CVE-2004-1406

CVE-2004-1406 affects IkonBoard 3.1.0–3.1.3. The issue is an input sanitization flaw in ikonboard.cgi, where the variables (st) and (keywords) are vulnerable, allowing remote attackers to inject arbitrary SQL commands. This is a remote, network‑based vulnerability with low complexity and no authe...

CVE-2004-1430

SQL injection vulnerability CVE-2004-1430 affects IbProArcade’s show_stats module (Arcade.php) where the gameid parameter can be exploited to inject arbitrary SQL. This is remote and arises from input handling in the application’s PHP code. The available sources confirm the vulnerability and base...

CVE-2004-1423

PHP-Calendar (Sean Proctor) before 0.10.1 contains multiple remote file inclusion flaws. The vulnerability is triggered by a URL in the phpc_root_path parameter to includes/calendar.php or includes/setup.php, allowing remote attackers to execute arbitrary PHP code. Affected product: PHP-Calendar;...

CVE-2004-1429

The CVE-2004-1429 entry applies to ArGoSoft FTP 1.4.2.4 and earlier, where there is no limit on password entry attempts. This disclosure indicates that remote attackers could perform brute-force password guesses against the FTP service, potentially compromising accounts. The connected records con...

CVE-2004-1409

CVE-2004-1409 affects Image Gallery Web Application 0.9.10 with multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. The provided documents specify the affected software and vulnerable condition but do not include explicit exploit...

CVE-2004-1405

Affected software: MediaWiki 1.3.8 and earlier (with Apache mod_mime); also referenced as vulnerable in MediaWiki

CVE-2004-9998

CVE-2004-9998 is rejected/not used; this placeholder does not represent an active vulnerability.

CVE-2004-1400

The vulnerability CVE-2004-1400 affects Ocean12 ASP Calendar. The public-facing control panel does not require authentication, permitting remote attackers to gain unauthorized access by requesting main.asp (and related admin paths). This unauthenticated access can enable attackers to perform priv...

CVE-2004-1424

CVE-2004-1424 affects Moodle 1.4.2 and earlier. A cross-site scripting (XSS) flaw exists in view.php where the search parameter can be exploited to inject arbitrary scripts/HTML. This is a remote, unauthenticated vector; impact includes potential partial integrity compromise and user-facing scrip...

CVE-2004-1399

The CVE-2004-1399 entry concerns the phpBB Attachment module (version 2.3.10 and earlier). The underlying issue is a directory traversal vulnerability where an attacker can cause a filename to include .. to read arbitrary files. Impact is described as partial confidentiality (read access) with no...

CVE-2004-1414

Gadu-Gadu 6.1 build 156 allows remote attackers to cause a denial of service application hang via a message that contains many special strings that are converted to images...

CVE-2004-1425

Directory traversal vulnerability in file.php in Moodle 1.4.2 and earlier allows remote attackers to read arbitrary session files for known session IDs via a .. dot dot in the file parameter...

CVE-2004-1408

The CVE-2004-1408 issue affects Image Gallery Web Application 0.9.10, specifically the addImage method in admin.class.php, which fails to properly validate filenames. This enables remote attackers to upload and execute arbitrary files. The vulnerability details are supported by CVE records (NVD/N...

CVE-2004-1405

MediaWiki 1.3.8 and earlier, when used with Apache modmime, does not properly handle files with two file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code...

CVE-2004-1423

Multiple PHP remote file inclusion vulnerabilities in Sean Proctor PHP-Calendar before 0.10.1, as used in Commonwealth of Massachusetts Virtual Law Office VLO and other products, allow remote attackers to execute arbitrary PHP code via a URL in the phpcrootpath parameter to 1 includes/calendar.ph...

CVE-2004-1404

Attachment Mod 2.3.10 module for phpBB, when used with Apache modmime, does not properly handle files with multiple file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code...

CVE-2004-1398

Format string vulnerability in prelink.c in kextload in Apple OS X, as used by TDIXSupport in Roxio Toast Titanium and possibly other products, allows local users to execute arbitrary code via format string specifiers in the extension argument...

CVE-2004-1414

Gadu-Gadu 6.1 build 156 is affected. The vulnerability allows remote attackers to cause an application hang (DoS) by sending a message containing many special strings that are converted to images. Root cause is not explicitly detailed beyond the conversion of special strings to images; no patch/v...

CVE-2004-1427

KorWeblog PHP remote file inclusion vulnerability (CVE-2004-1427) affects 1.6.2-cvs and earlier. The flaw is in main.inc via G_PATH, enabling remote code execution when a URL on a remote server is loaded, demonstrated by using .. sequences in the lng parameter to load main.inc. The CVSS vector (A...

CVE-2004-1416

The CVE-2004-1416 entry concerns RealOne 2.0 browser plugin (pnxr3260.dll) used in Internet Explorer. A crafted embed tag could remotely crash the application and, possibly, execute arbitrary code. The issue is triggered via the IE plugin component and is described as a remote execution/DoS vulne...