deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2004-2124
Published: 2004-12-31
Description: The register_globals simulation capability in Gallery 1.3.1 through 1.4.1 allows remote attackers to modify the HTTP_POST_VARS variable and conduct a PHP remote file inclusion attack via the GALLERY_BASEDIR parameter, a different vulnerability than CVE-2002-1412.
CVSS Score: 5.0 (MEDIUM)
References: http://gallery.menalto.com/modules.php?op=modload&name=News&file=index; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7693&w=2; http://secunia.com/advisories/10712/
CVE: CVE-2004-2125
Published: 2004-12-31
Description: Buffer overflow in blackd.exe for BlackICE PC Protection 3.6 and other versions before 3.6.ccb, with application protection off, allows local users to gain system privileges by modifying the .INI file to contain a long packetLog.fileprefix value.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/iss/2004-q1/0157.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4193&w=2; http://secunia.com/advisories/10739
CVE: CVE-2004-2126
Published: 2004-12-31
Description: The upgrade for BlackICE PC Protection 3.6 and earlier sets insecure permissions for .INI files such as (1) blackice.ini, (2) firewall.ini, (3) protect.ini, or (4) sigs.ini, which allows local users to modify BlackICE configuration or possibly execute arbitrary code by exploiting vulnerabilities in the .INI parsers.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4193&w=2; http://www.securityfocus.com/bid/9513; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4193&w=2
CVE: CVE-2004-2128
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in BRS WebWeaver 1.07 allows remote attackers to execute arbitrary script as other users via the query string to ISAPISkeleton.dll.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4977&w=2; http://secunia.com/advisories/10741; http://www.brswebweaver.com/modules.php?op=modload&name=News&file=article&sid=1
CVE: CVE-2004-2129
Published: 2004-12-31
Description: SurfNOW 2.2 allows remote attackers to cause a denial of service (crash) via a series of long HTTP GET requests, possibly triggering a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3559&w=2; http://www.securityfocus.com/bid/9519; https://exchange.xforce.ibmcloud.com/vulnerabilities/14976
CVE: CVE-2004-2137
Published: 2004-12-31
Description: Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" setting, leaks the BCC recipients of the message to the addresses listed in the To and CC fields, which may allow remote attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/12376; http://securitytracker.com/id?1011067; http://support.microsoft.com/kb/843555
CVE: CVE-2004-2138
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in AWSguest.php in AllWebScripts MySQLGuest allows remote attackers to inject arbitrary HTML and PHP code via the (1) Name, (2) Email, (3) Homepage or (4) Comments field.
CVSS Score: 6.8 (MEDIUM)
References: http://securitytracker.com/id?1011376; http://www.computerknights.org/forum_viewtopic.php?2.122; http://www.securityfocus.com/bid/11234
CVE: CVE-2004-2139
Published: 2004-12-31
Description: Unknown vulnerability in Adminedit.pl YaBB 1 Gold before 1.3.2 allows attackers to execute arbitrary code via settings.pl.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/12609/; http://www.osvdb.org/10222; http://www.securityfocus.com/bid/11235
CVE: CVE-2004-2140
Published: 2004-12-31
Description: CRLF injection vulnerability in YaBB 1 Gold before 1.3.2 allows remote attackers to modify text file contents via the subject variable.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/12609/; http://www.yabbforum.com/community/YaBB.pl?board=general%3Baction=display%3Bnum=[PII_REDACTED]; http://secunia.com/advisories/12609/
CVE: CVE-2004-2141
Published: 2004-12-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2004-1827.  Reason: This candidate is a duplicate of CVE-2004-1827.  Notes: All CVE users should reference CVE-2004-1827 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2004-2142
Published: 2004-12-31
Description: Unknown vulnerability in the remote tape support (remote.c) in the RMT client for Jorg Schilling sdd 1.28 and 1.31 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: ftp://ftp.berlios.de/pub/sdd/AN-1.52; http://secunia.com/advisories/12584/; https://exchange.xforce.ibmcloud.com/vulnerabilities/17442
CVE: CVE-2004-2143
Published: 2004-12-31
Description: SQL injection vulnerability in the ReMOSitory Server add-on module to Mambo Portal 4.5.1 (1.09) and earlier allows remote attackers to execute arbitrary SQL commands via the filecatid parameter in the com_remository option.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2004-09/0215.html; http://archives.neohapsis.com/archives/bugtraq/2004-09/0249.html; http://secunia.com/advisories/12597/
CVE: CVE-2004-2144
Published: 2004-12-31
Description: Baal Smart Forms before 3.2 allows remote attackers to bypass authentication and obtain system access via a direct request to regadmin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: http://secunia.com/advisories/12649/; http://securitytracker.com/id?1011416; https://exchange.xforce.ibmcloud.com/vulnerabilities/17499
CVE: CVE-2004-2145
Published: 2004-12-31
Description: SQL injection vulnerability in PD9 Software MegaBBS 2 and 2.1 allows remote attackers to execute arbitrary SQL commands via the (1) sortdir or (2) criteria parameter to ladder-log.asp or the (3) memberid or (4) teamid parameter to view-profile.asp.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0962.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1134&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/17497
CVE: CVE-2004-2146
Published: 2004-12-31
Description: CRLF injection vulnerability in PD9 Software MegaBBS 2 and 2.1 allows attackers to conduct HTTP response splitting attacks via the fid parameter in a writenew action to thread-post.asp.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0962.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1134&w=2; http://www.pd9soft.com/megabbs/forums/thread-view.asp?tid=4924
CVE: CVE-2004-2147
Published: 2004-12-31
Description: Unknown versions of Symantec Norton AntiVirus and Microsoft Outlook allow attackers to cause a denial of service (crash) via malformed e-mail messages (1) without a body or (2) without a carriage return ("\n") separating the headers from the body.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/82/376487/2004-09-24/2004-09-30/0; http://www.securityfocus.com/bid/11259; http://www.securityfocus.com/archive/82/376487/2004-09-24/2004-09-30/0
CVE: CVE-2004-2148
Published: 2004-12-31
Description: Unknown local vulnerability in the "change user" feature of Slava Astashonok Fprobe 1.0.5 and earlier has unknown impact and attack vectors.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/12648/; http://securitytracker.com/id?1011417; http://sourceforge.net/project/shownotes.php?release_id=269807
CVE: CVE-2004-2149
Published: 2004-12-31
Description: Buffer overflow in the prepared statements API in libmysqlclient for MySQL 4.1.3 beta and 4.1.4 allows remote attackers to cause a denial of service via a large number of placeholders.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.mysql.com/bug.php?id=5194; http://dev.mysql.com/doc/mysql/en/news-4-1-5.html; http://securitytracker.com/id?1011408
CVE: CVE-2004-2150
Published: 2004-12-31
Description: Nettica Corporation INTELLIPEER Email Server 1.01 displays different error messages for valid and invalid account names, which allows remote attackers to determine valid account names.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-203
References: http://secunia.com/advisories/12661/; http://securitytracker.com/id?1011425; http://www.osvdb.org/10349
CVE: CVE-2004-2151
Published: 2004-12-31
Description: Chatman 1.1.1 RC1 and earlier allows remote attackers to cause a denial of service (memory consumption or application crash) via a very large data size.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/12665/; http://securitytracker.com/id?1011431; http://www.osvdb.org/10365
CVE: CVE-2004-2152
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in 'raw' page output mode for MediaWiki 1.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/12692/; http://sourceforge.net/project/shownotes.php?group_id=34373&release_id=271848; http://www.osvdb.org/10454
CVE: CVE-2004-2153
Published: 2004-12-31
Description: Multiple unknown vulnerabilities in Real Estate Management Software 1.0 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/apps/freshmeat/2004-09/0030.html; http://secunia.com/advisories/12721; http://www.osvdb.org/10480
CVE: CVE-2004-2154
Published: 2004-12-31
Description: CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-178, CWE-178
References: http://www.cups.org/str.php?L700; http://www.novell.com/linux/security/advisories/2005_18_sr.html; http://www.redhat.com/support/errata/RHSA-2005-571.html
CVE: CVE-2004-2155
Published: 2004-12-31
Description: Online-bookmarks before 0.4.6 allows remote attackers to bypass its authentication mechanism via a direct request to (1) config/*, (2) bookmarks.php, (3) footer.php, (4) main.php, (5) tree.php, or (6) functions.php.
CVSS Score: 7.5 (HIGH)
References: http://freshmeat.net/projects/onlinebookmarks/?branch_id=34962&release_id=174401; http://secunia.com/advisories/12728/; http://www.securityfocus.com/bid/11305
CVE: CVE-2004-2156
Published: 2004-12-31
Description: Multiple unknown vulnerabilities in Online Recruitment Agency 1.0 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/apps/freshmeat/2004-09/0030.html; http://secunia.com/advisories/12720/; http://securitytracker.com/id?1011539
CVE: CVE-2004-2157
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in Comment.php in Serendipity 0.7 beta1, and possibly other versions before 0.7-beta3, allows remote attackers to inject arbitrary HTML and PHP code via the (1) email or (2) username field.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/026955.html; http://secunia.com/advisories/12673/; http://securitytracker.com/id?1011448
CVE: CVE-2004-2158
Published: 2004-12-31
Description: SQL injection vulnerability in Serendipity 0.7-beta1 allows remote attackers to execute arbitrary SQL commands via the entry_id parameter to (1) exit.php or (2) comment.php.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/026955.html; http://secunia.com/advisories/12673/; http://securitytracker.com/id?1011448
CVE: CVE-2004-2159
Published: 2004-12-31
Description: Multiple buffer overflows in XMLStarlet Command Line XML Toolkit 0.9.3 have unknown impact and attack vectors via (1) xml_elem.c and (2) xml_select.c.
CVSS Score: 10.0 (HIGH)
References: http://securitytracker.com/id?1011496; http://sourceforge.net/project/shownotes.php?release_id=268962; http://www.osvdb.org/10074
CVE: CVE-2004-2160
Published: 2004-12-31
Description: Format string vulnerability in xml_elem.c for XMLStarlet Command Line XML Toolkit 0.9.3 may allow attackers to cause a denial of service or execute arbitrary code.
CVSS Score: 6.4 (MEDIUM)
References: http://cvs.sourceforge.net/viewcvs.py/xmlstar/xmlstarlet/src/xml_elem.c?r1=1.17&r2=1.18; http://sourceforge.net/project/shownotes.php?release_id=268962; http://cvs.sourceforge.net/viewcvs.py/xmlstar/xmlstarlet/src/xml_elem.c?r1=1.17&r2=1.18
CVE: CVE-2004-2161
Published: 2004-12-31
Description: SQL injection vulnerability in file_overview.php in TUTOS 1.1 allows remote attackers to execute arbitrary SQL commands via the link_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://cvs.sourceforge.net/viewcvs.py/tutos/tutos/php/file/file_overview.php?r1=1.11.2.1&r2=1.11.2.2; http://secunia.com/advisories/12606/; http://secunia.com/advisories/18954
CVE: CVE-2004-2162
Published: 2004-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in TUTOS 1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the search field of the Address Module or (2) the t parameter to app_new.php.
CVSS Score: 4.3 (MEDIUM)
References: http://cvs.sourceforge.net/viewcvs.py/tutos/tutos/php/app_new.php?r1=1.58&r2=1.59; http://secunia.com/advisories/12606/; http://secunia.com/advisories/18954
CVE: CVE-2004-2163
Published: 2004-12-31
Description: login_radius on OpenBSD 3.2, 3.5, and possibly other versions does not verify the shared secret in a response packet from a RADIUS server, which allows remote attackers to bypass authentication by spoofing server replies.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0058.html; http://secunia.com/advisories/12617; http://www.openbsd.org/errata35.html#radius
CVE: CVE-2004-2164
Published: 2004-12-31
Description: shoprestoreorder.asp in VP-ASP 5.0 does not close the database connection when a user restores a previous order, which allows remote attackers to cause a denial of service (connection consumption).
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/12611; http://www.osvdb.org/10071; http://www.securityfocus.com/bid/11228
CVE: CVE-2004-2165
Published: 2004-12-31
Description: Lords of the Realm III 1.01 and earlier, when in the lobby stage, allows remote attackers to cause a denial of service (crash from unallocated memory write) via a long user nickname.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/lotr3boom-adv.txt; http://seclists.org/lists/fulldisclosure/2004/Sep/0660.html; http://secunia.com/advisories/12589/
CVE: CVE-2004-2166
Published: 2004-12-31
Description: The print-from-email feature in the Canon ImageRUNNER (iR) 5000i and C3200 digital printer, when not using IP address range filtering, allows remote attackers to print arbitrary text without authentication via a text/plain email to TCP port 25.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/12659/; http://www.securityfocus.com/archive/1/376242; http://www.securityfocus.com/bid/11247
CVE: CVE-2004-2167
Published: 2004-12-31
Description: Multiple buffer overflows in LaTeX2rtf 1.9.15, and possibly other versions, allow remote attackers to execute arbitrary code via (1) the expandmacro function, and possibly (2) Environments and (3) TranslateCommand.
CVSS Score: 7.5 (HIGH)
References: http://cvs.sourceforge.net/viewcvs.py/latex2rtf/latex2rtf/definitions.c?rev=1.22&view=log; http://www.osvdb.org/displayvuln.php?osvdb_id=10216; http://www.securityfocus.com/bid/11233
CVE: CVE-2004-2168
Published: 2004-12-31
Description: BaSoMail 1.24 allows remote attackers to cause a denial of service (CPU consumption) via multiple connections to TCP port (1) 25 (SMTP) or (2) 110 (POP3).
CVSS Score: 5.0 (MEDIUM)
References: http://members.lycos.co.uk/r34ct/main/Baso_mail/Baso_1.24.txt; http://securitytracker.com/id?1008912; http://www.osvdb.org/3789
CVE: CVE-2004-2169
Published: 2004-12-31
Description: Application Access Server (A-A-S) 1.0.37 and earlier allows remote authenticated users to cause a denial of service (application crash) via a long file request.
CVSS Score: 2.1 (LOW)
References: http://members.lycos.co.uk/r34ct/main/A-A-S/AAS1_0_3.TXT; http://www.secunia.com/advisories/10762/; https://exchange.xforce.ibmcloud.com/vulnerabilities/15003
CVE: CVE-2004-2170
Published: 2004-12-31
Description: Directory traversal vulnerability in sample_showcode.html in Caravan 2.00/03d and earlier allows remote attackers to read arbitrary files via the fname parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://members.lycos.co.uk/r34ct/main/Caravan/Caravan.txt; http://securitytracker.com/id?1008913; http://www.osvdb.org/3787
CVE: CVE-2004-2171
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in Cherokee before 0.4.8 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting error page.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/10701/; http://www.osvdb.org/3707; http://www.securityfocus.com/bid/9496
CVE: CVE-2004-2172
Published: 2004-12-31
Description: EarlyImpact ProductCart uses a weak encryption scheme to encrypt passwords, which allows remote attackers to obtain the password via a chosen plaintext attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: http://archives.neohapsis.com/archives/bugtraq/2004-02/0503.html; http://archives.neohapsis.com/archives/fulldisclosure/2004-02/0871.html; http://secunia.com/advisories/10898
CVE: CVE-2004-2173
Published: 2004-12-31
Description: SQL injection vulnerability in advSearch_h.asp in EarlyImpact ProductCart allows remote attackers to execute arbitrary SQL commands via the priceUntil parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2004-02/0503.html; http://archives.neohapsis.com/archives/fulldisclosure/2004-02/0871.html; http://secunia.com/advisories/10898
CVE: CVE-2004-2174
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in Custva.asp in EarlyImpact ProductCart allows remote attackers to inject arbitrary Javascript via the redirectUrl parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2004-02/0503.html; http://archives.neohapsis.com/archives/fulldisclosure/2004-02/0871.html; http://secunia.com/advisories/10898
CVE: CVE-2004-2175
Published: 2004-12-31
Description: Multiple SQL injection vulnerabilities in ReviewPost PHP Pro allow remote attackers to execute arbitrary SQL commands via the (1) product parameter to showproduct.php or (2) cat parameter to showcat.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/10786/; http://www.securityfocus.com/archive/1/352598; http://www.securityfocus.com/bid/9574
CVE: CVE-2004-2176
Published: 2004-12-31
Description: The Internet Connection Firewall (ICF) in Microsoft Windows XP SP2 is configured by default to trust sessmgr.exe, which allows local users to use sessmgr.exe to create a local listening port that bypasses the ICF access controls.
CVSS Score: 4.6 (MEDIUM)
References: http://www.securityfocus.com/archive/1/378508; http://www.securityfocus.com/bid/11410; http://www.securityfocus.com/archive/1/378508
CVE: CVE-2004-2177
Published: 2004-12-31
Description: Cross-site scripting (XSS) vulnerability in DevoyBB Web Forum 1.0.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://sourceforge.net/project/shownotes.php?release_id=273104; http://www.maxpatrol.com/advdetails.asp?id=11; http://www.securityfocus.com/bid/11428
CVE: CVE-2004-2178
Published: 2004-12-31
Description: SQL injection vulnerability in DevoyBB Web Forum 1.0.0 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://sourceforge.net/project/shownotes.php?release_id=273104; http://www.maxpatrol.com/advdetails.asp?id=11; http://www.securityfocus.com/bid/11428
CVE: CVE-2004-2179
Published: 2004-12-31
Description: asycpict.dll, as used in Microsoft products such as Front Page 97 and 98, allows remote attackers to cause a denial of service (hang) via a JPEG image with maximum height and width values.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/378431; http://www.securityfocus.com/archive/1/378619; http://www.securityfocus.com/bid/11412
CVE: CVE-2004-2180
Published: 2004-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in WowBB Forum 1.61 allow remote attackers to inject arbitrary web script or HTML via the (1) country parameter to view_user.php, (2) show parameter to view_forum.php, (3) letter parameter to view_user.php, (4) highlight parameter to view_topic.php, (5) show parameter to index.php, (6) q parameter to search.php, (7) Referer header to admin.php, or the (8) user_email parameter to login.php.
CVSS Score: 4.3 (MEDIUM)
References: http://www.maxpatrol.com/advdetails.asp?id=7; http://www.securityfocus.com/bid/11429; http://www.maxpatrol.com/advdetails.asp?id=7
CVE: CVE-2004-2181
Published: 2004-12-31
Description: Multiple SQL injection vulnerabilities in WowBB Forum 1.61 allow remote attackers to execute arbitrary SQL commands via the (1) sort_by or (2) page parameters to view_user.php, or the (3) forum_id parameter to view_topic.php.  NOTE: the sort_by vector was later reported to be present in WowBB 1.65.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/wowbb-165-sql-vuln.html; http://www.maxpatrol.com/advdetails.asp?id=7; http://www.securityfocus.com/bid/11429
CVE: CVE-2004-2182
Published: 2004-12-31
Description: Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.macromedia.com/devnet/security/security_zone/mpsb04-08.html; http://www.securityfocus.com/bid/11414; http://www.macromedia.com/devnet/security/security_zone/mpsb04-08.html
CVE: CVE-2004-2183
Published: 2004-12-31
Description: Unknown vulnerability in WeHelpBUS 0.1 allows remote attackers to execute arbitrary shell commands via the query string.
CVSS Score: 7.5 (HIGH)
References: http://sourceforge.net/project/shownotes.php?release_id=275295; http://www.securityfocus.com/bid/11431; http://sourceforge.net/project/shownotes.php?release_id=275295
CVE: CVE-2004-2184
Published: 2004-12-31
Description: Directory traversal vulnerability in Digicraft Yak! server 2.0 through 2.1.2 allows remote attackers to read or write arbitrary files via "../" or "..\" sequences in commands such as (1) dir or (2) put.
CVSS Score: 6.4 (MEDIUM)
References: http://aluigi.altervista.org/adv/yak-adv.txt; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]3778&w=2; http://secunia.com/advisories/12849
CVE: CVE-2004-2185
Published: 2004-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki 1.3.5 allow remote attackers to execute arbitrary scripts and/or SQL queries via (1) the UnicodeConverter extension, (2) raw page views, (3) SpecialIpblocklist, (4) SpecialEmailuser, (5) SpecialMaintenance, and (6) ImagePage.
CVSS Score: 6.8 (MEDIUM)
References: http://sourceforge.net/project/shownotes.php?release_id=275099; http://www.securityfocus.com/bid/11416; http://sourceforge.net/project/shownotes.php?release_id=275099
CVE: CVE-2004-2186
Published: 2004-12-31
Description: SQL injection vulnerability in MediaWiki 1.3.5 allows remote attackers to execute arbitrary SQL commands via SpecialMaintenance.
CVSS Score: 7.5 (HIGH)
References: http://sourceforge.net/project/shownotes.php?release_id=275099; http://www.securityfocus.com/bid/11416; http://sourceforge.net/project/shownotes.php?release_id=275099
CVE: CVE-2004-2187
Published: 2004-12-31
Description: Unknown vulnerability in ImagePage for MediaWiki 1.3.5, related to "filename validation," has unknown impact and attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://sourceforge.net/project/shownotes.php?release_id=275099; http://www.securityfocus.com/bid/11416; http://sourceforge.net/project/shownotes.php?release_id=275099