CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2004 (CVSS score >= 4)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
551 CVE-2004-2161 Exec Code Sql 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in file_overview.php in TUTOS 1.1 allows remote attackers to execute arbitrary SQL commands via the link_id parameter.
552 CVE-2004-2160 DoS Exec Code 2004-12-31 2008-09-05
6.4
 None Remote Low Not required None Partial Partial
Format string vulnerability in xml_elem.c for XMLStarlet Command Line XML Toolkit 0.9.3 may allow attackers to cause a denial of service or execute arbitrary code.
553 CVE-2004-2159 Overflow 2004-12-31 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Multiple buffer overflows in XMLStarlet Command Line XML Toolkit 0.9.3 have unknown impact and attack vectors via (1) xml_elem.c and (2) xml_select.c.
554 CVE-2004-2158 Exec Code Sql 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Serendipity 0.7-beta1 allows remote attackers to execute arbitrary SQL commands via the entry_id parameter to (1) exit.php or (2) comment.php.
555 CVE-2004-2157 XSS 2004-12-31 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Comment.php in Serendipity 0.7 beta1, and possibly other versions before 0.7-beta3, allows remote attackers to inject arbitrary HTML and PHP code via the (1) email or (2) username field.
556 CVE-2004-2156 2004-12-31 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Multiple unknown vulnerabilities in Online Recruitment Agency 1.0 have unknown impact and attack vectors.
557 CVE-2004-2155 Bypass 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Online-bookmarks before 0.4.6 allows remote attackers to bypass its authentication mechanism via a direct request to (1) config/*, (2) bookmarks.php, (3) footer.php, (4) main.php, (5) tree.php, or (6) functions.php.
558 CVE-2004-2154 Bypass 2004-12-31 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive.
559 CVE-2004-2153 2004-12-31 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Multiple unknown vulnerabilities in Real Estate Management Software 1.0 have unknown impact and attack vectors.
560 CVE-2004-2152 XSS 2004-12-31 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in 'raw' page output mode for MediaWiki 1.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML.
561 CVE-2004-2151 DoS 2004-12-31 2017-07-11
5.0
 None Remote Low Not required None None Partial
Chatman 1.1.1 RC1 and earlier allows remote attackers to cause a denial of service (memory consumption or application crash) via a very large data size.
562 CVE-2004-2150 2004-12-31 2017-07-11
5.0
 None Remote Low Not required Partial None None
Nettica Corporation INTELLIPEER Email Server 1.01 displays different error messages for valid and invalid account names, which allows remote attackers to determine valid account names.
563 CVE-2004-2149 DoS Overflow 2004-12-31 2019-12-17
5.0
 None Remote Low Not required None None Partial
Buffer overflow in the prepared statements API in libmysqlclient for MySQL 4.1.3 beta and 4.1.4 allows remote attackers to cause a denial of service via a large number of placeholders.
564 CVE-2004-2148 2004-12-31 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
Unknown local vulnerability in the "change user" feature of Slava Astashonok Fprobe 1.0.5 and earlier has unknown impact and attack vectors.
565 CVE-2004-2147 DoS 2004-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
Unknown versions of Symantec Norton AntiVirus and Microsoft Outlook allow attackers to cause a denial of service (crash) via malformed e-mail messages (1) without a body or (2) without a carriage return ("\n") separating the headers from the body.
566 CVE-2004-2146 Http R.Spl. 2004-12-31 2017-07-11
5.0
 None Remote Low Not required None Partial None
CRLF injection vulnerability in PD9 Software MegaBBS 2 and 2.1 allows attackers to conduct HTTP response splitting attacks via the fid parameter in a writenew action to thread-post.asp.
567 CVE-2004-2145 Exec Code Sql 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in PD9 Software MegaBBS 2 and 2.1 allows remote attackers to execute arbitrary SQL commands via the (1) sortdir or (2) criteria parameter to ladder-log.asp or the (3) memberid or (4) teamid parameter to view-profile.asp.
568 CVE-2004-2144 Bypass 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Baal Smart Forms before 3.2 allows remote attackers to bypass authentication and obtain system access via a direct request to regadmin.php.
569 CVE-2004-2143 Exec Code Sql 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the ReMOSitory Server add-on module to Mambo Portal 4.5.1 (1.09) and earlier allows remote attackers to execute arbitrary SQL commands via the filecatid parameter in the com_remository option.
570 CVE-2004-2142 2004-12-31 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Unknown vulnerability in the remote tape support (remote.c) in the RMT client for Jorg Schilling sdd 1.28 and 1.31 has unknown impact and attack vectors.
571 CVE-2004-2140 2004-12-31 2008-09-10
5.0
 None Remote Low Not required None Partial None
CRLF injection vulnerability in YaBB 1 Gold before 1.3.2 allows remote attackers to modify text file contents via the subject variable.
572 CVE-2004-2139 Exec Code 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Unknown vulnerability in Adminedit.pl YaBB 1 Gold before 1.3.2 allows attackers to execute arbitrary code via settings.pl.
573 CVE-2004-2138 XSS 2004-12-31 2017-07-11
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in AWSguest.php in AllWebScripts MySQLGuest allows remote attackers to inject arbitrary HTML and PHP code via the (1) Name, (2) Email, (3) Homepage or (4) Comments field.
574 CVE-2004-2137 +Info 2004-12-31 2017-07-11
5.0
 None Remote Low Not required Partial None None
Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" setting, leaks the BCC recipients of the message to the addresses listed in the To and CC fields, which may allow remote attackers to obtain sensitive information.
575 CVE-2004-2134 2004-01-28 2018-10-19
4.6
 None Local Low Not required Partial Partial Partial
Oracle toplink mapping workBench uses a weak encryption algorithm for passwords, which allows local users to decrypt the passwords.
576 CVE-2004-2133 Exec Code 2004-01-29 2017-07-11
4.6
 None Local Low Not required Partial Partial Partial
Certain third-party packages for CVSup 16.1h, such as SuSE Linux, contain untrusted paths in the ELF RPATH fields of certain executables, which could allow local users to execute arbitrary code by causing cvsup to link against malicious libraries that are created in world-writable directories such as /usr/src/packages.
577 CVE-2004-2132 Dir. Trav. 2004-01-29 2017-07-11
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in PJreview_Neo.cgi in PJ CGI Neo review allows remote attackers to read arbitrary files via a .. (dot dot) in the p parameter.
578 CVE-2004-2131 Exec Code Overflow 2004-01-27 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
Stack-based buffer overflow in ontape for IBM Informix Dynamic Server (IDS) 9.40.xC3 and earlier allows local users, with DSA privileges, to execute arbitrary code via a long ONCONFIG environment variable.
579 CVE-2004-2130 XSS 2004-12-23 2016-10-18
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in privmsg.php in phpBB 2.0.6 allow remote attackers to execute arbitrary script or HTML via the (1) folder or (2) mode variables.
580 CVE-2004-2129 DoS Overflow 2004-12-31 2017-07-11
5.0
 None Remote Low Not required None None Partial
SurfNOW 2.2 allows remote attackers to cause a denial of service (crash) via a series of long HTTP GET requests, possibly triggering a buffer overflow.
581 CVE-2004-2128 XSS 2004-12-31 2017-07-11
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in BRS WebWeaver 1.07 allows remote attackers to execute arbitrary script as other users via the query string to ISAPISkeleton.dll.
582 CVE-2004-2127 Dir. Trav. 2004-01-20 2017-07-11
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in Web Blog 1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file variable.
583 CVE-2004-2126 Exec Code 2004-12-31 2016-10-18
4.6
 None Local Low Not required Partial Partial Partial
The upgrade for BlackICE PC Protection 3.6 and earlier sets insecure permissions for .INI files such as (1) blackice.ini, (2) firewall.ini, (3) protect.ini, or (4) sigs.ini, which allows local users to modify BlackICE configuration or possibly execute arbitrary code by exploiting vulnerabilities in the .INI parsers.
584 CVE-2004-2125 Overflow +Priv 2004-12-31 2017-07-11
4.6
 None Local Low Not required Partial Partial Partial
Buffer overflow in blackd.exe for BlackICE PC Protection 3.6 and other versions before 3.6.ccb, with application protection off, allows local users to gain system privileges by modifying the .INI file to contain a long packetLog.fileprefix value.
585 CVE-2004-2124 File Inclusion 2004-12-31 2017-07-11
5.0
 None Remote Low Not required None Partial None
The register_globals simulation capability in Gallery 1.3.1 through 1.4.1 allows remote attackers to modify the HTTP_POST_VARS variable and conduct a PHP remote file inclusion attack via the GALLERY_BASEDIR parameter, a different vulnerability than CVE-2002-1412.
586 CVE-2004-2123 XSS 2004-12-31 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Nextplace.com E-Commerce ASP Engine allow remote attackers to inject arbitrary web script or HTML via the (1) level parameter of productdetail.asp, (2) searchKey parameter of searchresults.asp, and possibly (3) level parameter of ListCategories.asp.
587 CVE-2004-2122 XSS 2004-01-24 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in intraforum_db.cgi in Intra Forum allows remote attackers to inject arbitrary web script or HTML via the (1) use_last_read or (2) forum parameters.
588 CVE-2004-2121 Dir. Trav. 2004-12-31 2017-07-11
5.0
 None Remote Low Not required Partial None None
Multiple directory traversal vulnerabilities in Borland Web Server (BWS) 1.0b3 and earlier allow remote attackers to read and download arbitrary files via (1) multi-dot "......" sequences, or (2) "%5c%2e%2e" (encoded "\..") sequences, in the URL.
589 CVE-2004-2120 DoS 2004-01-23 2017-07-11
5.0
 None Remote Low Not required None None Partial
Reptile Web Server allows remote attackers to cause a denial of service (CPU consumption) via multiple incomplete GET requests without the HTTP version.
590 CVE-2004-2119 XSS 2004-12-31 2018-08-13
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Tiny Server 1.1 allows remote attackers to inject arbitrary web script or HTML via the URL.
591 CVE-2004-2118 DoS Overflow 2004-12-31 2018-08-13
5.0
 None Remote Low Not required None None Partial
Tiny Server 1.1 allows remote attackers to cause a denial of service (crash) via a GET request with a long filename, possibly due to a buffer overflow.
592 CVE-2004-2117 DoS 2004-01-24 2018-08-13
5.0
 None Remote Low Not required None None Partial
Tiny Server 1.1 allows remote attackers to cause a denial of service (crash) via malformed HTTP requests such as (1) a GET request without the HTTP version (HTTP/1.1), or (2) a request without GET or the HTTP version.
593 CVE-2004-2116 Dir. Trav. 2004-12-31 2018-08-13
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in Tiny Server 1.1 allows remote attackers to read or download arbitrary files via a .. (dot dot) in the URL.
594 CVE-2004-2115 XSS 2004-12-31 2017-07-11
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.
595 CVE-2004-2114 Exec Code Overflow 2004-12-31 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based and heap-based buffer overflows in ProxyNow! 2.75 and earlier allow remote attackers to execute arbitrary code via a GET request with a long ftp:// URL.
596 CVE-2004-2113 XSS 2004-12-31 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in BremsServer 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the URL.
597 CVE-2004-2112 Dir. Trav. 2004-12-31 2017-07-11
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in BremsServer 1.2.4 allows remote attackers to read arbitrary files via ".." (dot dot) sequences in the URL.
598 CVE-2004-2111 119 Exec Code Overflow 2004-12-31 2020-07-28
8.5
 None Remote Medium ??? Complete Complete Complete
Stack-based buffer overflow in the site chmod command in Serv-U FTP Server before 4.2 allows remote attackers to execute arbitrary code via a long filename.
599 CVE-2004-2110 Exec Code Sql 2004-12-31 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hide_email parameter.
600 CVE-2004-2109 XSS 2004-12-31 2017-07-11
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in (1) imagezoom.asp or (2) recommend.asp in Q-Shop allow remote attackers to execute arbitrary script and steal the user session ID via Javascript in a URL.
Total number of vulnerabilities : 2243   Page : 1 2 3 4 5 6 7 8 9 10 11 12 (This Page)13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.