CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In December 2004

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
601 CVE-2004-2162 XSS 2004-12-31 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in TUTOS 1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the search field of the Address Module or (2) the t parameter to app_new.php.
602 CVE-2004-2161 Exec Code Sql 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in file_overview.php in TUTOS 1.1 allows remote attackers to execute arbitrary SQL commands via the link_id parameter.
603 CVE-2004-2160 DoS Exec Code 2004-12-31 2008-09-05
6.4
 None Remote Low Not required None Partial Partial
Format string vulnerability in xml_elem.c for XMLStarlet Command Line XML Toolkit 0.9.3 may allow attackers to cause a denial of service or execute arbitrary code.
604 CVE-2004-2159 Overflow 2004-12-31 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Multiple buffer overflows in XMLStarlet Command Line XML Toolkit 0.9.3 have unknown impact and attack vectors via (1) xml_elem.c and (2) xml_select.c.
605 CVE-2004-2158 Exec Code Sql 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Serendipity 0.7-beta1 allows remote attackers to execute arbitrary SQL commands via the entry_id parameter to (1) exit.php or (2) comment.php.
606 CVE-2004-2157 XSS 2004-12-31 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Comment.php in Serendipity 0.7 beta1, and possibly other versions before 0.7-beta3, allows remote attackers to inject arbitrary HTML and PHP code via the (1) email or (2) username field.
607 CVE-2004-2156 2004-12-31 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Multiple unknown vulnerabilities in Online Recruitment Agency 1.0 have unknown impact and attack vectors.
608 CVE-2004-2155 Bypass 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Online-bookmarks before 0.4.6 allows remote attackers to bypass its authentication mechanism via a direct request to (1) config/*, (2) bookmarks.php, (3) footer.php, (4) main.php, (5) tree.php, or (6) functions.php.
609 CVE-2004-2154 Bypass 2004-12-31 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive.
610 CVE-2004-2153 2004-12-31 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Multiple unknown vulnerabilities in Real Estate Management Software 1.0 have unknown impact and attack vectors.
611 CVE-2004-2152 XSS 2004-12-31 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in 'raw' page output mode for MediaWiki 1.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML.
612 CVE-2004-2151 DoS 2004-12-31 2017-07-11
5.0
 None Remote Low Not required None None Partial
Chatman 1.1.1 RC1 and earlier allows remote attackers to cause a denial of service (memory consumption or application crash) via a very large data size.
613 CVE-2004-2150 2004-12-31 2017-07-11
5.0
 None Remote Low Not required Partial None None
Nettica Corporation INTELLIPEER Email Server 1.01 displays different error messages for valid and invalid account names, which allows remote attackers to determine valid account names.
614 CVE-2004-2149 DoS Overflow 2004-12-31 2019-12-17
5.0
 None Remote Low Not required None None Partial
Buffer overflow in the prepared statements API in libmysqlclient for MySQL 4.1.3 beta and 4.1.4 allows remote attackers to cause a denial of service via a large number of placeholders.
615 CVE-2004-2148 2004-12-31 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
Unknown local vulnerability in the "change user" feature of Slava Astashonok Fprobe 1.0.5 and earlier has unknown impact and attack vectors.
616 CVE-2004-2147 DoS 2004-12-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
Unknown versions of Symantec Norton AntiVirus and Microsoft Outlook allow attackers to cause a denial of service (crash) via malformed e-mail messages (1) without a body or (2) without a carriage return ("\n") separating the headers from the body.
617 CVE-2004-2146 Http R.Spl. 2004-12-31 2017-07-11
5.0
 None Remote Low Not required None Partial None
CRLF injection vulnerability in PD9 Software MegaBBS 2 and 2.1 allows attackers to conduct HTTP response splitting attacks via the fid parameter in a writenew action to thread-post.asp.
618 CVE-2004-2145 Exec Code Sql 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in PD9 Software MegaBBS 2 and 2.1 allows remote attackers to execute arbitrary SQL commands via the (1) sortdir or (2) criteria parameter to ladder-log.asp or the (3) memberid or (4) teamid parameter to view-profile.asp.
619 CVE-2004-2144 Bypass 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Baal Smart Forms before 3.2 allows remote attackers to bypass authentication and obtain system access via a direct request to regadmin.php.
620 CVE-2004-2143 Exec Code Sql 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the ReMOSitory Server add-on module to Mambo Portal 4.5.1 (1.09) and earlier allows remote attackers to execute arbitrary SQL commands via the filecatid parameter in the com_remository option.
621 CVE-2004-2142 2004-12-31 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Unknown vulnerability in the remote tape support (remote.c) in the RMT client for Jorg Schilling sdd 1.28 and 1.31 has unknown impact and attack vectors.
622 CVE-2004-2140 2004-12-31 2008-09-10
5.0
 None Remote Low Not required None Partial None
CRLF injection vulnerability in YaBB 1 Gold before 1.3.2 allows remote attackers to modify text file contents via the subject variable.
623 CVE-2004-2139 Exec Code 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Unknown vulnerability in Adminedit.pl YaBB 1 Gold before 1.3.2 allows attackers to execute arbitrary code via settings.pl.
624 CVE-2004-2138 XSS 2004-12-31 2017-07-11
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in AWSguest.php in AllWebScripts MySQLGuest allows remote attackers to inject arbitrary HTML and PHP code via the (1) Name, (2) Email, (3) Homepage or (4) Comments field.
625 CVE-2004-2137 +Info 2004-12-31 2017-07-11
5.0
 None Remote Low Not required Partial None None
Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" setting, leaks the BCC recipients of the message to the addresses listed in the To and CC fields, which may allow remote attackers to obtain sensitive information.
626 CVE-2004-2130 XSS 2004-12-23 2016-10-18
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in privmsg.php in phpBB 2.0.6 allow remote attackers to execute arbitrary script or HTML via the (1) folder or (2) mode variables.
627 CVE-2004-2129 DoS Overflow 2004-12-31 2017-07-11
5.0
 None Remote Low Not required None None Partial
SurfNOW 2.2 allows remote attackers to cause a denial of service (crash) via a series of long HTTP GET requests, possibly triggering a buffer overflow.
628 CVE-2004-2128 XSS 2004-12-31 2017-07-11
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in BRS WebWeaver 1.07 allows remote attackers to execute arbitrary script as other users via the query string to ISAPISkeleton.dll.
629 CVE-2004-2126 Exec Code 2004-12-31 2016-10-18
4.6
 None Local Low Not required Partial Partial Partial
The upgrade for BlackICE PC Protection 3.6 and earlier sets insecure permissions for .INI files such as (1) blackice.ini, (2) firewall.ini, (3) protect.ini, or (4) sigs.ini, which allows local users to modify BlackICE configuration or possibly execute arbitrary code by exploiting vulnerabilities in the .INI parsers.
630 CVE-2004-2125 Overflow +Priv 2004-12-31 2017-07-11
4.6
 None Local Low Not required Partial Partial Partial
Buffer overflow in blackd.exe for BlackICE PC Protection 3.6 and other versions before 3.6.ccb, with application protection off, allows local users to gain system privileges by modifying the .INI file to contain a long packetLog.fileprefix value.
631 CVE-2004-2124 File Inclusion 2004-12-31 2017-07-11
5.0
 None Remote Low Not required None Partial None
The register_globals simulation capability in Gallery 1.3.1 through 1.4.1 allows remote attackers to modify the HTTP_POST_VARS variable and conduct a PHP remote file inclusion attack via the GALLERY_BASEDIR parameter, a different vulnerability than CVE-2002-1412.
632 CVE-2004-2123 XSS 2004-12-31 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Nextplace.com E-Commerce ASP Engine allow remote attackers to inject arbitrary web script or HTML via the (1) level parameter of productdetail.asp, (2) searchKey parameter of searchresults.asp, and possibly (3) level parameter of ListCategories.asp.
633 CVE-2004-2121 Dir. Trav. 2004-12-31 2017-07-11
5.0
 None Remote Low Not required Partial None None
Multiple directory traversal vulnerabilities in Borland Web Server (BWS) 1.0b3 and earlier allow remote attackers to read and download arbitrary files via (1) multi-dot "......" sequences, or (2) "%5c%2e%2e" (encoded "\..") sequences, in the URL.
634 CVE-2004-2119 XSS 2004-12-31 2018-08-13
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Tiny Server 1.1 allows remote attackers to inject arbitrary web script or HTML via the URL.
635 CVE-2004-2118 DoS Overflow 2004-12-31 2018-08-13
5.0
 None Remote Low Not required None None Partial
Tiny Server 1.1 allows remote attackers to cause a denial of service (crash) via a GET request with a long filename, possibly due to a buffer overflow.
636 CVE-2004-2116 Dir. Trav. 2004-12-31 2018-08-13
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in Tiny Server 1.1 allows remote attackers to read or download arbitrary files via a .. (dot dot) in the URL.
637 CVE-2004-2115 XSS 2004-12-31 2017-07-11
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.
638 CVE-2004-2114 Exec Code Overflow 2004-12-31 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based and heap-based buffer overflows in ProxyNow! 2.75 and earlier allow remote attackers to execute arbitrary code via a GET request with a long ftp:// URL.
639 CVE-2004-2113 XSS 2004-12-31 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in BremsServer 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the URL.
640 CVE-2004-2112 Dir. Trav. 2004-12-31 2017-07-11
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in BremsServer 1.2.4 allows remote attackers to read arbitrary files via ".." (dot dot) sequences in the URL.
641 CVE-2004-2111 119 Exec Code Overflow 2004-12-31 2020-07-28
8.5
 None Remote Medium ??? Complete Complete Complete
Stack-based buffer overflow in the site chmod command in Serv-U FTP Server before 4.2 allows remote attackers to execute arbitrary code via a long filename.
642 CVE-2004-2110 Exec Code Sql 2004-12-31 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hide_email parameter.
643 CVE-2004-2109 XSS 2004-12-31 2017-07-11
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in (1) imagezoom.asp or (2) recommend.asp in Q-Shop allow remote attackers to execute arbitrary script and steal the user session ID via Javascript in a URL.
644 CVE-2004-2108 Exec Code Sql 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in QuadComm Q-Shop allow remote attackers to execute arbitrary SQL commands via certain parameters to (1) search.asp, (2) browse.asp, (3) details.asp, (4) showcat.asp, (5) users.asp, (6) addtomylist.asp, (7) modline.asp, (8) cart.asp, or (9) newuser.asp.
645 CVE-2004-2107 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Finjan SurfinGate 6.0 and 7.0, when running in proxy mode, does not authenticate FHTTP commands on TCP port 3141, which allows remote attackers to use the finjan-parameter-type header to (1) restart the service, (2) use the getlastmsg command to view log information, or (3) use the online command to force a policy update from the database server.
646 CVE-2004-2106 2004-12-31 2018-10-30
5.0
 None Remote Low Not required Partial None None
Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to list directories via a direct request to (1) /com/, (2) /com/novell/, (3) /com/novell/webaccess, or (4) /ns-icons/.
647 CVE-2004-2105 2004-12-31 2018-10-30
5.0
 None Remote Low Not required Partial None None
The webacc servlet in Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to read arbitrary .htt files via a full pathname in the error parameter.
648 CVE-2004-2104 +Info 2004-12-31 2018-10-30
5.0
 None Remote Low Not required Partial None None
Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to obtain sensitive server information, including the internal IP address, via a direct request to (1) snoop.jsp, (2) SnoopServlet, (3) env.bas, or (4) lcgitest.nlm.
649 CVE-2004-2103 XSS 2004-12-31 2018-10-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to process arbitrary script or HTML as other users via (1) a malformed request for a Perl program with script in the filename, (2) the User.id parameter to the webacc servlet, (3) the GWAP.version parameter to webacc, or (4) a URL request for a .bas file with script in the filename.
650 CVE-2004-2102 XSS 2004-12-31 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in FREESCO 2.05, a modified version of thttpd, allows remote attackers to inject arbitrary web script or HTML via the test parameter.
Total number of vulnerabilities : 1223   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 (This Page)14 15 16 17 18 19 20 21 22 23 24 25
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.