Unscored severity · published Jan 10, 2005
CVE-2004-1106
Cross-site scripting (XSS) vulnerability in Gallery 1.4.4-pl3 and earlier allows remote attackers to execute arbitrary web script or HTML via "specially formed URLs," possibly via…
–
CVSS
1.5%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Gallery 1.4.4-pl3 and earlier allows remote attackers to execute arbitrary web script or HTML via "specially formed URLs," possibly via the include parameter in index.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GA
Gallery · Gallery Project
1.4; 1.4.1; 1.4.2; 1.4.3_pl1; 1.4.3_pl2; 1.4_pl1; +1 more · source: NVD
LI
Linux · Gentoo
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1106
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1106
URL Repurposed
http://g3cko.info/gallery2-4.patch
gallery.menalto.com
http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=142&mode=thread&order=0&thold=0
Patch
http://www.debian.org/security/2005/dsa-642
Patch
http://www.gentoo.org/security/en/glsa/glsa-200411-10.xml
Patch
http://www.securityfocus.com/bid/11602
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/17948
More from Gallery
9.8
CVE-2012-4919
Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability
–
CVE-2006-4030
Unspecified vulnerability in the stats module in Gallery 1.5.1-RC2 and earlier allows remote attackers to obtain sensitive information via unspecified attack vectors, related to…
–
CVE-2006-1696
Cross-site scripting (XSS) vulnerability in Gallery before 1.5.3 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors
–
CVE-2006-1219
Directory traversal vulnerability in Gallery 2.0.3 and earlier, and 2.1 before RC-2a, allows remote attackers to include arbitrary PHP files via ".." (dot dot) sequences in the…
–
CVE-2006-1126
Gallery 2 up to 2.0.2 allows remote attackers to spoof their IP address via a modified X-Forwarded-For (X_FORWARDED_FOR) HTTP header, which is checked by Gallery before other more…