CVE-2004-2608

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

SmartWebby Smart Guest Book stores SmartGuestBook.mdb (aka the "news database") under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as the unencrypted username and password of the administrator's account.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published
Dec 31, 2004
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2004

CVE-2004-26092.1The stuffit.com executable on Symantec PowerQuest DeployCenter 5.5 boot disks allows local users to obtain sensitive information (an unencryCVE-2004-26104.6mntd_mount.c in mntd before 0.4.2 might allow local users to gain privileges via shell metacharacters in a remount option in the configuratiCVE-2004-26114.6The Change Permissions function in the Sophster suite before 0.9.6 28 May 2004 (aka 0.9.6-r5), possibly including Sophster, FreeSophster, anCVE-2004-26127.5BNC 2.9.0 only grants access when an incorrect password is provided, which allows remote attackers to use the functionality intended for autCVE-2004-261310.0Unspecified vulnerability in procfs in the Linux-VServer stable branch for the 2.4 kernel before 1.23 and Linux-VServer development branch fCVE-2004-26147.5Buffer overflow in MyWeb 3.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTCVE-2004-26154.6The documentation for CuteNews 1.3.6 and possibly other versions specifies that files under cutenews/data must be manually given world-writaCVE-2004-26164.0The file server in ActivePost Standard 3.1 and earlier allows remote authenticated users to obtain sensitive information by uploading a fileCVE-2004-26175.0Directory traversal vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to read files outside of the web root via a .. (dCVE-2004-26184.3Cross-site scripting (XSS) vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to inject arbitrary web script or HTML viaCVE-2004-26197.5ripMIME 1.3.2.3 and earlier allows remote attackers to bypass e-mail protection via a base64 MIME encoded attachment containing invalid charCVE-2004-26205.0The MIMEH_read_headers function in ripMIME 1.3.1.0 does not properly handle trailing "\r" and "\n" characters in headers, which leads to a b
CVE-2004-2608: Medium severity, CVSS 5.0 | Vulnix