CVE-2004-2007

CVE-2004-2007 describes a cross-site scripting (XSS) vulnerability in modules.php for NukeJokes 1.7 and 2 Beta. The flaw allows remote attackers to inject arbitrary HTML or web script via (1) the cat parameter in CatView or (2) the jokeid parameter in JokeView. This is a client-side script inject...

CVE-2004-1795

Technical details about CVE-2004-1795 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2004-2029

BNBT BitTorrent Tracker, Beta 7.5 Release 2 and earlier, is affected by a vulnerability in Util_DecodeHTTPAuth where a remote attacker can trigger a crash (denial of service) by sending a crafted HTTP Basic Authorization header containing the value "A==". No remediation details are provided in th...

CVE-2004-1808

The CVE-2004-1808 issue concerns Extcompose in metamail, where the tool does not verify the output file before writing, permitting a local user to overwrite arbitrary files via a symlink attack. Affected component: Extcompose/m metamail (exact version not specified in provided documents). Root ca...

CVE-2004-1991

CVE-2004-1991 affects Aldo’s Web Server (aweb) 1.5. The vulnerability is aDirectory traversal in an HTTP GET request that allows an attacker to view arbitrary files by supplying an improper path using .. (dot dot). The NVD metrics indicate a NETWORK attack vector with low complexity and no authen...

CVE-2004-2027

Icecast 2.0.0 and earlier is affected by a remote denial-of-service due to a long Authorization header triggering an out-of-bounds read. The vulnerability (CVE-2004-2027) can crash the server, reducing availability. Affected component is the HTTP Basic Authorization handling. Remediation per sour...

CVE-2004-1842

PHP-Nuke 6.x through 7.1.0 is affected by a CSRF that lets an attacker gain administrative privileges via an image tag pointing to admin.php. The PT-2004-2741 entry confirms the issue and recommends upgrading to a version containing the fix; no specific fixed version is provided in the sources.

CVE-2004-1824

CVE-2004-1824 – vBulletin XSS vulnerability : The affected software is Jelsoft/vBulletin. The issue is a cross-site scripting flaw in the handling of URI input (not properly sanitized), exploitable via the what parameter to memberlist.php or similar URI input vectors in older vBulletin releases. ...

CVE-2004-1997

CVE-2004-1997 : Kolab stores OpenLDAP passwords in plaintext in the slapd.conf file, which may be world-readable and allow local users to gain privileges. The NVD entry lists a CVSSv2 base score of 4.6 (LOCAL access, LOW attack complexity, PARTIAL confidentiality/integrity/availability impacts). ...

CVE-2004-1917

CVE-2004-1917 involves a format string vulnerability in LCDProc, present in version 0.4.1 and earlier, specifically in test_func_func. The flaw allows remote attackers to execute arbitrary code by supplying format string specifiers via the str variable. The cited sources consistently describe the...

CVE-2004-1854

CVE-2004-1854 affects Picophone 1.63 and earlier, where a buffer overflow in the logging function allows remote attackers to execute arbitrary code via a large packet. The entries in CVE records confirm the vulnerable component (logging function) and the impact (remote code execution) with a netw...

CVE-2004-1949

The CVE concerns PostNuke prior to 7.2.6 with a SQL injection vulnerability that allows remote attackers to run arbitrary SQL. The flaw is triggered by input parameters in two modules: (1) sif in index.php of the Comments module, and (2) timezoneoffset in changeinfo.php of the Your_Account module...

CVE-2004-1914

Affected software : NukeCalendar 1.1.a as used in PHP-Nuke. Vulnerability : SQL injection in modules.php via the eid parameter. This allows remote attackers to execute arbitrary SQL commands. Impact : Partial confidentiality, integrity, and availability impact as per CVSS; attacker can compromise...

CVE-2004-2026

CVE-2004-2026 describes a format-string vulnerability in Pound’s logmsg function (svc.c) affecting Pound 1.5 and earlier. A remote attacker could trigger arbitrary code execution by supplying format-specifiers in syslog messages. The vulnerability is due to improper handling of user-controlled fo...

CVE-2004-1789

CVE-2004-1789 affects ZyWALL 10 (firmware 4.07) and is a reflected XSS in the web management interface via the rpAuth_1 page. The underlying cause is improper handling of user-supplied input in the web interface, allowing remote attackers to inject arbitrary script/HTML. The provided documents do...

CVE-2004-2041

The vulnerability CVE-2004-2041 affects e107 0.615 via a PHP remote file inclusion in secure_img_render.php. An attacker can set the p parameter to a remote URL to cause the server to execute code, enabling arbitrary PHP execution. Impact is partial confidentiality, integrity, and availability ac...

CVE-2004-2023

The vulnerability CVE-2004-2023 affects Zen Cart (notably Zen Cart 1.1.2d and 1.1.4 before patch 1). The issue is a SQL injection in login.php that allows remote attackers to modify or disclose data via the (1) admin_name or (2) admin_pass parameters. The underlying cause is unsafely constructed ...

CVE-2004-1794

The CVE-2004-1794 entry describes a Cross-site Scripting (XSS) vulnerability in the VCard4J Toolkit. The issue allows remote attackers to inject arbitrary web script or HTML via the NICKNAME tag in a vCard. According to the available data, this is a client-side input handling weakness in VCard4J ...

CVE-2004-1928

CVE-2004-1928 affects Tiki Wiki CMS Groupware (TikiWiki) up to version 1.8.1. The issue is in the image upload feature, where remote attackers can upload and potentially execute arbitrary files via the img/wiki_up URL. The vulnerability is remote, over the network, and contributes to partial conf...

CVE-2004-1933

The CVE-2004-1933 entry affects Citadel/UX versions 5.00–6.14. The underlying issue is that the database directory and files are installed with world-read permissions, enabling local users to bypass access controls and read messages that should be restricted. This is described consistently across...