Uncategorized CVEs — 2005 (Page 34/38)

CVEs without a recognized CWE (not present in the CWE map or marked as N/A).

CVSS ≥ 0.0

2005-04-13

High

CVE-2005-1149

SQL injection vulnerability in admin/login.asp in aspclick.it ACNews 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.

CVSS: 7.5CWE: N/A

Low

CVE-2005-1301

nProtect:Netizen 2005.3.17.1 does not properly verify that the update module is downloaded from an authorized site, which allows remote malicious web sites to write arbitrary files.

CVSS: 2.6CWE: N/A

High

CVE-2005-1134

SQL injection vulnerability in exit.php for Serendipity 0.8 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) url_id or (2) entry_id parameters.

CVSS: 7.5CWE: N/A

2005-04-12

Critical

CVE-2005-1099

Multiple buffer overflows in the HandleChild function in server.c in Greylisting daemon (GLD) 1.3 and 1.4, when GLD is listening on a network interface, allow remote attackers to execute arbitrary co…

CVSS: 10.0CWE: N/A

Medium

CVE-2005-1147

calendar.pl in CalendarScript 3.20 allows remote attackers to obtain sensitive information via invalid (1) calendar or (2) template parameters, which leaks the full pathname and debug information.

CVSS: 5.0CWE: N/A

Medium

CVE-2005-1146

NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in the login command in calendar.pl in CalendarScript 3.21 allows remote attackers to inject arbitrary web…

CVSS: 4.3CWE: N/A

Medium

CVE-2005-1145

NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in calendar.pl in CalendarScript 3.20 allows remote attackers to inject arbitrary web script or HTML via th…

CVSS: 4.3CWE: N/A

Medium

CVE-2005-1144

popup.php in EasyPHPCalendar before 6.2.8 allows remote attackers to obtain sensitive information via an invalid ev parameter, which reveals the full pathname of the web server in a PHP error message.

CVSS: 5.0CWE: N/A

Medium

CVE-2005-1143

Cross-site scripting (XSS) vulnerability in index.php in EasyPHPCalendar before 6.2.8 allows remote attackers to inject arbitrary web script or HTML via the yr parameter.

CVSS: 4.3CWE: N/A

Medium

CVE-2005-1130

Cross-site scripting (XSS) vulnerability in index.php in Pinnacle Cart allows remote attackers to inject arbitrary web script or HTML via the pg parameter.

CVSS: 4.3CWE: N/A

Medium

CVE-2005-1103

Sygate Security Agent (SSA) in Sygate Secure Enterprise 3.5 through 4.1 does not prevent the security policy from being updated by unprivileged users, which allows local users to modify the policy by…

CVSS: 4.6CWE: N/A

High

CVE-2005-1071

SQL injection vulnerability in banner.inc.php in JPortal Web Portal 2.3.1 allows remote attackers to execute arbitrary SQL commands via the haslo parameter.

CVSS: 7.5CWE: N/A

High

CVE-2005-1078

XAMPP 1.4.x has multiple default or null passwords, which allows attackers to gain privileges.

CVSS: 7.5CWE: N/A

Medium

CVE-2005-1077

Multiple cross-site scripting (XSS) vulnerabilities in XAMPP 1.4.x allow remote attackers to inject arbitrary web script or HTML via (1) cds.php, (2) Guestbook-EN.pl, or (3) phonebook.php.

CVSS: 4.3CWE: N/A

High

CVE-2005-0610

Multiple symlink vulnerabilities in portupgrade before 20041226_2 in FreeBSD allow local users to (1) overwrite arbitrary files and possibly replace packages to execute arbitrary code via pkg_fetch,…

CVSS: 7.2CWE: N/A

High

CVE-2005-0562

GIF file validation error in MSN Messenger 6.2 allows remote attackers in a user's contact list to execute arbitrary code via a GIF image with an improper height and width.

CVSS: 7.5CWE: N/A

High

CVE-2005-0555

Buffer overflow in the Content Advisor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a crafted Content Advisor file, aka "Content Advisor Memor…

CVSS: 7.5CWE: N/A

Medium

CVE-2004-0791

Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via a blind throughput-reduction attack using spoofed S…

CVSS: 5.0CWE: N/A

Medium

CVE-2004-0790

Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages, aka the "blind connection-reset attack." NOTE: C…

CVSS: 5.0CWE: N/A

2005-04-11

High

CVE-2005-1070

SQL injection vulnerability in index.php in Invision Power Board 1.3.1 Final and earlier allows remote attackers to execute arbitrary SQL commands via the st parameter.

CVSS: 7.5CWE: N/A

Medium

CVE-2005-1089

Unknown vulnerability in DC++ before 0.674 allows attackers to append data to arbitrary files.

CVSS: 5.0CWE: N/A

2005-04-10

High

CVE-2005-1055

TowerBlog 0.6 and earlier stores the login data file under the web root, which allows remote attackers to obtain the MD5 checksums of the username and password via a direct request to the _dat/login…

CVSS: 7.5CWE: N/A

Medium

CVE-2005-1064

The copy_symlink function in rsnapshot 1.2.0 and 1.1.x before 1.1.7 changes the ownership of files that a symlink points to rather than the symlink itself, which allows local users to obtain access t…

CVSS: 4.6CWE: N/A

2005-04-09

High

CVE-2005-1082

Multiple SQL injection vulnerabilities in AzDGDatingPlatinum 1.1.0 allows remote attackers to execute arbitrary SQL commands via (1) the id parameter to view.php or (2) the from parameter to members/…

CVSS: 7.5CWE: N/A

2005-04-08

High

CVE-2005-1067

Vulnerability in Access_user Class before 1.75 allows local users to gain access as other users via the password "new".

CVSS: 7.5CWE: N/A

Medium

CVE-2005-1072

Cross-site scripting (XSS) vulnerability in PunBB before 1.2.5 allows remote attackers to inject arbitrary web script or HTML.

CVSS: 4.3CWE: N/A

Medium

CVE-2005-1094

FTP Now 2.6.14 stores usernames and passwords in plaintext in sites.xml, which is world-readable, which allows local users to gain privileges.

CVSS: 4.6CWE: N/A

2005-04-07

Medium

CVE-2005-1087

CRLF injection vulnerability in the cmdIS.DLL plugin for AN HTTPD Server 1.42n allows remote attackers to spoof or hide entries in the logfile, and possibly read files using an injected type command,…

CVSS: 6.4CWE: N/A

High

CVE-2005-1047

Meilad File upload script (up.php) mod for phpBB 2.0.x does not properly limit the types of files that can be uploaded, which allows remote authenticated users to execute arbitrary commands by upload…

CVSS: 7.5CWE: N/A

2005-04-06

High

CVE-2005-1096

SQL injection vulnerability in main.asp for Ocean12 Membership Manager Pro 1.x allows remote attackers to execute arbitrary SQL commands via the UserID parameter.

CVSS: 7.5CWE: N/A

High

CVE-2005-1029

Multiple SQL injection vulnerabilities in Active Auction House allow remote attackers to execute arbitrary SQL commands via the (1) catid, (2) SortDir, or (3) Sortby parameter to default.asp, (4) ite…

CVSS: 7.5CWE: N/A

2005-04-05

High

CVE-2005-1035

Multiple buffer overflows in Pavuk before 0.9.32 have unknown attack vectors and impact.

CVSS: 7.5CWE: N/A

2005-04-01

High

CVE-2005-0749

The load_elf_library in the Linux kernel before 2.6.11.6 allows local users to cause a denial of service (kernel crash) via a crafted ELF library or executable, which causes a free of an invalid poin…

CVSS: 7.2CWE: N/A

2005-03-31

High

CVE-2005-0957

Bay Technical Associates RPC-3 Telnet Host 3.05 allows remote attackers to bypass authentication by pressing the escape and enter keys at the username prompt.

CVSS: 7.5CWE: N/A

2005-03-30

Medium

CVE-2005-0487

Cross-site scripting (XSS) vulnerability in index.php for Kayako ESupport 2.3.1, and possibly other versions, allows remote attackers to inject arbitrary HTML and web script via the nav parameter.

CVSS: 6.8CWE: N/A

Medium

CVE-2005-0481

TrackerCam 5.12 and earlier allows remote attackers to read log files via the fn parameter in a direct request to the ComGetLogFile.php3 script.

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0943

Cisco VPN 3000 series Concentrator running firmware 4.1.7.A and earlier allows remote attackers to cause a denial of service (device reload or drop user connection) via a crafted HTTPS packet.

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0486

Tarantella Secure Global Desktop Enterprise Edition 4.00 and 3.42, and Tarantella Enterprise 3 3.40 and 3.30, when using RSA SecurID and multiple users have the same username, reveals sensitive infor…

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0483

Multiple directory traversal vulnerabilities in sitenfo.sh, sitezipchk.sh, and siteziplist.sh in Glftpd 1.26 to 2.00 allow remote authenticated users to (1) determine the existence of arbitrary files…

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0482

TrackerCam 5.12 and earlier allows remote attackers to cause a denial of service (crash) via (1) a large number of connections with a negative Content-Length header, possibly triggering an integer si…

CVSS: 5.0CWE: N/A

High

CVE-2005-0484

Format string vulnerability in gprostats for GProFTPD before 8.1.9 may allow remote attackers to execute arbitrary code via an FTP transfer with a crafted filename that causes format string specifier…

CVSS: 7.5CWE: N/A

Medium

CVE-2005-0480

Cross-site scripting (XSS) vulnerability in TrackerCam 5.12 and earlier allows remote attackers to inject arbitrary HTML or web script via the login request, which is recorded in a log file but not p…

CVSS: 4.3CWE: N/A

Medium

CVE-2005-0478

Multiple buffer overflows in TrackerCam 5.12 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) an HTTP request with a long User-Agent header…

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0476

Cross-site scripting (XSS) vulnerability in hpm_guestbook.cgi allows remote attackers to inject arbitrary web script or HTML by posting a message.

CVSS: 4.3CWE: N/A

Medium

CVE-2005-0475

SQL injection vulnerability in paFAQ Beta4, and possibly other versions, allows remote attackers to execute arbitrary SQL code via the (1) offset, (2) limit, (3) order, or (4) orderby parameter to qu…

CVSS: 6.4CWE: N/A

Medium

CVE-2005-0474

SQL injection vulnerability in the user_valid_crypt function in user.php in WebCalendar 0.9.45 allows remote attackers to execute arbitrary SQL commands via an encoded webcalendar_session cookie.

CVSS: 6.4CWE: N/A

Medium

CVE-2005-0479

Directory traversal vulnerability in ComGetLogFile.php3 for TrackerCam 5.12 and earlier allows remote attackers to read arbitrary files via ".." sequences and (1) "/" slash), (2) "\" (backslash), or…

CVSS: 5.0CWE: N/A

2005-03-29

High

CVE-2005-0931

PHP remote file inclusion vulnerability in The Includer 1.0 and 1.1 allows remote attackers to execute arbitrary PHP code.

CVSS: 7.5CWE: N/A

High

CVE-2005-0946

SQL injection vulnerability in phpCoin 1.2.1b and earlier allows remote attackers to execute arbitrary SQL commands via the (1) term/keywords field on the search page, (2) username or (3) e-mail fiel…

CVSS: 7.5CWE: N/A

Medium

CVE-2005-0950

Directory traversal vulnerability in FastStone 4in1 Browser 1.2 allows remote attackers to read arbitrary files via a (1) ... (triple dot) or (2) ..\ (dot dot backslash) in the URL.

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0924

Cross-site scripting (XSS) vulnerability in Adventia E-Data 2.0 allows remote attackers to inject arbitrary web script or HTML via a query keyword.

CVSS: 4.3CWE: N/A

Medium

CVE-2005-0919

Adventia Chat 3.1 and Server Pro 3.0 allows remote attackers to inject arbitrary web script or HTML into the chat space, which leaves other users vulnerable to cross-site scripting (XSS) attacks.

CVSS: 4.3CWE: N/A

2005-03-28

Critical

CVE-2005-0892

Buffer overflow in smail 3.2.0.120 allows remote attackers or local users to execute arbitrary code via a long string in the MAIL FROM command and possibly other SMTP commands.

CVSS: 10.0CWE: N/A

Medium

CVE-2005-0908

Multiple cross-site scripting (XSS) vulnerabilities in Valdersoft Shopping Cart 3.0 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter to index.php or (2) the se…

CVSS: 4.3CWE: N/A

High

CVE-2005-0911

Multiple SQL injection vulnerabilities in exoops may allow remote attackers to execute arbitrary SQL commands via (1) the viewcat parameter to index.php or (2) the artid parameter in the viewarticle…

CVSS: 7.5CWE: N/A

2005-03-27

High

CVE-2005-0750

The bluez_sock_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges via (1) socket or (2) socketpair call wi…

CVSS: 7.2CWE: N/A

2005-03-26

Medium

CVE-2005-0898

Cross-site scripting (XSS) vulnerability in downloadform.php in E-Store Kit-2 PayPal Edition allows remote attackers to inject arbitrary web script or HTML via the txn_id parameter.

CVSS: 4.3CWE: N/A

Medium

CVE-2005-0900

marks.php in NukeBookmarks 0.6 for PHP-Nuke allows remote attackers to obtain sensitive information via an invalid (1) file or (2) category parameter, which reveal the path in an error message.

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0914

Multiple cross-site scripting (XSS) vulnerabilities in CPG Dragonfly 9.0.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) the profile parameter to index.php or (2) the cat pa…

CVSS: 4.3CWE: N/A

2005-03-25

Low

CVE-2005-0585

Firefox before 1.0.1 and Mozilla before 1.7.6 truncates long sub-domains or paths for display, which may allow remote malicious web sites to spoof legitimate sites and facilitate phishing attacks.

CVSS: 2.6CWE: N/A

High

CVE-2005-0592

Heap-based buffer overflow in the UTF8ToNewUnicode function for Firefox before 1.0.1 and Mozilla before 1.7.6 might allow remote attackers to cause a denial of service (crash) or execute arbitrary co…

CVSS: 7.5CWE: N/A

2005-03-24

Medium

CVE-2005-0889

Cross-site scripting (XSS) vulnerability in index.php for Dream4 Koobi CMS 4.2.3 allows remote attackers to inject arbitrary web script or HTML via the area parameter.

CVSS: 4.3CWE: N/A

High

CVE-2005-0912

Unknown vulnerabilities in deplate before 0.7.2 have unknown impact, possibly involving elements.rb.

CVSS: 7.5CWE: N/A

High

CVE-2005-0887

Eval injection vulnerability in Double Choco Latte before 0.9.4.3 allows remote attackers to execute arbitrary PHP code via the menuAction variable in (1) functions.inc.php or (2) main.php, which cau…

CVSS: 7.5CWE: N/A

2005-03-23

Medium

CVE-2005-0759

ImageMagick before 6.0 allows remote attackers to cause a denial of service (application crash) via a TIFF image with an invalid tag.

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0761

Unknown vulnerability in ImageMagick before 6.1.8 allows remote attackers to cause a denial of service (application crash) via a crafted PSD file.

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0878

Cross-site scripting (XSS) vulnerability in MercuryBoard before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the title field of a PM (private message).

CVSS: 4.3CWE: N/A

Medium

CVE-2005-0881

Cross-site scripting (XSS) vulnerability in articles.newcomment for Interspire ArticleLive 2005 allows remote attackers to inject arbitrary web script or HTML via the Articleld parameter.

CVSS: 4.3CWE: N/A

Medium

CVE-2005-0883

Multiple cross-site scripting (XSS) vulnerabilities in base.php for DigitalHive 2.0 allow remote attackers to inject arbitrary web script or HTML via (1) the mt parameter to the membres.php page or (…

CVSS: 4.3CWE: N/A

Low

CVE-2005-0143

Firefox before 1.0 and Mozilla before 1.7.5 display the SSL lock icon when an insecure page loads a binary file from a trusted site, which could facilitate phishing attacks.

CVSS: 2.6CWE: N/A

2005-03-21

Medium

CVE-2005-0713

The Bluetooth Setup Assistant for Mac OS X before 10.3.8 can be launched without a keyboard or Bluetooth device, which allows local users to bypass access restrictions and gain privileges.

CVSS: 4.6CWE: N/A

Low

CVE-2005-0715

AFP Server in Mac OS X before 10.3.8 uses insecure permissions for "Drop Boxes," which allows local users to read the contents of a Drop Box.

CVSS: 2.1CWE: N/A

High

CVE-2005-0716

Stack-based buffer overflow in the Core Foundation Library in Mac OS X 10.3.5 and 10.3.6, and possibly earlier versions, allows local users to execute arbitrary code via a long CF_CHARSET_PATH enviro…

CVSS: 7.2CWE: N/A

2005-03-16

High

CVE-2005-0352

Servers Alive 4.1 and 5.0, when running as a service, does not drop SYSTEM privileges before loading local manual under the help menu, which allows local users to gain privileges.

CVSS: 7.2CWE: N/A

2005-03-15

Medium

CVE-2005-0794

ZPanel 2.0 and 2.5 beta 10 does not remove or protect installation scripts after they have been used, which allows remote attackers to reinstall the software and possibly cause a denial of service vi…

CVSS: 6.4CWE: N/A

Medium

CVE-2005-0799

MySQL 4.1.9, and possibly earlier versions, allows remote attackers with certain privileges to cause a denial of service (application crash) via a use command followed by an MS-DOS device name such a…

CVSS: 5.0CWE: N/A

High

CVE-2005-0798

Novell iChain Mini FTP Server 2.3, and possibly earlier versions, does not limit the number of incorrect logins, which makes it easier for remote attackers to conduct brute force login attacks.

CVSS: 7.5CWE: N/A

High

CVE-2005-0792

SQL injection vulnerability in ZPanel 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) uname parameter to index.php or (2) page parameter to zpanel.php.

CVSS: 7.5CWE: N/A

High

CVE-2005-0793

PHP remote file inclusion vulnerability in zpanel.php in ZPanel allows remote attackers to (1) execute arbitrary PHP code in ZPanel 2.0 or (2) include local files in ZPanel 2.5 beta 10 and earlier by…

CVSS: 7.5CWE: N/A

Medium

CVE-2005-0767

Race condition in the Radeon DRI driver for Linux kernel 2.6.8.1 allows local users with DRI privileges to execute arbitrary code as root.

CVSS: 6.9CWE: N/A

Medium

CVE-2005-0384

Unknown vulnerability in the PPP driver for the Linux kernel 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) via a pppd client.

CVSS: 5.0CWE: N/A

2005-03-14

Medium

CVE-2005-0507

Directory traversal vulnerability in SD Server 4.0.70 and earlier allows remote attackers to read arbitrary files via .. sequences in an HTTP request.

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0795

HolaCMS 1.4.9 does not restrict file access to the holaDB/votes directory, which allows remote attackers to overwrite arbitrary files via a modified vote_filename parameter.

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0791

Cross-site scripting (XSS) vulnerability in adframe.php in phpAdsNew 2.0.4-pr1, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the refresh parame…

CVSS: 4.3CWE: N/A

Medium

CVE-2005-0790

phpAdsNew 2.0.4 allows remote attackers to obtain sensitive information via a direct request to (1) lib-xmlrpcs.inc.php, (2) maintenance-activation.php, (3) maintenance-cleantables.php, (4) maintenan…

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0789

Directory traversal vulnerability in LimeWire 3.9.6 through 4.6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in a magnet request.

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0788

LimeWire 4.1.2 through 4.5.6 allows remote attackers to read arbitrary files by specifying the full pathname in a Gnutella GET request.

CVSS: 5.0CWE: N/A

Low

CVE-2005-0510

The daemon for fallback-reboot before 0.995 allows attackers to cause a denial of service (daemon exit), possibly related to verbose debug messages when the daemon is not on a tty.

CVSS: 2.1CWE: N/A

Medium

CVE-2005-0509

Multiple cross-site scripting (XSS) vulnerabilities in the Mono 1.0.5 implementation of ASP.NET (.Net) allow remote attackers to inject arbitrary HTML or web script via Unicode representations for AS…

CVSS: 4.3CWE: N/A

Medium

CVE-2005-0508

Unknown vulnerability in Squiggle for Batik before 1.5.1 allows attackers to bypass certain access controls via certain features of the Rhino scripting engine due to a "script security issue."

CVSS: 4.6CWE: N/A

High

CVE-2005-0786

SQL injection vulnerability in gb_new.inc in SimpGB allows remote attackers to execute arbitrary SQL commands via the quote parameter to guestbook.php.

CVSS: 7.5CWE: N/A

Medium

CVE-2005-0506

The Avaya IP Office Phone Manager, and other products such as the IP Softphone, stores sensitive data in cleartext in a registry key, which allows local and possibly remote users to steal usernames a…

CVSS: 5.0CWE: N/A

High

CVE-2005-0505

Unknown vulnerability in Information Resource Manager (IRM) before 1.5.2.1 allows remote attackers to have "potentially serious" impact, related to LDAP logins.

CVSS: 7.5CWE: N/A

Medium

CVE-2005-0473

The HTML parsing functions in Gaim before 1.1.3 allow remote attackers to cause a denial of service (application crash) via malformed HTML that causes "an invalid memory access," a different vulnerab…

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0258

Directory traversal vulnerability in (1) usercp_register.php and (2) usercp_avatar.php for phpBB 2.0.11, and possibly other versions, with gallery avatars enabled, allows remote attackers to delete (…

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0472

Gaim before 1.1.3 allows remote attackers to cause a denial of service (infinite loop) via malformed SNAC packets from (1) AIM or (2) ICQ.

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0471

Sun Java JRE 1.1.x through 1.4.x writes temporary files with long filenames that become predictable on a file system that uses 8.3 style short names, which allows remote attackers to write arbitrary…

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0470

Buffer overflow in wpa_supplicant before 0.2.7 allows remote attackers to cause a denial of service (segmentation fault) via invalid EAPOL-Key packet data.

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0398

The KAME racoon daemon in ipsec-tools before 0.5 allows remote attackers to cause a denial of service (crash) via malformed ISAKMP packets.

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0259

phpBB 2.0.11, and possibly other versions, with remote avatars and avatar uploading enabled, allows local users to read arbitrary files by providing both a local and remote location for an avatar, th…

CVSS: 6.4CWE: N/A

2005-03-12

Medium

CVE-2005-0780

paFileDB 3.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) auth.php, (2) login.php, (3) category.php, (4) file.php, (5) team.php, (6) license.php, (7…

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0765

Unknown vulnerability in the JXTA dissector in Ethereal 0.10.9 allows remote attackers to cause a denial of service (application crash).

CVSS: 5.0CWE: N/A

2005-03-10

Medium

CVE-2005-0731

PY Software Active Webcam WebServer (webcam.exe) 5.5 allows remote attackers to cause a denial of service (CPU consumption) via a direct request to Filelist.html.

CVSS: 5.0CWE: N/A

High

CVE-2005-0774

SQL injection vulnerability in member.php and possibly other scripts in PhotoPost PHP 5.0 RC3 allows remote attackers to execute arbitrary SQL commands via the uid parameter.

CVSS: 7.5CWE: N/A

2005-03-09

Low

CVE-2005-0719

Unknown vulnerability in the systems message queue in HP Tru64 Unix 4.0F PK8 through 5.1B-2/PK4 allows local users to cause a denial of service (process crash) for processes such as nfsstat, pfstat,…

CVSS: 2.1CWE: N/A

Low

CVE-2005-0736

Integer overflow in sys_epoll_wait in eventpoll.c for Linux kernel 2.6 to 2.6.11 allows local users to overwrite kernel memory via a large number of events.

CVSS: 2.1CWE: N/A

Medium

CVE-2005-0745

UTStarcom iAN-02EX VoIP Analog Terminal Adaptor (ATA) allows local users to bypass ATA access restrictions by dialing "*#26845#" and causing a device reset.

CVSS: 4.6CWE: N/A

2005-03-08

High

CVE-2005-0699

Multiple buffer overflows in the dissect_a11_radius function in the CDMA A11 (3G-A11) dissector (packet-3g-a11.c) for Ethereal 0.10.9 and earlier allow remote attackers to execute arbitrary code via…

CVSS: 7.5CWE: N/A

Medium

CVE-2005-0747

ApplyYourself i-Class allows remote attackers to obtain sensitive information about their own applications by reusing the hidden ID field, as demonstrated using the id parameter to ApplicantDecision.…

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0741

Cross-site scripting (XSS) vulnerability in YaBB.pl for YaBB 2.0 RC1 allows remote attackers to inject arbitrary web script or HTML via the username parameter in a usersrecentposts action.

CVSS: 4.3CWE: N/A

High

CVE-2005-0725

SQL injection vulnerability in the getAllbyArticle function in wfsfiles.php for WF-Sections (wfsections) 1.07 allows remote attackers to execute arbitrary SQL commands via the articleid parameter to…

CVSS: 7.5CWE: N/A

Medium

CVE-2005-0723

Cross-site scripting (XSS) vulnerability in the jumpmenu function in functions.php for paFileDB 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL parameters,…

CVSS: 4.3CWE: N/A

Low

CVE-2005-0099

The SDL port of abuse (abuse-SDL) before 2.00 does not properly drop privileges before creating certain files, which allows local users to create or overwrite arbitrary files.

CVSS: 2.1CWE: N/A

High

CVE-2005-0696

Buffer overflow in ArGoSoft FTP Server 1.4.2.8 allows remote authenticated users to execute arbitrary code via a long DELE command. NOTE: this issue was later reported to also affect 1.4.3.5.

CVSS: 7.5CWE: N/A

High

CVE-2005-0685

Multiple access validation errors in OutStart Participate Enterprise (PE) allow remote attackers to (1) browse arbitrary directory trees by modifying the rootFolder parameter to displaynavigator.jsp,…

CVSS: 7.5CWE: N/A

Low

CVE-2005-0626

Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which al…

CVSS: 2.6CWE: N/A

Medium

CVE-2005-0098

Multiple buffer overflows in the SDL port of abuse (abuse-SDL) before 2.00 allow local users to execute arbitrary code via the command line.

CVSS: 4.6CWE: N/A

2005-03-07

Medium

CVE-2005-0722

eXPerience2 allows remote attackers to obtain the full path for the web root via a direct request to modules.php without any parameters, which leaks the path in a PHP error message.

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0703

Xerox MicroServer Web Server for various WorkCentre products including M35/M45/M55 2.028.11.000 through 2.97.20.032 and 4.84.16.000 through 4.97.20.032, Pro 35/45/55 3.028.11.000 through 3.97.20.032,…

CVSS: 5.0CWE: N/A

Medium

CVE-2005-0702

SQL injection vulnerability in phpMyFAQ 1.4 and 1.5 allows remote attackers to add FAQ records to the database via the username field in forum messages.

CVSS: 5.0CWE: N/A