CVE-2004-2167

CVE-2004-2167 affects LaTeX2rtf 1.9.15 (and possibly other versions) with multiple buffer overflows that allow remote code execution via the expandmacro function, and possibly Environments and TranslateCommand. Connected documents confirm the vulnerability but do not provide further exploitation ...

CVE-2004-2185

MediaWiki 1.3.5 is affected by multiple XSS vulnerabilities affecting the UnicodeConverter extension, raw page views, SpecialIpblocklist, SpecialEmailuser, SpecialMaintenance, and ImagePage. The connected documents confirm the flaws but do not provide explicit remediation steps or fixed versions....

CVE-2004-2177

CVE-2004-2177 affects DevoyBB Web Forum 1.0.0. Multiple sources (NVD, Red Hat, CVE list, OpenVAS NT/NESSUS) describe a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via unknown vectors. OpenVAS notes additional vulnerability vectors (...

CVE-2004-2201

CVE-2004-2201 describes an SQL injection vulnerability in DUware DUforum 3.0–3.1. The issue allows remote attackers to execute arbitrary SQL commands by providing crafted input via the FOR_ID parameter in messages.asp, the MSG_ID parameter in messageDetail.asp, or the password parameter on the lo...

CVE-2004-2185

Multiple cross-site scripting XSS vulnerabilities in MediaWiki 1.3.5 allow remote attackers to execute arbitrary scripts and/or SQL queries via 1 the UnicodeConverter extension, 2 raw page views, 3 SpecialIpblocklist, 4 SpecialEmailuser, 5 SpecialMaintenance, and 6 ImagePage...

CVE-2004-2192

CVE-2004-2192 concerns a SQL injection in Turbo Traffic Trader PHP 1.0, specifically in tttadmin/settings.php where the ttt_admin parameter enables remote attackers to execute arbitrary SQL commands. The vulnerability arises from improper handling of user-supplied input in the affected script, al...

CVE-2004-2166

CVE-2004-2166 affects Canon ImageRUNNER (iR) 5000i and C3200 printers, where the print-from-email feature can be abused when IP range filtering is not used. A remote attacker can send a text/plain email to TCP port 25 and cause the device to print arbitrary text without authentication. The issue ...

CVE-2004-2191

CVE-2004-2191 describes a cross-site scripting (XSS) vulnerability in the ttt-webmaster.php component of Turbo Traffic Trader PHP 1.0. The flaw allows remote attackers to inject arbitrary web script or HTML through the parameters (1) msg[0] or (2) siteurl, potentially compromising user data or se...

CVE-2004-2180

WowBB Forum 1.61 and earlier versions are affected by multiple cross-site scripting (XSS) vulnerabilities. The flaws allow attackers to inject arbitrary script/HTML via numerous vectors: country (view_user.php), show (view_forum.php), letter (view_user.php), highlight (view_topic.php), show (inde...

CVE-2004-2156

Multiple unknown vulnerabilities in Online Recruitment Agency 1.0 have unknown impact and attack vectors...

CVE-2004-2160

XMLStarlet Command Line XML Toolkit 0.9.3 is affected by a format string vulnerability in xml_elem.c, as described for CVE-2004-2160. The issue enables denial of service or arbitrary code execution and is exploitable via network access with low attack complexity, according to the NVD entry. Affec...

CVE-2004-2207

CVE-2004-2207 affects IdealBB, a web-based bulletin board, with a cross-site scripting (XSS) vulnerability reported in versions 1.4.9 through 1.5.3. The vulnerability allows remote attackers to inject arbitrary web script or HTML via unknown vectors. The connected OpenVAS and CVE records corrobor...

CVE-2004-2189

Affected software: DMXReady Site Chassis Manager. Vulnerability: SQL injection in the Site Chassis Manager allows remote attackers to execute arbitrary SQL via unknown vectors. Impact as per CVSS: Confidentiality, Integrity, and Availability partially affected (score 7.5). Exploitation details, a...

CVE-2004-2179

CVE-2004-2179 affects asycpict.dll used in Microsoft FrontPage 97/98; allows remote DoS by sending a JPEG with maximum height/width, causing a hang. Red Hat and CVE lists mirror the description; no remediation details are provided in the connected documents. Exploit details and fix/version inform...

CVE-2004-2185

Multiple cross-site scripting XSS vulnerabilities in MediaWiki 1.3.5 allow remote attackers to execute arbitrary scripts and/or SQL queries via 1 the UnicodeConverter extension, 2 raw page views, 3 SpecialIpblocklist, 4 SpecialEmailuser, 5 SpecialMaintenance, and 6 ImagePage...

CVE-2004-2167

Multiple buffer overflows in LaTeX2rtf 1.9.15, and possibly other versions, allow remote attackers to execute arbitrary code via 1 the expandmacro function, and possibly 2 Environments and 3 TranslateCommand...

CVE-2004-2211

CVE-2004-2211 describes a cross-site scripting (XSS) vulnerability in AliveSites Forums 2.0. The flaw allows remote attackers to inject arbitrary scripts/HTML through multiple input vectors: forum_id, method, and forum_title in post.asp; forum_title in forum.asp; and id in post.asp. The cited ref...

CVE-2004-2158

The CVE-2004-2158 entry describes a SQL injection in Serendipity 0.7-beta1, exploitable via the entry_id parameter to exit.php or comment.php. The root cause is improper sanitization of user input, allowing remote attackers to execute arbitrary SQL commands and potentially alter or retrieve data....

CVE-2004-2197

CVE-2004-2197 affects kdocker up to version 0.8. The binary kdocker.cpp fails to properly check file ownership, enabling local users to run arbitrary programs via ownership trust bypass. Affected component: kdocker.cpp in kdocker 0.1–0.8. Root cause: insufficient ownership verification. Impact: l...

CVE-2004-2157

The CVE-2004-2157 entry describes a cross-site scripting (XSS) vulnerability in Serendipity 0.7 beta1 (and possibly earlier versions before 0.7-beta3) in the Comment.php component. The flaw allows remote attackers to inject arbitrary HTML and PHP code via the (1) email or (2) username field, impa...