# CVEs published 2005-05-10 360 CVEs were published on May 10, 2005: 0 critical, 0 high. Days are UTC. - [CVE-2001-1477](https://cve.now/CVE-2001-1477.md): The Domain gateway in BEA Tuxedo 7.1 does not perform authorization checks for imported services and qspaces on remote domains, even when an (no CVSS) - [CVE-2002-1659](https://cve.now/CVE-2002-1659.md): user\_profile.asp in PortalApp 2.2 allows local users to gain privileges by modifying the user\_id variable. (no CVSS) - [CVE-2002-1660](https://cve.now/CVE-2002-1660.md): calendar.php in vBulletin before 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the command paramet (no CVSS) - [CVE-2003-1133](https://cve.now/CVE-2003-1133.md): Rit Research Labs The Bat! 1.0.11 through 2.0 creates new accounts with insecure ACLs, which allows local users to read other users' email m (no CVSS) - [CVE-2003-1134](https://cve.now/CVE-2003-1134.md): Sun Java 1.3.1, 1.4.1, and 1.4.2 allows local users to cause a denial of service (JVM crash), possibly by calling the ClassDepth function wi (no CVSS) - [CVE-2003-1135](https://cve.now/CVE-2003-1135.md): Buffer overflow in Yahoo! Messenger 5.6 allows remote attackers to cause a denial of service (crash) via a file send request (sendfile) with (no CVSS) - [CVE-2003-1136](https://cve.now/CVE-2003-1136.md): Cross-site scripting (XSS) vulnerability in Chi Kien Uong Guestbook 1.51 allows remote attackers to inject arbitrary web script or HTML via (no CVSS) - [CVE-2003-1137](https://cve.now/CVE-2003-1137.md): Charles Steinkuehler sh-httpd 0.3 and 0.4 allows remote attackers to read files or execute arbitrary CGI scripts via a GET request that cont (no CVSS) - [CVE-2003-1138](https://cve.now/CVE-2003-1138.md): The default configuration of Apache 2.0.40, as shipped with Red Hat Linux 9.0, allows remote attackers to list directory contents, even if a (no CVSS) - [CVE-2003-1139](https://cve.now/CVE-2003-1139.md): Musicqueue 1.2.0 allows local users to overwrite arbitrary files by triggering a segmentation fault and using a symlink attack on the result (no CVSS) - [CVE-2003-1140](https://cve.now/CVE-2003-1140.md): Buffer overflow in Musicqueue 1.2.0 allows local users to execute arbitrary code via a long language variable in the configuration file. (no CVSS) - [CVE-2003-1141](https://cve.now/CVE-2003-1141.md): Buffer overflow in NIPrint 4.10 allows remote attackers to execute arbitrary code via a long string to TCP port 515. (no CVSS) - [CVE-2003-1142](https://cve.now/CVE-2003-1142.md): Help in NIPrint LPD-LPR Print Server 4.10 and earlier executes Windows Explorer with SYSTEM privileges, which allows local users to gain pri (no CVSS) - [CVE-2003-1143](https://cve.now/CVE-2003-1143.md): Croteam Serious Sam demo test 2 2.1a, Serious Sam: the First Encounter 1.05, and Serious Sam: the Second Encounter 1.05 allow remote attacke (no CVSS) - [CVE-2003-1144](https://cve.now/CVE-2003-1144.md): Buffer overflow in the log viewing interface in Perception LiteServe 1.25 through 2.2 allows remote attackers to execute arbitrary code via (no CVSS) - [CVE-2003-1145](https://cve.now/CVE-2003-1145.md): Cross-site scripting (XSS) vulnerability in friendmail.php in OpenAutoClassifieds 1.0 allows remote attackers to inject arbitrary web script (no CVSS) - [CVE-2003-1146](https://cve.now/CVE-2003-1146.md): Cross-site scripting (XSS) vulnerability in John Beatty Easy PHP Photo Album 1.0 allows remote attackers to inject arbitrary web script or H (no CVSS) - [CVE-2003-1148](https://cve.now/CVE-2003-1148.md): Multiple PHP remote file inclusion vulnerabilities in J-Pierre DEZELUS Les Visiteurs 2.0.1, as used in phpMyConferences (phpMyConference) 8. (no CVSS) - [CVE-2003-1149](https://cve.now/CVE-2003-1149.md): Cross-site scripting (XSS) vulnerability in Symantec Norton Internet Security 2003 6.0.4.34 allows remote attackers to inject arbitrary web (no CVSS) - [CVE-2003-1150](https://cve.now/CVE-2003-1150.md): Buffer overflow in the portmapper service (PMAP.NLM) in Novell NetWare 6 SP3 and ZenWorks for Desktops 3.2 SP2 through 4.0.1 allows remote a (no CVSS) - [CVE-2003-1151](https://cve.now/CVE-2003-1151.md): Cross-site scripting (XSS) vulnerability in Fastream NETFile Server 6.0.3.588 allows remote attackers to inject arbitrary web script or HTML (no CVSS) - [CVE-2003-1152](https://cve.now/CVE-2003-1152.md): WebTide 7.04 allows remote attackers to list arbitrary directories via an HTTP request for %3f.jsp (encoded "?"). (no CVSS) - [CVE-2003-1153](https://cve.now/CVE-2003-1153.md): byteHoard 0.7 and 0.71 allows remote attackers to list arbitrary files and directories via a direct request to files.inc.php. (no CVSS) - [CVE-2003-1154](https://cve.now/CVE-2003-1154.md): MAILsweeper for SMTP 4.3 allows remote attackers to bypass virus protection via a mail message with a malformed zip attachment, as exploited (no CVSS) - [CVE-2003-1155](https://cve.now/CVE-2003-1155.md): X-CD-Roast 0.98 alpha10 through alpha14 allows local users to overwrite arbitrary files via a symlink attack on an unknown file. (no CVSS) - [CVE-2003-1156](https://cve.now/CVE-2003-1156.md): Java Runtime Environment (JRE) and Software Development Kit (SDK) 1.4.2 through 1.4.2\_02 allows local users to overwrite arbitrary files via (no CVSS) - [CVE-2003-1157](https://cve.now/CVE-2003-1157.md): Cross-site scripting (XSS) vulnerability in login.asp in Citrix MetaFrame XP Server 1.0 allows remote attackers to inject arbitrary web scri (no CVSS) - [CVE-2003-1158](https://cve.now/CVE-2003-1158.md): Multiple buffer overflows in the FTP service in Plug and Play Web Server 1.0002c allow remote attackers to cause a denial of service (crash) (no CVSS) - [CVE-2003-1159](https://cve.now/CVE-2003-1159.md): Plug and Play Web Server Proxy 1.0002c allows remote attackers to cause a denial of service (server crash) via an invalid URI in an HTTP GET (no CVSS) - [CVE-2003-1160](https://cve.now/CVE-2003-1160.md): FlexWATCH Network video server 132 allows remote attackers to bypass authentication and gain administrative privileges via an HTTP request t (no CVSS) - [CVE-2003-1161](https://cve.now/CVE-2003-1161.md): exit.c in Linux kernel 2.6-test9-CVS, as stored on kernel.bkbits.net, was modified to contain a backdoor, which could allow local users to e (no CVSS) - [CVE-2003-1162](https://cve.now/CVE-2003-1162.md): index.php in Tritanium Bulletin Board 1.2.3 allows remote attackers to read and reply to arbitrary messages by modifying the thread\_id, foru (no CVSS) - [CVE-2003-1163](https://cve.now/CVE-2003-1163.md): hash.c in Ganglia gmond 2.5.3 allows remote attackers to cause a denial of service (segmentation fault) via a UDP packet that contains a sin (no CVSS) - [CVE-2003-1164](https://cve.now/CVE-2003-1164.md): Cross-site scripting (XSS) vulnerability in Mldonkey 2.5-4 allows remote attackers to inject arbitrary web script or HTML via the URI, which (no CVSS) - [CVE-2003-1165](https://cve.now/CVE-2003-1165.md): Buffer overflow in BRS WebWeaver 1.06 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrar (no CVSS) - [CVE-2003-1166](https://cve.now/CVE-2003-1166.md): Directory traversal vulnerability in (1) Openfile.aspx and (2) Html.aspx in HTTP Commander 4.0 allows remote attackers to view arbitrary fil (no CVSS) - [CVE-2003-1167](https://cve.now/CVE-2003-1167.md): misc.cpp in KPopup 0.9.1 trusts the PATH variable when executing killall, which allows local users to elevate their privileges by modifying (no CVSS) - [CVE-2003-1168](https://cve.now/CVE-2003-1168.md): HTTP Commander 4.0 allows remote attackers to obtain sensitive information via an HTTP request that contains a . (no CVSS) - [CVE-2003-1169](https://cve.now/CVE-2003-1169.md): DATEV Nutzungskontrolle 2.1 and 2.2 has insecure write permissions for critical registry keys, which allows local users to bypass access res (no CVSS) - [CVE-2003-1170](https://cve.now/CVE-2003-1170.md): Format string vulnerability in main.cpp in kpopup 0.9.1 and 0.9.5pre2 allows local users to cause a denial of service (segmentation fault) a (no CVSS) - [CVE-2003-1171](https://cve.now/CVE-2003-1171.md): Heap-based buffer overflow in the sec\_filter\_out function in mod\_security 1.7RC1 through 1.7.1 in Apache 2 allows remote attackers to execut (no CVSS) - [CVE-2003-1172](https://cve.now/CVE-2003-1172.md): Directory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoon 2.1 and 2.2 allows remote attackers to (no CVSS) - [CVE-2003-1173](https://cve.now/CVE-2003-1173.md): Centrinity FirstClass 7.1 allows remote attackers to access sensitive information by appending search to the end of the URL and checking all (no CVSS) - [CVE-2003-1174](https://cve.now/CVE-2003-1174.md): Buffer overflow in NullSoft Shoutcast Server 1.9.2 allows local users to cause a denial of service via (1) icy-name followed by a long serve (no CVSS) - [CVE-2003-1175](https://cve.now/CVE-2003-1175.md): Cross-site scripting (XSS) vulnerability in index.php in Sympoll 1.5 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS) - [CVE-2003-1176](https://cve.now/CVE-2003-1176.md): post\_message\_form.asp in Web Wiz Forums 6.34 through 7.5, when quote mode is used, allows remote attackers to read or write to private forum (no CVSS) - [CVE-2003-1177](https://cve.now/CVE-2003-1177.md): Buffer overflow in the base64 decoder in MERCUR Mailserver 4.2 before SP3a allows remote attackers to cause a denial of service and possibly (no CVSS) - [CVE-2003-1178](https://cve.now/CVE-2003-1178.md): Eval injection vulnerability in comments.php in Advanced Poll 2.0.2 allows remote attackers to execute arbitrary PHP code via the (1) id, (2 (no CVSS) - [CVE-2003-1179](https://cve.now/CVE-2003-1179.md): Multiple PHP remote file inclusion vulnerabilities in Advanced Poll 2.0.2 allow remote attackers to execute arbitrary PHP code via the inclu (no CVSS) - [CVE-2003-1180](https://cve.now/CVE-2003-1180.md): Directory traversal vulnerability in Advanced Poll 2.0.2 allows remote attackers to read arbitrary files or inject arbitrary local PHP files (no CVSS) - [CVE-2003-1181](https://cve.now/CVE-2003-1181.md): Advanced Poll 2.0.2 allows remote attackers to obtain sensitive information via an HTTP request to info.php, which invokes the phpinfo() fun (no CVSS) - [CVE-2003-1182](https://cve.now/CVE-2003-1182.md): Cross-site scripting (XSS) vulnerability in MPM Guestbook 1.2 allows remote attackers to inject arbitrary web script or HTML via the lng par (no CVSS) - [CVE-2003-1183](https://cve.now/CVE-2003-1183.md): The WebCache component in Oracle Files 9.0.3.1.0, 9.0.3.2.0, and 9.0.3.3.0 of Oracle Collaboration Suite Release 1 caches files despite the (no CVSS) - [CVE-2003-1184](https://cve.now/CVE-2003-1184.md): Multiple cross-site scripting (XSS) vulnerabilities in ThWboard Beta 2.8 and 2.81 allow remote attackers to inject arbitrary web script or H (no CVSS) - [CVE-2003-1185](https://cve.now/CVE-2003-1185.md): Multiple SQL injection vulnerabilities in ThWboard before Beta 2.8.2 allow remote attackers to inject arbitrary SQL commands via various vec (no CVSS) - [CVE-2003-1186](https://cve.now/CVE-2003-1186.md): Buffer overflow in TelCondex SimpleWebServer 2.12.30210 Build3285 allows remote attackers to execute arbitrary code via a long HTTP Referer (no CVSS) - [CVE-2003-1187](https://cve.now/CVE-2003-1187.md): Cross-site scripting (XSS) vulnerability in include.php in PHPKIT 1.6.02 and 1.6.03 allows remote attackers to inject arbitrary web script o (no CVSS) - [CVE-2003-1188](https://cve.now/CVE-2003-1188.md): Unichat allows remote attackers to cause a denial of service (crash) by adding extra chat characters (avatars) and logging in to a chat room (no CVSS) - [CVE-2003-1189](https://cve.now/CVE-2003-1189.md): Unknown vulnerability in Nokia IPSO 3.7, configured as IP Clusters, allows remote attackers to cause a denial of service via unknown attack (no CVSS) - [CVE-2003-1190](https://cve.now/CVE-2003-1190.md): Cross-site scripting (XSS) vulnerability in PHPRecipeBook 1.24 through 2.17 allows remote attackers to inject arbitrary web script or HTML v (no CVSS) - [CVE-2003-1191](https://cve.now/CVE-2003-1191.md): chatbox.php in e107 0.554 and 0.603 allows remote attackers to cause a denial of service (pages fail to load) via HTML in the Name field, wh (no CVSS) - [CVE-2003-1192](https://cve.now/CVE-2003-1192.md): Stack-based buffer overflow in IA WebMail Server 3.1.0 allows remote attackers to execute arbitrary code via a long GET request. (no CVSS) - [CVE-2003-1193](https://cve.now/CVE-2003-1193.md): Multiple SQL injection vulnerabilities in the Portal DB (1) List of Values (LOVs), (2) Forms, (3) Hierarchy, and (4) XML components packages (no CVSS) - [CVE-2003-1194](https://cve.now/CVE-2003-1194.md): Cross-site scripting (XSS) vulnerability in Booby .1 through 0.2.3 allows remote attackers to inject arbitrary web script or HTML via the er (no CVSS) - [CVE-2003-1195](https://cve.now/CVE-2003-1195.md): SQL injection vulnerability in getmember.asp in VieBoard 2.6 Beta 1 allows remote attackers to execute arbitrary SQL commands via the msn va (no CVSS) - [CVE-2003-1196](https://cve.now/CVE-2003-1196.md): SQL injection vulnerability in viewtopic.asp in VieBoard 2.6 allows remote attackers to execute arbitrary SQL commands via the forumid param (no CVSS) - [CVE-2003-1197](https://cve.now/CVE-2003-1197.md): Cross-site scripting (XSS) vulnerability in index.php for Ledscripts.com LedForums Beta 1 allows remote attackers to inject arbitrary web sc (no CVSS) - [CVE-2003-1198](https://cve.now/CVE-2003-1198.md): connection.c in Cherokee web server before 0.4.6 allows remote attackers to cause a denial of service via an HTTP POST request without a Con (no CVSS) - [CVE-2003-1199](https://cve.now/CVE-2003-1199.md): Cross-site scripting (XSS) vulnerability in MyProxy 20030629 allows remote attackers to inject arbitrary web script or HTML via the URL. (no CVSS) - [CVE-2003-1200](https://cve.now/CVE-2003-1200.md): Stack-based buffer overflow in FORM2RAW.exe in Alt-N MDaemon 6.5.2 through 6.8.5 allows remote attackers to execute arbitrary code via a lon (no CVSS) - [CVE-2003-1201](https://cve.now/CVE-2003-1201.md): ldbm\_back\_exop\_passwd in the back-ldbm backend in passwd.c for OpenLDAP 2.1.12 and earlier, when the slap\_passwd\_parse function does not ret (no CVSS) - [CVE-2003-1202](https://cve.now/CVE-2003-1202.md): The checklogin function in omail.pl for omail webmail 0.98.4 and earlier allows remote attackers to execute arbitrary commands via shell met (no CVSS) - [CVE-2004-0462](https://cve.now/CVE-2004-0462.md): The built-in web servers for multiple networking devices do not set the Secure attribute for sensitive cookies in HTTPS sessions, which coul (no CVSS) - [CVE-2004-1779](https://cve.now/CVE-2004-1779.md): Cross-site scripting (XSS) vulnerability in board.php for ThWboard before beta 2.84 allows remote attackers to inject arbitrary web script o (no CVSS) - [CVE-2004-1780](https://cve.now/CVE-2004-1780.md): Info Touch Surfnet kiosk allows local users to deposit extra time into Internet kiosk accounts via repeated authentication attempts. (no CVSS) - [CVE-2004-1781](https://cve.now/CVE-2004-1781.md): Info Touch Surfnet kiosk allows local users to crash Surfnet and access the underlying operating system via the CMD\_CREDITCARD\_CHARGE comman (no CVSS) - [CVE-2004-1782](https://cve.now/CVE-2004-1782.md): athenareg.php in Athena Web Registration allows remote attackers to execute arbitrary commands via shell metacharacters in the pass paramete (no CVSS) - [CVE-2004-1783](https://cve.now/CVE-2004-1783.md): Directory traversal vulnerability in Net2Soft Flash FTP Server 1.0 allows remote attackers to read and create arbitrary files via a /.. (no CVSS) - [CVE-2004-1784](https://cve.now/CVE-2004-1784.md): Buffer overflow in the web server of Webcam Watchdog 3.63 allows remote attackers to execute arbitrary code via a long HTTP GET request. (no CVSS) - [CVE-2004-1785](https://cve.now/CVE-2004-1785.md): SQL injection vulnerability in calendar.php for Invision Power Board 1.3 allows remote attackers to execute arbitrary SQL commands via the m (no CVSS) - [CVE-2004-1786](https://cve.now/CVE-2004-1786.md): PortalApp places user credentials under the web root with insufficient access control, which allows remote attackers to gain access to sensi (no CVSS) - [CVE-2004-1787](https://cve.now/CVE-2004-1787.md): SQL injection vulnerability in PostCalendar 4.0.0 allows remote attackers to execute arbitrary SQL commands via search queries. (no CVSS) - [CVE-2004-1788](https://cve.now/CVE-2004-1788.md): ASP-Nuke 1.3 and earlier places user credentials under the web document root with insufficient access control, which allows remote attackers (no CVSS) - [CVE-2004-1789](https://cve.now/CVE-2004-1789.md): Cross-site scripting (XSS) vulnerability in the web management interface in ZyWALL 10 4.07 allows remote attackers to inject arbitrary web s (no CVSS) - [CVE-2004-1790](https://cve.now/CVE-2004-1790.md): Cross-site scripting (XSS) vulnerability in the web management interface in Edimax AR-6004 ADSL Routers allows remote attackers to inject ar (no CVSS) - [CVE-2004-1791](https://cve.now/CVE-2004-1791.md): The web management interface in Edimax AR-6004 ADSL Routers uses a default administrator name and password, which also appear as the default (no CVSS) - [CVE-2004-1792](https://cve.now/CVE-2004-1792.md): swnet.dll in YaSoft Switch Off 2.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a long packet with t (no CVSS) - [CVE-2004-1793](https://cve.now/CVE-2004-1793.md): Stack-based buffer overflow in swnet.dll in YaSoft Switch Off 2.3 and earlier allows remote authenticated users to execute arbitrary code vi (no CVSS) - [CVE-2004-1794](https://cve.now/CVE-2004-1794.md): Cross-site scripting (XSS) vulnerability in the VCard4J Toolkit allows remote attackers to inject arbitrary web script or HTML via the NICKN (no CVSS) - [CVE-2004-1795](https://cve.now/CVE-2004-1795.md): Info Touch Surfnet kiosk allows local users to access the underlying filesystem via a 'file://' URI. (no CVSS) - [CVE-2004-1796](https://cve.now/CVE-2004-1796.md): PHP remote file inclusion vulnerability in HotNews 0.7.2 and earlier allows remote attackers to execute arbitrary PHP code via the (1) confi (no CVSS) - [CVE-2004-1797](https://cve.now/CVE-2004-1797.md): Cross-site scripting (XSS) vulnerability in search.php for FreznoShop 1.3.0 RC1 and earlier allows remote attackers to inject arbitrary web (no CVSS) - [CVE-2004-1798](https://cve.now/CVE-2004-1798.md): RealOne player 6.0.11.868 allows remote attackers to execute arbitrary script in the "My Computer" zone via a Synchronized Multimedia Integr (no CVSS) - [CVE-2004-1799](https://cve.now/CVE-2004-1799.md): PF in certain OpenBSD versions, when stateful filtering is enabled, does not limit packets for a session to the original interface, which al (no CVSS) - [CVE-2004-1800](https://cve.now/CVE-2004-1800.md): Unknown vulnerability in Sysbotz SimpleData 4.0.1 and possibly earlier versions allows remote attackers to gain access via a crafted URL and (no CVSS) - [CVE-2004-1801](https://cve.now/CVE-2004-1801.md): Directory traversal vulnerability in PWebServer 0.3.3 allows remote attackers to read arbitrary files via a .. (no CVSS) - [CVE-2004-1802](https://cve.now/CVE-2004-1802.md): Chat Anywhere 2.72 and earlier allows remote attackers to hide their IP address by using %00 before the nickname, which causes the IP addres (no CVSS) - [CVE-2004-1804](https://cve.now/CVE-2004-1804.md): wMCam server 2.1.348 allows remote attackers to cause a denial of service (no new connections) via multiple malformed HTTP requests without (no CVSS) - [CVE-2004-1805](https://cve.now/CVE-2004-1805.md): Format string vulnerability in games using the Epic Games Unreal Engine 436 allows remote attackers to cause a denial of service (crash) and (no CVSS) - [CVE-2004-1806](https://cve.now/CVE-2004-1806.md): SQL injection vulnerability in index.cfm in CFWebstore 5.0 allows remote attackers to execute SQL commands via the (1) category\_id, (2) prod (no CVSS) - [CVE-2004-1807](https://cve.now/CVE-2004-1807.md): Cross-site scripting (XSS) vulnerability in index.cfm in CFWebstore 5.0 allows remote attackers to inject arbitrary web script or HTML via t (no CVSS) - [CVE-2004-1808](https://cve.now/CVE-2004-1808.md): Extcompose in metamail does not verify the output file before writing to it, which allows local users to overwrite arbitrary files via a sym (no CVSS) - [CVE-2004-1809](https://cve.now/CVE-2004-1809.md): Cross-site scripting (XSS) vulnerability in phpBB 2.0.6d and earlier allows remote attackers to inject arbitrary web script or HTML via the (no CVSS) - [CVE-2004-1810](https://cve.now/CVE-2004-1810.md): The Javascript engine in Opera 7.23 allows remote attackers to cause a denial of service (crash) by creating a new Array object with a large (no CVSS) - [CVE-2004-1811](https://cve.now/CVE-2004-1811.md): The SSL HTTP Server in HP Web-enabled Management Software 5.0 through 5.92, with anonymous access enabled, allows remote attackers to compro (no CVSS) - [CVE-2004-1812](https://cve.now/CVE-2004-1812.md): Multiple stack-based buffer overflows in Agent Common Services (1) cam.exe and (2) awservices.exe in Unicenter TNG 2.4 allow remote attacker (no CVSS) - [CVE-2004-1813](https://cve.now/CVE-2004-1813.md): VocalTec VGW4/8 Gateway 8.0 allows remote attackers to bypass authentication via an HTTP request to home.asp with a trailing slash (/). (no CVSS) - [CVE-2004-1814](https://cve.now/CVE-2004-1814.md): Directory traversal vulnerability in VocalTec VGW4/8 Gateway 8.0 allows remote attackers to read protected files via .. (no CVSS) - [CVE-2004-1815](https://cve.now/CVE-2004-1815.md): Unknown vulnerability in ColdFusion MX 6.0 and 6.1, and JRun 4.0, when a SOAP web service expects an array of objects as an argument, allows (no CVSS) - [CVE-2004-1816](https://cve.now/CVE-2004-1816.md): Unknown vulnerability in Sun Java System Application Server 7.0 Update 2 and earlier, when a SOAP web service expects an array of objects as (no CVSS) - [CVE-2004-1817](https://cve.now/CVE-2004-1817.md): Cross-site scripting (XSS) vulnerability in modules.php in Php-Nuke 7.1.0 allows remote attackers to inject arbitrary web script or HTML via (no CVSS) - [CVE-2004-1818](https://cve.now/CVE-2004-1818.md): Cross-site scripting (XSS) vulnerability in nmimage.php in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to execute arbi (no CVSS) - [CVE-2004-1819](https://cve.now/CVE-2004-1819.md): 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to obtain sensitive information via a direct request to displaycategory.ph (no CVSS) - [CVE-2004-1820](https://cve.now/CVE-2004-1820.md): PHP remote file inclusion vulnerability in displaycategory.php in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to execu (no CVSS) - [CVE-2004-1821](https://cve.now/CVE-2004-1821.md): SQL injection vulnerability in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0 allows remote attackers to gain privileges or perform unauthorized (no CVSS) - [CVE-2004-1822](https://cve.now/CVE-2004-1822.md): Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.1 through 5.0.3 beta allow remote attackers to inject arbitrary web script o (no CVSS) - [CVE-2004-1823](https://cve.now/CVE-2004-1823.md): Multiple cross-site scripting (XSS) vulnerabilities in Jelsoft vBulletin 2.0 beta 3 through 3.0 can4 allows remote attackers to inject arbit (no CVSS) - [CVE-2004-1824](https://cve.now/CVE-2004-1824.md): Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin before 3.0 allows remote attackers to inject arbitrary web script or HTML via (no CVSS) - [CVE-2004-1825](https://cve.now/CVE-2004-1825.md): Cross-site scripting (XSS) vulnerability in index.php in Mambo Open Source 4.5 stable 1.0.3 and earlier allows remote attackers to inject ar (no CVSS) - [CVE-2004-1826](https://cve.now/CVE-2004-1826.md): SQL injection vulnerability in index.php in Mambo Open Source 4.5 stable 1.0.3 and earlier allows remote attackers to execute arbitrary SQL (no CVSS) - [CVE-2004-1827](https://cve.now/CVE-2004-1827.md): Cross-site scripting (XSS) vulnerability in YaBB 1 Gold(SP1.3) and YaBB SE 1.5.1 Final allows remote attackers to inject arbitrary web scrip (no CVSS) - [CVE-2004-1828](https://cve.now/CVE-2004-1828.md): Vcard 2.9 and possibly other versions does not require authorization to run uninstall.php, which could allow remote attackers to uninstall V (no CVSS) - [CVE-2004-1829](https://cve.now/CVE-2004-1829.md): Multiple cross-site scripting (XSS) vulnerabilities in error.php in Gijza.net Error Manager 2.1 for PHP-Nuke 6.0 allow remote attackers to i (no CVSS) - [CVE-2004-1830](https://cve.now/CVE-2004-1830.md): error.php in Error Manager 2.1 for PHP-Nuke 6.0 allows remote attackers to obtain sensitive information via an invalid (1) language, (2) new (no CVSS) - [CVE-2004-1831](https://cve.now/CVE-2004-1831.md): Buffer overflow in Chrome 1.2.0.0 and earlier allows remote attackers to cause a denial of service (crash) via a packet with a large length (no CVSS) - [CVE-2004-1832](https://cve.now/CVE-2004-1832.md): Buffer overflow in the GUI admin service in Mac OS X Server 10.3 allows remote attackers to cause a denial of service (crash and restart) vi (no CVSS) - [CVE-2004-1833](https://cve.now/CVE-2004-1833.md): The admin.ib file in Borland Interbase 7.1 for Linux has default world writable permissions, which allows local users to gain database admin (no CVSS) - [CVE-2004-1834](https://cve.now/CVE-2004-1834.md): mod\_disk\_cache in Apache 2.0 through 2.0.49 stores client headers, including authentication information, on the hard disk, which could allow (no CVSS) - [CVE-2004-1835](https://cve.now/CVE-2004-1835.md): Multiple SQL injection vulnerabilities in index.php in Invision Gallery 1.0.1 allow remote attackers to execute arbitrary SQL via the (1) im (no CVSS) - [CVE-2004-1836](https://cve.now/CVE-2004-1836.md): SQL injection vulnerability in index.php in Invision Power Top Site List 1.1 RC 2 and earlier allows remote attackers to execute arbitrary S (no CVSS) - [CVE-2004-1837](https://cve.now/CVE-2004-1837.md): Cross-site scripting (XSS) vulnerability in Mod\_survey 3.0.x before 3.0.16-pre2 and 3.2.x before 3.2.0-pre4 allows remote attackers to injec (no CVSS) - [CVE-2004-1838](https://cve.now/CVE-2004-1838.md): Directory traversal vulnerability in xweb 1.0 allows remote attackers to download arbitrary files via a .. (no CVSS) - [CVE-2004-1839](https://cve.now/CVE-2004-1839.md): MS Analysis module 2.0 for PHP-Nuke allows remote attackers to obtain sensitive information via a direct request to (1) browsers.php, (2) ms (no CVSS) - [CVE-2004-1840](https://cve.now/CVE-2004-1840.md): Multiple cross-site scripting (XSS) vulnerabilities in MS Analysis module 2.0 for PHP-Nuke allows remote attackers to inject arbitrary web s (no CVSS) - [CVE-2004-1841](https://cve.now/CVE-2004-1841.md): SQL injection vulnerability in MS Analysis module 2.0 for PHP-Nuke allows remote attackers to execute arbitrary SQL via the referer field in (no CVSS) - [CVE-2004-1842](https://cve.now/CVE-2004-1842.md): Cross-site request forgery (CSRF) vulnerability in Php-Nuke 6.x through 7.1.0 allows remote attackers to gain administrative privileges via (no CVSS) - [CVE-2004-1843](https://cve.now/CVE-2004-1843.md): SQL injection vulnerability in Member Management System 2.1 allows remote attackers to execute arbitrary SQL via the ID parameter to (1) res (no CVSS) - [CVE-2004-1844](https://cve.now/CVE-2004-1844.md): Cross-site scripting (XSS) vulnerability in Member Management System 2.1 allows remote attackers to inject arbitrary web script or HTML via (no CVSS) - [CVE-2004-1845](https://cve.now/CVE-2004-1845.md): Multiple cross-site scripting (XSS) vulnerabilities in News Manager Lite 2.5 allow remote attackers to inject arbitrary web script or HTML v (no CVSS) - [CVE-2004-1846](https://cve.now/CVE-2004-1846.md): Multiple SQL injection vulnerabilities in News Manager Lite 2.5 allow remote attackers to execute arbitrary SQL code via the (1) ID paramete (no CVSS) - [CVE-2004-1847](https://cve.now/CVE-2004-1847.md): News Manager Lite 2.5 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMIN parameter in t (no CVSS) - [CVE-2004-1848](https://cve.now/CVE-2004-1848.md): Ipswitch WS\_FTP Server 4.0.2 allows remote attackers to cause a denial of service (disk consumption) and bypass file size restrictions via a (no CVSS) - [CVE-2004-1849](https://cve.now/CVE-2004-1849.md): Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1 (no CVSS) - [CVE-2004-1850](https://cve.now/CVE-2004-1850.md): The Rage 1.01 and earlier allows remote attackers to cause a denial of service (infinite loop) via a TCP packet with the port and IP address (no CVSS) - [CVE-2004-1851](https://cve.now/CVE-2004-1851.md): Dameware Mini Remote Control 4.1.0.0 uses insufficiently random data to create the encryption key, which makes it easier for remote attacker (no CVSS) - [CVE-2004-1852](https://cve.now/CVE-2004-1852.md): DameWare Mini Remote Control 3.x before 3.74 and 4.x before 4.2 transmits the Blowfish encryption key in plaintext, which allows remote atta (no CVSS) - [CVE-2004-1853](https://cve.now/CVE-2004-1853.md): Buffer overflow in Terminator 3: War of the Machines 1.0 allows remote attackers to cause a denial of service via a long ServerInfo variable (no CVSS) - [CVE-2004-1854](https://cve.now/CVE-2004-1854.md): Buffer overflow in the logging function in Picophone 1.63 and earlier allows remote attackers to execute arbitrary code via a large packet. (no CVSS) - [CVE-2004-1855](https://cve.now/CVE-2004-1855.md): Dark Age of Camelot before 1.68 live patch does not sign the RSA public key, which could allow remote malicious servers to gain sensitive in (no CVSS) - [CVE-2004-1856](https://cve.now/CVE-2004-1856.md): devices\_update\_printer\_fw\_upload.hts in HP Web JetAdmin 7.5.2546, when no password is set, allows remote attackers to upload arbitrary files (no CVSS) - [CVE-2004-1857](https://cve.now/CVE-2004-1857.md): Directory traversal vulnerability in setinfo.hts in HP Web Jetadmin 7.5.2546 allows remote authenticated attackers to read arbitrary files v (no CVSS) - [CVE-2004-1858](https://cve.now/CVE-2004-1858.md): HP Web Jetadmin 7.5.2546 allows remote attackers to cause a denial of service (crash) via a malformed request, possibly due to a stricmp() e (no CVSS) - [CVE-2004-1859](https://cve.now/CVE-2004-1859.md): Directory traversal vulnerability in Trend Micro Interscan Web Viruswall in InterScan VirusWall 3.5x allows remote attackers to read arbitra (no CVSS) - [CVE-2004-1860](https://cve.now/CVE-2004-1860.md): Buffer overflow in Check Point SmartDashboard in Check Point NG AI R54 and R55 allows remote authenticated users to cause a denial of servic (no CVSS) - [CVE-2004-1861](https://cve.now/CVE-2004-1861.md): Invision NetSupport School Pro uses a weak encryption algorithm to encrypt passwords, which allows local users to obtain passwords. (no CVSS) - [CVE-2004-1862](https://cve.now/CVE-2004-1862.md): Multiple cross-site scripting (XSS) vulnerabilities in Extreme Messageboard (XMB) 1.8 SP3 and 1.9 beta allow remote attackers to inject arbi (no CVSS) - [CVE-2004-1863](https://cve.now/CVE-2004-1863.md): Multiple cross-site scripting (XSS) vulnerabilities in XMB (aka extreme message board) 1.9 beta (aka Nexus beta) allow remote attackers to i (no CVSS) - [CVE-2004-1864](https://cve.now/CVE-2004-1864.md): SQL injection vulnerability in Extreme Messageboard (XMB) 1.9 beta allows remote attackers to execute arbitrary SQL commands via the restric (no CVSS) - [CVE-2004-1865](https://cve.now/CVE-2004-1865.md): Cross-site scripting (XSS) vulnerability in the administration panel in bBlog 0.7.2 allows remote authenticated users with superuser privile (no CVSS) - [CVE-2004-1866](https://cve.now/CVE-2004-1866.md): nstxd in Nstx 1.1 beta3 and earlier allows remote attackers to cause a denial of service (crash) via a large packet, which triggers a null d (no CVSS) - [CVE-2004-1867](https://cve.now/CVE-2004-1867.md): Cross-site scripting (XSS) vulnerability in guest.cgi in Fresh Guest Book allows remote attackers to inject arbitrary web script or HTML via (no CVSS) - [CVE-2004-1868](https://cve.now/CVE-2004-1868.md): Stack-based buffer overflow in WinSig.exe in eSignal 7.5 and 7.6 allows remote attackers to execute arbitrary code via a long STREAMQUOTE ta (no CVSS) - [CVE-2004-1869](https://cve.now/CVE-2004-1869.md): Etherlords I 1.07 and earlier and Etherlords II 1.03 and earlier allows remote attackers to cause a denial of service (crash) by sending a p (no CVSS) - [CVE-2004-1870](https://cve.now/CVE-2004-1870.md): Multiple SQL injection vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to gain users' passwords via the (1) ph (no CVSS) - [CVE-2004-1871](https://cve.now/CVE-2004-1871.md): Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to inject arbitrary web sc (no CVSS) - [CVE-2004-1872](https://cve.now/CVE-2004-1872.md): Cross-site scripting (XSS) vulnerability in WebCT Campus Edition 4.1.1.5 allows remote attackers to inject arbitrary web script or HTML via (no CVSS) - [CVE-2004-1873](https://cve.now/CVE-2004-1873.md): SQL injection vulnerability in category.asp in A-CART Pro and A-CART 2.0 allows remote attackers to gain privileges via the catcode paramete (no CVSS) - [CVE-2004-1874](https://cve.now/CVE-2004-1874.md): Multiple cross-site scripting (XSS) vulnerabilities in (1) deliver.asp and (2) billing.asp in A-CART Pro and A-CART 2.0 allow remote attacke (no CVSS) - [CVE-2004-1875](https://cve.now/CVE-2004-1875.md): Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via th (no CVSS) - [CVE-2004-1876](https://cve.now/CVE-2004-1876.md): The "%f" feature in the VirusEvent directive in Clam AntiVirus daemon (clamd) before 0.70 allows local users to execute arbitrary commands v (no CVSS) - [CVE-2004-1877](https://cve.now/CVE-2004-1877.md): The p\_submit\_url value in the sample login form in the Oracle 9i Application Server (9iAS) Single Sign-on Administrators Guide, Release 2(9. (no CVSS) - [CVE-2004-1878](https://cve.now/CVE-2004-1878.md): LINBOX LIN:BOX allows remote attackers to bypass authentication, obtain sensitive information, or gain access via a direct request to admin/ (no CVSS) - [CVE-2004-1879](https://cve.now/CVE-2004-1879.md): Cross-site scripting (XSS) vulnerability in PHPKIT 1.6.03 allows allows remote attackers to inject arbitrary web script or HTML via forum me (no CVSS) - [CVE-2004-1880](https://cve.now/CVE-2004-1880.md): Memory leak in the back-bdb backend for OpenLDAP 2.1.12 and earlier allows remote attackers to cause a denial of service (memory consumption (no CVSS) - [CVE-2004-1881](https://cve.now/CVE-2004-1881.md): SQL injection vulnerability in (1) mailorder.asp or (2) payonline.asp in CactuShop 5.x allows remote attackers to execute arbitrary SQL comm (no CVSS) - [CVE-2004-1882](https://cve.now/CVE-2004-1882.md): Cross-site scripting (XSS) vulnerability in popuplargeimage.asp in CactuShop 5.x allows remote attackers to inject arbitrary web script or H (no CVSS) - [CVE-2004-1883](https://cve.now/CVE-2004-1883.md): Multiple buffer overflows in Ipswitch WS\_FTP Server 4.0.2 (1) allow remote authenticated users to execute arbitrary code by causing a large (no CVSS) - [CVE-2004-1884](https://cve.now/CVE-2004-1884.md): Ipswitch WS\_FTP Server 4.0.2 has a backdoor XXSESS\_MGRYY username with a default password, which allows remote attackers to gain access. (no CVSS) - [CVE-2004-1885](https://cve.now/CVE-2004-1885.md): Ipswitch WS\_FTP Server 4.0.2 allows remote authenticated users to execute arbitrary programs as SYSTEM by using the SITE command to modify c (no CVSS) - [CVE-2004-1887](https://cve.now/CVE-2004-1887.md): Ada Image Server (ImgSvr) 0.4 allows remote attackers to view directories or download files via an HTTP request with a trailing %00 (null). (no CVSS) - [CVE-2004-1888](https://cve.now/CVE-2004-1888.md): display.cgi in Aborior Encore WebForum allows remote to execute arbitrary commands via shell metacharacters in the file variable. (no CVSS) - [CVE-2004-1889](https://cve.now/CVE-2004-1889.md): Unknown vulnerability in ftpd in SGI IRIX 6.5.20 through 6.5.23 allows remote attackers to cause a denial of service (hang) via a link failu (no CVSS) - [CVE-2004-1890](https://cve.now/CVE-2004-1890.md): Unknown vulnerability in ftpd in SGI IRIX 6.5.20 through 6.5.23 allows remote attackers to cause a denial of service (hang) via the PORT mod (no CVSS) - [CVE-2004-1891](https://cve.now/CVE-2004-1891.md): The ftp\_syslog function in ftpd in SGI IRIX 6.5.20 "doesn't work with anonymous FTP," which has an unknown impact, possibly preventing the a (no CVSS) - [CVE-2004-1892](https://cve.now/CVE-2004-1892.md): Stack-based buffer overflow in DecodeBase16 function, as used in the (1) IRC module and (2) web server in eMule 0.42d, allows remote attacke (no CVSS) - [CVE-2004-1893](https://cve.now/CVE-2004-1893.md): Dreamweaver MX, when "Using Driver On Testing Server" or "Using DSN on Testing Server" is selected, uploads the mmhttpdb.asp script to the w (no CVSS) - [CVE-2004-1894](https://cve.now/CVE-2004-1894.md): TEXutil in ConTEXt, when executed with the --silent option, allows local users to overwrite arbitrary files via a symlink attack on texutil. (no CVSS) - [CVE-2004-1895](https://cve.now/CVE-2004-1895.md): YaST Online Update (YOU) in SuSE 8.2 and 9.0 allows local users to overwrite arbitrary files via a symlink attack on you-$USER/cookies. (no CVSS) - [CVE-2004-1896](https://cve.now/CVE-2004-1896.md): Heap-based buffer overflow in in\_mod.dll in Nullsoft Winamp 2.91 through 5.02 allows remote attackers to execute arbitrary code via a Fasttr (no CVSS) - [CVE-2004-1897](https://cve.now/CVE-2004-1897.md): Administration interface in Monit 1.4 through 4.2 allows remote attackers to cause a denial of service (segmentation fault) by sending a Bas (no CVSS) - [CVE-2004-1898](https://cve.now/CVE-2004-1898.md): Stack-based buffer overflow in the administration interface in Monit 1.4 through 4.2 allows remote attackers to execute arbitrary code via a (no CVSS) - [CVE-2004-1899](https://cve.now/CVE-2004-1899.md): The administration interface in Monit 1.4 through 4.2 allows remote attackers to cause an off-by-one overflow via a POST that contains 1024 (no CVSS) - [CVE-2004-1900](https://cve.now/CVE-2004-1900.md): Format string vulnerability in the logging function in IGI 2 Covert Strike server 1.3 and earlier allows remote attackers to execute arbitra (no CVSS) - [CVE-2004-1901](https://cve.now/CVE-2004-1901.md): Portage before 2.0.50-r3 allows local users to overwrite arbitrary files via a hard link attack on the lockfiles. (CVSS 5.5) - [CVE-2004-1902](https://cve.now/CVE-2004-1902.md): The Citrix MetaFrame Password Manager 2.0, when a central credential store is not configured, does not encrypt passwords entered immediately (no CVSS) - [CVE-2004-1903](https://cve.now/CVE-2004-1903.md): Buffer overflow in blaxxun 3D 7.0 allows remote attackers to execute arbitrary code via a long URL property inside an object tag. (no CVSS) - [CVE-2004-1904](https://cve.now/CVE-2004-1904.md): Buffer overflow in ascontrol.dll in Panda ActiveScan 5.0 allows remote attackers to execute arbitrary code via the Internacional property fo (no CVSS) - [CVE-2004-1905](https://cve.now/CVE-2004-1905.md): ascontrol.dll in Panda ActiveScan 5.0 allows remote attackers to cause a denial of service (crash) by calling the SetSitesFile function. (no CVSS) - [CVE-2004-1906](https://cve.now/CVE-2004-1906.md): Mcafee FreeScan allows remote attackers to cause a denial of service and possibly arbitrary code via a long string in the ScanParam property (no CVSS) - [CVE-2004-1907](https://cve.now/CVE-2004-1907.md): The Web Filtering functionality in Kerio Personal Firewall (KPF) 4.0.13 allows remote attackers to cause a denial of service (crash) by send (no CVSS) - [CVE-2004-1908](https://cve.now/CVE-2004-1908.md): McFreeScan.CoMcFreeScan.1 ActiveX object in Mcafee FreeScan allows remote attackers to obtain sensitive information via the GetSpecialFolder (no CVSS) - [CVE-2004-1909](https://cve.now/CVE-2004-1909.md): Claim Anti-Virus (ClamAV) 0.68 and earlier allows remote attackers to cause a denial of service (crash) via certain RAR archives, such as th (no CVSS) - [CVE-2004-1910](https://cve.now/CVE-2004-1910.md): rufsi.dll in Symantec Virus Detection allows remote attackers to cause a denial of service (crash) via a long string to the GetPrivateProfil (no CVSS) - [CVE-2004-1911](https://cve.now/CVE-2004-1911.md): Cross-site scripting (XSS) vulnerability in AzDGDatingLite 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the (1) (no CVSS) - [CVE-2004-1912](https://cve.now/CVE-2004-1912.md): The (1) modules.php, (2) block-Calendar.php, (3) block-Calendar1.php, (4) block-Calendar\_center.php scripts in NukeCalendar 1.1.a, as used i (no CVSS) - [CVE-2004-1913](https://cve.now/CVE-2004-1913.md): Cross-site scripting (XSS) vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to inject arbitr (no CVSS) - [CVE-2004-1914](https://cve.now/CVE-2004-1914.md): SQL injection vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to execute arbitrary SQL comm (no CVSS) - [CVE-2004-1915](https://cve.now/CVE-2004-1915.md): Buffer overflow in the parse\_all\_client\_messages function in LCDproc 0.4.x up to 0.4.4 allows remote attackers to execute arbitrary code via (no CVSS) - [CVE-2004-1916](https://cve.now/CVE-2004-1916.md): Multiple buffer overflows in LCDProc 0.4.1, and possibly other 0.4.x versions up to 0.4.4, allows remote attackers to execute arbitrary code (no CVSS) - [CVE-2004-1917](https://cve.now/CVE-2004-1917.md): Format string vulnerability in test\_func\_func in LCDProc 0.4.1 and earlier allows remote attackers to execute arbitrary code via format stri (no CVSS) - [CVE-2004-1918](https://cve.now/CVE-2004-1918.md): RSniff 1.0 allows remote attackers to cause a denial of service (connection exhaustion) via a large number of connections with a command oth (no CVSS) - [CVE-2004-1919](https://cve.now/CVE-2004-1919.md): The hash\_strcmp function in hasch.c in Crackalaka 1.0.8 allows remote attackers to cause a denial of service (crash) via large malformed str (no CVSS) - [CVE-2004-1920](https://cve.now/CVE-2004-1920.md): X-Micro WLAN 11b Broadband Router 1.2.2, 1.2.2.3, 1.2.2.4, and 1.6.0.0 has a hardcoded "super" username and password, which could allow remo (no CVSS) - [CVE-2004-1921](https://cve.now/CVE-2004-1921.md): X-Micro WLAN 11b Broadband Router 1.6.0.1 has a hardcoded "1502" username and password, which could allow remote attackers to gain access. (no CVSS) - [CVE-2004-1922](https://cve.now/CVE-2004-1922.md): Microsoft Internet Explorer 5.5 and 6.0 allocates memory based on the memory size written in the BMP file instead of the actual BMP file siz (no CVSS) - [CVE-2004-1923](https://cve.now/CVE-2004-1923.md): Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to gain sensitive information via a direct request to (1) banner\_cli (no CVSS) - [CVE-2004-1924](https://cve.now/CVE-2004-1924.md): Multiple cross-site scripting (XSS) vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to inject arbi (no CVSS) - [CVE-2004-1925](https://cve.now/CVE-2004-1925.md): Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to execute arbitrary SQL co (no CVSS) - [CVE-2004-1926](https://cve.now/CVE-2004-1926.md): Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to inject arbitrary code via the (1) Theme, (2) Country, (3) Real Na (no CVSS) - [CVE-2004-1927](https://cve.now/CVE-2004-1927.md): Directory traversal vulnerability in the map feature (tiki-map.phtml) in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attac (no CVSS) - [CVE-2004-1928](https://cve.now/CVE-2004-1928.md): The image upload feature in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to upload and possibly execute arbitrary (no CVSS) - [CVE-2004-1929](https://cve.now/CVE-2004-1929.md): SQL injection vulnerability in the bblogin function in functions.php in PHP-Nuke 6.x through 7.2 allows remote attackers to bypass authentic (no CVSS) - [CVE-2004-1930](https://cve.now/CVE-2004-1930.md): Cross-site scripting (XSS) vulnerability in the cookiedecode function in mainfile.php for PHP-Nuke 6.x through 7.2, when themes are used, al (no CVSS) - [CVE-2004-1932](https://cve.now/CVE-2004-1932.md): SQL injection vulnerability in (1) auth.php and (2) admin.php in PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL c (no CVSS) - [CVE-2004-1933](https://cve.now/CVE-2004-1933.md): Citadel/UX 5.00 through 6.14 installs the database directory and files with world-read permissions, which could allow local users to bypass (no CVSS) - [CVE-2004-1934](https://cve.now/CVE-2004-1934.md): PHP remote file inclusion vulnerability in affich.php in Gemitel 3.50 allows remote attackers to execute arbitrary PHP code via the base par (no CVSS) - [CVE-2004-1935](https://cve.now/CVE-2004-1935.md): Cross-site scripting (XSS) vulnerability in SCT Campus Pipeline allows remote attackers to inject arbitrary web script or HTML via onload, o (no CVSS) - [CVE-2004-1936](https://cve.now/CVE-2004-1936.md): ZoneAlarm Pro 4.5.538.001 and possibly other versions allows remote attackers to bypass e-mail protection via attachments whose names contai (no CVSS) - [CVE-2004-1937](https://cve.now/CVE-2004-1937.md): Multiple directory traversal vulnerabilities in Nuked-KlaN 1.4b and 1.5b allow remote attackers to read or include arbitrary files via .. (no CVSS) - [CVE-2004-1938](https://cve.now/CVE-2004-1938.md): SQL injection vulnerability in userlogin.php in Phorum 3.4.7 allows remote attackers to execute arbitrary SQL commands via doubly hex-encode (no CVSS) - [CVE-2004-1939](https://cve.now/CVE-2004-1939.md): Cross-site scripting (XSS) vulnerability in Zaep AntiSpam 2.0 allows remote attackers to inject arbitrary web script or HTML via double enco (no CVSS) - [CVE-2004-1940](https://cve.now/CVE-2004-1940.md): sipclient.cpp in KPhone 4.0.1 and earlier allows remote attackers to cause a denial of service (crash) via a STUN response packet with a lar (no CVSS) - [CVE-2004-1941](https://cve.now/CVE-2004-1941.md): Fastream NETFile FTP/Web Server 6.5.1.980 allows remote attackers to cause a denial of service via a username that does not exist. (no CVSS) - [CVE-2004-1942](https://cve.now/CVE-2004-1942.md): The Solaris 9 patches 113579-02 through 113579-05, and 114342-02 through 114342-05, prevent ypserv and ypxfrd from properly restricting acce (no CVSS) - [CVE-2004-1943](https://cve.now/CVE-2004-1943.md): PHP remote file inclusion vulnerability in album\_portal.php in phpBB modified by Przemo 1.8 allows remote attackers to execute arbitrary PHP (no CVSS) - [CVE-2004-1944](https://cve.now/CVE-2004-1944.md): Eudora 6.1 and 6.0.3 for Windows allows remote attackers to cause a denial of service (crash) via a deeply nested multipart MIME message. (no CVSS) - [CVE-2004-1945](https://cve.now/CVE-2004-1945.md): Buffer overflow in Kinesphere eXchange POP3 allows remote attackers to execute arbitrary code via a long MAIL FROM field. (no CVSS) - [CVE-2004-1946](https://cve.now/CVE-2004-1946.md): Format string vulnerability in the PRINT\_ERROR function in common.c for Cherokee Web Server 0.4.16 and earlier allows local users to execute (no CVSS) - [CVE-2004-1947](https://cve.now/CVE-2004-1947.md): The AVXSCANONLINE.AvxScanOnlineCtrl.1 ActiveX control in BitDefender Scan Online allows remote attackers to (1) obtain sensitive information (no CVSS) - [CVE-2004-1948](https://cve.now/CVE-2004-1948.md): NcFTP client 3.1.6 and 3.1.7, when the username and password are included in an FTP URL that is provided on the command line, allows local u (no CVSS) - [CVE-2004-1949](https://cve.now/CVE-2004-1949.md): SQL injection vulnerability in PostNuke 7.2.6 and earlier allows remote attackers to execute arbitrary SQL via (1) the sif parameter to inde (no CVSS) - [CVE-2004-1950](https://cve.now/CVE-2004-1950.md): phpBB 2.0.8a and earlier trusts the IP address that is in the X-Forwarded-For in the HTTP header, which allows remote attackers to spoof IP (no CVSS) - [CVE-2004-1951](https://cve.now/CVE-2004-1951.md): xine 1.x alpha, 1.x beta, and 1.0rc through 1.0rc3a, and xine-ui 0.9.21 to 0.9.23 allows remote attackers to overwrite arbitrary files via t (no CVSS) - [CVE-2004-1952](https://cve.now/CVE-2004-1952.md): SQL injection vulnerability in Advanced Guestbook 2.2 allows remote attackers to execute arbitrary SQL commands and gain privileges via the (no CVSS) - [CVE-2004-1953](https://cve.now/CVE-2004-1953.md): phProfession 2.5 allows remote attackers to gain sensitive information via a direct HTTP request to upload.php, which reveals the path in a (no CVSS) - [CVE-2004-1954](https://cve.now/CVE-2004-1954.md): Cross-site scripting (XSS) vulnerability in modules.php in phProfession 2.5 allows remote attackers to inject arbitrary web script or HTML v (no CVSS) - [CVE-2004-1955](https://cve.now/CVE-2004-1955.md): SQL injection vulnerability in modules.php in phProfession 2.5 allows remote attackers to execute arbitrary SQL code via the offset paramete (no CVSS) - [CVE-2004-1956](https://cve.now/CVE-2004-1956.md): PostNuke 0.7.2.6 allows remote attackers to gain information via a direct HTTP request to files in the (1) includes/blocks directory, (2) pn (no CVSS) - [CVE-2004-1957](https://cve.now/CVE-2004-1957.md): Multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.726 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS) - [CVE-2004-1958](https://cve.now/CVE-2004-1958.md): Directory traversal vulnerability in manifest.ini in Unreal engine allows remote attackers to overwrite arbitrary files via .. (no CVSS) - [CVE-2004-1959](https://cve.now/CVE-2004-1959.md): blocker\_query.php in Protector System 1.15b1 for PHP-Nuke allows remote attackers to gain sensitive information via a string in the portNum (no CVSS) - [CVE-2004-1960](https://cve.now/CVE-2004-1960.md): Cross-site scripting (XSS) vulnerability in blocker\_query.php in Protector System 1.15b1 allows remote attackers to inject arbitrary web scr (no CVSS) - [CVE-2004-1961](https://cve.now/CVE-2004-1961.md): blocker.php in Protector System 1.15b1 allows remote attackers to bypass SQL injection protection and execute limited SQL commands via URL-e (no CVSS) - [CVE-2004-1962](https://cve.now/CVE-2004-1962.md): SQL injection vulnerability in index.php in Protector System 1.15b1 allows remote attackers to bypass SQL injection filters by using "/\*\*/" (no CVSS) - [CVE-2004-1963](https://cve.now/CVE-2004-1963.md): nqt.php in Network Query Tool (NQT) 1.6 allows remote attackers to obtain sensitive information via a string in the portNum parameter, which (no CVSS) - [CVE-2004-1964](https://cve.now/CVE-2004-1964.md): Cross-site scripting (XSS) vulnerability in nqt.php in Network Query Tool (NQT) 1.6 allows remote attackers to inject arbitrary web script o (no CVSS) - [CVE-2004-1965](https://cve.now/CVE-2004-1965.md): Multiple cross-site scripting (XSS) vulnerabilities in Open Bulletin Board (OpenBB) 1.0.6 and earlier allows remote attackers to inject arbi (no CVSS) - [CVE-2004-1966](https://cve.now/CVE-2004-1966.md): Multiple SQL injection vulnerabilities in Open Bulletin Board (OpenBB) 1.0.6 and earlier allow remote attackers to execute arbitrary SQL com (no CVSS) - [CVE-2004-1967](https://cve.now/CVE-2004-1967.md): Cross-site request forgery (CSRF) vulnerabilities in (1) cp\_forums.php, (2) cp\_usergroup.php, (3) cp\_ipbans.php, (4) myhome.php, (5) post.ph (no CVSS) - [CVE-2004-1968](https://cve.now/CVE-2004-1968.md): The readmsg action in myhome.php in Open Bulletin Board (OpenBB) 1.0.6 and earlier allows remote attackers to read arbitrary messages by mod (no CVSS) - [CVE-2004-1969](https://cve.now/CVE-2004-1969.md): The avatar upload capability in Open Bulletin Board (OpenBB) 1.0.6 and earlier allows remote attackers to execute arbitrary script by upload (no CVSS) - [CVE-2004-1970](https://cve.now/CVE-2004-1970.md): Samsung SmartEther SS6215S switch, and possibly other Samsung switches, allows remote attackers and local users to gain administrative acces (no CVSS) - [CVE-2004-1971](https://cve.now/CVE-2004-1971.md): modules.php in PHP-Nuke Video Gallery Module 0.1 Beta 5 allows remote attackers to gain sensitive information via an HTTP request with an in (no CVSS) - [CVE-2004-1972](https://cve.now/CVE-2004-1972.md): SQL injection vulnerability in modules.php in PHP-Nuke Video Gallery Module 0.1 Beta 5 allows remote attackers to execute arbitrary SQL code (no CVSS) - [CVE-2004-1973](https://cve.now/CVE-2004-1973.md): DiGi Web Server allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request that contains a large number (no CVSS) - [CVE-2004-1974](https://cve.now/CVE-2004-1974.md): paFileDB 3.1 allows remote attackers to gain sensitive information via a direct request to (1) login.php, (2) category.php, (3) search.php, (no CVSS) - [CVE-2004-1975](https://cve.now/CVE-2004-1975.md): Cross-site scripting (XSS) vulnerability in the category module in pafiledb.php for paFileDB 3.1 allows remote attackers to inject arbitrary (no CVSS) - [CVE-2004-1976](https://cve.now/CVE-2004-1976.md): SMC Barricade broadband router 7008ABR and 7004VBR enable remote administration by default, which allows remote attackers to gain access by (no CVSS) - [CVE-2004-1977](https://cve.now/CVE-2004-1977.md): 3com NBX IP VOIP NetSet Configuration Manager allows remote attackers to cause a denial of service (crash) via a Nessus scan in safeChecks m (no CVSS) - [CVE-2004-1978](https://cve.now/CVE-2004-1978.md): Cross-site scripting (XSS) vulnerability in help.php in Moodle before 1.3 allows remote attackers to inject arbitrary HTML and web script vi (no CVSS) - [CVE-2004-1979](https://cve.now/CVE-2004-1979.md): Cross-site scripting (XSS) vulnerability in do\_search.php in PROPS 0.6.1 allows remote attackers to inject arbitrary HTML or web script via (no CVSS) - [CVE-2004-1980](https://cve.now/CVE-2004-1980.md): Directory traversal vulnerability in glossary.php in PROPS 0.6.1 allows remote attackers to view arbitrary files via a .. (no CVSS) - [CVE-2004-1981](https://cve.now/CVE-2004-1981.md): The web interface for Crystal Reports allows remote attackers to cause a denial of service (disk exhaustion) by repeatedly requesting report (no CVSS) - [CVE-2004-1982](https://cve.now/CVE-2004-1982.md): Post.pl in YaBB 1 Gold SP 1.2 allows remote attackers to modify records in the board's .txt file via carriage return characters in the subje (no CVSS) - [CVE-2004-1983](https://cve.now/CVE-2004-1983.md): The arch\_get\_unmapped\_area function in mmap.c in the PaX patches for Linux kernel 2.6, when Address Space Layout Randomization (ASLR) is ena (no CVSS) - [CVE-2004-1984](https://cve.now/CVE-2004-1984.md): Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers to obtain sensitive information via a direct HTTP request to (1) phpin (no CVSS) - [CVE-2004-1985](https://cve.now/CVE-2004-1985.md): Cross-site scripting (XSS) vulnerability in menu.inc.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to inject arbitrary HTML (no CVSS) - [CVE-2004-1986](https://cve.now/CVE-2004-1986.md): Directory traversal vulnerability in modules.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrativ (no CVSS) - [CVE-2004-1987](https://cve.now/CVE-2004-1987.md): picmgmtbatch.inc.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrative privileges to execute arbi (no CVSS) - [CVE-2004-1988](https://cve.now/CVE-2004-1988.md): PHP remote file inclusion vulnerability in init.inc.php in Coppermine Photo Gallery 1.2.0 RC4 allows remote attackers to execute arbitrary P (no CVSS) - [CVE-2004-1989](https://cve.now/CVE-2004-1989.md): PHP remote file inclusion vulnerability in theme.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to execute arbitrary PHP cod (no CVSS) - [CVE-2004-1990](https://cve.now/CVE-2004-1990.md): Aldo's Web Server (aweb) 1.5 allows remote attackers to gain sensitive information via an arbitrary character, which reveals the full path a (no CVSS) - [CVE-2004-1991](https://cve.now/CVE-2004-1991.md): Directory traversal vulnerability in Aldo's Web Server (aweb) 1.5 allows remote attackers to view arbitrary files via a .. (no CVSS) - [CVE-2004-1992](https://cve.now/CVE-2004-1992.md): Buffer overflow in Serv-U FTP server before 5.0.0.6 allows remote attackers to cause a denial of service (crash) via a long -l parameter, wh (no CVSS) - [CVE-2004-1993](https://cve.now/CVE-2004-1993.md): The patch to the checklogin function in omail.pl for omail webmail 0.98.5 is incomplete, which allows remote attackers to execute arbitrary (no CVSS) - [CVE-2004-1994](https://cve.now/CVE-2004-1994.md): FuseTalk 4.0 allows remote attackers to ban other users via a direct request to banning.cfm. (no CVSS) - [CVE-2004-1995](https://cve.now/CVE-2004-1995.md): Cross-Site Request Forgery (CSRF) vulnerability in FuseTalk 2.0 allows remote attackers to create arbitrary accounts via a link to adduser.c (no CVSS) - [CVE-2004-1996](https://cve.now/CVE-2004-1996.md): Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 1.0 allows remote attackers to inject arbitrary web script via the s (no CVSS) - [CVE-2004-1997](https://cve.now/CVE-2004-1997.md): Kolab stores OpenLDAP passwords in plaintext in the slapd.conf file, which may be installed world-readable, which allows local users to gain (no CVSS) - [CVE-2004-1998](https://cve.now/CVE-2004-1998.md): The Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to gain sensitive information via an invalid show parameter to modu (no CVSS) - [CVE-2004-1999](https://cve.now/CVE-2004-1999.md): Cross-site scripting (XSS) vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to inject arbitrary HTM (no CVSS) - [CVE-2004-2000](https://cve.now/CVE-2004-2000.md): SQL injection vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL via the (1) (no CVSS) - [CVE-2004-2001](https://cve.now/CVE-2004-2001.md): ifconfig "-arp" in SGI IRIX 6.5 through 6.5.22m does not properly disable ARP requests from being sent or received. (no CVSS) - [CVE-2004-2002](https://cve.now/CVE-2004-2002.md): Unknown vulnerability in SGI IRIX 6.5 through 6.5.22m allows remote attackers to cause a denial of service via a certain UDP packet. (no CVSS) - [CVE-2004-2003](https://cve.now/CVE-2004-2003.md): Buffer overflow in the ssl\_prcert function in the SSLway filter (sslway.c) for DeleGate 8.9.2 and earlier allows remote attackers to execute (no CVSS) - [CVE-2004-2004](https://cve.now/CVE-2004-2004.md): The Live CD in SUSE LINUX 9.1 Personal edition is configured without a password for root, which allows remote attackers to gain privileges v (no CVSS) - [CVE-2004-2005](https://cve.now/CVE-2004-2005.md): Buffer overflow in Eudora for Windows 5.2.1, 6.0.3, and 6.1 allows remote attackers to execute arbitrary code via an e-mail with (1) a link (no CVSS) - [CVE-2004-2006](https://cve.now/CVE-2004-2006.md): Trend Micro OfficeScan 3.0 - 6.0 has default permissions of "Everyone Full Control" on the installation directory and registry keys, which a (no CVSS) - [CVE-2004-2007](https://cve.now/CVE-2004-2007.md): Cross-site scripting (XSS) vulnerability in modules.php in NukeJokes 1.7 and 2 Beta allows remote attackers to inject arbitrary HTML or web (no CVSS) - [CVE-2004-2008](https://cve.now/CVE-2004-2008.md): SQL injection vulnerability in modules.php in NukeJokes 1.7 and 2 Beta allows remote attackers to execute arbitrary SQL via the jokeid param (no CVSS) - [CVE-2004-2009](https://cve.now/CVE-2004-2009.md): NukeJokes 1.7 and 2 Beta allows remote attackers to obtain the full path of the server via (1) a direct call to mainfunctions.php, (2) an in (no CVSS) - [CVE-2004-2010](https://cve.now/CVE-2004-2010.md): PHP remote file inclusion vulnerability in index.php in phpShop 0.7.1 and earlier allows remote attackers to execute arbitrary PHP code by m (no CVSS) - [CVE-2004-2011](https://cve.now/CVE-2004-2011.md): msxml3.dll in Internet Explorer 6.0.2600.0 allows remote attackers to cause a denial of service (crash) via a single & (ampersand) in a \