deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2003-0513
Published: 2004-04-15
Description: Microsoft Internet Explorer allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Internet Explorer to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html; http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html; http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html
CVE: CVE-2003-0514
Published: 2004-04-15
Description: Apple Safari allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Safari to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html; http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html; http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html
CVE: CVE-2003-0592
Published: 2004-04-15
Description: Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html; http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html; http://www.debian.org/security/2004/dsa-459
CVE: CVE-2003-0593
Published: 2004-04-15
Description: Opera allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Opera to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html; http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html; http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html
CVE: CVE-2003-0594
Published: 2004-04-15
Description: Mozilla allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Mozilla to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html; http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html; http://www.mandriva.com/security/advisories?name=MDKSA-2004:021
CVE: CVE-2003-0905
Published: 2004-04-15
Description: Unknown vulnerability in Windows Media Station Service and Windows Media Monitor Service components of Windows Media Services 4.1 allows remote attackers to cause a denial of service (disallowing new connections) via a certain sequence of TCP/IP packets.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/982630; http://www.securityfocus.com/bid/9825; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-008
CVE: CVE-2003-1033
Published: 2004-04-15
Description: The (1) instdbmsrv and (2) instlserver programs in SAP DB Development Tools 7.x trust the user-provided INSTROOT environment variable as a path when assigning setuid permissions to the lserver program, which allows local users to gain root privileges via a modified INSTROOT that points to a malicious dbmsrv or lserver program.
CVSS Score: 7.2 (HIGH)
References: http://listserv.sap.com/pipermail/sapdb.sources/2003-April/000143.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7471&w=2; http://www.securityfocus.com/bid/7407
CVE: CVE-2003-1034
Published: 2004-04-15
Description: The RPM installation of SAP DB 7.x creates the (1) dbmsrv or (2) lserver programs with world-writable permissions, which allows local users to gain privileges by modifying those programs.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3805&w=2; http://www.securityfocus.com/bid/7242; https://exchange.xforce.ibmcloud.com/vulnerabilities/11669
CVE: CVE-2003-1035
Published: 2004-04-15
Description: The default installation of SAP R/3 46C/D allows remote attackers to bypass account locking by using the RFC API instead of the SAPGUI to conduct a brute force password guessing attack, which does not lock out the account like the SAPGUI does.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2003-March/004039.html; http://www.securityfocus.com/archive/1/451378/100/0/threaded; http://www.securityfocus.com/bid/7007
CVE: CVE-2003-1036
Published: 2004-04-15
Description: Multiple buffer overflows in the AGate component for SAP Internet Transaction Server (ITS) allow remote attackers to execute arbitrary code via long (1) ~command, (2) ~runtimemode, or (3) ~session parameters, or (4) a long HTTP Content-Type header.
CVSS Score: 7.5 (HIGH)
References: http://www.phenoelit.de/stuff/Phenoelit20c3.pd; https://exchange.xforce.ibmcloud.com/vulnerabilities/14186; http://www.phenoelit.de/stuff/Phenoelit20c3.pd
CVE: CVE-2003-1037
Published: 2004-04-15
Description: Format string vulnerability in the WGate component for SAP Internet Transaction Server (ITS) allows remote attackers to execute arbitrary code via a high "trace level."
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1009453; http://www.phenoelit.de/stuff/Phenoelit20c3.pd; https://exchange.xforce.ibmcloud.com/vulnerabilities/15514
CVE: CVE-2003-1038
Published: 2004-04-15
Description: The AGate component for SAP Internet Transaction Server (ITS) allows remote attackers to obtain sensitive information via a ~command parameter with an AgateInstallCheck value, which provides a list of installed DLLs and full pathnames.
CVSS Score: 5.0 (MEDIUM)
References: http://www.phenoelit.de/stuff/Phenoelit20c3.pd; https://exchange.xforce.ibmcloud.com/vulnerabilities/15516; http://www.phenoelit.de/stuff/Phenoelit20c3.pd
CVE: CVE-2003-1039
Published: 2004-04-15
Description: Multiple buffer overflows in the mySAP.com architecture for SAP allow remote attackers to execute arbitrary code via a long HTTP Host header to (1) Message Server, (2) Web Dispatcher, or (3) Application Server.
CVSS Score: 7.5 (HIGH)
References: http://www.phenoelit.de/stuff/Phenoelit20c3.pd; https://exchange.xforce.ibmcloud.com/vulnerabilities/15513; http://www.phenoelit.de/stuff/Phenoelit20c3.pd
CVE: CVE-2003-1040
Published: 2004-04-15
Description: kmod in the Linux kernel does not set its uid, suid, gid, or sgid to 0, which allows local users to cause a denial of service (crash) by sending certain signals to kmod.
CVSS Score: 2.1 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20040204-01-U.asc; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000820; http://linux.bkbits.net:8080/linux-2.4/diffs/kernel/kmod.c%401.6?nav=index.html%7Csrc/%7Csrc/kernel%7Chist/kernel/kmod.c
CVE: CVE-2004-0107
Published: 2004-04-15
Description: The (1) post and (2) trigger scripts in sysstat 4.0.7 and earlier allow local users to overwrite arbitrary files via symlink attacks on temporary files, a different vulnerability than CVE-2004-0108.
CVSS Score: 4.6 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20040302-01-U.asc; http://www.ciac.org/ciac/bulletins/o-097.shtml; http://www.osvdb.org/6884
CVE: CVE-2004-0108
Published: 2004-04-15
Description: The isag utility, which processes sysstat data, allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CAN-2004-0107.
CVSS Score: 4.6 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20040302-01-U.asc; http://www.debian.org/security/2004/dsa-460; http://www.redhat.com/support/errata/RHSA-2004-053.html
CVE: CVE-2004-0111
Published: 2004-04-15
Description: gdk-pixbuf before 0.20 allows attackers to cause a denial of service (crash) via a malformed bitmap (BMP) file.
CVSS Score: 5.0 (MEDIUM)
References: http://www.debian.org/security/2004/dsa-464; http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:020; http://www.redhat.com/support/errata/RHSA-2004-102.html
CVE: CVE-2004-0121
Published: 2004-04-15
Description: Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which allows remote attackers to use script code in the Local Machine zone and execute arbitrary programs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-88
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2842&w=2; http://www.ciac.org/ciac/bulletins/o-096.shtml; http://www.idefense.com/application/poi/display?id=79&type=vulnerabilities
CVE: CVE-2004-0122
Published: 2004-04-15
Description: Microsoft MSN Messenger 6.0 and 6.1 does not properly handle certain requests, which allows remote attackers to read arbitrary files.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/688094; http://www.securityfocus.com/bid/9828; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-010
CVE: CVE-2004-0148
Published: 2004-04-15
Description: wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2690&w=2; http://secunia.com/advisories/11055; http://secunia.com/advisories/20168
CVE: CVE-2004-0150
Published: 2004-04-15
Description: Buffer overflow in the getaddrinfo function in Python 2.2 before 2.2.2, when IPv6 support is disabled, allows remote attackers to execute arbitrary code via an IPv6 address that is obtained using DNS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://www.debian.org/security/2004/dsa-458; http://www.gentoo.org/security/en/glsa/glsa-200409-03.xml; http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:019
CVE: CVE-2004-0151
Published: 2004-04-15
Description: Unknown vulnerability in xitalk 1.1.11 and earlier allows local users to execute arbitrary commands.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/11114/; http://shellcode.org/Advisories/XITALK.txt; http://www.debian.org/security/2004/dsa-462
CVE: CVE-2004-0152
Published: 2004-04-15
Description: Multiple stack-based buffer overflows in (1) the encode_mime function, (2) the encode_uuencode function, (3) or the decode_uuencode function for emil 2.1.0 and earlier allow remote attackers to execute arbitrary code via e-mail messages containing attachments with filenames.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7236&w=2; http://www.debian.org/security/2004/dsa-468; https://exchange.xforce.ibmcloud.com/vulnerabilities/15601
CVE: CVE-2004-0153
Published: 2004-04-15
Description: Multiple format string vulnerabilities in emil 2.1.0 and earlier may allow remote attackers to execute arbitrary code by triggering certain error messages.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7236&w=2; http://www.debian.org/security/2004/dsa-468; https://exchange.xforce.ibmcloud.com/vulnerabilities/15602
CVE: CVE-2004-0173
Published: 2004-04-15
Description: Directory traversal vulnerability in Apache 1.3.29 and earlier, and Apache 2.0.48 and earlier, when running on Cygwin, allows remote attackers to read arbitrary files via a URL containing "..%5C" (dot dot encoded backslash) sequences.
CVSS Score: 5.0 (MEDIUM)
References: http://issues.apache.org/bugzilla/show_bug.cgi?id=26152; http://lists.grok.org.uk/pipermail/full-disclosure/2004-February/017740.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1387&w=2
CVE: CVE-2004-0217
Published: 2004-04-15
Description: The LiveUpdate capability (liveupdate.sh) in Symantec AntiVirus Scan Engine 4.0 and 4.3 for Red Hat Linux allows local users to create or append to arbitrary files via a symlink attack on /tmp/LiveUpdate.log.
CVSS Score: 7.0 (HIGH)
CWE: CWE-59
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8164&w=2; http://www.securityfocus.com/bid/9662; https://exchange.xforce.ibmcloud.com/vulnerabilities/15215
CVE: CVE-2004-0224
Published: 2004-04-15
Description: Multiple buffer overflows in (1) iso2022jp.c or (2) shiftjis.c for Courier-IMAP before 3.0.0, Courier before 0.45, and SqWebMail before 4.0.0 may allow remote attackers to execute arbitrary code "when Unicode character is out of BMP range."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/11087/; http://sourceforge.net/project/shownotes.php?release_id=5767; http://www.securityfocus.com/bid/9845
CVE: CVE-2004-0362
Published: 2004-04-15
Description: Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRV_MULTI response containing a SRV_USER_ONLINE response packet and a SRV_META_USER response packet with long (1) nickname, (2) firstname, (3) lastname, or (4) email address fields, as exploited by the Witty worm.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2378&w=2; http://secunia.com/advisories/11073; http://www.ciac.org/ciac/bulletins/o-104.shtml
CVE: CVE-2004-0363
Published: 2004-04-15
Description: Stack-based buffer overflow in the SymSpamHelper ActiveX component (symspam.dll) in Norton AntiSpam 2004, as used in Norton Internet Security 2004, allows remote attackers to execute arbitrary code via a long parameter to the LaunchCustomRuleWizard method.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6638&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4362&w=2; http://secunia.com/advisories/11169
CVE: CVE-2004-0364
Published: 2004-04-15
Description: The WrapNISUM ActiveX component (WrapUM.dll) in Norton Internet Security 2004 is marked safe for scripting, which allows remote attackers to execute arbitrary programs via the LaunchURL method.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2442&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4362&w=2; http://secunia.com/advisories/11168
CVE: CVE-2004-0372
Published: 2004-04-15
Description: xine allows local users to overwrite arbitrary files via a symlink attack on a bug report email that is generated by the (1) xine-bugreport or (2) xine-check scripts.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5558&w=2; http://security.gentoo.org/glsa/glsa-200404-20.xml; http://www.debian.org/security/2004/dsa-477
CVE: CVE-2004-1934
Published: 2004-04-15
Description: PHP remote file inclusion vulnerability in affich.php in Gemitel 3.50 allows remote attackers to execute arbitrary PHP code via the base parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5505&w=2; http://secunia.com/advisories/11393; http://securitytracker.com/id?1009824
CVE: CVE-2004-1935
Published: 2004-04-15
Description: Cross-site scripting (XSS) vulnerability in SCT Campus Pipeline allows remote attackers to inject arbitrary web script or HTML via onload, onmouseover, and other Javascript events in an e-mail attachment.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7231&w=2; http://secunia.com/advisories/11396; http://www.securityfocus.com/bid/10154
CVE: CVE-2004-1938
Published: 2004-04-19
Description: SQL injection vulnerability in userlogin.php in Phorum 3.4.7 allows remote attackers to execute arbitrary SQL commands via doubly hex-encoded characters such as "%2527", which is translated to "'", as demonstrated using the phorum_uriauth parameter to list.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2897&w=2; http://secunia.com/advisories/11407; http://www.securityfocus.com/bid/10173
CVE: CVE-2004-1941
Published: 2004-04-19
Description: Fastream NETFile FTP/Web Server 6.5.1.980 allows remote attackers to cause a denial of service via a username that does not exist.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3861&w=2; http://secunia.com/advisories/11428; http://securitytracker.com/id?1009868
CVE: CVE-2004-1942
Published: 2004-04-19
Description: The Solaris 9 patches 113579-02 through 113579-05, and 114342-02 through 114342-05, prevent ypserv and ypxfrd from properly restricting access to secure NIS maps, which allows local users to use ypcat or ypmatch to extract the contents of a secure map such as passwd.adjunct.byname.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0417&w=2; http://sunsolve.sun.com/search/document.do?assetkey=1-26-57554-1; http://www.ciac.org/ciac/bulletins/o-144.shtml
CVE: CVE-2004-1943
Published: 2004-04-19
Description: PHP remote file inclusion vulnerability in album_portal.php in phpBB modified by Przemo 1.8 allows remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2532&w=2; http://www.securityfocus.com/bid/10177; https://exchange.xforce.ibmcloud.com/vulnerabilities/15916
CVE: CVE-2004-1946
Published: 2004-04-19
Description: Format string vulnerability in the PRINT_ERROR function in common.c for Cherokee Web Server 0.4.16 and earlier allows local users to execute arbitrary code via format string specifiers in the -C command line argument.  NOTE: it is not clear whether this issue could be exploited remotely, or if Cherokee is running at escalated privileges. Therefore it might not be a vulnerability.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8672&w=2; http://www.nosystem.com.ar/advisories/advisory-03.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/15924
CVE: CVE-2004-1947
Published: 2004-04-19
Description: The AVXSCANONLINE.AvxScanOnlineCtrl.1 ActiveX control in BitDefender Scan Online allows remote attackers to (1) obtain sensitive information such as system drives and contents or (2) use the RequestFile method to download and execute arbitrary code via an object codebase that uses bitdefender.cab.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7412&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1616&w=2; http://secunia.com/advisories/11427
CVE: CVE-2004-1950
Published: 2004-04-19
Description: phpBB 2.0.8a and earlier trusts the IP address that is in the X-Forwarded-For in the HTTP header, which allows remote attackers to spoof IP addresses.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3144&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8409&w=2; http://secunia.com/advisories/11434
CVE: CVE-2004-1945
Published: 2004-04-20
Description: Buffer overflow in Kinesphere eXchange POP3 allows remote attackers to execute arbitrary code via a long MAIL FROM field.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2458&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8096&w=2; http://secunia.com/advisories/11449
CVE: CVE-2004-1948
Published: 2004-04-20
Description: NcFTP client 3.1.6 and 3.1.7, when the username and password are included in an FTP URL that is provided on the command line, allows local users to obtain sensitive information via "ps aux," which displays the URL in the process list.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1685&w=2; http://secunia.com/advisories/11438; http://www.osvdb.org/5595
CVE: CVE-2004-1992
Published: 2004-04-20
Description: Buffer overflow in Serv-U FTP server before 5.0.0.6 allows remote attackers to cause a denial of service (crash) via a long -l parameter, which triggers an out-of-bounds read.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9290&w=2; http://marc.info/?l=ntbugtraq&m=[PII_REDACTED]8234&w=2; http://secunia.com/advisories/11430
CVE: CVE-2004-1954
Published: 2004-04-21
Description: Cross-site scripting (XSS) vulnerability in modules.php in phProfession 2.5 allows remote attackers to inject arbitrary web script or HTML via the jcode parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0060&w=2; http://secunia.com/advisories/11465; http://www.osvdb.org/5624
CVE: CVE-2004-1956
Published: 2004-04-21
Description: PostNuke 0.7.2.6 allows remote attackers to gain information via a direct HTTP request to files in the (1) includes/blocks directory, (2) pnadodb directory, (3) NS-NewUser module, (4) NS-Your_Account, (5) NS-LostPassword module, or (6) NS-User module which reveals the path to the web server in a PHP error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0472&w=2; http://www.securityfocus.com/bid/10191; http://www.waraxe.us/index.php?modname=sa&id=22
CVE: CVE-2004-1957
Published: 2004-04-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.726 allows remote attackers to inject arbitrary web script or HTML via the (1) lid and query parameters to the Downloads module, (2) query parameter to the Web_links module, or (3) hlpfile parameter to openwindow.php.
CVSS Score: 2.6 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0472&w=2; http://www.securityfocus.com/bid/10191; http://www.waraxe.us/index.php?modname=sa&id=22
CVE: CVE-2004-1356
Published: 2004-04-23
Description: Unknown vulnerability in the sendfilev function in Sun Solaris 8 and 9 allows local users to cause a denial of service (system panic) via unknown vectors.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/11457/; http://sunsolve.sun.com/search/document.do?assetkey=1-26-57470-1&searchclause=%22category:security%22%20%20108528-27; http://www.auscert.org.au/render.html?it=4056
CVE: CVE-2004-1952
Published: 2004-04-23
Description: SQL injection vulnerability in Advanced Guestbook 2.2 allows remote attackers to execute arbitrary SQL commands and gain privileges via the password.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2005-02/0138.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2890&w=2; http://www.securityfocus.com/bid/10209
CVE: CVE-2004-1959
Published: 2004-04-23
Description: blocker_query.php in Protector System 1.15b1 for PHP-Nuke allows remote attackers to gain sensitive information via a string in the portNum parameter, which reveals the full path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0121&w=2; http://protector.warcenter.se/article-53--0-0.html; http://www.securityfocus.com/bid/10206
CVE: CVE-2004-1961
Published: 2004-04-23
Description: blocker.php in Protector System 1.15b1 allows remote attackers to bypass SQL injection protection and execute limited SQL commands via URL-encoded "'" characters ("%27").
CVSS Score: 7.5 (HIGH)
References: http://protector.warcenter.se/article-53--0-0.html; http://www.securityfocus.com/archive/1/361300/2004-04-21/2004-04-27/0; http://www.securityfocus.com/bid/10206
CVE: CVE-2004-1963
Published: 2004-04-23
Description: nqt.php in Network Query Tool (NQT) 1.6 allows remote attackers to obtain sensitive information via a string in the portNum parameter, which reveals the full path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8267&w=2; http://secunia.com/advisories/11479; http://www.waraxe.us/index.php?modname=sa&id=24