CVE-2004-1700

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in SettingsBase.php in Pinnacle ShowCenter 1.51 build 121 allows remote attackers to inject arbitrary HTML or web script via the Skin parameter, which is echoed in an error message.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Oct 14, 2004
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2004

CVE-2004-170110.0Heap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers to executCVE-2004-17025.0The AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 does not properly check the return value of the ReceiveTransactCVE-2004-17038.8Fusion News 3.6.1 allows remote attackers to add user accounts, if the administrator is logged in, via a comment that contains an img bbcodeCVE-2004-17047.5WpQuiz 2.60b1 through 2.60b8 allows remote attackers to gain privileges via a direct request to adminrestore.php in the extras directory.CVE-2004-17055.0Buffer overflow in Citadel/UX 6.23 and earlier allows remote attackers to cause a denial of service via a long username.CVE-2004-17067.5The U.S. Robotics USR808054 wireless access point allows remote attackers to cause a denial of service (device crash) and possibly execute aCVE-2004-17077.2The (1) dbsnmp and (2) nmo programs in Oracle 8i, Oracle 9i, and Oracle IAS 9.0.2.0.1, on Unix systems, use a default path to find and execuCVE-2004-17085.0Webbsyte Chat 0.9.0 allows remote attackers to cause a denial of service (crash) via a large number of connections.CVE-2004-17092.1Datakey Rainbow iKey2032 USB token, when using the CIP client package, does not encrypt communications between the token and the driver, whiCVE-2004-17107.5page.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the url parameter.CVE-2004-17114.3Cross-site scripting (XSS) vulnerability in post.php in Moodle before 1.3 allows remote attackers to inject arbitrary web script or HTML viaCVE-2004-17124.3Cross-site scripting (XSS) vulnerability in TypePad allows remote attackers to inject arbitrary Javascript via the name parameter.
CVE-2004-1700: Medium severity, CVSS 4.3 | Vulnix