deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-2023
Published: 2004-12-31
Description: SQL injection vulnerability in login.php in Zen Cart 1.1.2d, 1.1.4 before patch 1, and possibly other versions allows remote attackers to execute arbitrary SQL via the (1) admin_name or (2) admin_pass parameters.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9781&w=2; http://secunia.com/advisories/11649; http://securitytracker.com/id?1010172
CVE: CVE-2004-2024
Published: 2004-12-31
Description: The distribution of Zen Cart 1.1.4 before patch 2 includes certain debugging code in the Admin password retrieval functionality, which allows attackers to gain administrative privileges via password_forgotten.php.
CVSS Score: 7.5 (HIGH)
References: http://www.zen-cart.com/modules/ipb/index.php?showtopic=4873; http://www.zen-cart.com/modules/mydownloads/viewcat.php?cid=31&orderby=dateD; http://www.zen-cart.com/modules/ipb/index.php?showtopic=4873
CVE: CVE-2004-2025
Published: 2004-12-31
Description: SQL injection vulnerability in application_top.php for Zen Cart 1.1.3 before patch 2 may allow remote attackers to execute arbitrary SQL commands via the products_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.zen-cart.com/modules/ipb/index.php?showtopic=3731; http://www.zen-cart.com/modules/mydownloads/viewcat.php?cid=31&orderby=dateD; http://www.zen-cart.com/modules/ipb/index.php?showtopic=3731
CVE: CVE-2004-2026
Published: 2004-12-31
Description: Format string vulnerability in the logmsg function in svc.c for Pound 1.5 and earlier allows remote attackers to execute arbitrary code via format string specifiers in syslog messages.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0343.html; http://secunia.com/advisories/11528; http://security.gentoo.org/glsa/glsa-200405-08.xml
CVE: CVE-2004-2045
Published: 2004-12-31
Description: The HTTP administration interface on Conceptronic CADSLR1 ADSL router running firmware 3.04n allows remote attackers to cause a denial of service (device reboot) via an HTTP request with a long username.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2857&w=2; http://secunia.com/advisories/12110; http://www.securityfocus.com/bid/10769
CVE: CVE-2004-2046
Published: 2004-12-31
Description: Unknown vulnerability in APC PowerChute Business Edition 6.0 through 7.0.1 allows remote attackers to cause a denial of service via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6378&w=2; http://secunia.com/advisories/12124; http://securitytracker.com/id?1010745
CVE: CVE-2004-2048
Published: 2004-12-31
Description: radmin in eSeSIX Thintune thin clients running firmware 2.4.38 and earlier starts a process port 25072 that can be accessed with a default "jstwo" password, which allows remote attackers to gain access.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1021&w=2; http://secunia.com/advisories/12154; http://securitytracker.com/id?1010770
CVE: CVE-2004-2049
Published: 2004-12-31
Description: eSeSIX Thintune thin clients running firmware 2.4.38 and earlier store sensitive usernames and passwords in cleartext in configuration files for the keeper library, which allows attackers to gain access.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1021&w=2; http://secunia.com/advisories/12154; http://securitytracker.com/id?1010770
CVE: CVE-2004-2050
Published: 2004-12-31
Description: eSeSIX Thintune thin clients running firmware 2.4.38 and earlier allow local users to gain privileges by pressing CTRL-SHIFT-ALT-DEL and entering the "maertsJ" password, which is hard-coded into lshell.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1021&w=2; http://secunia.com/advisories/12154; http://securitytracker.com/id?1010770
CVE: CVE-2004-2052
Published: 2004-12-31
Description: eSeSIX Thintune thin clients running firmware 2.4.38 and earlier accept any password that begins with the actual password, which makes it easier for users to conduct brute force password guessing.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1021&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1021&w=2
CVE: CVE-2004-2054
Published: 2004-12-31
Description: CRLF injection vulnerability in PhpBB 2.0.4 and 2.0.9 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via (1) the mode parameter to privmsg.php or (2) the redirect parameter to login.php.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2723&w=2; http://secunia.com/advisories/12114; http://www.securityfocus.com/bid/10753
CVE: CVE-2004-2056
Published: 2004-12-31
Description: SQL injection vulnerability in action.php in Nucleus CMS 3.01 allows remote attackers to execute arbitrary SQL statements via the itemid parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9299&w=2; http://secunia.com/advisories/13136; https://exchange.xforce.ibmcloud.com/vulnerabilities/18002
CVE: CVE-2004-2057
Published: 2004-12-31
Description: SQL injection vulnerability in ASPRunner 2.4 allows remote attackers to execute arbitrary SQL statements.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0011.html; http://ferruh.mavituna.com/article/?574; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0418&w=2
CVE: CVE-2004-2058
Published: 2004-12-31
Description: ASPRunner 2.4 allows remote attackers to gain sensitive information via (1) hidden form fields or (2) error messages.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0011.html; http://ferruh.mavituna.com/article/?574; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0418&w=2
CVE: CVE-2004-2059
Published: 2004-12-31
Description: Multiple cross-site scripting vulnerabilities in ASPRunner 2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) SearchFor parameter in [TABLE-NAME]_search.asp, (2) SQL parameter in [TABLE-NAME]_edit.asp, (3) SearchFor parameter in [TABLE]_list.asp, or (4) SQL parameter in export.asp.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0011.html; http://ferruh.mavituna.com/article/?574; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0418&w=2
CVE: CVE-2004-2060
Published: 2004-12-31
Description: ASPRunner 2.4 stores the database under the web root in the db directory, which may allow remote attackers to obtain the database via a direct request to the database filename, which is predictable based on table and field names.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0011.html; http://ferruh.mavituna.com/article/?574; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0418&w=2
CVE: CVE-2004-2062
Published: 2004-12-31
Description: SQL injection vulnerability in antiboard.php in AntiBoard 0.7.2 and earlier allows remote attackers to execute arbitrary SQL via the (1) thread_id, (2) parent_id, or (3) mode parameters.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0965&w=2; http://secunia.com/advisories/12137; http://www.securityfocus.com/bid/10821
CVE: CVE-2004-2063
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in antiboard.php in AntiBoard 0.7.2 and earlier allows remote attackers to inject arbitrary HTML or web script via the feedback parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0965&w=2; http://secunia.com/advisories/12137; http://www.osvdb.org/8269
CVE: CVE-2004-2065
Published: 2004-12-31
Description: DansGuardian 2.8 and earlier allows remote attackers to bypass the extension filtering rule via a hex encoded extension or . in the filename.
CVSS Score: 7.5 (HIGH)
References: http://dansguardian.org/?page=history; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7408&w=2; http://secunia.com/advisories/12191
CVE: CVE-2004-2068
Published: 2004-12-31
Description: fetchnews in leafnode 1.9.47 and earlier allows remote attackers to cause a denial of service (process hang) via an empty NNTP news article with missing mandatory headers.
CVSS Score: 5.0 (MEDIUM)
References: http://leafnode.sourceforge.net/leafnode-SA-2004-01.txt; http://secunia.com/advisories/10590; http://www.derkeiler.com/Mailing-Lists/VulnWatch/2004-01/0009.html
CVE: CVE-2004-2069
Published: 2004-12-31
Description: sshd.c in OpenSSH 3.6.1p2 and 3.7.1p2 and possibly other versions, when using privilege separation, does not properly signal the non-privileged process when a session has been terminated after exceeding the LoginGraceTime setting, which leaves the connection open and allows remote attackers to cause a denial of service (connection consumption).
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=openssh-unix-dev&m=[PII_REDACTED]0444&w=2; http://marc.info/?l=openssh-unix-dev&m=[PII_REDACTED]2320&w=2; http://rhn.redhat.com/errata/RHSA-2005-550.html
CVE: CVE-2004-2070
Published: 2004-12-31
Description: The Altiris Client Service for Windows 5.6 SP1 Hotfix E (5.6.181) allows local users to execute arbitrary commands by opening the AClient tray icon and using the View Log File option, a different vulnerability than CVE-2005-1590.
CVSS Score: 7.2 (HIGH)
References: http://www.securityfocus.com/archive/1/381649; http://www.securityfocus.com/archive/1/381649
CVE: CVE-2004-2071
Published: 2004-12-31
Description: Macallan Mail Solution 2.8.4.6 (Build 260), and possibly earlier versions, allows remote attackers to bypass authentication in the web interface via an HTTP GET request with two slashes ("//") after the server name.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/10861; http://securitytracker.com/id?1009030; http://www.osvdb.org/3926
CVE: CVE-2004-2072
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in index.php for Mambo Open Source 4.6, and possibly earlier versions, allows remote attackers to execute script on other clients via the Itemid parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/9588; http://www.systemsecure.org/advisories/ssadvisory06022004.php; https://exchange.xforce.ibmcloud.com/vulnerabilities/15062
CVE: CVE-2004-2074
Published: 2004-12-31
Description: Format string vulnerability in Dream FTP 1.02 allows local users to cause a denial of service (crash) via format string specifiers in the (1) PASS or (2) RETR commands.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1009295; http://www.securityfocus.com/bid/9800; https://exchange.xforce.ibmcloud.com/vulnerabilities/15380
CVE: CVE-2004-2075
Published: 2004-12-31
Description: Sophos Anti-Virus 3.78 allows remote attackers to cause a denial of service (infinite loop) via a MIME header that is not properly terminated.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/10855; http://securitytracker.com/id?1009042; http://www.osvdb.org/3925
CVE: CVE-2004-2076
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in search.php for Jelsoft vBulletin 3.0.0 RC4 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/353869; http://www.securityfocus.com/bid/9656; https://exchange.xforce.ibmcloud.com/vulnerabilities/15208
CVE: CVE-2004-2081
Published: 2004-12-31
Description: The samiftp.dll library in Sami FTP Server 1.1.3 allows local users to cause a denial of service (pmsystem.exe crash) by issuing (1) a CD command with a tilde (~) character or dot dot (/../) or (2) a GET command for an unavailable file.
CVSS Score: 5.0 (MEDIUM)
References: http://www.karja.com/samiftp/news.html; http://www.securityfocus.com/archive/1/353753; http://www.securityfocus.com/bid/9657
CVE: CVE-2004-2094
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in WebcamXP 1.06.945 allows remote attackers to inject arbitrary HTML or web script as other users via a URL that contains the script.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6270&w=2; http://www.securityfocus.com/bid/9465; https://exchange.xforce.ibmcloud.com/vulnerabilities/14904
CVE: CVE-2004-2095
Published: 2004-12-31
Description: Honeyd before 0.8 replies to TCP packets with the SYN and RST flags set, which allows remote attackers to identify IP addresses that are being simulated by Honeyd.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6047&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8505&w=2; http://secunia.com/advisories/10694
CVE: CVE-2004-2096
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in Mephistoles httpd 0.6.0 final allows remote attackers to execute arbitrary script as other users by injecting arbitrary HTML or script into the URL.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4179&w=2; http://secunia.com/advisories/10693; http://www.osvdb.org/3689
CVE: CVE-2004-2097
Published: 2004-12-31
Description: Multiple scripts on SuSE Linux 9.0 allow local users to overwrite arbitrary files via a symlink attack on (1) /tmp/fvwm-bug created by fvwm-bug, (2) /tmp/wmmenu created by wm-oldmenu2new, (3) /tmp/rates created by x11perfcomp, (4) /tmp/xf86debug.1.log created by xf86debug, (5) /tmp/.winpopup-new created by winpopup-send.sh, or (6) /tmp/initrd created by lvmcreate_initrd.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3923&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6258&w=2; http://securitytracker.com/id?1008781
CVE: CVE-2004-2098
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in the banner engine (TBE) 5.0 allows remote attackers to execute arbitrary script as other users via the HTML banner view/preview capability.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8330&w=2; http://www.securityfocus.com/bid/9472; https://exchange.xforce.ibmcloud.com/vulnerabilities/14911
CVE: CVE-2004-2099
Published: 2004-12-31
Description: Buffer overflow in Need for Speed Hot Pursuit 2.0 client (NFSHP2), version 242 and earlier, allows remote attackers (servers) to execute arbitrary code via long (1) gamename, (2) gamever, (3) hostname, (4) gametype, (5) mapname or (6) gamemode commands.
CVSS Score: 5.1 (MEDIUM)
References: http://aluigi.altervista.org/adv/nfshp2cbof-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8691&w=2; http://www.securityfocus.com/bid/9473
CVE: CVE-2004-2100
Published: 2004-12-31
Description: GeoHttpServer, when configured to authenticate users, allows remote attackers to bypass authentication and access unauthorized files via a URL that contains %0a%0a (encoded newlines).
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5214&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5214&w=2
CVE: CVE-2004-2101
Published: 2004-12-31
Description: The sysinfo script in GeoHttpServer allows remote attackers to cause a denial of service (crash) via a long pwd parameter, possibly triggering a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5214&w=2; http://securitytracker.com/id?1008807; https://exchange.xforce.ibmcloud.com/vulnerabilities/14913
CVE: CVE-2004-2102
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in FREESCO 2.05, a modified version of thttpd, allows remote attackers to inject arbitrary web script or HTML via the test parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5905&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/14916; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5905&w=2
CVE: CVE-2004-2103
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to process arbitrary script or HTML as other users via (1) a malformed request for a Perl program with script in the filename, (2) the User.id parameter to the webacc servlet, (3) the GWAP.version parameter to webacc, or (4) a URL request for a .bas file with script in the filename.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4440&w=2; http://support.novell.com/cgi-bin/search/searchtid.cgi?/10091529.htm; http://www.osvdb.org/4949
CVE: CVE-2004-2104
Published: 2004-12-31
Description: Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to obtain sensitive server information, including the internal IP address, via a direct request to (1) snoop.jsp, (2) SnoopServlet, (3) env.bas, or (4) lcgitest.nlm.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4440&w=2; http://secunia.com/advisories/10711; http://www.osvdb.org/3715
CVE: CVE-2004-2105
Published: 2004-12-31
Description: The webacc servlet in Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to read arbitrary .htt files via a full pathname in the error parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4440&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4440&w=2
CVE: CVE-2004-2106
Published: 2004-12-31
Description: Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to list directories via a direct request to (1) /com/, (2) /com/novell/, (3) /com/novell/webaccess, or (4) /ns-icons/.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4440&w=2; http://www.osvdb.org/13402; http://www.osvdb.org/13403
CVE: CVE-2004-2107
Published: 2004-12-31
Description: Finjan SurfinGate 6.0 and 7.0, when running in proxy mode, does not authenticate FHTTP commands on TCP port 3141, which allows remote attackers to use the finjan-parameter-type header to (1) restart the service, (2) use the getlastmsg command to view log information, or (3) use the online command to force a policy update from the database server.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-01/0929.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6339&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3629&w=2
CVE: CVE-2004-2108
Published: 2004-12-31
Description: Multiple SQL injection vulnerabilities in QuadComm Q-Shop allow remote attackers to execute arbitrary SQL commands via certain parameters to (1) search.asp, (2) browse.asp, (3) details.asp, (4) showcat.asp, (5) users.asp, (6) addtomylist.asp, (7) modline.asp, (8) cart.asp, or (9) newuser.asp.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8229&w=2; http://secunia.com/advisories/10704; http://securitytracker.com/alerts/2004/Jan/1008837.html
CVE: CVE-2004-2109
Published: 2004-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) imagezoom.asp or (2) recommend.asp in Q-Shop allow remote attackers to execute arbitrary script and steal the user session ID via Javascript in a URL.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8229&w=2; http://secunia.com/advisories/10704; http://www.osvdb.org/3696
CVE: CVE-2004-2110
Published: 2004-12-31
Description: SQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hide_email parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5960&w=2; http://phorum.org/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5960&w=2
CVE: CVE-2004-2111
Published: 2004-12-31
Description: Stack-based buffer overflow in the site chmod command in Serv-U FTP Server before 4.2 allows remote attackers to execute arbitrary code via a long filename.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2004-01/0249.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5840&w=2; http://securitytracker.com/id?1008841
CVE: CVE-2004-2112
Published: 2004-12-31
Description: Directory traversal vulnerability in BremsServer 1.2.4 allows remote attackers to read arbitrary files via ".." (dot dot) sequences in the URL.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7031&w=2; http://secunia.com/advisories/10731; http://www.osvdb.org/3755
CVE: CVE-2004-2113
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in BremsServer 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the URL.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7031&w=2; http://secunia.com/advisories/10731; http://www.osvdb.org/3754
CVE: CVE-2004-2114
Published: 2004-12-31
Description: Stack-based and heap-based buffer overflows in ProxyNow! 2.75 and earlier allow remote attackers to execute arbitrary code via a GET request with a long ftp:// URL.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1508&w=2; http://www.securityfocus.com/bid/9500; https://exchange.xforce.ibmcloud.com/vulnerabilities/14955
CVE: CVE-2004-2115
Published: 2004-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6967&w=2; http://www.securityfocus.com/bid/9484; https://exchange.xforce.ibmcloud.com/vulnerabilities/14930
CVE: CVE-2004-2116
Published: 2004-12-31
Description: Directory traversal vulnerability in Tiny Server 1.1 allows remote attackers to read or download arbitrary files via a .. (dot dot) in the URL.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6730&w=2; http://packetstormsecurity.com/files/129320/Tiny-Server-1.1.9-Arbitrary-File-Disclosure.html; http://secunia.com/advisories/10707
CVE: CVE-2004-2118
Published: 2004-12-31
Description: Tiny Server 1.1 allows remote attackers to cause a denial of service (crash) via a GET request with a long filename, possibly due to a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6730&w=2; http://secunia.com/advisories/10707; http://www.autistici.org/fdonato/advisory/tinyServer1.1%5B1.0.5%5D-adv.txt
CVE: CVE-2004-2119
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in Tiny Server 1.1 allows remote attackers to inject arbitrary web script or HTML via the URL.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6730&w=2; http://secunia.com/advisories/10707; http://www.autistici.org/fdonato/advisory/tinyServer1.1%5B1.0.5%5D-adv.txt
CVE: CVE-2004-2121
Published: 2004-12-31
Description: Multiple directory traversal vulnerabilities in Borland Web Server (BWS) 1.0b3 and earlier allow remote attackers to read and download arbitrary files via (1) multi-dot "......" sequences, or (2) "%5c%2e%2e" (encoded "\..") sequences, in the URL.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3907&w=2; http://securitytracker.com/id?1008840; http://www.securityfocus.com/bid/9486
CVE: CVE-2004-2123
Published: 2004-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Nextplace.com E-Commerce ASP Engine allow remote attackers to inject arbitrary web script or HTML via the (1) level parameter of productdetail.asp, (2) searchKey parameter of searchresults.asp, and possibly (3) level parameter of ListCategories.asp.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5018&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/14952; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5018&w=2