8092 matches found
CVE-2004-1407
CVE-2004-1407 affects the Singapore Gallery (Singapore Image Gallery Web Application) version 0.9.10. The vulnerability set consists of multiple directory traversal flaws in the PHP code: specifically the showThumb method in thumb.php allows reading arbitrary files, and admin.class.php enables de...
CVE-2004-1410
CVE-2004-1410 is a documented XSS in Gadu-Gadu builds up to 155, via a URL echoed in a parsing-error popup. The connected CVE-2004-1229 describes a different XSS vulnerability in the same Gadu-Gadu parser, triggered by URLs (http:// or news://). The affected software is the Gadu-Gadu client; the ...
CVE-2004-1404
The CVE-2004-1404 entry concerns the Attachment Mod 2.3.10 module for phpBB when used with Apache mod_mime. The vulnerability arises from improper handling of files with double extensions (e.g., .php.rar), which can enable remote attackers to upload and execute arbitrary code on the server. The p...
CVE-2004-1421
CVE-2004-1421: Affects WHM AutoPilot 2.4.6.5 and earlier. The vulnerability arises from PHP remote file inclusion through the server_inc parameter in 1) step_one.php, 2) step_one_tables.php, and 3) step_two_tables.php, enabling an attacker to reference a URL on a remote server that contains execu...
CVE-2004-1397
Cross-site scripting XSS vulnerability in UseModWiki 1.0 allows remote attackers to inject arbitrary web script or HTML via an argument to wiki.pl...
CVE-2004-1396
Winamp 5.07 (and possibly other versions) is vulnerable to remote denial of service by processing malformed media files: (1) an mp4/m4a playlist with invalid tag data, or (2) an invalid .nsv/.nsa file. This can cause the application to crash or exhibit high CPU usage. No remediation details are p...
CVE-2004-1418
Cross-site scripting XSS vulnerability in WPKontakt 3.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via an e-mail address, which is not quoted when a parsing error is generated...
CVE-2004-1424
Cross-site scripting XSS vulnerability in view.php in Moodle 1.4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter...
CVE-2004-1422
CVE-2004-1422 : WHM AutoPilot
CVE-2004-1401
SQL injection vulnerability in verify.asp in Asp-rider allows remote attackers to execute arbitrary SQL statements and bypass authentication via the username parameter...
CVE-2004-1431
FormMail.php 5.0, and possibly other versions, allows remote attackers to read arbitrary files via a full pathname in the arfile auto-reply parameter...
CVE-2004-1418
CVE-2004-1418 affects WPKontakt 3.0.1 and earlier. The vulnerability is a cross-site scripting (XSS) flaw where an e-mail address is not quoted during a parsing error, allowing an attacker to inject arbitrary web script or HTML. Documented impact indicates partial integrity compromise with no con...
CVE-2004-1411
Gadu-Gadu build 155 and earlier allows remote attackers to cause a denial of service infinite loop via a message that contains an image whose filename does not start with restricted characters...
CVE-2004-1415
CVE-2004-1415 – 2BGal SQL Injection affects 2BGal photo gallery (versions 2.4 and 2.5.1) via the PHP script modules, notably disp_album.php (and possibly disp_img.php). The root cause is failure to sanitize the id_album parameter, allowing remote attackers to inject arbitrary SQL commands. Conseq...
CVE-2004-1402
The CVE-2004-1402 entry concerns iWebNegar, a PHP web log application. The vulnerability is a SQL injection affecting multiple entry points: the string parameter for index.php, comments.php, and the administrator login page. The underlying cause is unsanitized input that allows attackers to injec...
CVE-2004-1401
CVE-2004-1401 corresponds to a SQL injection in ASP-Rider’s verify.asp via the username parameter, allowing remote attackers to manipulate SQL and bypass authentication, potentially gaining administrative access. Affected software: ASP-Rider (ASP scripts). Root cause: improper input handling in v...
CVE-2004-1180
CVE-2004-1180 affects netkit-rwho (rwhod) prior to version 0.17 on little-endian architectures. The Debian/DSA entries describe a vulnerability with missing input validation in rwhod that can be exploited remotely to crash the listening process (DoS). Debian fixes are available: 0.17-4woody2 (sta...