8092 matches found
CVE-2004-1913
Cross-site scripting XSS vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to inject arbitrary web script or HTML via the eid parameter...
CVE-2004-1962
SQL injection vulnerability in index.php in Protector System 1.15b1 allows remote attackers to bypass SQL injection filters by using "//" sequences in the targeted fields...
CVE-2004-2065
DansGuardian 2.8 and earlier allows remote attackers to bypass the extension filtering rule via a hex encoded extension or . in the filename...
CVE-2004-2124
The registerglobals simulation capability in Gallery 1.3.1 through 1.4.1 allows remote attackers to modify the HTTPPOSTVARS variable and conduct a PHP remote file inclusion attack via the GALLERYBASEDIR parameter, a different vulnerability than CVE-2002-1412...
CVE-2004-2140
CRLF injection vulnerability in YaBB 1 Gold before 1.3.2 allows remote attackers to modify text file contents via the subject variable...
CVE-2004-2173
SQL injection vulnerability in advSearchh.asp in EarlyImpact ProductCart allows remote attackers to execute arbitrary SQL commands via the priceUntil parameter...
CVE-2004-2198
account.asp in DUware DUclassmate 1.0 through 1.1 allows remote attackers to change the passwords for arbitrary users by modifying the MMrecordId parameter on the "My Account" page...
CVE-2004-1572
AJ-Fork 167 does not restrict access to directories such as 1 data, 2 inc, 3 plugins, 4 skins, or 5 tools, which allows remote attackers to list files in those directories via a direct HTTP request...
CVE-2004-0825
QuickTime Streaming Server in Mac OS X Server 10.2.8, 10.3.4, and 10.3.5 allows remote attackers to cause a denial of service application deadlock via a certain sequence of operations...
CVE-2004-1156
Mozilla before 1.7.6, and Firefox before 1.0.1, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window...
CVE-2004-1332
Stack-based buffer overflow in the FTP daemon in HP-UX 11.11i, with the -v debug option enabled, allows remote attackers to execute arbitrary code via a long command request...
CVE-2004-1385
phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via 1 unexpected characters in the session ID such as shell metacharacters, 2 an invalid appname parameter to preferences.php or 3 an invalid menuaction parameter to index.php, which reveals the web server...
CVE-2004-1386
TikiWiki before 1.8.4.1 does not properly verify uploaded images, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2005-0200...
CVE-2004-1388
Format string vulnerability in the gpsdreport function for BerliOS GPD daemon gpsd, formerly pygps 1.9.0 through 2.7 allows remote attackers to execute arbitrary code via certain GPS requests containing format string specifiers that are not properly handled in syslog calls...
CVE-2004-1391
Untrusted execution path vulnerability in the PPPoE daemon PPPoEd in QNX RTP 6.1 allows local users to execute arbitrary programs by modifying the PATH environment variable to point to a malicious mount program...
CVE-2004-1400
The control panel in ASP Calendar does not require authentication to access, which allows remote attackers to gain unauthorized access via a direct request to main.asp...
CVE-2004-1424
Cross-site scripting XSS vulnerability in view.php in Moodle 1.4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter...
CVE-2004-1428
ArGoSoft FTP before 1.4.2.1 generates an error message if the user name does not exist instead of prompting for a password, which allows remote attackers to determine valid usernames...
CVE-2004-1432
Multiple versions of Cisco ONS 15327, ONS 15454, and ONS 15454 SDH, including 4.60 and 4.61, 4.5x, 4.10 to 4.13, 4.00 to 4.02, and earlier versions, allows remote attackers to cause a denial of service control card reset via malformed 1 IP or 2 ICMP packets...