deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-1883
Published: 2004-12-31
Description: Multiple buffer overflows in Ipswitch WS_FTP Server 4.0.2 (1) allow remote authenticated users to execute arbitrary code by causing a large error string to be generated by the ALLO handler, or (2) may allow remote FTP administrators to execute arbitrary code by causing a long hostname or username to be inserted into a reply to a STAT command while a file is being transferred.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2397&w=2; http://secunia.com/advisories/11206; http://www.securityfocus.com/archive/1/358361
CVE: CVE-2004-1885
Published: 2004-12-31
Description: Ipswitch WS_FTP Server 4.0.2 allows remote authenticated users to execute arbitrary programs as SYSTEM by using the SITE command to modify certain iFtpSvc options that are handled by iftpmgr.exe.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8116&w=2; http://secunia.com/advisories/11206; http://www.securityfocus.com/bid/9953
CVE: CVE-2004-1887
Published: 2004-12-31
Description: Ada Image Server (ImgSvr) 0.4 allows remote attackers to view directories or download files via an HTTP request with a trailing %00 (null).
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8255&w=2; http://secunia.com/advisories/11277; http://sourceforge.net/project/shownotes.php?release_id=230023
CVE: CVE-2004-1888
Published: 2004-12-31
Description: display.cgi in Aborior Encore WebForum allows remote to execute arbitrary commands via shell metacharacters in the file variable.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0868&w=2; http://www.osvdb.org/16831; http://www.securityfocus.com/archive/1/437813/100/0/threaded
CVE: CVE-2004-1889
Published: 2004-12-31
Description: Unknown vulnerability in ftpd in SGI IRIX 6.5.20 through 6.5.23 allows remote attackers to cause a denial of service (hang) via a link failure with Microsoft Windows.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20040401-01-P.asc; http://www.securityfocus.com/bid/10037; https://exchange.xforce.ibmcloud.com/vulnerabilities/15722
CVE: CVE-2004-1891
Published: 2004-12-31
Description: The ftp_syslog function in ftpd in SGI IRIX 6.5.20 "doesn't work with anonymous FTP," which has an unknown impact, possibly preventing the actions of anonymous users from being logged.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20040401-01-P.asc; ftp://patches.sgi.com/support/free/security/advisories/20040401-01-P.asc
CVE: CVE-2004-1892
Published: 2004-12-31
Description: Stack-based buffer overflow in DecodeBase16 function, as used in the (1) IRC module and (2) web server in eMule 0.42d, allows remote attackers to execute arbitrary code via a long string.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9960&w=2; http://secunia.com/advisories/11289; http://www.emule-project.net/home/perl/news.cgi?l=1&cat_id=22
CVE: CVE-2004-1893
Published: 2004-12-31
Description: Dreamweaver MX, when "Using Driver On Testing Server" or "Using DSN on Testing Server" is selected, uploads the mmhttpdb.asp script to the web site but does not require authentication, which allows remote attackers to obtain sensitive information and possibly execute arbitrary SQL commands via a direct request to mmhttpdb.asp.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9451&w=2; http://secunia.com/advisories/11284; http://www.macromedia.com/devnet/security/security_zone/mpsb04-05.html
CVE: CVE-2004-1894
Published: 2004-12-31
Description: TEXutil in ConTEXt, when executed with the --silent option, allows local users to overwrite arbitrary files via a symlink attack on texutil.log.
CVSS Score: 2.1 (LOW)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/019777.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3319&w=2; http://securitytracker.com/id?1009661
CVE: CVE-2004-1895
Published: 2004-12-31
Description: YaST Online Update (YOU) in SuSE 8.2 and 9.0 allows local users to overwrite arbitrary files via a symlink attack on you-$USER/cookies.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2004-04/0058.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9164&w=2; http://secunia.com/advisories/11300
CVE: CVE-2004-1896
Published: 2004-12-31
Description: Heap-based buffer overflow in in_mod.dll in Nullsoft Winamp 2.91 through 5.02 allows remote attackers to execute arbitrary code via a Fasttracker 2 (.xm) mod media file.
CVSS Score: 7.6 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8693&w=2; http://secunia.com/advisories/11285; http://securitytracker.com/id?1009660
CVE: CVE-2004-1897
Published: 2004-12-31
Description: Administration interface in Monit 1.4 through 4.2 allows remote attackers to cause a denial of service (segmentation fault) by sending a Basic Authentication request without a password, which causes Monit to decrement a null pointer and perform an out-of-bounds read.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3696&w=2; http://secunia.com/advisories/11304; http://www.securityfocus.com/bid/10051
CVE: CVE-2004-1898
Published: 2004-12-31
Description: Stack-based buffer overflow in the administration interface in Monit 1.4 through 4.2 allows remote attackers to execute arbitrary code via a long username.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0076.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3696&w=2; http://secunia.com/advisories/11304
CVE: CVE-2004-1899
Published: 2004-12-31
Description: The administration interface in Monit 1.4 through 4.2 allows remote attackers to cause an off-by-one overflow via a POST that contains 1024 bytes.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0076.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3696&w=2; http://secunia.com/advisories/11304
CVE: CVE-2004-1900
Published: 2004-12-31
Description: Format string vulnerability in the logging function in IGI 2 Covert Strike server 1.3 and earlier allows remote attackers to execute arbitrary code via format string specifiers in RCON commands.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/igi2fs-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1815&w=2; http://secunia.com/advisories/11299
CVE: CVE-2004-1901
Published: 2004-12-31
Description: Portage before 2.0.50-r3 allows local users to overwrite arbitrary files via a hard link attack on the lockfiles.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59, CWE-59
References: http://secunia.com/advisories/11305; http://security.gentoo.org/glsa/glsa-200404-01.xml; http://www.securityfocus.com/bid/10060
CVE: CVE-2004-1902
Published: 2004-12-31
Description: The Citrix MetaFrame Password Manager 2.0, when a central credential store is not configured, does not encrypt passwords entered immediately after executing the First Time User Wizards, which allows local users to gain sensitive information.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0311&w=2; http://secunia.com/advisories/11293; http://securitytracker.com/id?1009659
CVE: CVE-2004-1903
Published: 2004-12-31
Description: Buffer overflow in blaxxun 3D 7.0 allows remote attackers to execute arbitrary code via a long URL property inside an object tag.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2955&w=2; http://www.securityfocus.com/bid/10064; https://exchange.xforce.ibmcloud.com/vulnerabilities/15625
CVE: CVE-2004-1904
Published: 2004-12-31
Description: Buffer overflow in ascontrol.dll in Panda ActiveScan 5.0 allows remote attackers to execute arbitrary code via the Internacional property followed by a long string.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0482&w=2; http://secunia.com/advisories/11312; http://theinsider.deep-ice.com/texts/advisory53.txt
CVE: CVE-2004-1905
Published: 2004-12-31
Description: ascontrol.dll in Panda ActiveScan 5.0 allows remote attackers to cause a denial of service (crash) by calling the SetSitesFile function.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0482&w=2; http://theinsider.deep-ice.com/texts/advisory53.txt; http://www.securityfocus.com/bid/10067
CVE: CVE-2004-1906
Published: 2004-12-31
Description: Mcafee FreeScan allows remote attackers to cause a denial of service and possibly arbitrary code via a long string in the ScanParam property of a COM object, which may trigger a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/019877.html; http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/019891.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1898&w=2
CVE: CVE-2004-1907
Published: 2004-12-31
Description: The Web Filtering functionality in Kerio Personal Firewall (KPF) 4.0.13 allows remote attackers to cause a denial of service (crash) by sending hex-encoded URLs containing "%13%12%13".
CVSS Score: 2.6 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2004-04/0061.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4251&w=2; http://secunia.com/advisories/11331
CVE: CVE-2004-1908
Published: 2004-12-31
Description: McFreeScan.CoMcFreeScan.1 ActiveX object in Mcafee FreeScan allows remote attackers to obtain sensitive information via the GetSpecialFolderLocation function with certain parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/019877.html; http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/019891.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1898&w=2
CVE: CVE-2004-1909
Published: 2004-12-31
Description: Claim Anti-Virus (ClamAV) 0.68 and earlier allows remote attackers to cause a denial of service (crash) via certain RAR archives, such as those generated by the Beagle/Bagle worm.
CVSS Score: 2.6 (LOW)
References: http://freshmeat.net/projects/clamav/?branch_id=29355&release_id=154462; http://secunia.com/advisories/11177; http://security.gentoo.org/glsa/glsa-200404-07.xml
CVE: CVE-2004-1910
Published: 2004-12-31
Description: rufsi.dll in Symantec Virus Detection allows remote attackers to cause a denial of service (crash) via a long string to the GetPrivateProfileString function.  NOTE: this issue was originally reported as a buffer overflow, but that specific claim is disputed by the vendor, although a crash is acknowledged.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/019891.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6896&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1721&w=2
CVE: CVE-2004-1911
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in AzDGDatingLite 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the (1) l parameter (aka language variable) to index.php or (2) id parameter to view.php.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7973&w=2; http://secunia.com/advisories/11326; http://www.osvdb.org/5018
CVE: CVE-2004-1912
Published: 2004-12-31
Description: The (1) modules.php, (2) block-Calendar.php, (3) block-Calendar1.php, (4) block-Calendar_center.php scripts in NukeCalendar 1.1.a, as used in PHP-Nuke, allow remote attackers to obtain sensitive information via a URL with an invalid argument, which reveals the full path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2458&w=2; http://www.securityfocus.com/bid/10082; https://exchange.xforce.ibmcloud.com/vulnerabilities/15795
CVE: CVE-2004-1913
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to inject arbitrary web script or HTML via the eid parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2458&w=2; http://www.securityfocus.com/bid/10082; https://exchange.xforce.ibmcloud.com/vulnerabilities/15798
CVE: CVE-2004-1914
Published: 2004-12-31
Description: SQL injection vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to execute arbitrary SQL commands via the eid parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2458&w=2; http://www.securityfocus.com/bid/10082; https://exchange.xforce.ibmcloud.com/vulnerabilities/15799
CVE: CVE-2004-1937
Published: 2004-12-31
Description: Multiple directory traversal vulnerabilities in Nuked-KlaN 1.4b and 1.5b allow remote attackers to read or include arbitrary files via .. sequences in (1) the user_langue parameter to index.php or (2) the langue parameter to update.php, or modify arbitrary GLOBAL variables by causing globals.php to be loaded before conf.inc.php via (3) .. sequences in the file parameter with the page parameter set to globals, or (4) ../globals.php in the user_langue parameter, as demonstrated by modifying $nuked[prefix] in the Suggest module.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5823&w=2; http://secunia.com/advisories/11341; http://www.phpsecure.info/v2/tutos/frog/Nuked-KlaN.txt
CVE: CVE-2004-1940
Published: 2004-12-31
Description: sipclient.cpp in KPhone 4.0.1 and earlier allows remote attackers to cause a denial of service (crash) via a STUN response packet with a large attrLen value that causes an out-of-bounds read.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4859&w=2; http://www.securiteam.com/unixfocus/5PP0B1FCLY.html; http://www.securityfocus.com/bid/10159
CVE: CVE-2004-1949
Published: 2004-12-31
Description: SQL injection vulnerability in PostNuke 7.2.6 and earlier allows remote attackers to execute arbitrary SQL via (1) the sif parameter to index.php in the Comments module or (2) timezoneoffset parameter to changeinfo.php in the Your_Account module.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020154.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8978&w=2; http://news.postnuke.com/Article2580.html
CVE: CVE-2004-1951
Published: 2004-12-31
Description: xine 1.x alpha, 1.x beta, and 1.0rc through 1.0rc3a, and xine-ui 0.9.21 to 0.9.23 allows remote attackers to overwrite arbitrary files via the (1) audio.sun_audio_device or (2) dxr3.devicename options in an MRL link.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/11433; http://security.gentoo.org/glsa/glsa-200404-20.xml; http://www.osvdb.org/5594
CVE: CVE-2004-1953
Published: 2004-12-31
Description: phProfession 2.5 allows remote attackers to gain sensitive information via a direct HTTP request to upload.php, which reveals the path in a PHP error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0060&w=2; http://secunia.com/advisories/11465; http://www.osvdb.org/5623
CVE: CVE-2004-1955
Published: 2004-12-31
Description: SQL injection vulnerability in modules.php in phProfession 2.5 allows remote attackers to execute arbitrary SQL code via the offset parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0060&w=2; http://secunia.com/advisories/11465; http://www.osvdb.org/5625
CVE: CVE-2004-1958
Published: 2004-12-31
Description: Directory traversal vulnerability in manifest.ini in Unreal engine allows remote attackers to overwrite arbitrary files via .. (dot dot) sequences in a UMOD (Unreal MOD) file.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/umod-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9459&w=2; http://www.securityfocus.com/bid/10196
CVE: CVE-2004-1960
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in blocker_query.php in Protector System 1.15b1 allows remote attackers to inject arbitrary web script or HTML via the (1) target or (2) portNum parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://protector.warcenter.se/article-53--0-0.html; http://www.securityfocus.com/archive/1/361300/2004-04-21/2004-04-27/0; http://www.securityfocus.com/bid/10206
CVE: CVE-2004-1962
Published: 2004-12-31
Description: SQL injection vulnerability in index.php in Protector System 1.15b1 allows remote attackers to bypass SQL injection filters by using "/**/" sequences in the targeted fields.
CVSS Score: 7.5 (HIGH)
References: http://protector.warcenter.se/article-53--0-0.html; http://www.securityfocus.com/archive/1/361300/2004-04-21/2004-04-27/0; http://www.securityfocus.com/bid/10206
CVE: CVE-2004-1966
Published: 2004-12-31
Description: Multiple SQL injection vulnerabilities in Open Bulletin Board (OpenBB) 1.0.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) FID parameter in board.php, (2) sortorder, perpage, or id parameters in member.php, (3) forums parameter in search.php, or (4) PID or FID parameters in post.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6107&w=2; http://secunia.com/advisories/11481; http://securitytracker.com/id?1009935
CVE: CVE-2004-1995
Published: 2004-12-31
Description: Cross-Site Request Forgery (CSRF) vulnerability in FuseTalk 2.0 allows remote attackers to create arbitrary accounts via a link to adduser.cfm.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5478&w=2; http://secunia.com/advisories/11555; http://securitytracker.com/id?1010080
CVE: CVE-2004-2010
Published: 2004-12-31
Description: PHP remote file inclusion vulnerability in index.php in phpShop 0.7.1 and earlier allows remote attackers to execute arbitrary PHP code by modifying the base_dir parameter to reference a URL on a remote web server that contains phpshop.cfg.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7870&w=2; http://secunia.com/advisories/11587; http://www.fribble.net/advisories/phpshop_29-04-04.txt
CVE: CVE-2004-2011
Published: 2004-12-31
Description: msxml3.dll in Internet Explorer 6.0.2600.0 allows remote attackers to cause a denial of service (crash) via a single & (ampersand) in a <Ref href> link, which triggers a parsing error, possibly due to missing portions of the URI.
CVSS Score: 2.6 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7947&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/16112; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7947&w=2
CVE: CVE-2004-2012
Published: 2004-12-31
Description: The systrace_exit function in the systrace utility for NetBSD-current and 2.0 before April 16, 2004, and certain FreeBSD ports, does not verify the owner of the /dec/systrace connection before setting euid to 0, which allows local users to gain root privileges.
CVSS Score: 7.2 (HIGH)
References: ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-007.txt.asc; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0570&w=2; http://secunia.com/advisories/11585
CVE: CVE-2004-2013
Published: 2004-12-31
Description: Integer overflow in the SCTP_SOCKOPT_DEBUG_NAME SCTP socket option in socket.c in the Linux kernel 2.4.25 and earlier allows local users to execute arbitrary code via an optlen value of -1, which causes kmalloc to allocate 0 bytes of memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://archives.neohapsis.com/archives/bugtraq/2004-05/0091.html; http://lists.netsys.com/pipermail/full-disclosure/2004-May/021223.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5842&w=2
CVE: CVE-2004-2014
Published: 2004-12-31
Description: Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the name of the file being downloaded.
CVSS Score: 2.6 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5276&w=2; http://marc.info/?l=wget&m=[PII_REDACTED]6833&w=2; http://marc.info/?l=wget&m=[PII_REDACTED]7139&w=2
CVE: CVE-2004-2015
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in WebCT Campus Edition allows remote attackers to inject arbitrary HTML or web script via (1) iframe, (2) img, or (3) object tags.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0851.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1404&w=2; http://www.securityfocus.com/bid/10357
CVE: CVE-2004-2016
Published: 2004-12-31
Description: Stack-based buffer overflow in the HTTP server in NetChat 7.3 and earlier allows remote attackers to execute arbitrary code via a long GET request.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0354&w=2; http://secunia.com/advisories/11637; http://www.securityfocus.com/bid/10353
CVE: CVE-2004-2017
Published: 2004-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Turbo Traffic Trader C (TTT-C) 1.0 allow remote attackers to inject arbitrary HTML or web script, as demonstrated via (1) the link parameter to ttt-out, (2) the X-Forwarded-For header in a GET request to ttt-in, (3) the Referer header in a GET request to ttt-in, or the (4) site name or (5) site URL fields in the main control panel.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1866&w=2; http://secunia.com/advisories/11623; http://www.icefire.org/security/ttt-bugreport.txt
CVE: CVE-2004-2018
Published: 2004-12-31
Description: PHP remote file inclusion vulnerability in index.php in Php-Nuke 6.x through 7.3 allows remote attackers to execute arbitrary PHP code by modifying the modpath parameter to reference a URL on a remote web server that contains the code.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0870.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1896&w=2; http://secunia.com/advisories/11625
CVE: CVE-2004-2019
Published: 2004-12-31
Description: The WebLinks module in Php-Nuke 6.x through 7.3 allows remote attackers to obtain sensitive information via an invalid show parameter, which displays the full path in a PHP error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5299&w=2; http://secunia.com/advisories/11625; http://www.securityfocus.com/bid/10367
CVE: CVE-2004-2020
Published: 2004-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 6.x through 7.3 allow remote attackers to inject arbitrary HTML or web script into the (1) optionbox parameter in the News module, (2) date parameter in the Statistics module, (3) year, month, and month_1 parameters in the Stories_Archive module, (4) mode, order, and thold parameters in the Surveys module, or (5) a SQL statement to index.php, as processed by mainfile.php.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5299&w=2; http://secunia.com/advisories/11625; http://www.osvdb.org/6225
CVE: CVE-2004-2021
Published: 2004-12-31
Description: Directory traversal vulnerability in file_manager.php in osCommerce 2.2 allows remote attackers to view arbitrary files via a .. (dot dot) in the filename argument.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2005-03/0378.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1519&w=2; http://secunia.com/advisories/11624
CVE: CVE-2004-2022
Published: 2004-12-31
Description: ActivePerl 5.8.x and others, and Larry Wall's Perl 5.6.1 and others, when running on Windows systems, allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long argument to the system command, which leads to a stack-based buffer overflow.  NOTE: it is unclear whether this bug is in Perl or the OS API that is used by Perl.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0905.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9025&w=2; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]5922&w=2