8092 matches found
CVE-2004-1953
phProfession 2.5 allows remote attackers to gain sensitive information via a direct HTTP request to upload.php, which reveals the path in a PHP error message...
CVE-2004-1960
Cross-site scripting XSS vulnerability in blockerquery.php in Protector System 1.15b1 allows remote attackers to inject arbitrary web script or HTML via the 1 target or 2 portNum parameters...
CVE-2004-2012
The systraceexit function in the systrace utility for NetBSD-current and 2.0 before April 16, 2004, and certain FreeBSD ports, does not verify the owner of the /dec/systrace connection before setting euid to 0, which allows local users to gain root privileges...
CVE-2004-2018
PHP remote file inclusion vulnerability in index.php in Php-Nuke 6.x through 7.3 allows remote attackers to execute arbitrary PHP code by modifying the modpath parameter to reference a URL on a remote web server that contains the code...
CVE-2004-2021
Directory traversal vulnerability in filemanager.php in osCommerce 2.2 allows remote attackers to view arbitrary files via a .. dot dot in the filename argument...
CVE-2004-2024
The distribution of Zen Cart 1.1.4 before patch 2 includes certain debugging code in the Admin password retrieval functionality, which allows attackers to gain administrative privileges via passwordforgotten.php...
CVE-2004-2025
SQL injection vulnerability in applicationtop.php for Zen Cart 1.1.3 before patch 2 may allow remote attackers to execute arbitrary SQL commands via the productsid parameter...
CVE-2004-2068
fetchnews in leafnode 1.9.47 and earlier allows remote attackers to cause a denial of service process hang via an empty NNTP news article with missing mandatory headers...
CVE-2004-2071
Macallan Mail Solution 2.8.4.6 Build 260, and possibly earlier versions, allows remote attackers to bypass authentication in the web interface via an HTTP GET request with two slashes "//" after the server name...
CVE-2004-2072
Cross-site scripting XSS vulnerability in index.php for Mambo Open Source 4.6, and possibly earlier versions, allows remote attackers to execute script on other clients via the Itemid parameter...
CVE-2004-2076
Cross-site scripting XSS vulnerability in search.php for Jelsoft vBulletin 3.0.0 RC4 allows remote attackers to inject arbitrary web script or HTML via the query parameter...
CVE-2004-2081
The samiftp.dll library in Sami FTP Server 1.1.3 allows local users to cause a denial of service pmsystem.exe crash by issuing 1 a CD command with a tilde character or dot dot /../ or 2 a GET command for an unavailable file...
CVE-2004-2101
The sysinfo script in GeoHttpServer allows remote attackers to cause a denial of service crash via a long pwd parameter, possibly triggering a buffer overflow...
CVE-2004-2103
Cross-site scripting XSS vulnerability in Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to process arbitrary script or HTML as other users via 1 a malformed request for a Perl program with script in the filename, 2 the User.id parameter to the webacc servlet, 3 the...
CVE-2004-2115
Multiple cross-site scripting XSS vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the 1 action, 2 username, or 3 password parameters in an isqlplus request...
CVE-2004-2126
The upgrade for BlackICE PC Protection 3.6 and earlier sets insecure permissions for .INI files such as 1 blackice.ini, 2 firewall.ini, 3 protect.ini, or 4 sigs.ini, which allows local users to modify BlackICE configuration or possibly execute arbitrary code by exploiting vulnerabilities in the...
CVE-2004-2137
Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" setting, leaks the BCC recipients of the message to the addresses listed in the To and CC fields, which may allow remote attackers to obtain sensitive information...
CVE-2004-2154
CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive...
CVE-2004-2155
Online-bookmarks before 0.4.6 allows remote attackers to bypass its authentication mechanism via a direct request to 1 config/, 2 bookmarks.php, 3 footer.php, 4 main.php, 5 tree.php, or 6 functions.php...