CVE-2004-2671

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

mod.php in eNdonesia 8.3 allows remote attackers to obtain sensitive information via certain direct requests, and certain requests with invalid parameter values, which reveal the path in various error messages, as demonstrated by the (1) mod and (2) cid parameters.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://echo.or.id/adv/adv02-y3dips-2004.txtExploit, Vendor Advisory
http://secunia.com/advisories/12231Vendor Advisory
http://securitytracker.com/id?1010864Vendor Advisory
http://www.securityfocus.com/archive/1/370855Exploit, Vendor Advisory
http://www.securityfocus.com/bid/8507Exploit, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/13042
http://echo.or.id/adv/adv02-y3dips-2004.txtExploit, Vendor Advisory
http://secunia.com/advisories/12231Vendor Advisory
http://securitytracker.com/id?1010864Vendor Advisory
http://www.securityfocus.com/archive/1/370855Exploit, Vendor Advisory
http://www.securityfocus.com/bid/8507Exploit, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/13042

Timeline

Published: Dec 31, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-26727.5Unspecified vulnerability in ArGoSoft FTP server before 1.4.2.2 allows attackers to upload .lnk files via unknown vectors.CVE-2004-26739.0Multiple buffer overflows in ArGoSoft FTP Server before 1.4.1.6 allow remote authenticated users to cause a denial of service and possibly e CVE-2004-26746.8Directory traversal vulnerability in ArGoSoft FTP Server before 1.4.1.6 allows remote authenticated users to determine the existence of arbi CVE-2004-26756.8ArGoSoft FTP Server before 1.4.1.6 allows remote authenticated users to cause a denial of service (crash) via a SITE PASS command with a lon CVE-2004-26767.2The Spy Sweeper Enterprise Client (SpySweeperTray.exe) in WebRoot Spy Sweeper before 2.0 does not drop privileges when using the help functi CVE-2004-26777.5Format string vulnerability in qwik-smtpd.c in QwikMail SMTP (qwik-smtpd) 0.3 and earlier allows remote attackers to execute arbitrary code CVE-2004-26785.1Unspecified vulnerability in HP Tru64 UNIX 5.1B PK2(BL22) and PK3(BL24), and 5.1A PK6(BL24), when using IPsec/IKE (Internet Key Exchange) wi CVE-2004-26797.8Check Point Firewall-1 4.1 up to NG AI R55 allows remote attackers to obtain potentially sensitive information by sending an Internet Key Ex CVE-2004-26805.0mod_python (libapache2-mod-python) 3.1.4 and earlier does not properly handle when output filters process more than 16384 bytes, which can c CVE-2004-26817.5PeerSec MatrixSSL before 1.1 caches session keys for an indefinitely long time, which might make it easier for remote attackers to hijack a CVE-2004-26825.8PeerSec MatrixSSL before 1.1 does not implement RSA blinding, which allows context-dependent attackers to obtain the server's private key by CVE-2004-26832.1Unspecified vulnerability in the %XML.Utils.SchemaServer class in InterSystems Cache' 5.0 allows attackers to access arbitrary files on a se