CVE-2004-1909

Claim Anti-Virus ClamAV 0.68 and earlier allows remote attackers to cause a denial of service crash via certain RAR archives, such as those generated by the Beagle/Bagle worm...

CVE-2004-1886

...

CVE-2004-1796

CVE-2004-1796 concerns a PHP remote file inclusion vulnerability in HotNews 0.7.2 and earlier. The flaw allows an attacker to execute arbitrary PHP code by supplying manipulated values to either the config[header] parameter in hotnews-engine.inc.php3 or the config[incdir] parameter in hnmain.inc....

CVE-2004-1845

News Manager Lite 2.5 is affected by multiple cross-site scripting (XSS) vulnerabilities. An attacker can inject arbitrary script/HTML via specific user-supplied parameters: (1) email in comment_add.asp, (2) search in search.asp, and (3) n in category_news_headline.asp. The CVE entry notes these ...

CVE-2004-1846

CVE-2004-1846 affects News Manager Lite 2.5 with multiple SQL injection flaws allowing remote attackers to execute arbitrary SQL via the (1) ID parameter to more.asp, (2) ID parameter to category_news.asp, or (3) filter parameter to news_sort.asp. The sources provided reiterate this vulnerability...

CVE-2004-1888

CVE-2004-1888 affects Aborior Encore WebForum: the display.cgi component allows remote command execution through shell metacharacters in the file parameter. The vulnerability is network‑level with no authentication required per the description, enabling an attacker to run arbitrary commands with ...

CVE-2004-1919

The vulnerability CVE-2004-1919 affects Crackalaka 1.0.8, where the hash_strcmp function in hasch.c can be triggered by large malformed strings to cause a remote denial of service (crash). The NVD entry documents a MEDIUM base score (AV:N/AC:L/Au:N/C:N/I:N/A:P) with network exploitability and no ...

CVE-2004-1940

KPhone’s sipclient.cpp (versions 4.0.1 and earlier) is affected by a vulnerability where a STUN response with a large attrLen value triggers an out-of-bounds read, leading to remote denial of service (crash). The issue is disclosed across CVE-2004-1940 entries (NVD, CVE list, PT-2004-2837), consi...

CVE-2004-1978

The vulnerability is in Moodle (a CMS) prior to version 1.3, in help.php, where a cross‑site scripting (XSS) flaw exists that allows a remote attacker to inject arbitrary HTML/script via the text parameter. Exploitation details are not provided in the primary sources, though OpenVAS entries descr...

CVE-2004-2053

This CVE concerns EasyIns Stadtportal 4, where a PHP remote file inclusion vulnerability exists in index.php, exploitable via the site parameter. The underlying issue is improper handling of the site input, allowing an attacker to cause arbitrary PHP code execution. Impact is described as partial...

CVE-2004-2061

RiSearch shows a vulnerability in the show.pl CGI script that allows an attacker to use the remote host as an open proxy and to read arbitrary local files by passing a url parameter with http://, ftp://, or file://. Affected software/versions include RiSearch 1.0.01 and RiSearch Pro 3.2.06. The u...

CVE-2004-1831

CVE-2004-1831 affects Chrome 1.2.0.0 and earlier. The vulnerability is a buffer overflow in processing a packet with a large length value, causing a crash through a null dereference or out-of-bounds read. This can lead to a denial of service via remote input over the network. The available docume...

CVE-2004-2024

Zen Cart 1.1.4 prior to patch 2 contains debugging code in the Admin password retrieval path (password_forgotten.php) that can enable attackers to gain administrative privileges. The connected records confirm the product/version and the root cause as debugging code in the admin password recovery ...

CVE-2004-1955

The CVE-2004-1955 entry describes a SQL injection in the phProfession 2.5 package, specifically via the offset parameter in modules.php. Affected software: phProfession 2.5; vulnerable component: modules.php. Root cause: improper handling of the offset input enables arbitrary SQL execution by rem...

CVE-2004-1923

CVE-2004-1923 affects Tiki Wiki CMS Groupware prior to 1.8.2 (specifically = 1.8.2).

CVE-2004-1926

Tiki Wiki CMS Groupware (TikiWiki) <= 1.8.1 is affected by multiple input validation vulnerabilities allowing remote code injection via user profile fields (Theme, Country, Real Name, Displayed time zone) and directory/add-site fields (Name, Description, URL, Country). Connection records indic...

CVE-2004-2001

CVE-2004-2001 affects SGI IRIX 6.5 through 6.5.22m where using ifconfig "-arp" does not properly disable ARP requests from being sent or received. The vulnerability is described in multiple feeds as enabling ARP traffic even when disabled, with NVD indicating local attack vector, low complexity, ...

CVE-2004-1958

The CVE-2004-1958 entry describes a directory traversal vulnerability in the manifest.ini component of Unreal Engine, exploitable via .. sequences in a UMOD (Unreal MOD) file to overwrite arbitrary files. This indicates a remote-reachability issue affecting Unreal Engine’s handling of UMOD packag...

CVE-2004-1884

CVE-2004-1884 affects Ipswitch WS_FTP Server 4.0.2. The vulnerability is a backdoor: the XXSESS_MGRYY user with a default password can enable remote access, enabling partial confidentiality/integrity/availability impact as indicated by CVSS base vector AV:N/AC:L/Au:N/C:P/I:P/A:P. Public reference...

CVE-2004-1882

CVE-2004-1882 concerns CactuShop 5.x (ASP). The vulnerability is a cross-site scripting (XSS) flaw in the script popuplargeimage.asp, exploitable via the user-controlled parameter strImageTag . OpenVAS notes that the remote host runs CactuShop and that lack of sanitization can enable execution of...