8091 matches found
CVE-2004-2066
CVE-2004-2066 affects LinPHA 0.9.4, where a flaw in session.php enables SQL injection via the linpha_userid or linpha_password cookies, allowing remote attackers to execute arbitrary SQL and bypass authentication. The vulnerability’s impact is described as partial confidentiality, integrity, and ...
CVE-2004-2058
CVE-2004-2058 affects ASPrunner 2.4, where a remote attacker can disclose sensitive information via (1) hidden form fields or (2) error messages. The core description in the CVE entry is that ASPRunner 2.4 allows information disclosure to unauthenticated remote actors. Connected documents corrobo...
CVE-2004-1849
The CVE-2004-1849 entry describes multiple cross-site scripting (XSS) vulnerabilities in cPanel version 9.1.0. The affected components are the web pages dodelautores.html (email parameter) and addhandle.html (handle parameter). Exploitation leads to injection of arbitrary web script or HTML by re...
CVE-2004-1797
CVE-2004-1797 is described as a Cross-site scripting (XSS) vulnerability in FreznoShop 1.3.0 RC1 and earlier, exploitable via the search parameter in search.php. The affected software is FreznoShop; the vulnerable file/function is search.php, where user-supplied input in the search parameter can ...
CVE-2004-1781
The CVE-2004-1781 entry concerns the Info Touch Surfnet kiosk. The vulnerability arises in the Surfnet kiosk software via the CMD_CREDITCARD_CHARGE command, which local users can trigger to crash Surfnet and gain access to the underlying operating system. The NVD entry indicates a local exploit w...
CVE-2004-1934
CVE-2004-1934 corresponds to a PHP remote file inclusion vulnerability in Gemitel 3.50, where the affich.php script accepts a base parameter that can be manipulated by an attacker to execute arbitrary PHP code. The OpenVAS NASL entry describes a related file inclusion vulnerability in Gemitel tha...
CVE-2004-1823
The CVE-2004-1823 issue affects Jelsoft vBulletin 2.0 beta 3 through 3.0, where multiple XSS vulnerabilities allow remote attackers to inject arbitrary web script or HTML via (1) the page parameter to showthread.php and (2) the order parameter to forumdisplay.php. The vulnerability is caused by u...
CVE-2004-1893
CVE-2004-1893 affects Dreamweaver MX. The description states that when “Using Driver On Testing Server” or “Using DSN on Testing Server” is selected, mmhttpdb.asp is uploaded to the site without authentication, allowing remote attackers to obtain sensitive information and potentially execute arbi...
CVE-2004-1998
CVE-2004-1998 affects Php-Nuke (Downloads module) versions 6.x–7.2. The issue stems from an invalid show parameter to modules.php, which causes a PHP error message that reveals the full filesystem path, enabling information disclosure. Impact is limited to confidentiality (full path exposure); ex...
CVE-2004-1968
Open Bulletin Board (OpenBB) before version 1.0.6 contains a vulnerability in the readmsg action of myhome.php that allows remote attackers to read arbitrary messages by modifying the id parameter. The affected component is the readmsg functionality; underlying cause is improper validation of the...
CVE-2004-1973
The vulnerability CVE-2004-1973 concerns the DiGi Web Server, where a remote attacker can trigger a denial of service by sending an HTTP GET containing a large sequence of / characters. The server’s processing converts slashes to backslashes, consuming resources and potentially impacting availabi...
CVE-2004-2035
CVE-2004-2035 affects MiniShare 1.3.2, where remote attackers can cause a denial of service (crash) by sending a malformed HTTP GET or HEAD request that has an improper number of trailing CRLF sequences. The available records confirm the vulnerability and its impact as a crash/DoS, but do not pro...
CVE-2004-1990
Aldo's Web Server (aweb) 1.5 is affected by an information-disclosure vulnerability. Remote attackers can cause the server to reveal the full path and the user running the aweb process via an arbitrary character in a malformed request. Root cause is associated with handling of malformed requests ...
CVE-2004-1790
This CVE affects Edimax AR-6004 ADSL Routers. The issue is a Cross-site scripting (XSS) vulnerability in the web management interface, allowing remote attackers to inject arbitrary web script or HTML through the URL. The provided documents do not specify affected firmware versions, exact vulnerab...
CVE-2004-1959
The CVE-2004-1959 entry affects Protector System 1.15b1 for PHP-Nuke, where blocker_query.php exposes sensitive path information through the portNum parameter in an error message. This is a remote information-disclosure vulnerability that allows attackers to learn server filesystem paths. The ava...
CVE-2004-2059
CVE-2004-2059 : The provided documents describe multiple cross-site scripting vulnerabilities in ASPrunner 2.4 . The flaws allow remote attackers to inject arbitrary web script or HTML via four input vectors: (1) the SearchFor parameter in [TABLE-NAME]_search.asp, (2) the SQL parameter in [TABLE-...
CVE-2004-1873
The CVE-2004-1873 entry concerns SQL injection in category.asp of A-CART Pro 2.0 and A-CART 2.0. The root cause is improper handling of the catcode parameter in category.asp, enabling remote attackers to gain privileges. Connected PT-2004-2772 provides concrete remediation guidance: update the ca...
CVE-2004-1887
CVE-2004-1887 affects Ada Image Server (ImgSvr) 0.4. The vulnerability allows remote attackers to view directories or download files by making an HTTP request with a trailing %00 (null). The NVD entry notes a network attack vector with low complexity and no authentication required, resulting in p...
CVE-2004-1897
Administration interface in Monit 1.4 through 4.2 allows remote attackers to cause a denial of service segmentation fault by sending a Basic Authentication request without a password, which causes Monit to decrement a null pointer and perform an out-of-bounds read...