CVE-2004-2651

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in YaCy before 0.32 allow remote attackers to inject arbitrary web script or HTML via the (1) urlmaskfilter parameter to index.html or the (2) page parameter to Wiki.html.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2004-12/0413.htmlExploit, Vendor Advisory
http://securitytracker.com/id?1012686Exploit, Patch
http://www.osvdb.org/12629
http://www.osvdb.org/12630Exploit, Patch
http://www.securityfocus.com/bid/12104Exploit
http://www.yacy.net/yacy/News.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/18688
https://exchange.xforce.ibmcloud.com/vulnerabilities/18690
http://archives.neohapsis.com/archives/bugtraq/2004-12/0413.htmlExploit, Vendor Advisory
http://securitytracker.com/id?1012686Exploit, Patch
http://www.osvdb.org/12629
http://www.osvdb.org/12630Exploit, Patch
http://www.securityfocus.com/bid/12104Exploit
http://www.yacy.net/yacy/News.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/18688
https://exchange.xforce.ibmcloud.com/vulnerabilities/18690

Timeline

Published: Dec 31, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-26527.8The DecodeTCPOptions function in decode.c in Snort before 2.3.0, when printing TCP/IP options using FAST output or verbose mode, allows remo CVE-2004-26537.5Unspecified vulnerability in PD9 Software MegaBBS 2.0 and 2.1 allows attackers to gain privileges via unknown vectors involving (1) admin/us CVE-2004-26545.0The clientAbortBody function in client_side.c in Squid Web Proxy Cache before 2.6 STABLE6 allows remote attackers to cause a denial of servi CVE-2004-26555.4rdesktop 1.3.1 with xscreensaver 4.14, and possibly other versions, when running on Fedora and possibly other platforms, does not release th CVE-2004-26564.3Multiple cross-site scripting (XSS) vulnerabilities in Slashdot Like Automated Storytelling Homepage (Slash) (aka Slashcode) before R_2_5_0_CVE-2004-26571.7Mozilla Firefox 1.5.0.1, and possibly other versions, preserves some records of user activity even after uninstalling, which allows local us CVE-2004-26582.1resmgr in SUSE CORE 9 does not properly identify terminal names, which allows local users to spoof terminals and login types.CVE-2004-26594.0Opera offers an Open button to verify that a user wishes to execute a downloaded file, which allows user-assisted remote attackers to constr CVE-2004-26604.9Memory leak in direct-io.c in Linux kernel 2.6.x before 2.6.10 allows local users to cause a denial of service (memory consumption) via cert CVE-2004-26615.0Soft3304 04WebServer before 1.41 does not properly check file names, which allows remote attackers to obtain sensitive information (CGI sour CVE-2004-26625.0Soft3304 04WebServer before 1.41 allows remote attackers to cause a denial of service (resource consumption or crash) via certain data relat CVE-2004-26637.5The (1) SetDebugging and (2) RunEgatherer methods in IBM Access Support eGatherer ActiveX control 2.0.0.16 allow remote attackers to create