CVE-2004-1959

The CVE-2004-1959 entry affects Protector System 1.15b1 for PHP-Nuke, where blocker_query.php exposes sensitive path information through the portNum parameter in an error message. This is a remote information-disclosure vulnerability that allows attackers to learn server filesystem paths. The ava...

CVE-2004-2059

CVE-2004-2059 : The provided documents describe multiple cross-site scripting vulnerabilities in ASPrunner 2.4 . The flaws allow remote attackers to inject arbitrary web script or HTML via four input vectors: (1) the SearchFor parameter in [TABLE-NAME]_search.asp, (2) the SQL parameter in [TABLE-...

CVE-2004-1873

The CVE-2004-1873 entry concerns SQL injection in category.asp of A-CART Pro 2.0 and A-CART 2.0. The root cause is improper handling of the catcode parameter in category.asp, enabling remote attackers to gain privileges. Connected PT-2004-2772 provides concrete remediation guidance: update the ca...

CVE-2004-1887

CVE-2004-1887 affects Ada Image Server (ImgSvr) 0.4. The vulnerability allows remote attackers to view directories or download files by making an HTTP request with a trailing %00 (null). The NVD entry notes a network attack vector with low complexity and no authentication required, resulting in p...

CVE-2004-1897

Administration interface in Monit 1.4 through 4.2 allows remote attackers to cause a denial of service segmentation fault by sending a Basic Authentication request without a password, which causes Monit to decrement a null pointer and perform an out-of-bounds read...

CVE-2004-2064

Cross-site scripting XSS vulnerability in lostBook 1.1 and earlier allows remote attackers to inject arbitrary web script via the 1 Email or 2 Website fields...

CVE-2004-1932

SQL injection vulnerability in 1 auth.php and 2 admin.php in PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account via base64-encoded SQL in the admin parameter...

CVE-2004-1937

CVE-2004-1937 refers to multiple directory traversal vulnerabilities in Nuked-KlaN 1.4b and 1.5b that allow remote attackers to read or include arbitrary files via .. sequences in parameters to index.php, update.php, or globals loading order, potentially modifying globals in the process. The issu...

CVE-2004-1920

X-Micro WLAN 11b Broadband Router (versions 1.2.2, 1.2.2.3, 1.2.2.4, 1.6.0.0) contains a hardcoded 'super' username and password, which could allow remote attackers to gain access. The connected documents confirm the affected product and credential issue but do not provide details on exploitation...

CVE-2004-2014

CVE-2004-2014 affects wget 1.9 and 1.9.1, where a local user can overwrite arbitrary files via a symlink attack on the target filename during download. The underlying cause is a symlink/ race condition when determining the output file, permitting writes to files the user has access to. Remediatio...

CVE-2004-2016

NetChat HTTP server (versions ≤7.3) is affected by a stack-based buffer overflow triggered by a long GET request, enabling remote arbitrary code execution. The CVE-2004-2016 entry is supported by connected records that name the affected product and impact; no patch or remediation is provided with...

CVE-2004-1840

CVE-2004-1840 affects the MS Analysis module 2.0 for PHP-Nuke. The vulnerability is multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary JavaScript/HTML via (1) screen parameter to modules.php, (2) module_name parameter to title.php, (3) sortby parameter to mo...

CVE-2004-1979

Summary: The CVE-2004-1979 entry describes a stored/ reflected cross-site scripting (XSS) vulnerability in the PROPS 0.6.1 product, specifically in the do_search.php script. The issue is triggered via the search_string parameter, enabling remote attackers to inject arbitrary HTML or web script. T...

CVE-2004-1827

CVE-2004-1827 is an XSS vulnerability in YaBB 1 Gold(SP1.3) and YaBB SE 1.5.1 Final. The issue allows remote attackers to inject arbitrary web script via the background:url property in (1) glow or (2) shadow tags. Affected software is YaBBForum components mentioned in the CVE record, with the vul...

CVE-2004-1951

CVE-2004-1951 affects xine 1.x (alpha/beta, 1.0rc through 1.0rc3a) and xine-ui 0.9.21–0.9.23. The vulnerability allows a remote attacker to overwrite arbitrary files via MRL links using the audio.sun_audio_device or dxr3.devicename options. Impact is arbitrary file writes within the permissions o...

CVE-2004-1903

CVE-2004-1903 affects blaxxun 3D 7.0. A buffer overflow in a long URL property inside an object tag can allow remote attackers to execute arbitrary code. Root cause is improper handling of URL data in the affected component. According to the entry, the issue has a network attack vector with no au...

CVE-2004-1851

Dameware Mini Remote Control 4.1.0.0 is affected. The root cause is use of insufficiently random data to generate the encryption key, making it easier for remote attackers to obtain sensitive information via brute force guessing. From the provided documents, there is no explicit remediation or pa...

CVE-2004-1946

Format string vulnerability in the PRINT_ERROR function of Cherokee Web Server 0.4.16 and earlier allows local users to execute arbitrary code via format string specifiers in the -C command line argument. The initial description notes it is unclear whether the issue could be exploited remotely or...

CVE-2004-1999

CVE-2004-1999 describes a Cross-site scripting (XSS) vulnerability in the Downloads module of Php-Nuke 6.x through 7.2. The issue allows remote attackers to inject arbitrary HTML and web script via the ttitle or sid parameters to modules.php. Affected software is Php-Nuke, version range 6.x–7.2, ...

CVE-2004-2032

CVE-2004-2032 affects Netgear RP114. A remote attacker can bypass keyword-based URL filtering by sending a long URL composed of a large number of %20 (space) sequences, enabling partial information disclosure through circumvention of filtering. The NVD entry classifies the impact as Partial Confi...