6866 matches found
CVE-2004-0343
The CVE-2004-0343 entry concerns YaBB SE 1.5.4 through 1.5.5b, where multiple SQL injection flaws enable remote attackers to execute arbitrary SQL. The vulnerable vectors are in ModifyMessage.php via the msg parameter and via the postid parameter. Impact is described as complete confidentiality, ...
CVE-2004-0239
CVE-2004-0239 affects PhotoPost PHP Pro up to version 4.6. The vulnerability is a SQL injection in the showphoto.php script, exploitable via the photo parameter, which allows remote attackers to access unauthorized data. The issue stems from unsanitized input used in a database query. Affected so...
CVE-2004-0293
ShopCartCGI 2.3 contains a directory traversal flaw. The vulnerability affects the CGI scripts gotopage.cgi and genindexpage.cgi, permitting an unauthenticated remote attacker to read arbitrary files via a .. path in HTTP requests. Exploitation details or fixes are not provided in the connected d...
CVE-2004-0248
CVE-2004-0248 describes a cross-site scripting (XSS) vulnerability in PHPX 3.2.3. The issue allows remote attackers to run arbitrary script as another user by injecting HTML or script into three inputs: the keywords argument of main.inc.php, the body argument of help.inc.php, or the subject field...
CVE-2004-0272
CVE-2004-0272 describes an SQL injection vulnerability in MaxWebPortal that allows remote attackers to inject arbitrary SQL via the SendTo parameter in Personal Messages, potentially exposing sensitive information. The NVD reports a CVSS v2 base score of 7.5 (HIGH) with network access, low attack...
CVE-2004-0239
SQL injection vulnerability in showphoto.php in PhotoPost PHP Pro 4.6 and earlier allows remote attackers to gain unauthorized access via the photo variable...
CVE-2004-0294
YaBB 1 SP 1.3.1 is vulnerable to information disclosure via password enumeration. The vulnerability arises because the application displays different error messages when a user exists versus does not exist, enabling remote attackers to determine valid usernames and perform brute‑force password gu...
CVE-2004-0289
The CVE-2004-0289 entry concerns SignatureDB 0.1.1 where a buffer overflow in the sdbscan component can be triggered by a database file containing a large key parameter. This allows local users to cause a denial of service through a segmentation fault. The vulnerability is described in multiple s...
CVE-2004-0300
The CVE-2004-0300 entry concerns Ecommerce Corporation Online Store Kit 3.0. The vulnerability is a SQL injection in multiple parameters: cat in shop.php, id in more.php, cat_manufacturer in shop_by_brand.php, and id in listing.php. This allows remote attackers to inject arbitrary SQL and gain un...
CVE-2004-0355
CVE-2004-0355 affects Invision Power Board 1.3 Final. A remote attacker can select a non-image file for the "Personal Photo" field, causing an error message that reveals the installation path (partial information disclosure). The NVD/NVD-derived data indicate a base score of 5.0 (Medium), network...
CVE-2004-0317
CVE-2004-0317 affects Load Sharing Facility (LSF) versions 4.x, 5.x, and 6.x. The vulnerability is a buffer overflow in the eauth component triggered by a long LSF_From_PC parameter, allowing local users or attackers within an LSF cluster to cause a denial of service (segmentation fault) and pote...
CVE-2004-0237
CVE-2004-0237 corresponds to a directory traversal vulnerability in the Aprox PHP Portal, specifically in index.php where the show parameter can be used to read arbitrary files. This is publicly documented in CVE/NVD entries as a vulnerability enabling unauthorized file disclosure. The connected ...
CVE-2004-0313
PSO Proxy 0.91 contains a stack buffer overflow in its HTTP handling. A remote attacker can send an excessively long HTTP request (e.g., a long GET argument or long method name) to overwrite the stack, causing denial of service and potentially executing arbitrary code. Public evidence of exploita...
CVE-2004-0346
Off-by-one buffer overflow in xlateasciiwrite in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command...
CVE-2004-0281
CVE-2004-0281 affects Caucho Resin (2.1.12) and is a path traversal vulnerability that allows remote disclosure of files under the /WEB-INF/ directory by requesting WEB-INF.., effectively bypassing directory boundaries. The core issue is improper normalization of path traversal sequences, enablin...
CVE-2004-0112
The CVE-2004-0112 issue affects OpenSSL 0.9.7a/b/c: during the SSL/TLS handshake, the Kerberos ciphersuite path fails to validate the Kerberos ticket length, enabling a remote attacker to cause a denial-of-service by triggering an out-of-bounds read. Public sources in connected documents confirm ...
CVE-2004-0112
The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service crash via a crafted SSL/TLS handshake that causes an...
CVE-2004-0330
Buffer overflow in Serv-U ftp before 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM command...
CVE-2004-0305
Cross-site scripting XSS vulnerability in error.asp in WebCortex WebStores 2000 6.0 allows remote attackers to execute arbitrary script as other users and steal session IDs via the Messageid parameter...