CVSS: 5.0EPSS: 7%CPEs: 5EXPL: 1CVE-2004-2124 – Gallery 1.3.x/1.4 - Remote Global Variable Injection
https://notcve.org/view.php?id=CVE-2004-2124
The register_globals simulation capability in Gallery 1.3.1 through 1.4.1 allows remote attackers to modify the HTTP_POST_VARS variable and conduct a PHP remote file inclusion attack via the GALLERY_BASEDIR parameter, a different vulnerability than CVE-2002-1412. • https://www.exploit-db.com/exploits/23599 http://gallery.menalto.com/modules.php?op=modload&name=News&file=index http://marc.info/?l=bugtraq&m=107524414317693&w=2 http://secunia.com/advisories/10712 http://www.gentoo.org/security/en/glsa/glsa-200402-04.xml http://www.osvdb.org/3737 http://www.securityfocus.com/bid/9490 https://exchange.xforce.ibmcloud.com/vulnerabilities/14950 •
CVSS: 7.5EPSS: 10%CPEs: 1EXPL: 3CVE-2004-1466 – Gallery 1.4.4 - Remote Server-Side Script Execution
https://notcve.org/view.php?id=CVE-2004-1466
The set_time_limit function in Gallery before 1.4.4_p2 deletes non-image files in a temporary directory every 30 seconds after they have been uploaded using save_photos.php, which allows remote attackers to upload and execute execute arbitrary scripts before they are deleted, if the temporary directory is under the web root. • https://www.exploit-db.com/exploits/24383 http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0757.html http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=134&mode=thread&order=0&thold=0 http://www.gentoo.org/security/en/glsa/glsa-200409-05.xml http://www.securityfocus.com/bid/10968 https://exchange.xforce.ibmcloud.com/vulnerabilities/17021 •
CVSS: 6.8EPSS: 4%CPEs: 8EXPL: 0CVE-2004-1106
https://notcve.org/view.php?id=CVE-2004-1106
Cross-site scripting (XSS) vulnerability in Gallery 1.4.4-pl3 and earlier allows remote attackers to execute arbitrary web script or HTML via "specially formed URLs," possibly via the include parameter in index.php. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Gallery 1.4.4-pl3 y anteriores permite a atacantes remotos ejecutar script web o HTML de su elección mediante "URL s especialmente malformadas", posiblemente mediante un parámetro include en index.php • http://g3cko.info/gallery2-4.patch http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=142&mode=thread&order=0&thold=0 http://www.debian.org/security/2005/dsa-642 http://www.gentoo.org/security/en/glsa/glsa-200411-10.xml http://www.securityfocus.com/bid/11602 https://exchange.xforce.ibmcloud.com/vulnerabilities/17948 •
CVSS: 10.0EPSS: 0%CPEs: 18EXPL: 0CVE-2004-0522
https://notcve.org/view.php?id=CVE-2004-0522
Gallery 1.4.3 and earlier allows remote attackers to bypass authentication and obtain Gallery administrator privileges. Gallery 1.4.3 y anteriores permite a atacantes remotos saltarse la autenticación y obtener privilegios de administrador de Gallery. • http://secunia.com/advisories/11752 http://security.gentoo.org/glsa/glsa-200406-10.xml http://www.debian.org/security/2004/dsa-512 http://www.securityfocus.com/bid/10451 https://exchange.xforce.ibmcloud.com/vulnerabilities/16301 •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 1CVE-2003-1428
https://notcve.org/view.php?id=CVE-2003-1428
Gallery 1.3.3 creates directories with insecure permissions, which allows local users to read, modify, or delete photos. • http://www.securityfocus.com/archive/1/311161 http://www.securityfocus.com/bid/6809 https://exchange.xforce.ibmcloud.com/vulnerabilities/11284 •