CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2004

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1151 CVE-2004-1613 DoS 2004-10-18 2017-10-11
5.0
 None Remote Low Not required None None Partial
Mozilla allows remote attackers to cause a denial of service (application crash from null dereference or infinite loop) via a web page that contains a (1) TEXTAREA, (2) INPUT, (3) FRAMESET or (4) IMG tag followed by a null character and some trailing characters, as demonstrated by mangleme.
1152 CVE-2004-1612 Dir. Trav. 2004-10-18 2017-07-11
5.0
 None Remote Low Not required None Partial None
Directory traversal vulnerability in SalesLogix 6.1 allows remote attackers to upload arbitrary files via a .. (dot dot) in a ProcessQueueFile request.
1153 CVE-2004-1611 Exec Code 2004-10-18 2017-07-11
5.1
 None Remote High Not required Partial Partial Partial
SalesLogix 6.1 does not verify if a user is authenticated before performing sensitive operations, which could allow remote attackers to (1) execute arbitrary SLX commands on the server or spoof the server via a man-in-the-middle (MITM) attack, or (2) obtain the database password via a GetConnection request to TCP port 1707.
1154 CVE-2004-1610 Exec Code 2004-10-18 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
SalesLogix 6.1 uses client-specified pathnames for writing certain files, which might allow remote authenticated users to create arbitrary files and execute code via the (1) vMME.AttachmentPath or (2) vMME.LibraryPath variables.
1155 CVE-2004-1609 2004-10-18 2017-07-11
5.0
 None Remote Low Not required Partial None None
SalesLogix 6.1 includes usernames, passwords, and other sensitive information in the headers of an HTTP response, which could allow remote attackers to gain access.
1156 CVE-2004-1608 Sql 2004-10-18 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in SalesLogix 6.1 allows remote attackers to execute arbitrary SQL statements via the id parameter in a view operation.
1157 CVE-2004-1607 +Info 2004-10-18 2017-07-11
5.0
 None Remote Low Not required Partial None None
slxweb.dll in SalesLogix 6.1 allows remote attackers to obtain sensitive information via a (1) Library or (2) Attachment request with an invalid file parameter, which reveals the path in an error message.
1158 CVE-2004-1606 +Info 2004-10-18 2017-07-11
6.4
 None Remote Low Not required Partial None Partial
slxweb.dll in SalesLogix 6.1 allows remote attackers to cause a denial service (application crash) via an invalid HTTP request, which might also leak sensitive information in the ErrorLogMsg cookie.
1159 CVE-2004-1605 Bypass 2004-10-14 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
SalesLogix 6.1 allows remote attackers to bypass authentication by modifying the slxweb cookie to set user=Admin, teams=ADMIN!, and usertype=Administrator.
1160 CVE-2004-1604 2004-09-30 2016-10-18
5.0
 None Remote Low Not required None Partial None
cPanel 9.9.1-RELEASE-3 allows remote authenticated users to chmod arbitrary files via a symlink attack on the _private directory, which is created when Front Page extensions are enabled.
1161 CVE-2004-1603 2004-10-18 2017-07-11
5.0
 None Remote Low Not required Partial None None
cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled.
1162 CVE-2004-1602 2004-10-15 2017-07-11
5.0
 None Remote Low Not required Partial None None
ProFTPD 1.2.x, including 1.2.8 and 1.2.10, responds in a different amount of time when a given username exists, which allows remote attackers to identify valid usernames by timing the server response.
1163 CVE-2004-1601 Dir. Trav. 2004-10-16 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in index.php in CoolPHP 1.0-stable allows remote attackers to access arbitrary files and execute local PHP scripts via a .. (dot dot) in the op parameter.
1164 CVE-2004-1600 2004-10-16 2017-07-11
5.0
 None Remote Low Not required Partial None None
index.php in CoolPHP 1.0-stable allows remote attackers to gain sensitive information via an invalid op parameter, which reveals the path in an error message.
1165 CVE-2004-1599 XSS 2004-10-16 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php in CoolPHP 1.0-stable allows remote attackers to execute arbitrary web script or HTML via the (1) query or (2) nick parameters.
1166 CVE-2004-1598 2004-10-12 2017-07-11
5.0
 None Remote Low Not required Partial None None
Adobe Acrobat and Acrobat Reader 6.0 allow remote attackers to read arbitrary files via a PDF file that contains an embedded Shockwave (swf) file that references files outside of the temporary directory.
1167 CVE-2004-1597 DoS 2004-10-13 2017-07-11
5.0
 None Remote Low Not required None None Partial
RIM Blackberry 7230 running RIM Blackberry OS 3.7 SP1 allows remote attackers to cause a denial of service (device reboot and possibly data corruption) via a calendar message with a long Location field, which triggers a watchdog while the message is being stored.
1168 CVE-2004-1596 2004-10-13 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
The 3COM Wireless router 3CRADSL72 running Boot Code 1.3d allows remote attackers to gain sensitive information such as passwords and router settings via a direct HTTP request to app_sta.stm.
1169 CVE-2004-1595 Exec Code Overflow 2004-10-13 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in ShixxNote 6.net build 117 allows remote attackers to execute arbitrary code via a long font field.
1170 CVE-2004-1594 XSS 2004-10-13 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in FuseTalk 4.0 allows remote attackers to execute arbitrary web script via an img src tag.
1171 CVE-2004-1593 XSS 2004-12-31 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in render.UserLayoutRootNode.uP in SCT Campus Pipeline allows remote attackers to inject arbitrary web script or HTML via the utf parameter.
1172 CVE-2004-1592 Exec Code File Inclusion 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in index.php in ocPortal 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the req_path parameter to reference a URL on a remote web server that contains a malicious funcs.php script.
1173 CVE-2004-1591 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
The web interface for Micronet Wireless Broadband Router SP916BM running firmware before 1.9 08/04/2004 resets the password to the default password when the router is shut off, which could allow remote attackers to gain access.
1174 CVE-2004-1590 2004-12-31 2017-07-11
5.0
 None Remote Low Not required None Partial None
Clientexec allows remote attackers to gain sensitive information via an HTTP request to phpinfo.php, which calls the phpinfo function.
1175 CVE-2004-1589 XSS 2004-12-31 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in GoSmart Message Board allows remote attackers to execute inject web script or HTML via the (1) Category parameter to Forum.asp or (2) MainMessageID parameter to ReplyToQuestion.asp.
1176 CVE-2004-1588 Exec Code Sql 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in GoSmart Message Board allows remote attackers to execute arbitrary SQL code via the (1) QuestionNumber and Category parameters to Forum.asp or (2) Username and Password parameter to Login_Exec.asp.
1177 CVE-2004-1587 DoS Overflow 2004-12-31 2017-07-11
5.0
 None Remote Low Not required None None Partial
Buffer overflow in Monolith games including (1) Alien versus Predator 2 1.0.9.6 and earlier, (2) Blood 2 2.1 and earlier, (3) No one lives forever 1.004 and earlier and (4) Shogo 2.2 and earlier allows remote attackers to cause a denial of service (application crash) via a long secure Gamespy query.
1178 CVE-2004-1586 2004-12-31 2016-10-18
2.1
 None Local Low Not required None Partial None
Flash Messaging clients can ignore disconnecting commands such as "shutdown" from the Flash Messaging Server 5.2.0g (rev 1.1.2), which could allow remote attackers to stay connected.
1179 CVE-2004-1585 DoS 2004-12-31 2017-07-11
5.0
 None Remote Low Not required None None Partial
Flash Messaging 5.2.0g (rev 1.1.2) and earlier allows remote attackers to cause a denial of service (application crash) via certain wide characters.
1180 CVE-2004-1584 Http R.Spl. 2004-12-31 2017-07-11
5.0
 None Remote Low Not required None Partial None
CRLF injection vulnerability in wp-login.php in WordPress 1.2 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the text parameter.
1181 CVE-2004-1583 Dir. Trav. 2004-12-31 2017-07-19
6.4
 None Remote Low Not required Partial Partial None
Directory traversal vulnerability in the FTP server in TriDComm 1.3 and earlier allows remote attackers to read or write arbitrary files via a .. (dot dot) in FTP commands such as (1) DIR, (2) GET, or (3) PUT.
1182 CVE-2004-1582 Exec Code File Inclusion 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in BlackBoard 1.5.1 allows remote attackers to execute arbitrary PHP code by modifying the libpath parameter (incorrectly called "libpach") to reference a URL on a remote web server that contains _more.php, as demonstrated using checkdb.inc.php.
1183 CVE-2004-1581 2004-12-31 2017-07-11
5.0
 None Remote Low Not required Partial None None
BlackBoard 1.5.1 allows remote attackers to gain sensitive information via a direct request to (1) checkdb.inc.php, (2) admin.inc.php or (3) cp.inc.php, which reveals the path in a PHP error message.
1184 CVE-2004-1580 1 Exec Code Sql 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in CubeCart 2.0.1 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
1185 CVE-2004-1579 2004-12-31 2017-07-11
5.0
 None Remote Low Not required Partial None None
index.php in CubeCart 2.0.1 allows remote attackers to gain sensitive information via an HTTP request with an invalid cat_id parameter, which reveals the full path in a PHP error message.
1186 CVE-2004-1578 XSS 2004-12-31 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php in Invision Power Board 2.0.0 allows remote attackers to execute arbitrary web script or HTML via the Referer field in the HTTP header.
1187 CVE-2004-1577 2004-12-31 2017-07-11
5.0
 None Remote Low Not required Partial None None
index.php in PHP Links allows remote attackers to gain sensitive information via an invalid show parameter, which reveals the full path in an error message.
1188 CVE-2004-1576 DoS 2004-12-31 2017-07-11
5.0
 None Remote Low Not required None None Partial
Format string vulnerability in Judge Dredd: Dredd vs. Death 1.01 and earlier allows remote attackers to cause a denial of service (application crash) via format string specifiers in a chat message.
1189 CVE-2004-1575 DoS 2004-12-31 2017-07-11
5.0
 None Remote Low Not required None None Partial
The XML parser in Xerces-C++ 2.5.0 allows remote attackers to cause a denial of service (CPU consumption) via XML attributes in a crafted XML document.
1190 CVE-2004-1574 Exec Code Overflow 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Vypress Messenger 3.5.1 and earlier allows remote attackers to execute arbitrary code via a message with a long first field.
1191 CVE-2004-1573 Exec Code +Priv 2004-12-31 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
The documentation for AJ-Fork 167 implies that users should set permissions for users.db.php to 777, which allows local users to execute arbitrary PHP code and gain privileges as the administrator.
1192 CVE-2004-1572 2004-12-31 2017-07-11
5.0
 None Remote Low Not required Partial None None
AJ-Fork 167 does not restrict access to directories such as (1) data, (2) inc, (3) plugins, (4) skins, or (5) tools, which allows remote attackers to list files in those directories via a direct HTTP request.
1193 CVE-2004-1571 2004-12-31 2017-07-11
5.0
 None Remote Low Not required Partial None None
AJ-Fork 167 allows remote attackers to gain sensitive information via a direct request to (1) auto-acronyms.php, (2) auto-archive.php, (3) ount-article-views.php, (4) kses.php, (5) custom-quick-tags.php, (6) disable-all-comments.php, (7) easy-date-format.php, (8) enable-disable-comments.php, (9) filter-by-author.php, (10) format-switcher.php, (11) long-to-short.php, (12) prospective-posting.php, or (13) sort-by-xfield.php, which displays the full path in an error message.
1194 CVE-2004-1570 Exec Code Sql 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in bBlog 0.7.2 and 0.7.3 allows remote attackers to execute arbitrary SQL commands via the p parameter.
1195 CVE-2004-1569 DoS Exec Code Overflow 2004-12-31 2017-07-11
4.0
 None Remote High Not required None Partial Partial
Buffer overflow in (1) MusicConverter.exe, (2) playlist.exe, and (3) amp.exe in dBpowerAMP Audio Player 2.0 and dbPowerAmp Music Converter 10.0 allows remote attackers to cause a denial of service or execute arbitrary code via a .pls or .m3u playlist that contains long File1 (filename) fields.
1196 CVE-2004-1568 Dir. Trav. 2004-12-31 2017-07-11
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in ParaChat Server 5.5 allows remote attackers to read arbitrary files via a ..%5C (hex-encoded dot dot) in the URL.
1197 CVE-2004-1567 +Priv 2004-12-31 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
profile.php in Silent Storm Portal 2.1 and 2.2 allows remote attackers to gain privileges by setting the mail parameter to 1, which is the value for an administrator.
1198 CVE-2004-1566 XSS 2004-12-31 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php in Silent Storm Portal 2.1 and 2.2 allows remote attackers to execute arbitrary web script or HTML via the module parameter.
1199 CVE-2004-1565 2004-12-31 2016-10-18
5.0
 None Remote Low Not required Partial None None
list.php in w-Agora 4.1.6a allows remote attackers to reveal the full path via a crafted HTTP request, possibly involving a malformed id parameter.
1200 CVE-2004-1564 Http R.Spl. 2004-12-31 2017-07-11
5.0
 None Remote Low Not required None Partial None
CRLF injection vulnerability in subscribe_thread.php in w-Agora 4.1.6a allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the thread parameter.
Total number of vulnerabilities : 2451   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 (This Page)25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.