CVE-2004-1937
published 2004-12-31CVE-2004-1937: Multiple directory traversal vulnerabilities in Nuked-KlaN 1.4b and 1.5b allow remote attackers to read or include arbitrary files via .. sequences in (1) the…
PriorityP430medium5CVSS 2.0
AVNACLAuNCPINAN
EXPLOIT
EPSS
8.12%
94.1th percentile
Multiple directory traversal vulnerabilities in Nuked-KlaN 1.4b and 1.5b allow remote attackers to read or include arbitrary files via .. sequences in (1) the user_langue parameter to index.php or (2) the langue parameter to update.php, or modify arbitrary GLOBAL variables by causing globals.php to be loaded before conf.inc.php via (3) .. sequences in the file parameter with the page parameter set to globals, or (4) ../globals.php in the user_langue parameter, as demonstrated by modifying $nuked[prefix] in the Suggest module.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nuked-klan | nuked-klan | — | — |
| nuked-klan | nuked-klan | — | — |
| nuked-klan | nuked-klan | — | — |
| nuked-klan | nuked-klan | — | — |
| nuked-klan | nuked-klan | — | — |
| nuked-klan | nuked-klan | — | — |
| nuked-klan | nuked-klan | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rmpw-q9gh-4qqx: Multiple directory traversal vulnerabilities in Nuked-KlaN 1
ghsa_unreviewed·2022-04-29
CVE-2004-1937 [MEDIUM] GHSA-rmpw-q9gh-4qqx: Multiple directory traversal vulnerabilities in Nuked-KlaN 1
Multiple directory traversal vulnerabilities in Nuked-KlaN 1.4b and 1.5b allow remote attackers to read or include arbitrary files via .. sequences in (1) the user_langue parameter to index.php or (2) the langue parameter to update.php, or modify arbitrary GLOBAL variables by causing globals.php to be loaded before conf.inc.php via (3) .. sequences in the file parameter with the page parameter set to globals, or (4) ../globals.php in the user_langue parameter, as demonstrated by modifying $nuked[prefix] in the Suggest module.
Red Hat
security flaw
vendor_redhat·2005-06-06·CVSS 7.5
CVE-2005-1937 [HIGH] security flaw
security flaw
A regression error in Firefox 1.0.3 and Mozilla 1.7.7 allows remote attackers to inject arbitrary Javascript from one page into the frameset of another site, aka the frame injection spoofing vulnerability, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2004-0718.
No detection rules found.
http://marc.info/?l=bugtraq&m=108222826225823&w=2http://secunia.com/advisories/11341http://www.phpsecure.info/v2/tutos/frog/Nuked-KlaN.txthttp://www.securityfocus.com/bid/10104https://exchange.xforce.ibmcloud.com/vulnerabilities/15843https://exchange.xforce.ibmcloud.com/vulnerabilities/15844http://marc.info/?l=bugtraq&m=108222826225823&w=2http://secunia.com/advisories/11341http://www.phpsecure.info/v2/tutos/frog/Nuked-KlaN.txthttp://www.securityfocus.com/bid/10104https://exchange.xforce.ibmcloud.com/vulnerabilities/15843https://exchange.xforce.ibmcloud.com/vulnerabilities/15844
2004-12-31
Published