CVE-2004-1059

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in mnoGoSearch 3.2.26 and earlier allow remote attackers to inject arbitrary HTML and web script via the (1) next and (2) prev result search pages, and the (3) extended and (4) simple search forms.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.grok.org.uk/pipermail/full-disclosure/2004-December/030222.htmlPatch, Vendor Advisory
http://www.mikx.de/index.php?p=6Patch, Vendor Advisory
http://www.mnogosearch.org/history.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/11895Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/18434
http://lists.grok.org.uk/pipermail/full-disclosure/2004-December/030222.htmlPatch, Vendor Advisory
http://www.mikx.de/index.php?p=6Patch, Vendor Advisory
http://www.mnogosearch.org/history.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/11895Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/18434

Timeline

Published: Dec 10, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-10605.0Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service CVE-2004-10614.3Cross-site scripting (XSS) vulnerability in Bugzilla before 2.18, including 2.16.x before 2.16.11, allows remote attackers to inject arbitra CVE-2004-10624.3Multiple cross-site scripting (XSS) vulnerabilities in ViewCVS 0.9.2 allow remote attackers to inject arbitrary HTML and web script via cert CVE-2004-106310.0PHP 4.x to 4.3.9, and PHP 5.x to 5.0.2, when running in safe mode on a multithreaded Unix webserver, allows local users to bypass safe_mode_CVE-2004-106410.0The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which CVE-2004-106510.0Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary cod CVE-2004-10663.6The cmdline pseudofiles in (1) procfs on FreeBSD 4.8 through 5.3, and (2) linprocfs on FreeBSD 5.x through 5.3, do not properly validate a p CVE-2004-106710.0Off-by-one error in the mysasl_canon_user function in Cyrus IMAP Server 2.2.9 and earlier leads to a buffer overflow, which may allow remote CVE-2004-10686.2A "missing serialization" error in the unix_dgram_recvmsg function in Linux 2.4.27 and earlier, and 2.6.x up to 2.6.9, allows local users to CVE-2004-10691.2Race condition in SELinux 2.6.x through 2.6.9 allows local users to cause a denial of service (kernel crash) via SOCK_SEQPACKET unix domain CVE-2004-10707.2The load_elf_binary function in the binfmt_elf loader (binfmt_elf.c) in Linux kernel 2.4.x up to 2.4.27, and 2.6.x up to 2.6.8, does not pro CVE-2004-10717.2The binfmt_elf loader (binfmt_elf.c) in Linux kernel 2.4.x up to 2.4.27, and 2.6.x up to 2.6.8, does not properly handle a failed call to th