CVE Daily
← All years

Uncategorized 2005

Page 5/38.

CVEs without a recognized CWE (not present in the CWE map or marked as N/A).

CVSS ≥ 0.0
2005-12-21
High

CVE-2005-4348

fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstre…

CVSS: 7.8CWE: CWE-399
Read more
2005-12-20
High

CVE-2005-4427

Multiple SQL injection vulnerabilities in Cerberus Helpdesk allow remote attackers to execute arbitrary SQL commands via the (1) file_id parameter to attachment_send.php, (2) the $addy variable in em…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4428

Cross-site scripting (XSS) vulnerability in index.php in Cerberus Helpdesk allows remote attackers to inject arbitrary web script or HTML via the kb_ask parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4417

The default configuration of Widcomm Bluetooth for Windows (BTW) 4.0.1.1500 and earlier, as installed on Belkin Bluetooth Software 1.4.2 Build 10 and ANYCOM Blue USB-130-250 Software 4.0.1.1500, and…

CVSS: 6.4CWE: N/A
Read more
Medium

CVE-2005-4410

Cross-site scripting (XSS) vulnerability in NQcontent 3 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the text parameter.

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4411

Buffer overflow in Mercury Mail Transport System 4.01b allows remote attackers to execute arbitrary code via a long request to TCP port 105.

CVSS: 7.5CWE: N/A
Read more
Low

CVE-2005-4412

Citrix Program Neighborhood client before 9.150 caches the user password in plaintext in the GUI while asterisks are used to visually obfuscate the password, which allows attackers with access to the…

CVSS: 2.1CWE: N/A
Read more
Medium

CVE-2005-4413

Multiple cross-site scripting (XSS) vulnerabilities in sample scripts in IBM WebSphere Application Server 6 allow remote attackers to inject arbitrary web script or HTML via the (1) E-mail address fi…

CVSS: 4.3CWE: N/A
Read more
Critical

CVE-2005-4414

Unspecified vulnerability in Teamwork 3 before alpha 1.7 has unknown impact and attack vectors, related to "a menu security bug."

CVSS: 10.0CWE: N/A
Read more
Medium

CVE-2005-4415

Cross-site scripting (XSS) vulnerability in index.php in TML CMS 0.5 allows remote attackers to inject arbitrary web script or HTML via the form parameter.

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4416

SQL injection vulnerability in index.php in TML CMS 0.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4426

Interpretation conflict in YaBB before 2.1 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF file extension, which causes the HTML to be executed…

CVSS: 4.0CWE: N/A
Read more
High

CVE-2005-4419

Multiple SQL injection vulnerabilities in CategoryResults.cfm in Honeycomb Archive and Honeycomb Archive Enterprise 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) series, (2…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4420

Cross-site scripting (XSS) vulnerability in Honeycomb Archive Enterprise 3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the keyword par…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4421

Dev-Editor 3.0 allows remote attackers to access any directory outside the web root whose name is a substring of the web root directory name.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4422

Unrestricted file upload vulnerability in toendaCMS before 0.6.2 Stable allows remote authenticated administrators to execute arbitrary code by uploading a file with an executable extension, then acc…

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2005-4423

Unrestricted file upload vulnerability in PHPFM before 0.2.3 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension to an accessible directory, a…

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2005-4424

Directory traversal vulnerability in PHPKIT 1.6.1 R2 and earlier might allow remote authenticated users to execute arbitrary PHP code via a .. (dot dot) in the path parameter and a %00 at the end of…

CVSS: 6.5CWE: N/A
Read more
High

CVE-2005-4408

Multiple SQL injection vulnerabilities in Miraserver 1.0 RC4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php, (2) id parameter to newsitem…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4425

Unspecified vulnerability in Kerio WinRoute Firewall before 6.1.3 allows remote attackers to cause a denial of service (crash) via certain RTSP streams.

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2005-4409

Cross-site scripting (XSS) vulnerability in MMBase 1.7.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4392

SQL injection vulnerability in printer_friendly.cfm in e-publish CMS 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4407

Cross-site scripting (XSS) vulnerability in index.cfm in Mercury CMS 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) content and (2) criteria parameters.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4398

NOTE: the vendor has disputed this issue. Cross-site scripting (XSS) vulnerability in lemoon 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search par…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4406

SQL injection vulnerability in index.cfm in Mercury CMS 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4390

SQL injection vulnerability in index.php in ContentServ 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the StoryID parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4391

Cross-site scripting (XSS) vulnerability in damoon allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the q parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4393

Cross-site scripting (XSS) vulnerability in show.cfm in e-publish CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) obcatid and (2) comid parameters.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4395

Cross-site scripting (XSS) vulnerability in FarCry 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the criteria parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4396

Cross-site scripting (XSS) vulnerability in admin/Default.asp in iCMS allows remote attackers to inject arbitrary web script or HTML via the LoginMSG parameter. NOTE: the provenance of this issue is…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4397

SQL injection vulnerability in RunScript.asp iCMS allows remote attackers to execute arbitrary SQL commands via the Event_ID parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4394

Cross-site scripting (XSS) vulnerability in EPiX 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search query parameters.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4399

Cross-site scripting (XSS) vulnerability in search/index.php in Libertas Enterprise CMS 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the page_search parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4400

Cross-site scripting (XSS) vulnerability in downloads/portal_ent in Liferay Portal Enterprise 3.6.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) _77_struts_a…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4401

Cross-site scripting (XSS) vulnerability in Lutece 1.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the query parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4402

Buffer overflow in MailEnable Professional 1.71 and earlier, and Enterprise 1.1 and earlier, allows remote authenticated users to execute arbitrary code via a long IMAP EXAMINE command.

CVSS: 6.5CWE: N/A
Read more
High

CVE-2005-4403

SQL injection vulnerability in index.php in Marwel 2.7 and earlier allows remote attackers to execute arbitrary SQL commands via the show parameter.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4404

SQL injection vulnerability in default.asp in Media2 CMS Shop 18.x allows remote attackers to execute arbitrary SQL commands via the item parameter. NOTE: the provenance of this issue is unknown; th…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4405

redqueen.cgi in Red Queen 1.02 and earlier allows remote attackers to obtain the full server path via invalid (1) yellowpage_id, (2) skin_id, (3) supplier_id, and (4) module parameters, which leaks t…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2005-4378

SQL injection vulnerability in Page.asp in Baseline CMS 1.95 and earlier allows remote attackers to execute arbitrary SQL commands via the SiteNodeID parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4389

search.cfm in CONTENS 3.0 and earlier allows remote attackers to obtain the full server path via invalid (1) submit.y, (2) bool, (3) itemsperpage, (4) submit, (5) submit.x, (6) criteria, (7) advanced…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2005-4388

Cross-site scripting (XSS) vulnerability in search.cfm in CONTENS 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the near parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4387

Cross-site scripting (XSS) vulnerability in home.php in contenite 0.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4385

Cross-site scripting (XSS) vulnerability in search.htm in Cofax 2.0 RC3 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4384

CitySoft Community Enterprise 4.x allows remote attackers to obtain the full path of the server via an invalid (1) fuseaction parameter to index.cfm and (2) documentid parameter to document/docWindow…

CVSS: 6.4CWE: N/A
Read more
Medium

CVE-2005-4383

Cross-site scripting (XSS) vulnerability in index.cfm in CitySoft Community Enterprise 4.x allows remote attackers to inject arbitrary web script or HTML via the (1) presentationSite, (2) docPublishY…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4381

Multiple cross-site scripting (XSS) vulnerabilities in Caravel CMS 3.0 Beta 1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) fileDN and (2) folderviewer_attrs p…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4379

Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to inject arbitrary web script or HTML via the (1) sort_mode parameter to (a) fisheye/list_g…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4372

Cross-site scripting (XSS) vulnerability in account.html in Adaptive Website Framework (AWF) 2.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4377

Cross-site scripting (XSS) vulnerability in Page.asp in Baseline CMS 1.95 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) PageID and (2) SiteNodeID parameters.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4376

Directory traversal vulnerability in Amaxus 3 and earlier allows remote attackers to access arbitrary files via ".." sequences in the change parameter.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2005-4375

Cross-site scripting (XSS) vulnerability in Amaxus 3 and earlier allows remote attackers to inject arbitrary web script or HTML via the change parameter. NOTE: it is possible that this is resultant…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4374

Multiple cross-site scripting (XSS) vulnerabilities in Allinta 2.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to faq.asp and (2) searchQuery p…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4373

Adaptive Website Framework (AWF) 2.10 and earlier allows remote attackers to obtain the full path of the application via an invalid mode parameter to community.html, which leaks the path in an error…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2005-4371

Acidcat 2.1.13 and earlier stores the database under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a request to databases/acidcat.md…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2005-4370

SQL injection vulnerability in main_content.asp in Acidcat 2.1.13 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter to default.asp.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4369

Cross-site scripting (XSS) vulnerability in Acuity CMS 2.6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly strSearchKeywords to browse.asp.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4361

Cross-site scripting (XSS) vulnerability in search.html in Magnolia Content Management Suite 2.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4367

Cross-site scripting (XSS) vulnerability in register_domain.php in DRZES HMS 3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the "Domain…

CVSS: 5.8CWE: N/A
Read more
Medium

CVE-2005-4366

Multiple SQL injection vulnerabilities in DRZES HMS 3.2 allow remote attackers to execute arbitrary SQL commands via the (1) plan_id parameter to (a) domains.php, (b) viewusage.php, (c) pop_accounts.…

CVSS: 6.4CWE: N/A
Read more
Medium

CVE-2005-4365

Multiple cross-site scripting (XSS) vulnerabilities in FLIP 0.9.0.1029 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter in text.php and (2) frame parameter in…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4364

Cross-site scripting (XSS) vulnerability in index.cfm in Hot Banana Web Content Management Suite 5.3 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.

CVSS: 5.8CWE: N/A
Read more
Medium

CVE-2005-4363

Cross-site scripting (XSS) vulnerability in the search engine in Komodo CMS 2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.

CVSS: 5.8CWE: N/A
Read more
Medium

CVE-2005-4362

SQL injection vulnerability in page.php in Komodo CMS 2.1 allows remote attackers to execute arbitrary SQL commands via the page parameter.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2005-4358

admin/admin_disallow.php in phpBB 2.0.18 allows remote attackers to obtain the installation path via a direct request with a non-empty setmodules parameter, which causes an invalid append_sid functio…

CVSS: 5.0CWE: N/A
Read more
Low

CVE-2005-4357

Cross-site scripting (XSS) vulnerability in phpBB 2.0.18, when "Allowed HTML tags" is enabled, allows remote attackers to inject arbitrary Javascript via a permitted HTML tag with " (quote) character…

CVSS: 2.6CWE: N/A
Read more
High

CVE-2005-4356

SQL injection vulnerability in UStore allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields. NOTE: the provenance of this information is unknown; the…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4355

Multiple cross-site scripting (XSS) vulnerabilities in UStore allow remote attackers to inject arbitrary web script or HTML via the (1) Cat parameter in default.asp and the (2) accessdenied parameter…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4354

Cross-site scripting (XSS) vulnerability in webglimpse.cgi in Webglimpse 2.14.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4359

SQL injection vulnerability in includes/core.inc.php in ODFaq 2.1.0 allows remote attackers to execute arbitrary SQL commands via the (1) cat and (2) srcText parameters to faq.php.

CVSS: 6.4CWE: N/A
Read more
High

CVE-2005-4350

Unspecified vulnerability in WBEM Services A.01.x before A.01.05.12 and A.02.x before A.02.00.08 on HP-UX B.11.00 through B.11.23 allows remote attackers to cause an unspecified denial of service via…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2005-4353

SQL injection vulnerability in index.php in toendaCMS 0.6.2.1, when configured to use a SQL database, allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS: 7.5CWE: N/A
Read more
2005-12-19
Medium

CVE-2005-4343

Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 allows remote attackers to attach arbitrary files and send mail via a crafted Subject field, which is not properly handled b…

CVSS: 5.0CWE: N/A
Read more
Low

CVE-2005-4344

Adobe (formerly Macromedia) ColdFusion MX 7.0 does not honor when the CFOBJECT /CreateObject(Java) setting is disabled, which allows local users to create an object despite the specified configuratio…

CVSS: 2.1CWE: N/A
Read more
Medium

CVE-2005-4346

Invalid SQL syntax error in blog.php in phpBB Blog 2.2.2 and earlier allows remote attackers to obtain the full path of the application via an invalid permalink parameter to index.php, which produces…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2005-4345

Adobe (formerly Macromedia) ColdFusion MX 7.0 exposes the password hash of the Administrator in an API call, which allows local developers to obtain the hash and gain privileges.

CVSS: 7.2CWE: N/A
Read more
Medium

CVE-2005-4339

Cross-site scripting (XSS) vulnerability in Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to inject arbitr…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4342

ColdFusion Sandbox on Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 does not throw an exception if the SecurityManager is disabled, which might allow remote attackers to…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4341

Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to list all available categories via a blank category_id par…

CVSS: 5.0CWE: N/A
Read more
Critical

CVE-2005-4338

announcement.pl in Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to gain administrator privileges by setti…

CVSS: 10.0CWE: N/A
Read more
High

CVE-2005-4337

The login page in Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to bypass authentication and gain privileg…

CVSS: 7.5CWE: N/A
Read more
2005-12-17
High

CVE-2005-4330

SQL injection vulnerability in browse.ihtml in iHTML Merchant Mall allows remote attackers to execute arbitrary SQL commands via the (1) id, (2) store, and (3) step parameters.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4331

SQL injection vulnerability in merchant.ihtml in iHTML Merchant Version 2 Pro allows remote attackers to execute arbitrary SQL commands via the (1) step, (2) id, and (3) pid parameters.

CVSS: 7.5CWE: N/A
Read more
Critical

CVE-2005-4332

Cisco Clean Access 3.5.5 and earlier on the Secure Smart Manager allows remote attackers to bypass authentication and cause a denial of service or upload files via direct requests to obsolete JSP fil…

CVSS: 9.4CWE: N/A
Read more
Medium

CVE-2005-4333

Multiple cross-site scripting (XSS) vulnerabilities in Binary Board System (BBS) 0.2.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) inreplyto, (2) article, an…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4321

The Internet Key Exchange version 1 (IKEv1) implementation in Apani Networks EpiForce 1.9 and earlier running IPSec, allow remote attackers to cause a denial of service (crash) via certain IKE packet…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2005-4334

SQL injection vulnerability in ZixForum 1.12 allows remote attackers to execute arbitrary SQL commands via the H_ID parameter to (1) zixforum/forum.asp, as used in (2) Headforums.asp and (3) Subject.…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4335

ProjectForum 4.7.0 and earlier allows remote attackers to cause a denial of service (crash) via a crafted pageid parameter to admin/versions.html.

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2005-4336

Cross-site scripting (XSS) vulnerability in ProjectForum 4.7.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) fwd parameter in admin/adminsignin.html and (2) o…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4328

Cross-site scripting (XSS) vulnerability in webglimpse.cgi in Webglimpse 2.14.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the ID parameter.

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4329

SQL injection vulnerability in pafiledb.php in PHP Arena paFileDB Extreme Edition RC 5 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) newsid and (2) id parameter.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4318

SQL injection vulnerability in index.php in Limbo CMS 1.0.4.2 and earlier, with register_globals off, allows remote attackers to execute arbitrary SQL commands via the _SERVER[REMOTE_ADDR] parameter,…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4327

Multiple cross-site scripting (XSS) vulnerabilities in Michael Arndt WebCal 1.11-3.04 allow remote attackers to inject arbitrary web script or HTML via the (1) function, (2) year, and (3) date parame…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4326

The web interface for American Power Conversion (APC) PowerChute Network Shutdown performs all communication in cleartext (base64-encoded), which allows remote attackers to sniff authentication crede…

CVSS: 5.0CWE: N/A
Read more
Critical

CVE-2005-4325

Multiple unspecified vulnerabilities in Driverse before 0.56b have unknown impact and attack vectors, related to (1) a "ptrace exploit" and (2) "some other potential security problems."

CVSS: 10.0CWE: N/A
Read more
High

CVE-2005-4324

Hitachi Groupmax Mail SMTP 06-50 through 06-52-/A and 07-00 through 07-20 allows remote attackers to cause a denial of service (service stop) via an e-mail message with an "invalid format."

CVSS: 7.8CWE: N/A
Read more
High

CVE-2005-4323

Unspecified vulnerability in Hitachi Cosminexus Collaboration Portal 06-00 through 06-10-/B, Groupmax Collaboration Portal 07-00 through 07-10-/B, and Groupmax Collaboration Web Client 07-00 through…

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2005-4322

Multiple cross-site scripting (XSS) vulnerabilities in Hitachi Cosminexus Collaboration Portal 06-00 through 06-10-/B, Groupmax Collaboration Portal 07-00 through 07-10-/B, and Groupmax Collaboration…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4319

Directory traversal vulnerability in index2.php in Limbo CMS 1.0.4.2 and earlier allows remote attackers to include arbitrary PHP files via ".." sequences in the option parameter.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2005-4317

Limbo CMS 1.0.4.2 and earlier, with register_globals off, does not protect the $_SERVER variable from external modification, which allows remote attackers to use the _SERVER[REMOTE_ADDR] parameter to…

CVSS: 6.8CWE: N/A
Read more
High

CVE-2005-4316

HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allows remote attackers to cause a denial of service via a "Rose Attack" that involves sending a subset of small IP fragments that do not form a complete,…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2005-4312

SQL injection vulnerability in index.php in AlmondSoft Almond Classifieds 5.02 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4311

Cross-site scripting (XSS) vulnerability in DCForum 6.25 and earlier, and possibly DCForum+ 1.x, allows remote attackers to inject arbitrary web script or HTML via (1) the page parameter in dcboard.p…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4309

SQL injection vulnerability in ezUpload Pro 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified search module parameters.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4313

SQL injection vulnerability in index.php in AlmondSoft Almond Personals 4.05 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4314

Cross-site scripting (XSS) vulnerability in ppcal.cgi in PPCal Shopping Cart 3.3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) stop and (2) user parameters.

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4310

SSH Tectia Server 5.0.0 (A, F, and T), when allowing host-based authentication only, allows users to log in with the wrong credentials.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4305

Cross-site scripting (XSS) vulnerability in Edgewall Trac 0.9, 0.9.1, and 0.9.2 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly sanitized before it i…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4308

index.php in ezUpload Pro 2.2 and earlier allows remote attackers to include files via the mode parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4304

index.php in ezDatabase 2.1.2 and earlier allows remote attackers to obtain sensitive information via an invalid cat_id parameter, which leaks the full pathname in an error message. NOTE: these deta…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2005-4303

SQL injection vulnerability in index.php for ezDatabase 2.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the db_id parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4307

Cross-site scripting (XSS) vulnerability in ScareCrow 2.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the forum parameter to (1) forum.cgi and (2) post.cgi, or (3)…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4302

Directory traversal vulnerability in index.php in ezDatabase 2.1.2 and earlier allows remote attackers to include arbitrary local files via ".." sequences in the p parameter.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2005-4306

Multiple cross-site scripting (XSS) vulnerabilities in SiteNet BBS 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) pg, (2) tid, (3) cid, and (4) fid paramete…

CVSS: 4.3CWE: N/A
Read more
2005-12-16
High

CVE-2005-3652

Heap-based buffer overflow in Citrix Program Neighborhood client 9.0 and earlier allows remote attackers to execute arbitrary code via a long name value in an Application Set response.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4298

Cross-site scripting (XSS) vulnerability in atl.cgi in AtlantForum 4.02 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) sch_allsubct, (2) before, and (3) ct par…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4299

Cross-site scripting (XSS) vulnerability in atl.cgi in Atlant Pro 4.02 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) before and (2) ct parameters.

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4300

Format string vulnerability in the lire_pop function in pop.c in libremail 1.1.0 and earlier, with compiled with the debug option, allows remote attackers to execute arbitrary code via a crafted e-ma…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4301

Cross-site scripting (XSS) vulnerability in phpXplorer 0.9.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the address bar field.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4297

Cross-site scripting (XSS) vulnerability in bbBoard 2.56 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly via the "keys" paramete…

CVSS: 4.3CWE: N/A
Read more
>