CVE-2004-1441

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in icq.cgi in Board Power 2.04PF allows remote attackers to inject arbitrary web script or HTML via the action parameter.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/fulldisclosure/2004-07/0642.htmlExploit
http://www.kb.cert.org/vuls/id/744590US Government Resource
http://www.securityfocus.com/bid/10734Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/16698
http://archives.neohapsis.com/archives/fulldisclosure/2004-07/0642.htmlExploit
http://www.kb.cert.org/vuls/id/744590US Government Resource
http://www.securityfocus.com/bid/10734Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/16698

Timeline

Published: Dec 31, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-14424.3Cross-site scripting (XSS) vulnerability in db2www CGI interpreter in IBM Net.Data 7 and 7.2 allows remote attackers to inject arbitrary web CVE-2004-14434.3Cross-site scripting (XSS) vulnerability in the inline MIME viewer in Horde-IMP (Internet Messaging Program) 3.2.4 and earlier, when used wi CVE-2004-14445.0Directory traversal vulnerability in Roundup 0.6.4 and earlier allows remote attackers to view arbitrary files via .. (dot dot) sequences in CVE-2004-14453.7A race condition in nessus-adduser in Nessus 2.0.11 and possibly earlier versions, if the TMPDIR environment variable is not set, allows loc CVE-2004-14465.0Unknown vulnerability in ScreenOS in Juniper Networks NetScreen firewall 3.x through 5.x allows remote attackers to cause a denial of servic CVE-2004-14475.0Jetbox One 2.0.8 and possibly other versions stores passwords in the database in plaintext, which could allow attackers to gain sensitive in CVE-2004-14484.6Jetbox One 2.0.8 and possibly other versions allow remote attackers with Author privileges in the IMAGES module to upload PHP files and exec CVE-2004-14492.6Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7 allows remote attackers to determine the location of files on a user's ha CVE-2004-14505.0Unknown vulnerability in LiveConnect in Mozilla 1.7 beta allows remote attackers to read arbitrary files in known locations.CVE-2004-14512.6Mozilla before 1.6 does not display the entire URL in the status bar when a link contains %00, which could allow remote attackers to trick u CVE-2004-14527.2Tomcat before 5.0.27-r3 in Gentoo Linux sets the default permissions on the init scripts as tomcat:tomcat, but executes the scripts with roo CVE-2004-14532.1GNU glibc 2.3.4 before 2.3.4.20040619, 2.3.3 before 2.3.3.20040420, and 2.3.2 before 2.3.2-r10 does not restrict the use of LD_DEBUG for a s