CVE Daily
← All years

Uncategorized 2005

Page 6/38.

CVEs without a recognized CWE (not present in the CWE map or marked as N/A).

CVSS ≥ 0.0
2005-12-16
Medium

CVE-2005-4291

Cross-site scripting (XSS) vulnerability in cart.cgi in ECTOOLS Onlineshop 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) product, (2) category, and (3) ui…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4287

PHP remote file include vulnerability in MarmaraWeb E-commerce allows remote attackers to execute arbitrary code via the page parameter to index.php.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4288

Cross-site scripting (XSS) vulnerability in index.php in MarmaraWeb E-commerce allows remote attackers to inject arbitrary web script or HTML via the page parameter to index.php. NOTE: this might be…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4289

Cross-site scripting (XSS) vulnerability in EDCstore.pl in eDatCat 0.3 allows remote attackers to inject arbitrary web script or HTML via the user_action parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4290

Cross-site scripting (XSS) vulnerability in index.cgi in ECW-Cart 2.03 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) kword, (2) max, (3) min, (4) comp, and (5…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4294

Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the username in the login page.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4292

Cross-site scripting (XSS) vulnerability in CommerceSQL 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search module parameters, possibly the keywords…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4293

Cross-site scripting (XSS) vulnerability in cp-app.cgi in ClickCartPro (CCP) 5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the affl parameter.

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4286

Unspecified vulnerability in PhpLogCon before 1.2.2 allows remote attackers to use arbitrary profiles via unknown vectors involving "'smart' values for userid and password," probably involving an SQL…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4296

AppServ Open Project 2.5.3 allows remote attackers to cause a denial of service via a large HTTP request.

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2005-4295

Cross-site scripting (XSS) vulnerability in Absolute Image Gallery XE 2.x allows remote attackers to inject arbitrary web script or HTML via the text parameter. NOTE: the provenance of this informat…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4284

Cross-site scripting (XSS) vulnerability in StaticStore Search Engine 1.189A and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to search.cgi, possi…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4285

Cross-site scripting (XSS) vulnerability in pdestore.cgi in Dick Copits PDEstore 1.8 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) the search module parameter or…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4283

Cross-site scripting (XSS) vulnerability in The CITY Shop 1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via parameters to the search module, possibly SKey to store.cg…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4281

Cross-site scripting (XSS) vulnerability in Zaygo HostingCart 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via certain search module parameters, possibly the root pa…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4280

Untrusted search path vulnerability in CMake before 2.2.0-r1 on Gentoo Linux allows local users in the portage group to gain privileges via a malicious shared object in the Portage temporary build di…

CVSS: 7.2CWE: N/A
Read more
High

CVE-2005-4279

Untrusted search path vulnerability in Qt-UnixODBC before 3.3.4-r1 on Gentoo Linux allows local users in the portage group to gain privileges via a malicious shared object in the Portage temporary bu…

CVSS: 7.2CWE: N/A
Read more
High

CVE-2005-4278

Untrusted search path vulnerability in Perl before 5.8.7-r1 on Gentoo Linux allows local users in the portage group to gain privileges via a malicious shared object in the Portage temporary build dir…

CVSS: 7.2CWE: N/A
Read more
Medium

CVE-2005-4277

Cross-site scripting (XSS) vulnerability in index.php in toendaCMS before 0.7 Beta allows remote attackers to inject arbitrary web script or HTML via the id parameter.

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4276

Westell Versalink 327W allows remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports, and with the SYN flag set (aka LanD). N…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2005-4275

Scientific Atlanta DPX2100 Cable Modem allows remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports, and with the SYN flag s…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2005-3253

Wireless Access Points (AP) for (1) Avaya AP-3 through AP-6 2.5 to 2.5.4, and AP-7/AP-8 2.5 and other versions before 3.1, and (2) Proxim AP-600 and AP-2000 before 2.5.5, and Proxim AP-700 and AP-400…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4282

Cross-site scripting (XSS) vulnerability in Zaygo DomainCart 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML, possibly via the root parameter to zaygo.cgi.

CVSS: 4.3CWE: N/A
Read more
2005-12-15
High

CVE-2005-4271

Buffer overflow in the malloc debug system in IBM AIX 5.3 allows local users to execute arbitrary code.

CVSS: 7.2CWE: N/A
Read more
Critical

CVE-2005-4272

Multiple buffer overflows in IBM AIX 5.1, 5.2, and 5.3 allow remote attackers to execute arbitrary code via (1) muxatmd and (2) slocal.

CVSS: 10.0CWE: N/A
Read more
Low

CVE-2005-4273

Multiple unspecified vulnerabilities in (1) getShell and (2) getCommand in IBM AIX 5.3 allow local users to append to arbitrary files.

CVSS: 2.1CWE: N/A
Read more
Medium

CVE-2005-4274

Unspecified vulnerability in Business Objects WebIntelligence 6.5x allows remote attackers to cause a denial of service (user account lock out) via unknown attack vectors related to "authentication m…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2005-4270

Buffer overflow in Watchfire AppScan QA 5.0.609 and 5.0.134 allows remote web servers to execute arbitrary code via an HTTP 401 response with a WWW-Authenticate header containing a long Realm field.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4269

mshtml.dll in Microsoft Windows XP, Server 2003, and Internet Explorer 6.0 SP1 allows attackers to cause a denial of service (access violation) by causing mshtml.dll to process button-focus events at…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2005-4243

Multiple SQL injection vulnerabilities in QuickPayPro 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) popupid parameter in popups.edit.php; (2) so, (3) sb, and (4) nr paramet…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4258

Unspecified Cisco Catalyst Switches allow remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports, and with the SYN flag set (…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2005-4266

WorldClient.dll in Alt-N MDaemon and WorldClient 8.1.3 trusts a Session parameter that contains a randomly generated session ID that is associated with a username, which allows remote attackers to pe…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4264

Multiple SQL injection vulnerabilities in index.php in PHP Support Tickets 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields, and (3) id parame…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4262

Cross-site scripting (XSS) vulnerability in the News module in Envolution allows remote attackers to inject arbitrary web script or HTML via the (1) startrow and (2) catid parameter. NOTE: this issu…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4261

Unspecified vulnerability in Positive Software Corporation CP+ (cpplus) before 2.5.5 allows attackers to have unknown impact and attack vectors, related to "a possible security flaw caused by a bug i…

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2005-4260

Interpretation conflict in includes/mainfile.php in PHP-Nuke 7.9 and later allows remote attackers to perform cross-site scripting (XSS) attacks by replacing the ">" in the tag with a "<", which bypa…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4259

Multiple SQL injection vulnerabilities in ASPBB 0.4 allow remote attackers to execute arbitrary SQL commands via the (1) TID parameter in topic.asp, (2) FORUM_ID parameter in forum.asp, and (3) PROFI…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4257

Linksys WRT54GS and BEFW11S4 allows remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports, and with the SYN flag set (aka LA…

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2005-4256

Cross-site scripting (XSS) vulnerability in forum.asp in ASP-DEV XM Forum RC3 allows remote attackers to inject arbitrary web script or HTML via the forum_title parameter. NOTE: the provenance of th…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4255

Cross-site scripting (XSS) vulnerability in TextSearch in WikkaWiki 1.1.6.0 allows remote attackers to inject arbitrary web script or HTML via a hex-encoded phrase parameter.

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4254

SQL injection vulnerability in view_Results.php in DreamLevels DreamPoll 3.0 final allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4253

Cross-site scripting (XSS) vulnerability in getdox.php in Torrential 1.2 allows remote attackers to inject arbitrary web script or HTML via the URL. NOTE: this might be resultant from CVE-2005-4160.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4249

ADP Forum 2.0 through 2.0.3 stores sensitive information in plaintext files under the web document root with insufficient access control, which allows remote attackers to obtain user credentials via…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2005-4248

Multiple cross-site scripting (XSS) vulnerabilities in QuickPayPro 3.1 allow remote attackers to inject arbitrary web script or HTML via various fields, such as those in (1) communication/subscribers…

CVSS: 4.3CWE: N/A
Read more
2005-12-14
High

CVE-2005-1928

Trend Micro ServerProtect EarthAgent for Windows Management Console 5.58 and possibly earlier versions, when running with Trend Micro Control Manager 2.5 and 3.0, and Damage Cleanup Server 1.1, allow…

CVSS: 7.8CWE: CWE-399
Read more
Medium

CVE-2005-1930

Directory traversal vulnerability in the Crystal Report component (rptserver.asp) in Trend Micro ServerProtect Management Console 5.58, as used in Control Manager 2.5 and 3.0 and Damage Cleanup Serve…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2005-3360

The installation of Trend Micro PC-Cillin Internet Security 2005 12.00 build 1244, and probably previous versions, uses insecure default ACLs, which allows local users to cause a denial of service (d…

CVSS: 7.2CWE: N/A
Read more
Medium

CVE-2005-4242

Multiple cross-site scripting (XSS) vulnerabilities in Horde Turba H3 2.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the address book and (2) contact data.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-3358

Linux kernel before 2.6.15 allows local users to cause a denial of service (panic) via a set_mempolicy call with a 0 bitmask, which causes a panic when a page fault occurs.

CVSS: 4.9CWE: N/A
Read more
Medium

CVE-2005-4252

Cross-site scripting (XSS) vulnerability in mcGallery PRO 2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search module parameters.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4236

Cross-site scripting (XSS) vulnerability in search.php in CKGOLD allows remote attackers to inject arbitrary web script or HTML via the search parameters.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4229

Cross-site scripting (XSS) vulnerability in auction.pl in EveryAuction 1.53 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter. NOTE: the prove…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4230

SQL injection vulnerability in poll.php in Link Up Gold 2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the number parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4231

Cross-site scripting (XSS) vulnerability in Link Up Gold 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) link parameter to tell_friend.php, (2) phrase[] paramet…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4233

SQL injection vulnerability in advertiser_statistic.php in Ad Manager Pro 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the ad_number parameter.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4234

SQL injection vulnerability in gallery.php in EncapsGallery 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4235

Cross-site scripting (XSS) vulnerability in knowledgebase.php in WHMCompleteSolution 2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameters.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4237

Cross-site scripting (XSS) vulnerability in MySQL Auction 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search module parameters, possibly the keyword…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4251

Multiple SQL injection vulnerabilities in mcGallery PRO 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id, (2) start, and (3) rand parameters to show.php, and th…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4238

Cross-site scripting (XSS) vulnerability in view_filters_page.php in Mantis 1.0.0rc3 and earlier allows remote attackers to inject arbitrary web script or HTML via the target_field parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4239

Cross-site scripting (XSS) vulnerability in Search/DisplayResults.php in PHP JackKnife 2.21 and earlier allows remote attackers to inject arbitrary web script or HTML via URL-encoded values in the sK…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4240

SQL injection vulnerability in search.php in VCD-db 0.98 and earlier allows remote attackers to execute arbitrary SQL commands via the by parameter.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4226

Multiple "potential" SQL injection vulnerabilities in phpWebThings 1.4 Patched might allow remote attackers to execute arbitrary SQL commands via (1) the ref parameter in download.php, (2) the direct…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4241

Cross-site scripting (XSS) vulnerability in the category page in VCD-db 0.98 and earlier allows remote attackers to inject arbitrary web script or HTML via the batch parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4250

Directory traversal vulnerability in mcGallery PRO 2.2 and earlier allows remote attackers to read arbitrary files via the language parameter.

CVSS: 5.0CWE: N/A
Read more
High

CVE-2005-4227

Multiple "potential" SQL injection vulnerabilities in DCP-Portal 6.1.1 might allow remote attackers to execute arbitrary SQL commands via (1) the password and username parameters in advertiser.php, (…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4211

PHP remote file inclusion vulnerability in coin_includes/db.php in phpCOIN 1.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the $_CCFG[_PKG_PATH_DBSE] variable.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4225

Multiple "potential" SQL injection vulnerabilities in myBloggie 2.1.3 beta might allow remote attackers to execute arbitrary SQL commands via (1) the category parameter in add.php, (2) the cat_desc p…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4224

Multiple "potential" SQL injection vulnerabilities in e107 0.7 might allow remote attackers to execute arbitrary SQL commands via (1) the email, hideemail, image, realname, signature, timezone, and x…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4223

Multiple "potential" SQL injection vulnerabilities in Utopia News Pro (UNP) 1.1.4 might allow remote attackers to execute arbitrary SQL commands via (1) the newsid parameter in editnews.php, (2) the…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4222

Multiple cross-site scripting (XSS) vulnerabilities in guestbook.cgi in Lars Ellingsen Guestserver 4.13 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified messa…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4221

SQL injection vulnerability in link.php in Arab Portal System 2 Beta 2 allows remote attackers to execute arbitrary SQL commands via the (1) PHPSESSID (session ID) or (2) REQUEST_URI (query string).

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4219

setting.php in Innovative CMS (ICMS, formerly Imoel-CMS) contains username and password information in cleartext, which might allow attackers to obtain this information via a direct request to settin…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2005-4218

SQL injection vulnerability in forum.php in PHPWebThings 1.4 allows remote attackers to execute arbitrary SQL commands via the msg parameter, a different vulnerability than CVE-2005-3585.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4217

Perl in Apple Mac OS X Server 10.3.9 does not properly drop privileges when using the "$<" variable to set uid, which allows attackers to gain privileges.

CVSS: 7.5CWE: CWE-264
Read more
High

CVE-2005-4216

The Administration Service (FMSAdmin.exe) in Macromedia Flash Media Server 2.0 r1145 allows remote attackers to cause a denial of service (application crash) via a malformed request with a single cha…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2005-4215

Motorola SB5100E Cable Modem allows remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports, and with the SYN flag set (aka LA…

CVSS: 7.8CWE: N/A
Read more
High

CVE-2005-4213

SQL injection vulnerability in mod.php in phpCOIN 1.2.2 allows remote attackers to execute arbitrary SQL commands via the phpcoinsessid cookie.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4212

Directory traversal vulnerability in coin_includes/db.php in phpCOIN 1.2.2 allows remote attackers to read arbitrary local files via ".." (dot dot) sequences in the $_CCFG[_PKG_PATH_DBSE] variable.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2005-3903

Buffer overflow in uidadmin in SCO Unixware 7.1.3 and 7.1.4 allows local users to execute arbitrary code via a -S (scheme) argument that specifies a large file, a different vulnerability than CVE-200…

CVSS: 4.6CWE: N/A
Read more
High

CVE-2005-2831

Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that refe…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-2830

Microsoft Internet Explorer 5.01, 5.5, and 6, when using an HTTPS proxy server that requires Basic Authentication, sends URLs in cleartext, which allows remote attackers to obtain sensitive informati…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2005-2829

Multiple design errors in Microsoft Internet Explorer 5.01, 5.5, and 6 allow user-assisted attackers to execute arbitrary code by (1) overlaying a malicious new window above a file download box, then…

CVSS: 5.1CWE: N/A
Read more
High

CVE-2005-2827

The thread termination routine in the kernel for Windows NT 4.0 and 2000 (NTOSKRNL.EXE) allows local users to modify kernel memory and execution flow via steps in which a terminating thread causes As…

CVSS: 7.2CWE: N/A
Read more
2005-12-13
Low

CVE-2005-4189

Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith H3 before 2.0.6 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Calendar name field when cre…

CVSS: 3.5CWE: N/A
Read more
Low

CVE-2005-4191

Multiple cross-site scripting (XSS) vulnerabilities in templates/tasklists/tasklists.inc in Horde Nag Task List Manager H3 before 2.0.4 allow remote authenticated users to inject arbitrary web script…

CVSS: 3.5CWE: N/A
Read more
Low

CVE-2005-4192

Multiple cross-site scripting (XSS) vulnerabilities in templates/notepads/notepads.inc in Horde Mnemo Note Manager H3 before 2.0.3 allow remote authenticated users to inject arbitrary web script or H…

CVSS: 3.5CWE: N/A
Read more
Medium

CVE-2005-4193

Cross-site scripting (XSS) vulnerability in UseBB before 0.7 allows remote attackers to inject arbitrary web script or HTML via the $_SERVER['PHP_SELF'] variable.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4194

Buffer overflow in MediaServerList.exe in Sights 'n Sounds Streaming Media Server 2.0.3.a allows remote attackers to cause a denial of service (application crash) via a long query string.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2005-4196

Multiple cross-site scripting (XSS) vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the ss parameter in SPT--Quic…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4197

tunnelform.yaws in Nortel SSL VPN 4.2.1.6 allows remote attackers to execute arbitrary commands via a link in the a parameter, which is executed with extra privileges in a cryptographically signed Ja…

CVSS: 7.5CWE: N/A
Read more
Critical

CVE-2005-4200

Multiple unspecified vulnerabilities in MyBulletinBoard (MyBB) before 1.0 have unknown impact and attack vectors, a different set of vulnerabilities than those identified by CVE-2005-4199.

CVSS: 10.0CWE: N/A
Read more
Medium

CVE-2005-4201

Directory traversal vulnerability in My Album Online 1.0 allows remote attackers to access arbitrary files via ".../" (triple dot) sequences in unspecified vectors.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2005-4202

Multiple directory traversal vulnerabilities in LogiSphere 0.9.9j allow remote attackers to access arbitrary files via (1) .. (dot dot), (2) "..." (triple dot), and (3) "..//" sequences in the URL, (…

CVSS: 5.0CWE: N/A
Read more
High

CVE-2005-4203

LogiSphere 0.9.9j does not restrict the number of messages that can be sent, which allows remote attackers to cause a denial of service by sending a large number of messages via the msg command. NOT…

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2005-4204

Cross-site scripting (XSS) vulnerability in LogiSphere 0.9.9j allows remote attackers to inject arbitrary Javascript via the msg command. NOTE: due to lack of appropriate details by the original rese…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4205

Cross-site scripting (XSS) vulnerability in searchdb.asp in LocazoList 1.03c and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter.

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4207

SQL injection vulnerability in BTGrup Admin WebController Script allows remote attackers to execute SQL commands via the (1) Username and (2) Password fields.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4208

Directory traversal vulnerability in Flatnuke 2.5.6 allows remote attackers to access arbitrary files via a .. (dot dot) and null byte (%00) in the id parameter of the read module.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2005-4210

Opera before 8.51, when running on Windows with Input Method Editor (IME) installed, allows remote attackers to cause a denial of service (persistent application crash) by bookmarking a site with a l…

CVSS: 5.0CWE: N/A
Read more
2005-12-12
Medium

CVE-2005-4178

Buffer overflow in Dropbear server before 0.47 allows authenticated users to execute arbitrary code via unspecified inputs that cause insufficient memory to be allocated due to an incorrect expressio…

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2005-4177

Cross-site scripting (XSS) vulnerability in book.cfm in Magic Book Personal and Professional 2.0 allows remote attackers to inject arbitrary web script or HTML via the StartRow parameter.

CVSS: 4.3CWE: N/A
Read more
2005-12-11
Medium

CVE-2005-4166

Cross-site scripting (XSS) vulnerability in password.asp in DUWare DUportal Pro 3.4.3 allows remote attackers to inject arbitrary web script or HTML via the result parameter.

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2005-4167

Cross-site scripting (XSS) vulnerability in eFiction 1.0 and 1.1 allows remote attackers to inject arbitrary web script or HTML via the let parameter in a viewlist action to titles.php.

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4168

Multiple SQL injection vulnerabilities in eFiction 1.0, 1.1, and 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the let parameter in a viewlist action to titles.php and (2) the…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4169

Multiple SQL injection vulnerabilities in eFiction 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) let parameter in a viewlist action to authors.php and (2) sid parameter to…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4170

SQL injection vulnerability in eFiction 1.1 allows remote attackers to execute arbitrary SQL commands via the uid parameter to viewuser.php.

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-4171

The "Upload new image" command in the "Manage Images" eFiction 1.1, when members are allowed to upload images, allows remote attackers to execute arbitrary PHP code by uploading a filename with a .ph…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4172

eFiction 1.0, 1.1, and 2.0 allows remote attackers to obtain sensitive information via a direct request to storyblock.php without arguments, which leaks the full pathname in the resulting PHP error m…

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2005-4173

eFiction 1.0, 1.1, and 2.0 allows remote attackers to obtain sensitive information by accessing phpinfo.php, which executes the PHP phpinfo function.

CVSS: 5.0CWE: N/A
Read more
High

CVE-2005-4174

eFiction 1.0, 1.1, and 2.0, in unspecified environments, might allow remote attackers to conduct unauthorized operations by directly accessing (1) install.php or (2) upgrade.php. NOTE: it is unclear…

CVSS: 7.5CWE: N/A
Read more
Low

CVE-2005-4175

Insyde BIOS V190 does not clear the keyboard buffer after reading the BIOS password during system startup, which allows local administrators or users to read the password directly from physical memor…

CVSS: 2.1CWE: N/A
Read more
Low

CVE-2005-4176

AWARD Bios Modular 4.50pg does not clear the keyboard buffer after reading the BIOS password during system startup, which allows local administrators or users to read the password directly from physi…

CVSS: 2.1CWE: N/A
Read more
High

CVE-2005-4165

Multiple SQL injection vulnerabilities in ASP-DEV ASP Resources Forum allow remote attackers to execute arbitrary SQL commands via the (1) forum_id parameter to forum.asp, (2) unspecified parameters…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4162

Cross-site scripting (XSS) vulnerability in cal_make.pl in ACME PerlCal 2.99.20 allows remote attackers to inject arbitrary web script or HTML via the p0 parameter.

CVSS: 4.3CWE: N/A
Read more
High

CVE-2005-4164

SQL injection vulnerability in view.php in PHP-addressbook 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2005-4163

Directory traversal vulnerability in captcha.php in Captcha PHP 0.9 allows remote attackers to read arbitrary files via the _tcf parameter.

CVSS: 5.0CWE: N/A
Read more
Medium

CVE-2005-4160

Directory traversal vulnerability in getdox.php in Torrential 1.2 allows remote attackers to read arbitrary files via "../" sequences in the query string argument.

CVSS: 5.0CWE: N/A
Read more
High

CVE-2005-4159

NOTE: this issue has been disputed by the vendor and third parties. SQL injection vulnerability in Memberlist.php in Simple Machines Forum (SMF) 1.1 rc1 and earlier allows remote attackers to execute…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2005-3533

Buffer overflow in OSH before 1.7-15 allows local users to execute arbitrary code via a long current working directory and filename.

CVSS: 7.2CWE: N/A
Read more
>