Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas3145▲ 569 respecto a la semana anterior

Críticas / altas1456▲ 54 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 1 respecto a la semana anterior

Sin puntuar (sin CVSS)301▲ 287 respecto a la semana anterior

2265 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2004-2279	Modificada	Media (4.3)	0.95%	—	Invision Power Services Invision Power Board	31/12/2004	16/6/2026	Cross-site scripting (XSS) vulnerability in Invision Power Board 1.3 Final allows remote attackers to execute arbitrary script as other users via the pop parameter in a chat action to index.php.
CVE-2004-2478	Modificada	Alta (7.5)	2.4%	—	CA Unicenter WEB Services Distributed Management IBM Trading Partner Interchange Jetty Http Server	31/12/2004	16/6/2026	Unspecified vulnerability in Jetty HTTP Server, as used in (1) IBM Trading Partner Interchange before 4.2.4, (2) CA Unicenter Web Services Distributed Management (WSDM) before 3.11, and possibly other products, allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
CVE-2004-1578	Modificada	Media (4.3)	1.1%	—	Invision Power Services Invision Power Board	31/12/2004	16/6/2026	Cross-site scripting (XSS) vulnerability in index.php in Invision Power Board 2.0.0 allows remote attackers to execute arbitrary web script or HTML via the Referer field in the HTTP header.
CVE-2004-1531	Modificada	Alta (7.5)	1.3%	💥 Exploit	Invision Power Services Invision Board	31/12/2004	16/6/2026	SQL injection vulnerability in post.php in Invision Power Board (IPB) 2.0.0 through 2.0.2 allows remote attackers to execute arbitrary SQL commands via the qpid parameter.
CVE-2004-1835	Modificada	Alta (7.5)	4.9%	💥 Exploit	Invision Power Services Invision Gallery	31/12/2004	16/6/2026	Multiple SQL injection vulnerabilities in index.php in Invision Gallery 1.0.1 allow remote attackers to execute arbitrary SQL via the (1) img, (2) cat, (3) sort_key, (4) order_key, (5) user, or (6) album parameters.
CVE-2004-2436	Modificada	Baja (2.1)	0.47%	—	Broadcom Common Services Broadcom Unicenter Network AND Systems Management Broadcom Unicenter Serviceplus Service Desk	31/12/2004	16/6/2026	Computer Associates Unicenter Common Services 3.0 and earlier stores the database "SA" password in cleartext in the TndAddNspTmp.bat file, which could allow local users to gain privileges.
CVE-2004-1836	Modificada	Alta (7.5)	4.4%	💥 Exploit	Invision Power Services Invision Power TOP Site List	31/12/2004	16/6/2026	SQL injection vulnerability in index.php in Invision Power Top Site List 1.1 RC 2 and earlier allows remote attackers to execute arbitrary SQL via the id parameter of the comments action.
CVE-2004-0352	Modificada	Media (5)	3.2%	—	Cisco Content Services Switch 11000 Cisco Content Services Switch 11050 Cisco Content Services Switch 11150 Cisco Content Services Switch 11800	23/11/2004	16/6/2026	Cisco 11000 Series Content Services Switches (CSS) running WebNS 5.0(x) before 05.0(04.07)S, and 6.10(x) before 06.10(02.05)S allow remote attackers to cause a denial of service (device reset) via a malformed packet to UDP port 5002.
CVE-2004-0338	Modificada	Alta (10)	2.4%	—	Invision Power Services Invision Board	23/11/2004	16/6/2026	SQL injection vulnerability in search.php for Invision Board Forum allows remote attackers to execute arbitrary SQL queries via the st parameter.
CVE-2004-0112	Modificada	Media (5)	10%	—	Cisco Firewall Services Module HP AAA Server HP Apache-based WEB Server Symantec Clientless VPN Gateway 4400+61	23/11/2004	16/6/2026	El código que une SSL/TLS en OpenSSL 0.9.7a, 0.9.7b y 0.9.7c, usando Kerberos, no comprueba adecuadamente la longitud de los tickets de Kerberos, lo que permite que atacantes remotos provoquen una denegación de servicio.
CVE-2004-0081	Modificada	Media (5)	7.2%	—	Cisco Firewall Services Module HP AAA Server HP Apache-based WEB Server Symantec Clientless VPN Gateway 4400+62	23/11/2004	16/6/2026	OpenSSL 0.9.6 anteriores a la 0.9.6d no manejan adecuadamente los tipos de mensajes desconocidos, lo que permite a atacantes remotos causar una denegación de servicios (por bucle infinito), como se demuestra utilizando la herramienta de testeo Codenomicon TLS.
CVE-2004-0079	Modificada	Alta (7.5)	9.5%	—	Cisco Firewall Services Module HP AAA Server HP Apache-based WEB Server Symantec Clientless VPN Gateway 4400+62	23/11/2004	16/6/2026	La función do_change_cipher_spec en OpenSSL 0.9.6c hasta 0.9.6.k y 0.9.7a hasta 0.9.7c permite que atacantes remotos provoquen una denegación de servicio (caída) mediante una hábil unión SSL/TLS que provoca un puntero nulo.
CVE-2004-0359	Modificada	Media (6.8)	5.6%	—	Invision Power Services Invision Board	23/11/2004	16/6/2026	Cross-site scripting (XSS) vulnerability in index.php for Invision Power Board 1.3 final allows remote attackers to execute arbitrary script as other users via the (1) c, (2) f, (3) showtopic, (4) showuser, or (5) username parameters.
CVE-2004-0355	Modificada	Media (5)	1.7%	—	Invision Power Services Invision Board	23/11/2004	16/6/2026	Invision Power Board 1.3 Final allows remote attackers to gain sensitive information by selecting a file for "Personal Photo" that is not an image file, which displays the installation path in an error message.
CVE-2003-0718	Modificada	Media (5)	88%	💥 Exploit	Microsoft Internet Information Server Microsoft Internet Information Services	3/11/2004	16/6/2026	El Manejador de Mensajes WebDAV de Internet Information Server (IIS) 5.0, 5.1, y 6.0 permite a atacantes remotos causar una denegación de servicio (consumición de memoria y CPU), caída de aplicación mediante un mensaje XML conteniendo elementos XML con un gran número de atributos.
CVE-2003-0905	Modificada	Media (5)	26%	—	Microsoft Windows Media Services	15/4/2004	16/6/2026	Vulnerabilidad desconocida en los componentes Windows Media Station Service y Windows Media Monitor Service de Windows Media Services 4.1 permite a atacantes remotos causar una denegación de servicio (impidiendo nuevas conexiones) mediante ciertas secuencias de paquetes TCP/IP.
CVE-2003-0904	Modificada	Media (6)	8.2%	—	Microsoft Exchange Server Microsoft Sharepoint Services Microsoft Windows Server 2003	20/1/2004	16/6/2026	Microsoft Exchange 2003 y Outlook Web Access (OWA), cuando usan SharePoint Services 2.0, hace que la autenticación Kerberos se desactive para IIS, lo que puede causar que usuarios de OWA vean los buzones de correo de otros usuarios.
CVE-2003-1002	Modificada	Media (5)	1.3%	—	Cisco Catalyst 6500 Cisco Catalyst 6500 Ws-svc-nam-1 Cisco Catalyst 6500 Ws-svc-nam-2 Cisco Catalyst 6500 Ws-x6380-nam+5	5/1/2004	16/6/2026	El Módulo de Servicios de Cortafuegos Cisco (FWSM) en dispositivos de la seria Cisco Cayalyst 6500 y 7600 permite a atacantes remotos causar una denegación de servicio (caída y recarga) mediante SNMPv3 cuando está establecido snmp-server.
CVE-2003-1001	Modificada	Media (5)	1.4%	—	Cisco Catalyst 6500 Cisco Catalyst 6500 Ws-svc-nam-1 Cisco Catalyst 6500 Ws-svc-nam-2 Cisco Catalyst 6500 Ws-x6380-nam+5	5/1/2004	16/6/2026	Desbordamiento de búfer en el Módulo de Servicios de Cortafuegos Cisco (FWSM) en dispositivos de la seria Cisco Cayalyst 6500 y 7600 permiten a atacantes remotos causar una denegación de servicio (caída y recarga) mediante una petición HTTP auth para autenticación TACACS+ o RADIUS.
CVE-2004-1785	Modificada	Alta (7.5)	1.4%	—	Invision Power Services Invision Board	3/1/2004	16/6/2026	SQL injection vulnerability in calendar.php for Invision Power Board 1.3 allows remote attackers to execute arbitrary SQL commands via the m parameter, which sets the $this->chosen_month variable.
CVE-2003-1132	Modificada	Media (5)	2.1%	—	Cisco Content Services Switch 11000 Cisco Content Services Switch 11500	31/12/2003	16/6/2026	The DNS server for Cisco Content Service Switch (CSS) 11000 and 11500, when prompted for a nonexistent AAAA record, responds with response code 3 (NXDOMAIN or "Name Error") instead of response code 0 ("No Error"), which allows remote attackers to cause a denial of service (inaccessible domain) by forcing other DNS…
CVE-2003-1454	Modificada	Media (5)	1.2%	—	Invision Power Services Invision Board	31/12/2003	16/6/2026	Invision Power Services Invision Board 1.0 through 1.1.1, when a forum is password protected, stores the administrator password in a cookie in plaintext, which could allow remote attackers to gain access.
CVE-2003-1385	Modificada	Media (6.8)	4.0%	💥 Exploit	Invision Power Services Invision Power Board	31/12/2003	16/6/2026	ipchat.php in Invision Power Board 1.1.1 allows remote attackers to execute arbitrary PHP code, if register_globals is enabled, by modifying the root_path parameter to reference a URL on a remote web server that contains the code.
CVE-2003-0822	Modificada	Alta (7.5)	83%	💥 Exploit	Microsoft Frontpage Server Extensions Microsoft Sharepoint Team Services Microsoft Windows 2000 Microsoft Windows XP	15/12/2003	16/6/2026	Desbordamiento de búfer en la funcionalidad de depuración en fp30reg.dll de Microsoft FrontPage Server Extensions 2000 y 2002 permite a atacantes remotos ejecutar código mediante una cierta petición en trozos codificada.
CVE-2003-0824	Modificada	Media (5)	37%	—	Microsoft Frontpage Server Extensions Microsoft Sharepoint Team Services Microsoft Windows 2000 Microsoft Windows XP	15/12/2003	16/6/2026	Vulnerabilidad desconocida en el intérprete SmartHTML interpreter (shtml.dll) en Microsoft FrontPage Server Extensions 2000 y 2002, y Microsoft SharePoint Team Services 2002, permite a atacantes remotos causar una denegación de servicio (fallo de respuesta) mediante una cierta petición.