Security Vulnerabilities Published In 2004(Gain Information)

2004 : January February March April May June July August September October November December

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

Copy Results Download Results Select Table

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2004-2748	200	+Info	2004-12-31	2008-09-05	4.3	None	Remote	Medium	Not required	Partial	None	None
viewreport.pl in NetIQ WebTrends Reporting Center Enterprise Edition 6.1a allows remote attackers to determine the installation path via an invalid profileid parameter, which leaks the pathname in an error message.
2	CVE-2004-2732	78	+Info	2004-12-31	2008-09-05	4.3	None	Remote	Medium	Not required	Partial	None	None
nbmember.cgi in Netbilling 2.0 allows remote attackers to obtain sensitive information via the cmd=test option, which can be leveraged to determine the access key.
3	CVE-2004-2718	264	+Info	2004-12-31	2008-09-05	4.3	None	Remote	Medium	Not required	Partial	None	None
PHPMyChat 0.14.5 does not remove or protect setup.php3 after installation, which allows attackers to obtain sensitive information including database passwords via a direct request.
4	CVE-2004-2679		+Info	2004-12-31	2008-09-05	7.8	None	Remote	Low	Not required	Complete	None	None
Check Point Firewall-1 4.1 up to NG AI R55 allows remote attackers to obtain potentially sensitive information by sending an Internet Key Exchange (IKE) with a certain Vendor ID payload that causes Firewall-1 to return a response containing version and other information.
5	CVE-2004-2671		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
mod.php in eNdonesia 8.3 allows remote attackers to obtain sensitive information via certain direct requests, and certain requests with invalid parameter values, which reveal the path in various error messages, as demonstrated by the (1) mod and (2) cid parameters.
6	CVE-2004-2666		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
Mantis before 20041016 provides a complete Issue History (Bug History) in the web interface regardless of view_history_threshold, which allows remote attackers to obtain sensitive information (private bug details) by visiting a bug's web page.
7	CVE-2004-2664		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
John Lim ADOdb Library for PHP before 4.23 allows remote attackers to obtain sensitive information via direct requests to certain scripts that result in an undefined value of ADODB_DIR, which reveals the installation path in an error message.
8	CVE-2004-2661		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
Soft3304 04WebServer before 1.41 does not properly check file names, which allows remote attackers to obtain sensitive information (CGI source code).
9	CVE-2004-2616		+Info	2004-12-31	2008-09-10	4.0	None	Remote	Low	Single system	Partial	None	None
The file server in ActivePost Standard 3.1 and earlier allows remote authenticated users to obtain sensitive information by uploading a file, which reveals the path in a success message.
10	CVE-2004-2609		Overflow +Info	2004-12-31	2008-09-05	2.1	None	Local	Low	Not required	Partial	None	None
The stuffit.com executable on Symantec PowerQuest DeployCenter 5.5 boot disks allows local users to obtain sensitive information (an unencrypted password for a Windows domain account) via four "stuffit /f:stuffit.dat" invocations, possibly due to a buffer overflow.
11	CVE-2004-2608		+Info	2004-12-31	2010-05-29	5.0	None	Remote	Low	Not required	Partial	None	None
SmartWebby Smart Guest Book stores SmartGuestBook.mdb (aka the "news database") under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as the unencrypted username and password of the administrator's account.
12	CVE-2004-2600		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
The firmware for Intelligent Platform Management Interface (IPMI) 1.5-based Intel Server Boards and Platforms is shipped with an Authentication Type Enables parameter set to an invalid None parameter, which allows remote attackers to obtain sensitive information when LAN management functionality is enabled.
13	CVE-2004-2588		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
Intentional information leak in phpinfo.php in XMB (aka extreme message board) 1.9 beta (aka Nexus beta) allows remote attackers to obtain sensitive information such as the configuration of the web server and the PHP application.
14	CVE-2004-2582		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
Novell iChain 2.3 includes the build number in the VIA line of the proxy server's HTTP headers, which allows remote attackers to obtain sensitive information.
15	CVE-2004-2577		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
The acl_check function in phpGroupWare 0.9.16RC2 always returns True, even when mkdir does not behave as expected, which could allow remote attackers to obtain sensitive information via WebDAV from users' home directories that lack .htaccess files, and possibly has other unknown impacts.
16	CVE-2004-2576		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
class.vfs_dav.inc.php in phpGroupWare 0.9.16.000 does not create .htaccess files to enable authorization checks for access to users' home-directory files, which allows remote attackers to obtain sensitive information from these files.
17	CVE-2004-2575		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
phpGroupWare 0.9.14.005 and earlier allow remote attackers to obtain sensitive information via a direct request to (1) hook_admin.inc.php, (2) hook_home.inc.php, (3) class.holidaycalc.inc.php, and (4) setup.inc.php.sample, which reveals the path in an error message.
18	CVE-2004-2572		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering (1) invalid characters such as "()" or (2) a large number of characters in the Lookup field on the netaddressbook.php web form, which reveals the path in an ldaplib.php error message when the ldap_search function fails, due to improper processing of the $keyword variable.
19	CVE-2004-2563		XSS +Info	2004-12-31	2008-09-05	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Serena TeamTrack 6.1.1 allows remote attackers to obtain sensitive information such as user names, versions, and database information, and conduct cross-site scripting (XSS) attacks, via a direct request to tmtrack.dll with modified LoginPage and Template parameters.
20	CVE-2004-2547		+Info	2004-12-31	2008-09-05	2.6	None	Remote	High	Not required	Partial	None	None
NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to obtain sensitive information via HTTP requests that (a) specify the / URI, (b) specify the /scripts/ URI, or (c) specify a non-existent file, which reveal the path in an error message.
21	CVE-2004-2544		+Info	2004-12-31	2008-09-05	2.1	None	Local	Low	Not required	Partial	None	None
Admin Console in Secure Computing Corporation Sidewinder G2 6.1.0.01 exports private keys when exporting firewall certificates, which might allow attackers to obtain sensitive information.
22	CVE-2004-2518		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
Gattaca Server 2003 1.1.10.0 allows remote attackers to obtain sensitive information via (1) a trailing null byte ("%00") to a URL or (2) an invalid LANGUAGE parameter to web.tmpl, which reveals the full installation path in an error message.
23	CVE-2004-2506		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
Unparsed web content delivery vulnerability in WIKINDX before 0.9.9g allows remote attackers to obtain sensitive information via a direct HTTP request to the config.inc file.
24	CVE-2004-2479		+Info	2004-12-31	2010-08-21	5.0	None	Remote	Low	Not required	Partial	None	None
Squid Web Proxy Cache 2.5 might allow remote attackers to obtain sensitive information via URLs containing invalid hostnames that cause DNS operations to fail, which results in references to previously used error messages.
25	CVE-2004-2455		+Priv +Info	2004-12-31	2008-09-05	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Sweex Wireless Broadband Router/Accesspoint 802.11g (LC000060) allows remote attackers to obtain sensitive information and gain privileges by using TFTP to download the nvram file, then extracting the username, password, and other data from the file.
26	CVE-2004-2454		+Info	2004-12-31	2008-09-05	2.1	None	Local	Low	Not required	Partial	None	None
aMSN 0.90 for Microsoft Windows allows local users to obtain sensitive information such as hashed passwords from (1) hotlog.htm and (2) config.xml.
27	CVE-2004-2452		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
Unknown vulnerability in Hitachi Cosminexus Portal Framework 01-00, 01-01, 01-02, 02-01, 02-02, 02-03, and other versions allows remote attackers to obtain sensitive information in the <ut:cache> tag library.
28	CVE-2004-2450		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
The client and server for Roger Wilco 1.4.1.6 and earlier or Roger Wilco Base Station 0.30a and earlier report sensitive information such as IDs and source IP addresses, which allows remote attackers to obtain sensitive information.
29	CVE-2004-2448		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
S-Mart Shopping Cart or RediCart 3.9.5b stores smart.cfg under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as the database name.
30	CVE-2004-2428		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
Abczone.it WWWguestbook 1.1 stores db/dbase.mdb under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as the plaintext username and password.
31	CVE-2004-2427		DoS +Info	2004-12-31	2008-09-05	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to obtain sensitive information via direct requests to (1) admin/getparam.cgi, (2) admin/systemlog.cgi, (3) admin/serverreport.cgi, and (4) admin/paramlist.cgi, modify system information via (5) setparam.cgi and (6) factorydefault.cgi, or (7) cause a denial of service (reboot) via restart.cgi.
32	CVE-2004-2414		+Info	2004-12-31	2008-09-05	2.1	None	Local	Low	Not required	Partial	None	None
Novell NetWare 6.5 SP 1.1, when installing or upgrading using the Overlay CDs and performing a custom installation with OpenSSH, includes sensitive password information in the (1) NIOUTPUT.TXT and (2) NI.LOG log files, which might allow local users to obtain the passwords.
33	CVE-2004-2408		DoS +Info	2004-12-31	2008-09-05	3.6	None	Local	Low	Not required	Partial	Partial	None
Linux VServer 1.27 and earlier, 1.3.9 and earlier, and 1.9.1 and earlier shares /proc permissions across all virtual and host servers, which allows local users with the ability to set permissions in /proc to obtain system information or cause a denial of service on other virtual servers or the host server.
34	CVE-2004-2385		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
EMU Webmail 5.2.7 allows remote attackers to obtain sensitive path information (home directory) via an HTTP request for init.emu.
35	CVE-2004-2353		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
BugPort before 1.099 stores its configuration file (conf/config.conf) under the web document root with a file extension that is not normally parsed by web servers, which allows remote attackers to obtain sensitive information.
36	CVE-2004-2345		DoS +Info	2004-12-31	2008-09-05	6.5	User	Remote	Low	Single system	Partial	Partial	Partial
Unknown multiple vulnerabilities in Oracle9i Database Server 9.0.1.4, 9.0.1.5, 9.2.0.3, and 9.2.0.4 allow local users with the ability to invoke SQL to cause a denial of service or obtain sensitive information.
37	CVE-2004-2331		Bypass +Info	2004-12-31	2008-09-05	2.1	None	Local	Low	Not required	Partial	None	None
ColdFusion MX 6.1 and 6.1 J2EE allows local users to bypass sandbox security restrictions and obtain sensitive information by using Java reflection methods to access trusted Java objects without using the CreateObject function or cfobject tag.
38	CVE-2004-2323		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to obtain sensitive information, including the SQL server username and password, via a GET request for source or configuration files such as Web.config.
39	CVE-2004-2320	200	XSS +Info	2004-12-31	2009-01-08	5.8	None	Remote	Medium	Not required	Partial	Partial	None
The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.
40	CVE-2004-2317		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
Information leak in Mbedthis AppWeb HTTP server 1.0 through 1.1.2 allows remote attackers to obtain sensitive information via a user message that is generated when Mbedthis denies access.
41	CVE-2004-2296		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
The preview_review function in the Reviews module in PHP-Nuke 6.0 to 7.3, when running on Windows systems, allows remote attackers to obtain sensitive information via an invalid date parameter, which generates an error message.
42	CVE-2004-2268		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
PimenGest2 before 1.1.1 allows remote attackers to obtain the database password via debug information in rowLatex.inc.php.
43	CVE-2004-2252		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	None	Partial	None
The firewall in Astaro Security Linux before 4.024 sends responses to SYN-FIN packets, which makes it easier for remote attackers to obtain information about the system and construct specialized attacks.
44	CVE-2004-2137		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" setting, leaks the BCC recipients of the message to the addresses listed in the To and CC fields, which may allow remote attackers to obtain sensitive information.
45	CVE-2004-2104		+Info	2004-12-31	2009-01-29	5.0	None	Remote	Low	Not required	Partial	None	None
Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to obtain sensitive server information, including the internal IP address, via a direct request to (1) snoop.jsp, (2) SnoopServlet, (3) env.bas, or (4) lcgitest.nlm.
46	CVE-2004-2044		+Info	2004-06-01	2008-09-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the "admin.php" string.
47	CVE-2004-2039		+Info	2004-05-29	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
e107 0.615 allows remote attackers to obtain sensitive information via a direct request to (1) alt_news.php, (2) backend_menu.php, (3) clock_menu.php, (4) counter_menu.php, (5) login_menu.php, and other files, which reveal the full path in a PHP error message.
48	CVE-2004-2019		+Info	2004-12-31	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
The WebLinks module in Php-Nuke 6.x through 7.3 allows remote attackers to obtain sensitive information via an invalid show parameter, which displays the full path in a PHP error message.
49	CVE-2004-1984		+Info	2004-05-02	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers to obtain sensitive information via a direct HTTP request to (1) phpinfo.php, (2) addpic.php, (3) config.php, (4) db_input.php, (5) displayecard.php, (6) ecard.php, (7) crop.inc.php, which reveal the full path in a PHP error message.
50	CVE-2004-1963		+Info	2004-04-23	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
nqt.php in Network Query Tool (NQT) 1.6 allows remote attackers to obtain sensitive information via a string in the portNum parameter, which reveals the full path in an error message.

Total number of vulnerabilities : 96 Page : 1 (This Page)2