CVE-2004-2608

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

SmartWebby Smart Guest Book stores SmartGuestBook.mdb (aka the "news database") under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as the unencrypted username and password of the administrator's account.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/12401Vendor Advisory
http://securitytracker.com/id?1011084Exploit
http://www.osvdb.org/9363Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/17146
http://secunia.com/advisories/12401Vendor Advisory
http://securitytracker.com/id?1011084Exploit
http://www.osvdb.org/9363Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/17146

Timeline

Published: Dec 31, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-26092.1The stuffit.com executable on Symantec PowerQuest DeployCenter 5.5 boot disks allows local users to obtain sensitive information (an unencry CVE-2004-26104.6mntd_mount.c in mntd before 0.4.2 might allow local users to gain privileges via shell metacharacters in a remount option in the configurati CVE-2004-26114.6The Change Permissions function in the Sophster suite before 0.9.6 28 May 2004 (aka 0.9.6-r5), possibly including Sophster, FreeSophster, an CVE-2004-26127.5BNC 2.9.0 only grants access when an incorrect password is provided, which allows remote attackers to use the functionality intended for aut CVE-2004-261310.0Unspecified vulnerability in procfs in the Linux-VServer stable branch for the 2.4 kernel before 1.23 and Linux-VServer development branch f CVE-2004-26147.5Buffer overflow in MyWeb 3.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTT CVE-2004-26154.6The documentation for CuteNews 1.3.6 and possibly other versions specifies that files under cutenews/data must be manually given world-writa CVE-2004-26164.0The file server in ActivePost Standard 3.1 and earlier allows remote authenticated users to obtain sensitive information by uploading a file CVE-2004-26175.0Directory traversal vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to read files outside of the web root via a .. (d CVE-2004-26184.3Cross-site scripting (XSS) vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to inject arbitrary web script or HTML via CVE-2004-26197.5ripMIME 1.3.2.3 and earlier allows remote attackers to bypass e-mail protection via a base64 MIME encoded attachment containing invalid char CVE-2004-26205.0The MIMEH_read_headers function in ripMIME 1.3.1.0 does not properly handle trailing "\r" and "\n" characters in headers, which leads to a b