CVEs

378,418 total · page 7371 of 7,569

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2004-2147	Symantec Norton Antivirus		0.00	—	0.01	Dec 31, 2004	Unknown versions of Symantec Norton AntiVirus and Microsoft Outlook allow attackers to cause a denial of service (crash) via malformed e-mail messages (1) without a body or (2) without a carriage return ("\n") separating the headers from the body.
CVE-2004-2148	Slava Astashonok Fprobe		0.00	—	0.00	Dec 31, 2004	Unknown local vulnerability in the "change user" feature of Slava Astashonok Fprobe 1.0.5 and earlier has unknown impact and attack vectors.
CVE-2004-2149	MySQL MySQL		0.00	—	0.06	Dec 31, 2004	Buffer overflow in the prepared statements API in libmysqlclient for MySQL 4.1.3 beta and 4.1.4 allows remote attackers to cause a denial of service via a large number of placeholders.
CVE-2004-2150	Nettica Corporation INTELLIPEER Email Server		0.00	—	0.02	Dec 31, 2004	Nettica Corporation INTELLIPEER Email Server 1.01 displays different error messages for valid and invalid account names, which allows remote attackers to determine valid account names.
CVE-2004-2151	Virtual Projects Chatman		0.03	—	0.04	Dec 31, 2004	Chatman 1.1.1 RC1 and earlier allows remote attackers to cause a denial of service (memory consumption or application crash) via a very large data size.
CVE-2004-2152	MediaWiki Mediawiki		0.00	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in 'raw' page output mode for MediaWiki 1.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML.
CVE-2004-2153	Real Estate Management Software Real Estate Management Software		0.00	—	0.02	Dec 31, 2004	Multiple unknown vulnerabilities in Real Estate Management Software 1.0 have unknown impact and attack vectors.
CVE-2004-2154	Apple Inc. Cups	Cri	0.64	9.8	0.02	Dec 31, 2004	CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive.
CVE-2004-2155	Ol Bookmarks Ol Bookmarks		0.00	—	0.02	Dec 31, 2004	Online-bookmarks before 0.4.6 allows remote attackers to bypass its authentication mechanism via a direct request to (1) config/*, (2) bookmarks.php, (3) footer.php, (4) main.php, (5) tree.php, or (6) functions.php.
CVE-2004-2156	Recruitment Agency Software Online Recruitment Agency		0.00	—	0.02	Dec 31, 2004	Multiple unknown vulnerabilities in Online Recruitment Agency 1.0 have unknown impact and attack vectors.
CVE-2004-2157	Serendipity Serendipity		0.00	—	0.02	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in Comment.php in Serendipity 0.7 beta1, and possibly other versions before 0.7-beta3, allows remote attackers to inject arbitrary HTML and PHP code via the (1) email or (2) username field.
CVE-2004-2158	Serendipity Serendipity		0.03	—	0.04	Dec 31, 2004	SQL injection vulnerability in Serendipity 0.7-beta1 allows remote attackers to execute arbitrary SQL commands via the entry_id parameter to (1) exit.php or (2) comment.php.
CVE-2004-2159	Xmlstarlet Command Line XML Toolkit		0.00	—	0.02	Dec 31, 2004	Multiple buffer overflows in XMLStarlet Command Line XML Toolkit 0.9.3 have unknown impact and attack vectors via (1) xml_elem.c and (2) xml_select.c.
CVE-2004-2160	Xmlstarlet Command Line XML Toolkit		0.00	—	0.02	Dec 31, 2004	Format string vulnerability in xml_elem.c for XMLStarlet Command Line XML Toolkit 0.9.3 may allow attackers to cause a denial of service or execute arbitrary code.
CVE-2004-2161	Tutos Tutos		0.03	—	0.03	Dec 31, 2004	SQL injection vulnerability in file_overview.php in TUTOS 1.1 allows remote attackers to execute arbitrary SQL commands via the link_id parameter.
CVE-2004-2162	Tutos Tutos		0.03	—	0.04	Dec 31, 2004	Multiple cross-site scripting (XSS) vulnerabilities in TUTOS 1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the search field of the Address Module or (2) the t parameter to app_new.php.
CVE-2004-2163	OpenBSD OpenBSD		0.00	—	0.02	Dec 31, 2004	login_radius on OpenBSD 3.2, 3.5, and possibly other versions does not verify the shared secret in a response packet from a RADIUS server, which allows remote attackers to bypass authentication by spoofing server replies.
CVE-2004-2164	Vpasp VP-ASP		0.00	—	0.02	Dec 31, 2004	shoprestoreorder.asp in VP-ASP 5.0 does not close the database connection when a user restores a previous order, which allows remote attackers to cause a denial of service (connection consumption).
CVE-2004-2165	Impressions Games Lords Of The Realm Iii		0.00	—	0.03	Dec 31, 2004	Lords of the Realm III 1.01 and earlier, when in the lobby stage, allows remote attackers to cause a denial of service (crash from unallocated memory write) via a long user nickname.
CVE-2004-2166	Canon Imagerunner 5000i		0.00	—	0.02	Dec 31, 2004	The print-from-email feature in the Canon ImageRUNNER (iR) 5000i and C3200 digital printer, when not using IP address range filtering, allows remote attackers to print arbitrary text without authentication via a text/plain email to TCP port 25.
CVE-2004-2167	Latex2rtf Latex2rtf		0.04	—	0.14	Dec 31, 2004	Multiple buffer overflows in LaTeX2rtf 1.9.15, and possibly other versions, allow remote attackers to execute arbitrary code via (1) the expandmacro function, and possibly (2) Environments and (3) TranslateCommand.
CVE-2004-2168	Baardsen Software Basomail Server		0.00	—	0.02	Dec 31, 2004	BaSoMail 1.24 allows remote attackers to cause a denial of service (CPU consumption) via multiple connections to TCP port (1) 25 (SMTP) or (2) 110 (POP3).
CVE-2004-2169	A A S Application Access Server A A S Application Access Server		0.00	—	0.01	Dec 31, 2004	Application Access Server (A-A-S) 1.0.37 and earlier allows remote authenticated users to cause a denial of service (application crash) via a long file request.
CVE-2004-2170	Niti Telecom Caravan Business Server		0.03	—	0.04	Dec 31, 2004	Directory traversal vulnerability in sample_showcode.html in Caravan 2.00/03d and earlier allows remote attackers to read arbitrary files via the fname parameter.
CVE-2004-2171	Cherokee Cherokee Httpd		0.03	—	0.04	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in Cherokee before 0.4.8 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting error page.
CVE-2004-2172	Netsourcecommerce Productcart	Hig	0.52	7.5	0.07	Dec 31, 2004	EarlyImpact ProductCart uses a weak encryption scheme to encrypt passwords, which allows remote attackers to obtain the password via a chosen plaintext attack.
CVE-2004-2173	Early Impact Productcart		0.00	—	0.02	Dec 31, 2004	SQL injection vulnerability in advSearch_h.asp in EarlyImpact ProductCart allows remote attackers to execute arbitrary SQL commands via the priceUntil parameter.
CVE-2004-2174	Early Impact Productcart		0.00	—	0.02	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in Custva.asp in EarlyImpact ProductCart allows remote attackers to inject arbitrary Javascript via the redirectUrl parameter.
CVE-2004-2175	Photopost Reviewpost PHP Pro		0.03	—	0.01	Dec 31, 2004	Multiple SQL injection vulnerabilities in ReviewPost PHP Pro allow remote attackers to execute arbitrary SQL commands via the (1) product parameter to showproduct.php or (2) cat parameter to showcat.php.
CVE-2004-2176	Microsoft Windows Xp		0.03	—	0.03	Dec 31, 2004	The Internet Connection Firewall (ICF) in Microsoft Windows XP SP2 is configured by default to trust sessmgr.exe, which allows local users to use sessmgr.exe to create a local listening port that bypasses the ICF access controls.
CVE-2004-2177	Devoybb Devoybb Web Forum		0.00	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in DevoyBB Web Forum 1.0.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVE-2004-2178	Devoybb Devoybb Web Forum		0.00	—	0.01	Dec 31, 2004	SQL injection vulnerability in DevoyBB Web Forum 1.0.0 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVE-2004-2179	Microsoft Frontpage		0.01	—	0.12	Dec 31, 2004	asycpict.dll, as used in Microsoft products such as Front Page 97 and 98, allows remote attackers to cause a denial of service (hang) via a JPEG image with maximum height and width values.
CVE-2004-2180	Wowbb Wowbb Web Forum		0.00	—	0.01	Dec 31, 2004	Multiple cross-site scripting (XSS) vulnerabilities in WowBB Forum 1.61 allow remote attackers to inject arbitrary web script or HTML via the (1) country parameter to view_user.php, (2) show parameter to view_forum.php, (3) letter parameter to view_user.php, (4) highlight…
CVE-2004-2181	Wowbb Wowbb Web Forum		0.03	—	0.01	Dec 31, 2004	Multiple SQL injection vulnerabilities in WowBB Forum 1.61 allow remote attackers to execute arbitrary SQL commands via the (1) sort_by or (2) page parameters to view_user.php, or the (3) forum_id parameter to view_topic.php. NOTE: the sort_by vector was later reported to be…
CVE-2004-2182	Macromedia Jrun		0.00	—	0.01	Dec 31, 2004	Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server.
CVE-2004-2183	Wehelpbus Wehelpbus		0.00	—	0.02	Dec 31, 2004	Unknown vulnerability in WeHelpBUS 0.1 allows remote attackers to execute arbitrary shell commands via the query string.
CVE-2004-2184	Digicraft Software Yak		0.04	—	0.08	Dec 31, 2004	Directory traversal vulnerability in Digicraft Yak! server 2.0 through 2.1.2 allows remote attackers to read or write arbitrary files via "../" or "..\" sequences in commands such as (1) dir or (2) put.
CVE-2004-2185	MediaWiki Mediawiki		0.00	—	0.02	Dec 31, 2004	Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki 1.3.5 allow remote attackers to execute arbitrary scripts and/or SQL queries via (1) the UnicodeConverter extension, (2) raw page views, (3) SpecialIpblocklist, (4) SpecialEmailuser, (5) SpecialMaintenance, and (6)…
CVE-2004-2186	MediaWiki Mediawiki		0.00	—	0.01	Dec 31, 2004	SQL injection vulnerability in MediaWiki 1.3.5 allows remote attackers to execute arbitrary SQL commands via SpecialMaintenance.
CVE-2004-2187	MediaWiki Mediawiki		0.00	—	0.01	Dec 31, 2004	Unknown vulnerability in ImagePage for MediaWiki 1.3.5, related to "filename validation," has unknown impact and attack vectors.
CVE-2004-2188	Dmxready Dmxready Site Chassis Manager		0.00	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in DMXReady Site Chassis Manager allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVE-2004-2189	Dmxready Dmxready Site Chassis Manager		0.00	—	0.01	Dec 31, 2004	SQL injection vulnerability in DMXReady Site Chassis Manager allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVE-2004-2190	Unzoo Unzoo		0.00	—	0.01	Dec 31, 2004	Directory traversal vulnerability in Unzoo 4.4-2 has unknown impact and attack vectors.
CVE-2004-2191	Turbotraffictrader Turbotraffictrader PHP		0.00	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in ttt-webmaster.php in Turbo Traffic Trader PHP 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) msg[0] or (2) siteurl parameters.
CVE-2004-2192	Turbotraffictrader Turbotraffictrader PHP		0.00	—	0.01	Dec 31, 2004	SQL injection vulnerability in tttadmin/settings.php in Turbo Traffic Trader PHP 1.0 allows remote attackers to execute arbitrary SQL commands via the ttt_admin parameter.
CVE-2004-2193	Cjoverkill Cjoverkill		0.00	—	0.01	Dec 31, 2004	Cross-site scripting (XSS) vulnerability in trade.php for CJOverkill 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the (1) tms[0] or (2) url parameters.
CVE-2004-2194	MailEnable Mailenable		0.00	—	0.02	Dec 31, 2004	MailEnable Professional Edition before 1.53 and Enterprise Edition before 1.02 allows remote attackers to cause a denial of service (crash) via malformed (1) SMTP or (2) IMAP commands.
CVE-2004-2195	Zanfi Solutions CMS lite		0.00	—	0.02	Dec 31, 2004	PHP remote file inclusion vulnerability in index.php in Zanfi CMS lite 1.1 allows remote attackers to execute arbitrary PHP code via the inc parameter.
CVE-2004-2196	Zanfi Solutions CMS lite		0.00	—	0.02	Dec 31, 2004	Zanfi CMS lite 1.1 allows remote attackers to obtain the full path of the web server via direct requests without required arguments to (1) adm_pages.php, (2) corr_pages.php, (3) del_block.php, (4) del_page.php, (5) footer.php, (6) home.php, and others.

CVE-2004-2147Dec 31, 2004
Symantec
Norton Antivirus
risk 0.00cvss —epss 0.01
Unknown versions of Symantec Norton AntiVirus and Microsoft Outlook allow attackers to cause a denial of service (crash) via malformed e-mail messages (1) without a body or (2) without a carriage return ("\n") separating the headers from the body.
CVE-2004-2148Dec 31, 2004
Slava Astashonok
Fprobe
risk 0.00cvss —epss 0.00
Unknown local vulnerability in the "change user" feature of Slava Astashonok Fprobe 1.0.5 and earlier has unknown impact and attack vectors.
CVE-2004-2149Dec 31, 2004
MySQL
MySQL
risk 0.00cvss —epss 0.06
Buffer overflow in the prepared statements API in libmysqlclient for MySQL 4.1.3 beta and 4.1.4 allows remote attackers to cause a denial of service via a large number of placeholders.
CVE-2004-2150Dec 31, 2004
Nettica Corporation
INTELLIPEER Email Server
risk 0.00cvss —epss 0.02
Nettica Corporation INTELLIPEER Email Server 1.01 displays different error messages for valid and invalid account names, which allows remote attackers to determine valid account names.
CVE-2004-2151Dec 31, 2004
Virtual Projects
Chatman
risk 0.03cvss —epss 0.04
Chatman 1.1.1 RC1 and earlier allows remote attackers to cause a denial of service (memory consumption or application crash) via a very large data size.
CVE-2004-2152Dec 31, 2004
MediaWiki
Mediawiki
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in 'raw' page output mode for MediaWiki 1.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML.
CVE-2004-2153Dec 31, 2004
Real Estate Management Software
Real Estate Management Software
risk 0.00cvss —epss 0.02
Multiple unknown vulnerabilities in Real Estate Management Software 1.0 have unknown impact and attack vectors.
CVE-2004-2154CriDec 31, 2004
Apple Inc.
Cups
risk 0.64cvss 9.8epss 0.02
CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive.
CVE-2004-2155Dec 31, 2004
Ol Bookmarks
Ol Bookmarks
risk 0.00cvss —epss 0.02
Online-bookmarks before 0.4.6 allows remote attackers to bypass its authentication mechanism via a direct request to (1) config/*, (2) bookmarks.php, (3) footer.php, (4) main.php, (5) tree.php, or (6) functions.php.
CVE-2004-2156Dec 31, 2004
Recruitment Agency Software
Online Recruitment Agency
risk 0.00cvss —epss 0.02
Multiple unknown vulnerabilities in Online Recruitment Agency 1.0 have unknown impact and attack vectors.
CVE-2004-2157Dec 31, 2004
Serendipity
Serendipity
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Comment.php in Serendipity 0.7 beta1, and possibly other versions before 0.7-beta3, allows remote attackers to inject arbitrary HTML and PHP code via the (1) email or (2) username field.
CVE-2004-2158Dec 31, 2004
Serendipity
Serendipity
risk 0.03cvss —epss 0.04
SQL injection vulnerability in Serendipity 0.7-beta1 allows remote attackers to execute arbitrary SQL commands via the entry_id parameter to (1) exit.php or (2) comment.php.
CVE-2004-2159Dec 31, 2004
Xmlstarlet
Command Line XML Toolkit
risk 0.00cvss —epss 0.02
Multiple buffer overflows in XMLStarlet Command Line XML Toolkit 0.9.3 have unknown impact and attack vectors via (1) xml_elem.c and (2) xml_select.c.
CVE-2004-2160Dec 31, 2004
Xmlstarlet
Command Line XML Toolkit
risk 0.00cvss —epss 0.02
Format string vulnerability in xml_elem.c for XMLStarlet Command Line XML Toolkit 0.9.3 may allow attackers to cause a denial of service or execute arbitrary code.
CVE-2004-2161Dec 31, 2004
Tutos
Tutos
risk 0.03cvss —epss 0.03
SQL injection vulnerability in file_overview.php in TUTOS 1.1 allows remote attackers to execute arbitrary SQL commands via the link_id parameter.
CVE-2004-2162Dec 31, 2004
Tutos
Tutos
risk 0.03cvss —epss 0.04
Multiple cross-site scripting (XSS) vulnerabilities in TUTOS 1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the search field of the Address Module or (2) the t parameter to app_new.php.
CVE-2004-2163Dec 31, 2004
OpenBSD
OpenBSD
risk 0.00cvss —epss 0.02
login_radius on OpenBSD 3.2, 3.5, and possibly other versions does not verify the shared secret in a response packet from a RADIUS server, which allows remote attackers to bypass authentication by spoofing server replies.
CVE-2004-2164Dec 31, 2004
Vpasp
VP-ASP
risk 0.00cvss —epss 0.02
shoprestoreorder.asp in VP-ASP 5.0 does not close the database connection when a user restores a previous order, which allows remote attackers to cause a denial of service (connection consumption).
CVE-2004-2165Dec 31, 2004
Impressions Games
Lords Of The Realm Iii
risk 0.00cvss —epss 0.03
Lords of the Realm III 1.01 and earlier, when in the lobby stage, allows remote attackers to cause a denial of service (crash from unallocated memory write) via a long user nickname.
CVE-2004-2166Dec 31, 2004
Canon
Imagerunner 5000i
risk 0.00cvss —epss 0.02
The print-from-email feature in the Canon ImageRUNNER (iR) 5000i and C3200 digital printer, when not using IP address range filtering, allows remote attackers to print arbitrary text without authentication via a text/plain email to TCP port 25.
CVE-2004-2167Dec 31, 2004
Latex2rtf
Latex2rtf
risk 0.04cvss —epss 0.14
Multiple buffer overflows in LaTeX2rtf 1.9.15, and possibly other versions, allow remote attackers to execute arbitrary code via (1) the expandmacro function, and possibly (2) Environments and (3) TranslateCommand.
CVE-2004-2168Dec 31, 2004
Baardsen Software
Basomail Server
risk 0.00cvss —epss 0.02
BaSoMail 1.24 allows remote attackers to cause a denial of service (CPU consumption) via multiple connections to TCP port (1) 25 (SMTP) or (2) 110 (POP3).
CVE-2004-2169Dec 31, 2004
A A S Application Access Server
A A S Application Access Server
risk 0.00cvss —epss 0.01
Application Access Server (A-A-S) 1.0.37 and earlier allows remote authenticated users to cause a denial of service (application crash) via a long file request.
CVE-2004-2170Dec 31, 2004
Niti Telecom
Caravan Business Server
risk 0.03cvss —epss 0.04
Directory traversal vulnerability in sample_showcode.html in Caravan 2.00/03d and earlier allows remote attackers to read arbitrary files via the fname parameter.
CVE-2004-2171Dec 31, 2004
Cherokee
Cherokee Httpd
risk 0.03cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in Cherokee before 0.4.8 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting error page.
CVE-2004-2172HigDec 31, 2004
Netsourcecommerce
Productcart
risk 0.52cvss 7.5epss 0.07
EarlyImpact ProductCart uses a weak encryption scheme to encrypt passwords, which allows remote attackers to obtain the password via a chosen plaintext attack.
CVE-2004-2173Dec 31, 2004
Early Impact
Productcart
risk 0.00cvss —epss 0.02
SQL injection vulnerability in advSearch_h.asp in EarlyImpact ProductCart allows remote attackers to execute arbitrary SQL commands via the priceUntil parameter.
CVE-2004-2174Dec 31, 2004
Early Impact
Productcart
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Custva.asp in EarlyImpact ProductCart allows remote attackers to inject arbitrary Javascript via the redirectUrl parameter.
CVE-2004-2175Dec 31, 2004
Photopost
Reviewpost PHP Pro
risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in ReviewPost PHP Pro allow remote attackers to execute arbitrary SQL commands via the (1) product parameter to showproduct.php or (2) cat parameter to showcat.php.
CVE-2004-2176Dec 31, 2004
Microsoft
Windows Xp
risk 0.03cvss —epss 0.03
The Internet Connection Firewall (ICF) in Microsoft Windows XP SP2 is configured by default to trust sessmgr.exe, which allows local users to use sessmgr.exe to create a local listening port that bypasses the ICF access controls.
CVE-2004-2177Dec 31, 2004
Devoybb
Devoybb Web Forum
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in DevoyBB Web Forum 1.0.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVE-2004-2178Dec 31, 2004
Devoybb
Devoybb Web Forum
risk 0.00cvss —epss 0.01
SQL injection vulnerability in DevoyBB Web Forum 1.0.0 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVE-2004-2179Dec 31, 2004
Microsoft
Frontpage
risk 0.01cvss —epss 0.12
asycpict.dll, as used in Microsoft products such as Front Page 97 and 98, allows remote attackers to cause a denial of service (hang) via a JPEG image with maximum height and width values.
CVE-2004-2180Dec 31, 2004
Wowbb
Wowbb Web Forum
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in WowBB Forum 1.61 allow remote attackers to inject arbitrary web script or HTML via the (1) country parameter to view_user.php, (2) show parameter to view_forum.php, (3) letter parameter to view_user.php, (4) highlight…
CVE-2004-2181Dec 31, 2004
Wowbb
Wowbb Web Forum
risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in WowBB Forum 1.61 allow remote attackers to execute arbitrary SQL commands via the (1) sort_by or (2) page parameters to view_user.php, or the (3) forum_id parameter to view_topic.php. NOTE: the sort_by vector was later reported to be…
CVE-2004-2182Dec 31, 2004
Macromedia
Jrun
risk 0.00cvss —epss 0.01
Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server.
CVE-2004-2183Dec 31, 2004
Wehelpbus
Wehelpbus
risk 0.00cvss —epss 0.02
Unknown vulnerability in WeHelpBUS 0.1 allows remote attackers to execute arbitrary shell commands via the query string.
CVE-2004-2184Dec 31, 2004
Digicraft Software
Yak
risk 0.04cvss —epss 0.08
Directory traversal vulnerability in Digicraft Yak! server 2.0 through 2.1.2 allows remote attackers to read or write arbitrary files via "../" or "..\" sequences in commands such as (1) dir or (2) put.
CVE-2004-2185Dec 31, 2004
MediaWiki
Mediawiki
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki 1.3.5 allow remote attackers to execute arbitrary scripts and/or SQL queries via (1) the UnicodeConverter extension, (2) raw page views, (3) SpecialIpblocklist, (4) SpecialEmailuser, (5) SpecialMaintenance, and (6)…
CVE-2004-2186Dec 31, 2004
MediaWiki
Mediawiki
risk 0.00cvss —epss 0.01
SQL injection vulnerability in MediaWiki 1.3.5 allows remote attackers to execute arbitrary SQL commands via SpecialMaintenance.
CVE-2004-2187Dec 31, 2004
MediaWiki
Mediawiki
risk 0.00cvss —epss 0.01
Unknown vulnerability in ImagePage for MediaWiki 1.3.5, related to "filename validation," has unknown impact and attack vectors.
CVE-2004-2188Dec 31, 2004
Dmxready
Dmxready Site Chassis Manager
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in DMXReady Site Chassis Manager allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVE-2004-2189Dec 31, 2004
Dmxready
Dmxready Site Chassis Manager
risk 0.00cvss —epss 0.01
SQL injection vulnerability in DMXReady Site Chassis Manager allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVE-2004-2190Dec 31, 2004
Unzoo
Unzoo
risk 0.00cvss —epss 0.01
Directory traversal vulnerability in Unzoo 4.4-2 has unknown impact and attack vectors.
CVE-2004-2191Dec 31, 2004
Turbotraffictrader
Turbotraffictrader PHP
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in ttt-webmaster.php in Turbo Traffic Trader PHP 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) msg[0] or (2) siteurl parameters.
CVE-2004-2192Dec 31, 2004
Turbotraffictrader
Turbotraffictrader PHP
risk 0.00cvss —epss 0.01
SQL injection vulnerability in tttadmin/settings.php in Turbo Traffic Trader PHP 1.0 allows remote attackers to execute arbitrary SQL commands via the ttt_admin parameter.
CVE-2004-2193Dec 31, 2004
Cjoverkill
Cjoverkill
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in trade.php for CJOverkill 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the (1) tms[0] or (2) url parameters.
CVE-2004-2194Dec 31, 2004
MailEnable
Mailenable
risk 0.00cvss —epss 0.02
MailEnable Professional Edition before 1.53 and Enterprise Edition before 1.02 allows remote attackers to cause a denial of service (crash) via malformed (1) SMTP or (2) IMAP commands.
CVE-2004-2195Dec 31, 2004
Zanfi Solutions
CMS lite
risk 0.00cvss —epss 0.02
PHP remote file inclusion vulnerability in index.php in Zanfi CMS lite 1.1 allows remote attackers to execute arbitrary PHP code via the inc parameter.
CVE-2004-2196Dec 31, 2004
Zanfi Solutions
CMS lite
risk 0.00cvss —epss 0.02
Zanfi CMS lite 1.1 allows remote attackers to obtain the full path of the web server via direct requests without required arguments to (1) adm_pages.php, (2) corr_pages.php, (3) del_block.php, (4) del_page.php, (5) footer.php, (6) home.php, and others.