CVE-2004-1892

Summary: CVE-2004-1892 describes a stack-based buffer overflow in eMule’s DecodeBase16 function used by the IRC module and the Web Server in eMule 0.42d, allowing remote code execution via a long input string. The connected Nessus/OpenVAS entries confirm a DecodeBase16 overflow vulnerability in t...

CVE-2004-2010

PHP remote file inclusion in phpShop 0.7.1 and earlier allows remote attackers to execute arbitrary PHP code by setting base_dir to a URL on a remote server that serves phpshop.cfg. This affects index.php. The underlying root cause is a file inclusion weakness that trusts a user-controlled base_d...

CVE-2004-1886

This CVE entry is rejected/not used; refer to CVE-2004-1848 instead.

CVE-2004-1976

The CVE-2004-1976 entry concerns SMC Barricade broadband routers (models 7008ABR and 7004VBR). The described vulnerability is that remote administration is enabled by default, allowing remote attackers to gain access by connecting to port 1900. The available documents confirm the affected devices...

CVE-2004-2062

CVE-2004-2062 affects AntiBoard ( antiboard.php ) ≤ 0.7.2. The vulnerability is a SQL injection in parameters (thread_id, parent_id, mode) that allows remote attackers to execute arbitrary SQL through the affected page. The vulnerability and affected component are documented in multiple sources (...

CVE-2004-1916

LCDProc 0.4.1 (and possibly other 0.4.x versions up to 0.4.4) is affected by multiple buffer overflows that allow remote attackers to execute arbitrary code via (1) a long invalid command to parse_all_client_messages, or (2) a long argv command to test_func_func. The connected sources consistentl...

CVE-2004-1837

CVE-2004-1837 affects Mod_survey versions 3.0.x prior to 3.0.16-pre2 and 3.2.x prior to 3.2.0-pre4, which are vulnerable to cross-site scripting (XSS). The flaw allows remote attackers to inject arbitrary web script or HTML through certain survey fields or error messages when query strings are ma...

CVE-2004-2012

The CVE-2004-2012 entry concerns the systrace_exit function in the systrace utility used on NetBSD-current (pre-April 16, 2004) and certain FreeBSD ports. The vulnerability arises because the code path does not verify the owner of the /dec/systrace connection before setting the effective user ID ...

CVE-2004-2020

CVE-2004-2020 affects Php-Nuke 6.x through 7.3. The vulnerability is a set of cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary HTML or scripts via user-supplied input in specific parameters: optionbox (News module), date (Statistics module), year/month/month_1 (Sto...

CVE-2004-1907

The vulnerability CVE-2004-1907 affects Kerio Personal Firewall (KPF) 4.0.13, where the Web Filtering functionality can be triggered to crash a remote system by receiving hex-encoded URLs containing %13%12%13. This results in a denial-of-service condition. The available data do not specify an off...

CVE-2004-2028

CVE-2004-2028 describes a cross-site scripting (XSS) vulnerability in the PHP component used by the e107 CMS, specifically in the stats.php module. The flaw allows remote attackers to inject arbitrary web script or HTML by manipulating the referer parameter sent to log.php. Affected software is e...

CVE-2004-2022

ActivePerl 5.8.x and Perl 5.6.1 (Windows) are affected by CVE-2004-2022, allowing a denial of service (crash) and potentially arbitrary code execution via a long argument to the system() command, due to a stack-based buffer overflow. The root cause is unclear whether the flaw lies in Perl or the ...

CVE-2004-1791

CVE-2004-1791 concerns Edimax AR-6004 ADSL Routers where the web management interface uses a default administrator name and password that also appear as the default login text. Multiple connected sources corroborate that this enables remote access to the device (attack surface is network-enabled)...

CVE-2004-1956

PostNuke 0.7.2.6 is affected by CVE-2004-1956. The vulnerability allows remote attackers to cause information disclosure by issuing direct HTTP requests to files in the includes/blocks, pnadodb, NS-NewUser, NS-Your_Account, NS-LostPassword, and NS-User paths, which trigger PHP error messages reve...

CVE-2004-1912

The CVE-2004-1912 issue affects NukeCalendar 1.1.a (as used in PHP-Nuke). The (1) modules.php, (2) block-Calendar.php, (3) block-Calendar1.php, and (4) block-Calendar_center.php scripts can disclose the full filesystem path via an error message when a URL with an invalid argument is requested. Th...

CVE-2004-1986

CVE-2004-1986 describes a directory traversal vulnerability in Coppermine Photo Gallery, specifically in modules.php. The affected versions are Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4, where remote attackers with administrative privileges can read arbitrary files by injecting a '..' sequenc...

CVE-2004-1806

CFWebStore CFWebStore 5.0.x is vulnerable to SQL injection in index.cfm via the parameters category_id, product_id, or feature_id. The root cause is unsafe SQL construction, enabling remote attackers to run arbitrary SQL and potentially gain administrative access on affected hosts. The assessment...

CVE-2004-2013

The CVE-2004-2013 vulnerability affects Linux kernels 2.4.25 and earlier, caused by an integer overflow in the SCTP_SOCKOPT_DEBUG_NAME SCTP socket option in socket.c. An optlen value of -1 allows kmalloc to allocate 0 bytes, enabling a local attacker to potentially execute arbitrary code. Documen...

CVE-2004-2036

CVE-2004-2036 concerns a SQL injection in the jPortal CGI/print.inc.php path. The vulnerability exists in the art_print function (print.inc.php) across unknown jPortal versions prior to 2.3.1, allowing remote attackers to inject arbitrary SQL via the id parameter. Public references (NVD/NIST, CVE...

CVE-2004-1835

CVE-2004-1835 affects Invision Gallery 1.0.1 and involves multiple SQL injection vulnerabilities in index.php. The affected parameters are img, cat, sort_key, order_key, user, and album, enabling remote attackers to modify SQL queries. This vulnerability is supported by sources such as PacketStor...