CVEs

340,789 total · page 6610 of 6,816

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2004-1198	Microsoft Internet Explorer	0.00	—	0.01	Dec 31, 2004	Microsoft Internet Explorer allows remote attackers to cause a denial of service (application crash from memory consumption), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.
CVE-2004-1200	Mozilla Corporation Firefox	0.00	—	0.01	Dec 31, 2004	Firefox and Mozilla allow remote attackers to cause a denial of service (application crash from memory consumption), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.
CVE-2004-1234	Linux Kernel	0.00	—	0.00	Dec 31, 2004	load_elf_binary in Linux before 2.4.26 allows local users to cause a denial of service (system crash) via an ELF binary in which the interpreter is NULL.
CVE-2004-1236	Netscape Directory Server	0.03	—	0.35	Dec 31, 2004	Buffer overflow in the LDAP component for Netscape Directory Server (NDS) 3.6 on HP-UX and other operating systems allows remote attackers to execute arbitrary code.
CVE-2004-1296	GNU Groff	0.00	—	0.00	Dec 31, 2004	The (1) eqn2graph and (2) pic2graph scripts in groff 1.18.1 allow local users to overwrite arbitrary files via a symlink attack on temporary files.
CVE-2004-1306	Microsoft Windows Nt	0.07	—	0.48	Dec 31, 2004	Heap-based buffer overflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers to execute arbitrary code via a crafted .hlp file.
CVE-2004-1327	Crystal Art Software Crystal FTP	0.03	—	0.05	Dec 31, 2004	Buffer overflow in Crystal FTP Client 2.8 allows remote malicious servers to execute arbitrary code via a response to a LIST command that contains a file name with a long extension.
CVE-2004-1328	HPE HP-UX	0.00	—	0.00	Dec 31, 2004	Unknown vulnerability in newgrp in HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain elevated privileges.
CVE-2004-1330	IBM Aix	0.03	—	0.00	Dec 31, 2004	Buffer overflow in paginit in AIX 5.1 through 5.3 allows local users to execute arbitrary code via a long username.
CVE-2004-1332	HPE HP-UX	0.01	—	0.16	Dec 31, 2004	Stack-based buffer overflow in the FTP daemon in HP-UX 11.11i, with the -v (debug) option enabled, allows remote attackers to execute arbitrary code via a long command request.
CVE-2004-1343	Nongnu Cvs	0.00	—	0.01	Dec 31, 2004	CVS 1.12 and earlier on Debian GNU/Linux does not properly handle when a mapping for the current repository does not exist in the cvs-repouids file, which allows remote attackers to cause a denial of service (server crash).
CVE-2004-1382	GNU Glibc	0.00	—	0.00	Dec 31, 2004	The glibcbug script in glibc 2.3.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CVE-2004-0968.
CVE-2004-1383	PhpGroupWare Phpgroupware	0.03	—	0.01	Dec 31, 2004	Multiple SQL injection vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to execute arbitrary SQL statements via the (1) order, (2) project_id, (3) pro_main, or (4) hours_id parameters to index.php or (5) ticket_id to viewticket_details.php.
CVE-2004-1384	PhpGroupWare Phpgroupware	0.03	—	0.03	Dec 31, 2004	Multiple cross-site scripting (XSS) vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) kp3, (2) type, (3) msg, (4) forum_id, (5) pos, (6) cats_app, (7) cat_id, (8) msgball[msgnum], (9) fldball[acctnum]…
CVE-2004-1385	PhpGroupWare Phpgroupware	0.03	—	0.05	Dec 31, 2004	phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpected characters in the session ID such as shell metacharacters, (2) an invalid appname parameter to preferences.php or (3) an invalid menuaction parameter to index.php, which…
CVE-2004-1386	Tiki Tiki	0.00	—	0.01	Dec 31, 2004	TikiWiki before 1.8.4.1 does not properly verify uploaded images, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2005-0200.
CVE-2004-1387	Apache HTTP Server	0.00	—	0.00	Dec 31, 2004	The check_forensic script in apache-utils package 1.3.31 allows local users to overwrite or create arbitrary files via a symlink attack on temporary files.
CVE-2004-1388	Gpsd Gpsd	0.09	—	0.74	Dec 31, 2004	Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1.9.0 through 2.7 allows remote attackers to execute arbitrary code via certain GPS requests containing format string specifiers that are not properly handled in syslog calls.
CVE-2004-1389	Symantec Netbackup	0.05	—	0.28	Dec 31, 2004	Unknown vulnerability in the Veritas NetBackup Administrative Assistant interface for NetBackup BusinesServer 3.4, 3.4.1, and 4.5, DataCenter 3.4, 3.4.1, and 4.5, Enterprise Server 5.1, and NetBackup Server 5.0 and 5.1, allows attackers to execute arbitrary commands via the…
CVE-2004-1390	QNX Rtp	0.02	—	0.26	Dec 31, 2004	Multiple buffer overflows in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allow remote attackers to execute arbitrary code via a long argument to the (1) -F, (2) name, (3) en, (4) upscript, (5) downscript, (6) retries, (7) timeout, (8) scriptdetach, (9) noscript, (10) nodetach, (11)…
CVE-2004-1391	QNX Rtp	0.00	—	0.00	Dec 31, 2004	Untrusted execution path vulnerability in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allows local users to execute arbitrary programs by modifying the PATH environment variable to point to a malicious mount program.
CVE-2004-1392	PHP PHP	0.04	—	0.08	Dec 31, 2004	PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_init function.
CVE-2004-1393	Sun Corporation Solaris	0.00	—	0.02	Dec 31, 2004	Unknown vulnerability in the tcsetattr function for Sun Solaris for SPARC 2.6, 7, and 8 allows local users to cause a denial of service (system hang).
CVE-2004-1394	Sun Corporation Solaris	0.00	—	0.00	Dec 31, 2004	The pfexec function for Sun Solaris 8 and 9 does not properly handle when a custom profile contains an invalid entry in the exec_attr database, which may allow local users with custom rights profiles to execute profile commands with additional privileges.
CVE-2004-1395	Monolith Productions Contract Jack	0.04	—	0.14	Dec 31, 2004	The Lithtech engine, as used in (1) Contract Jack 1.1 and earlier, (2) No one lives forever 2 1.3 and earlier, (3) Tron 2.0 1.042 and earlier, (4) F.E.A.R. (First Encounter Assault and Recon), and possibly other games, allows remote attackers to cause a denial of service…
CVE-2004-1396	Winamp Winamp	0.00	—	0.03	Dec 31, 2004	Winamp 5.07 and possibly other versions, allows remote attackers to cause a denial of service (application crash or CPU consumption) via (1) an mp4 or m4a playlist file that contains invalid tag data or (2) an invalid .nsv or .nsa file.
CVE-2004-1397	Usemodwiki Usemodwiki	0.00	—	0.00	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in UseModWiki 1.0 allows remote attackers to inject arbitrary web script or HTML via an argument to wiki.pl.
CVE-2004-1398	Roxio Toast	0.00	—	0.00	Dec 31, 2004	Format string vulnerability in prelink.c in kextload in Apple OS X, as used by TDIXSupport in Roxio Toast Titanium and possibly other products, allows local users to execute arbitrary code via format string specifiers in the extension argument.
CVE-2004-1399	PhpBB Attachment module	0.00	—	0.00	Dec 31, 2004	Directory traversal vulnerability in the Attachment module 2.3.10 and earlier for phpBB allows remote attackers to read arbitrary files via a .. (dot dot) in the filename.
CVE-2004-1400	Active Server Corner Asp Calendar	0.03	—	0.03	Dec 31, 2004	The control panel in ASP Calendar does not require authentication to access, which allows remote attackers to gain unauthorized access via a direct request to main.asp.
CVE-2004-1401	Asp Rider Asp Rider	0.03	—	0.01	Dec 31, 2004	SQL injection vulnerability in verify.asp in Asp-rider allows remote attackers to execute arbitrary SQL statements and bypass authentication via the username parameter.
CVE-2004-1402	Iwebnegar Iwebnegar	0.03	—	0.00	Dec 31, 2004	SQL injection vulnerability in iWebNegar allows remote attackers to execute arbitrary SQL commands via (1) the string parameter for index.php, (2) comments.php, or (3) the administrator login page.
CVE-2004-1403	Sir Gnuboard	0.00	—	0.01	Dec 31, 2004	PHP remote file inclusion vulnerability in index.php in GNUBoard 3.39 and earlier allows remote attackers to execute arbitrary PHP code by modifying the doc parameter to reference a URL on a remote web server that contains the code.
CVE-2004-1404	Opentools Attachment Mod	0.00	—	0.02	Dec 31, 2004	Attachment Mod 2.3.10 module for phpBB, when used with Apache mod_mime, does not properly handle files with multiple file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.
CVE-2004-1405	MediaWiki Mediawiki	0.00	—	0.12	Dec 31, 2004	MediaWiki 1.3.8 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.
CVE-2004-1406	Ikonboard.com Ikonboard	0.03	—	0.00	Dec 31, 2004	SQL injection vulnerability in ikonboard.cgi in Ikonboard 3.1.0 through 3.1.3 allows remote attackers to inject arbitrary SQL commands via the (1) st or (2) keywords parameter.
CVE-2004-1407	Singapore Image Gallery Web Application	0.00	—	0.00	Dec 31, 2004	Multiple directory traversal vulnerabilities in singapore Image Gallery Web Application 0.9.10 allow remote attackers to (1) read arbitrary files via the showThumb method for thumb.php, or (2) delete arbitrary files via admin.class.php.
CVE-2004-1408	Singapore Image Gallery Web Application	0.00	—	0.01	Dec 31, 2004	The addImage method for admin.class.php in Image Gallery Web Application 0.9.10 does not properly check filenames, which allows remote attackers to upload and execute arbitrary files.
CVE-2004-1409	Singapore Image Gallery Web Application	0.00	—	0.00	Dec 31, 2004	Multiple cross-site scripting vulnerabilities in Image Gallery Web Application 0.9.10 allow remote attackers to inject arbitrary web script or HTML.
CVE-2004-1410	Gadu Gadu Gadu-Gadu	0.03	—	0.00	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in Gadu-Gadu build 155 and earlier allows remote attackers to inject arbitrary web script via a URL, which is echoed in a popup window that displays a parsing error message, a different vulnerability than CVE-2004-1229.
CVE-2004-1411	Gadu Gadu Gadu-Gadu	0.00	—	0.01	Dec 31, 2004	Gadu-Gadu build 155 and earlier allows remote attackers to cause a denial of service (infinite loop) via a message that contains an image whose filename does not start with restricted characters.
CVE-2004-1412	Kayako Esupport	0.03	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in index.php in Kayako eSupport 2.x allows remote attackers to inject arbitrary web script or HTML via the searchm parameter.
CVE-2004-1413	Kayako Esupport	0.03	—	0.00	Dec 31, 2004	Multiple SQL injection vulnerabilities in Kayako eSupport 2.x allow remote attackers to execute arbitrary SQL commands via the (1) subcat, (2) rate, (3) questiondetails, (4) ticketkey22, (5) email22 parameters to index.php, or (6) the e-mail field of the Forgot Key feature.
CVE-2004-1414	Gadu Gadu Gadu-Gadu	0.00	—	0.01	Dec 31, 2004	Gadu-Gadu 6.1 build 156 allows remote attackers to cause a denial of service (application hang) via a message that contains many special strings that are converted to images.
CVE-2004-1415	2bgal 2bgal	0.03	—	0.01	Dec 31, 2004	SQL injection vulnerability in (1) disp_album.php and possibly (2) disp_img.php in 2Bgal 2.4 and 2.5.1 allows remote attackers to execute arbitrary SQL commands via the id_album parameter.
CVE-2004-1416	RealNetworks RealOne	0.00	—	0.01	Dec 31, 2004	pnxr3260.dll in the RealOne 2.0 build 6.0.11.868 browser plugin, as used in Internet Explorer, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embed tag.
CVE-2004-1417	Psychostats Psychostats	0.03	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in login.php in PsychoStats 2.2.4 Beta and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter.
CVE-2004-1418	WordPress WPKontakt	0.03	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in WPKontakt 3.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via an e-mail address, which is not quoted when a parsing error is generated.
CVE-2004-1419	Zeroboard Zeroboard	0.00	—	0.04	Dec 31, 2004	PHP remote file inclusion vulnerability in ZeroBoard 4.1pl4 and earlier allows remote attackers to execute arbitrary PHP code by modifying the (1) _zb_path parameter to outlogin.php or (2) dir parameter to write.php to reference a URL on a remote web server that contains the…
CVE-2004-1420	Whm Autopilot	0.03	—	0.01	Dec 31, 2004	Multiple cross-site scripting (XSS) vulnerabilities in header.php in WHM AutoPilot 2.4.6.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) site_title or (2) http_images parameter.

CVE-2004-1198Dec 31, 2004
Microsoft
Internet Explorer
risk 0.00cvss —epss 0.01
Microsoft Internet Explorer allows remote attackers to cause a denial of service (application crash from memory consumption), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.
CVE-2004-1200Dec 31, 2004
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.01
Firefox and Mozilla allow remote attackers to cause a denial of service (application crash from memory consumption), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.
CVE-2004-1234Dec 31, 2004
Linux
Kernel
risk 0.00cvss —epss 0.00
load_elf_binary in Linux before 2.4.26 allows local users to cause a denial of service (system crash) via an ELF binary in which the interpreter is NULL.
CVE-2004-1236Dec 31, 2004
Netscape
Directory Server
risk 0.03cvss —epss 0.35
Buffer overflow in the LDAP component for Netscape Directory Server (NDS) 3.6 on HP-UX and other operating systems allows remote attackers to execute arbitrary code.
CVE-2004-1296Dec 31, 2004
GNU
Groff
risk 0.00cvss —epss 0.00
The (1) eqn2graph and (2) pic2graph scripts in groff 1.18.1 allow local users to overwrite arbitrary files via a symlink attack on temporary files.
CVE-2004-1306Dec 31, 2004
Microsoft
Windows Nt
risk 0.07cvss —epss 0.48
Heap-based buffer overflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers to execute arbitrary code via a crafted .hlp file.
CVE-2004-1327Dec 31, 2004
Crystal Art Software
Crystal FTP
risk 0.03cvss —epss 0.05
Buffer overflow in Crystal FTP Client 2.8 allows remote malicious servers to execute arbitrary code via a response to a LIST command that contains a file name with a long extension.
CVE-2004-1328Dec 31, 2004
HPE
HP-UX
risk 0.00cvss —epss 0.00
Unknown vulnerability in newgrp in HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain elevated privileges.
CVE-2004-1330Dec 31, 2004
IBM
Aix
risk 0.03cvss —epss 0.00
Buffer overflow in paginit in AIX 5.1 through 5.3 allows local users to execute arbitrary code via a long username.
CVE-2004-1332Dec 31, 2004
HPE
HP-UX
risk 0.01cvss —epss 0.16
Stack-based buffer overflow in the FTP daemon in HP-UX 11.11i, with the -v (debug) option enabled, allows remote attackers to execute arbitrary code via a long command request.
CVE-2004-1343Dec 31, 2004
Nongnu
Cvs
risk 0.00cvss —epss 0.01
CVS 1.12 and earlier on Debian GNU/Linux does not properly handle when a mapping for the current repository does not exist in the cvs-repouids file, which allows remote attackers to cause a denial of service (server crash).
CVE-2004-1382Dec 31, 2004
GNU
Glibc
risk 0.00cvss —epss 0.00
The glibcbug script in glibc 2.3.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CVE-2004-0968.
CVE-2004-1383Dec 31, 2004
PhpGroupWare
Phpgroupware
risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to execute arbitrary SQL statements via the (1) order, (2) project_id, (3) pro_main, or (4) hours_id parameters to index.php or (5) ticket_id to viewticket_details.php.
CVE-2004-1384Dec 31, 2004
PhpGroupWare
Phpgroupware
risk 0.03cvss —epss 0.03
Multiple cross-site scripting (XSS) vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) kp3, (2) type, (3) msg, (4) forum_id, (5) pos, (6) cats_app, (7) cat_id, (8) msgball[msgnum], (9) fldball[acctnum]…
CVE-2004-1385Dec 31, 2004
PhpGroupWare
Phpgroupware
risk 0.03cvss —epss 0.05
phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpected characters in the session ID such as shell metacharacters, (2) an invalid appname parameter to preferences.php or (3) an invalid menuaction parameter to index.php, which…
CVE-2004-1386Dec 31, 2004
Tiki
Tiki
risk 0.00cvss —epss 0.01
TikiWiki before 1.8.4.1 does not properly verify uploaded images, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2005-0200.
CVE-2004-1387Dec 31, 2004
Apache
HTTP Server
risk 0.00cvss —epss 0.00
The check_forensic script in apache-utils package 1.3.31 allows local users to overwrite or create arbitrary files via a symlink attack on temporary files.
CVE-2004-1388Dec 31, 2004
Gpsd
Gpsd
risk 0.09cvss —epss 0.74
Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1.9.0 through 2.7 allows remote attackers to execute arbitrary code via certain GPS requests containing format string specifiers that are not properly handled in syslog calls.
CVE-2004-1389Dec 31, 2004
Symantec
Netbackup
risk 0.05cvss —epss 0.28
Unknown vulnerability in the Veritas NetBackup Administrative Assistant interface for NetBackup BusinesServer 3.4, 3.4.1, and 4.5, DataCenter 3.4, 3.4.1, and 4.5, Enterprise Server 5.1, and NetBackup Server 5.0 and 5.1, allows attackers to execute arbitrary commands via the…
CVE-2004-1390Dec 31, 2004
QNX
Rtp
risk 0.02cvss —epss 0.26
Multiple buffer overflows in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allow remote attackers to execute arbitrary code via a long argument to the (1) -F, (2) name, (3) en, (4) upscript, (5) downscript, (6) retries, (7) timeout, (8) scriptdetach, (9) noscript, (10) nodetach, (11)…
CVE-2004-1391Dec 31, 2004
QNX
Rtp
risk 0.00cvss —epss 0.00
Untrusted execution path vulnerability in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allows local users to execute arbitrary programs by modifying the PATH environment variable to point to a malicious mount program.
CVE-2004-1392Dec 31, 2004
PHP
PHP
risk 0.04cvss —epss 0.08
PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_init function.
CVE-2004-1393Dec 31, 2004
Sun Corporation
Solaris
risk 0.00cvss —epss 0.02
Unknown vulnerability in the tcsetattr function for Sun Solaris for SPARC 2.6, 7, and 8 allows local users to cause a denial of service (system hang).
CVE-2004-1394Dec 31, 2004
Sun Corporation
Solaris
risk 0.00cvss —epss 0.00
The pfexec function for Sun Solaris 8 and 9 does not properly handle when a custom profile contains an invalid entry in the exec_attr database, which may allow local users with custom rights profiles to execute profile commands with additional privileges.
CVE-2004-1395Dec 31, 2004
Monolith Productions
Contract Jack
risk 0.04cvss —epss 0.14
The Lithtech engine, as used in (1) Contract Jack 1.1 and earlier, (2) No one lives forever 2 1.3 and earlier, (3) Tron 2.0 1.042 and earlier, (4) F.E.A.R. (First Encounter Assault and Recon), and possibly other games, allows remote attackers to cause a denial of service…
CVE-2004-1396Dec 31, 2004
Winamp
Winamp
risk 0.00cvss —epss 0.03
Winamp 5.07 and possibly other versions, allows remote attackers to cause a denial of service (application crash or CPU consumption) via (1) an mp4 or m4a playlist file that contains invalid tag data or (2) an invalid .nsv or .nsa file.
CVE-2004-1397Dec 31, 2004
Usemodwiki
Usemodwiki
risk 0.00cvss —epss 0.00
Cross-site scripting (XSS) vulnerability in UseModWiki 1.0 allows remote attackers to inject arbitrary web script or HTML via an argument to wiki.pl.
CVE-2004-1398Dec 31, 2004
Roxio
Toast
risk 0.00cvss —epss 0.00
Format string vulnerability in prelink.c in kextload in Apple OS X, as used by TDIXSupport in Roxio Toast Titanium and possibly other products, allows local users to execute arbitrary code via format string specifiers in the extension argument.
CVE-2004-1399Dec 31, 2004
PhpBB
Attachment module
risk 0.00cvss —epss 0.00
Directory traversal vulnerability in the Attachment module 2.3.10 and earlier for phpBB allows remote attackers to read arbitrary files via a .. (dot dot) in the filename.
CVE-2004-1400Dec 31, 2004
Active Server Corner
Asp Calendar
risk 0.03cvss —epss 0.03
The control panel in ASP Calendar does not require authentication to access, which allows remote attackers to gain unauthorized access via a direct request to main.asp.
CVE-2004-1401Dec 31, 2004
Asp Rider
Asp Rider
risk 0.03cvss —epss 0.01
SQL injection vulnerability in verify.asp in Asp-rider allows remote attackers to execute arbitrary SQL statements and bypass authentication via the username parameter.
CVE-2004-1402Dec 31, 2004
Iwebnegar
Iwebnegar
risk 0.03cvss —epss 0.00
SQL injection vulnerability in iWebNegar allows remote attackers to execute arbitrary SQL commands via (1) the string parameter for index.php, (2) comments.php, or (3) the administrator login page.
CVE-2004-1403Dec 31, 2004
Sir
Gnuboard
risk 0.00cvss —epss 0.01
PHP remote file inclusion vulnerability in index.php in GNUBoard 3.39 and earlier allows remote attackers to execute arbitrary PHP code by modifying the doc parameter to reference a URL on a remote web server that contains the code.
CVE-2004-1404Dec 31, 2004
Opentools
Attachment Mod
risk 0.00cvss —epss 0.02
Attachment Mod 2.3.10 module for phpBB, when used with Apache mod_mime, does not properly handle files with multiple file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.
CVE-2004-1405Dec 31, 2004
MediaWiki
Mediawiki
risk 0.00cvss —epss 0.12
MediaWiki 1.3.8 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.
CVE-2004-1406Dec 31, 2004
Ikonboard.com
Ikonboard
risk 0.03cvss —epss 0.00
SQL injection vulnerability in ikonboard.cgi in Ikonboard 3.1.0 through 3.1.3 allows remote attackers to inject arbitrary SQL commands via the (1) st or (2) keywords parameter.
CVE-2004-1407Dec 31, 2004
Singapore
Image Gallery Web Application
risk 0.00cvss —epss 0.00
Multiple directory traversal vulnerabilities in singapore Image Gallery Web Application 0.9.10 allow remote attackers to (1) read arbitrary files via the showThumb method for thumb.php, or (2) delete arbitrary files via admin.class.php.
CVE-2004-1408Dec 31, 2004
Singapore
Image Gallery Web Application
risk 0.00cvss —epss 0.01
The addImage method for admin.class.php in Image Gallery Web Application 0.9.10 does not properly check filenames, which allows remote attackers to upload and execute arbitrary files.
CVE-2004-1409Dec 31, 2004
Singapore
Image Gallery Web Application
risk 0.00cvss —epss 0.00
Multiple cross-site scripting vulnerabilities in Image Gallery Web Application 0.9.10 allow remote attackers to inject arbitrary web script or HTML.
CVE-2004-1410Dec 31, 2004
Gadu Gadu
Gadu-Gadu
risk 0.03cvss —epss 0.00
Cross-site scripting (XSS) vulnerability in Gadu-Gadu build 155 and earlier allows remote attackers to inject arbitrary web script via a URL, which is echoed in a popup window that displays a parsing error message, a different vulnerability than CVE-2004-1229.
CVE-2004-1411Dec 31, 2004
Gadu Gadu
Gadu-Gadu
risk 0.00cvss —epss 0.01
Gadu-Gadu build 155 and earlier allows remote attackers to cause a denial of service (infinite loop) via a message that contains an image whose filename does not start with restricted characters.
CVE-2004-1412Dec 31, 2004
Kayako
Esupport
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in index.php in Kayako eSupport 2.x allows remote attackers to inject arbitrary web script or HTML via the searchm parameter.
CVE-2004-1413Dec 31, 2004
Kayako
Esupport
risk 0.03cvss —epss 0.00
Multiple SQL injection vulnerabilities in Kayako eSupport 2.x allow remote attackers to execute arbitrary SQL commands via the (1) subcat, (2) rate, (3) questiondetails, (4) ticketkey22, (5) email22 parameters to index.php, or (6) the e-mail field of the Forgot Key feature.
CVE-2004-1414Dec 31, 2004
Gadu Gadu
Gadu-Gadu
risk 0.00cvss —epss 0.01
Gadu-Gadu 6.1 build 156 allows remote attackers to cause a denial of service (application hang) via a message that contains many special strings that are converted to images.
CVE-2004-1415Dec 31, 2004
2bgal
2bgal
risk 0.03cvss —epss 0.01
SQL injection vulnerability in (1) disp_album.php and possibly (2) disp_img.php in 2Bgal 2.4 and 2.5.1 allows remote attackers to execute arbitrary SQL commands via the id_album parameter.
CVE-2004-1416Dec 31, 2004
RealNetworks
RealOne
risk 0.00cvss —epss 0.01
pnxr3260.dll in the RealOne 2.0 build 6.0.11.868 browser plugin, as used in Internet Explorer, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embed tag.
CVE-2004-1417Dec 31, 2004
Psychostats
Psychostats
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in login.php in PsychoStats 2.2.4 Beta and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter.
CVE-2004-1418Dec 31, 2004
WordPress
WPKontakt
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in WPKontakt 3.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via an e-mail address, which is not quoted when a parsing error is generated.
CVE-2004-1419Dec 31, 2004
Zeroboard
Zeroboard
risk 0.00cvss —epss 0.04
PHP remote file inclusion vulnerability in ZeroBoard 4.1pl4 and earlier allows remote attackers to execute arbitrary PHP code by modifying the (1) _zb_path parameter to outlogin.php or (2) dir parameter to write.php to reference a URL on a remote web server that contains the…
CVE-2004-1420Dec 31, 2004
Whm
Autopilot
risk 0.03cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in header.php in WHM AutoPilot 2.4.6.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) site_title or (2) http_images parameter.