreateObject function or CFOBJECT tag enabled, allows local users to conduct unauthorized activities and obtain administrative passwords by creating CFML scripts that use CreateObject or CFOBJECT...

CVE-2004-2198

account.asp in DUware DUclassmate 1.0 through 1.1 allows remote attackers to change the passwords for arbitrary users by modifying the MMrecordId parameter on the "My Account" page...

CVE-2004-2168

BaSoMail 1.24 is affected by CVE-2004-2168: remote attackers can cause a denial of service by opening multiple connections to TCP port 25 (SMTP) or 110 (POP3), leading to CPU consumption. The available sources confirm the vulnerability details and affected product/version, with no exploitation sp...

CVE-2004-2196

Affected product: Zanfi CMS lite 1.1. The vulnerability is a path disclosure issue where remote attackers can obtain the full path of the web server by directly requesting pages (1) adm_pages.php, (2) corr_pages.php, (3) del_block.php, (4) del_page.php, (5) footer.php, (6) home.php, and others. R...

CVE-2004-2202

CVE-2004-2202 affects DUware DUclassified 4.0–4.2. The vulnerability arises from SQL injection in adDetail.asp via (1) cat_id or (2) sub_id parameters, and in the login form via the password parameter, enabling remote attackers to bypass authentication and execute commands on the server’s underly...

CVE-2004-2199

CVE-2004-2199 is a cross-site scripting (XSS) vulnerability in DUware DUclassified 4.0. The issue arises from how the application handles messages, allowing an attacker to inject arbitrary web script or HTML via the message text. The vulnerability is remote and could enable script execution in th...

CVE-2004-2185

Multiple cross-site scripting XSS vulnerabilities in MediaWiki 1.3.5 allow remote attackers to execute arbitrary scripts and/or SQL queries via 1 the UnicodeConverter extension, 2 raw page views, 3 SpecialIpblocklist, 4 SpecialEmailuser, 5 SpecialMaintenance, and 6 ImagePage...

CVE-2004-2209

CVE-2004-2209 concerns a SQL injection in the IdealBB web application from Ideal Science, affecting versions 1.4.9 through 1.5.3. The vulnerability allows remote attackers to execute arbitrary SQL commands via unknown vectors. The report notes a network-access vector with low attack complexity an...

CVE-2004-2181

CVE-2004-2181 affects WowBB Forum 1.61 (and related vectors reported in 1.65). It is due to multiple SQL injection flaws allowing remote attackers to manipulate SQL queries via view_user.php parameters (sort_by, page) or via the forum_id parameter to view_topic.php. The CVSS base score is 7.5 (HI...

CVE-2004-2190

CVE-2004-2190 is a directory traversal vulnerability affecting Unzoo 4.4-2. The available connected sources describe an input validation error during archive unpacking that can lead to files being overwritten outside the target directory. The NVD entry notes unknown impact/attack vectors, but oth...

CVE-2004-2155

CVE-2004-2155 affects Online-Bookmarks prior to 0.4.6. The vulnerability allows remote attackers to bypass authentication by issuing direct requests to (config/*, bookmarks.php, footer.php, main.php, tree.php, or functions.php). The issue is a direct authentication bypass without requiring user i...