2005 CVEs (page 21)
Page 21 of 47 — CVEs published in 2005, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2005-2799 | | 2005-09-15 | Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03, 3.03.6, and possibly other versions before 4.20.7, allows remote attackers to execute arbitrary code vi… | |
CVE-2005-2658 | | 2005-09-15 | Buffer overflow in utility.cpp in Turquoise SuperStat (turqstat) 2.2.4 and earlier might allow remote NNTP servers to execute arbitrary code via a date with a… | |
CVE-2005-2495 | | 2005-09-15 | Multiple integer overflows in XFree86 before 4.3.0 allow user-assisted attackers to execute arbitrary code via a crafted pixmap image. | |
CVE-2005-2916 | | 2005-09-14 | Linksys WRT54G 3.01.03, 3.03.6, 4.00.7, and possibly other versions before 4.20.7, does not verify user authentication until after an HTTP POST request has bee… | |
CVE-2005-2915 | | 2005-09-14 | ezconfig.asp in Linksys WRT54G router 3.01.03, 3.03.6, non-default configurations of 2.04.4, and possibly other versions, uses weak encryption (XOR encoding wi… | |
CVE-2005-2914 | | 2005-09-14 | ezconfig.asp in Linksys WRT54G router 3.01.03, 3.03.6, non-default configurations of 2.04.4, and possibly other versions, does not use an authentication initia… | |
CVE-2005-2912 | | 2005-09-14 | Linksys WRT54G router allows remote attackers to cause a denial of service (CPU consumption and server hang) via an HTTP POST request with a negative Content-L… | |
CVE-2005-2904 | | 2005-09-14 | Zebedee 2.4.1, when "allowed redirection port" is not set, allows remote attackers to cause a denial of service (application crash) via a zero in the port numb… | |
CVE-2005-2903 | | 2005-09-14 | Heap-based buffer overflow in NOD32 2.5 with nod32.002 1.033 build 1127, with active scanning enabled, allows remote attackers to execute arbitrary code via an… | |
CVE-2005-2902 | | 2005-09-14 | SQL injection vulnerability in class-1 Forum Software 0.24.4 allows remote attackers to execute arbitrary SQL commands and bypass the file extension check via… | |
CVE-2005-2901 | | 2005-09-14 | Multiple Cross-site scripting (XSS) vulnerabilities in CjWeb2Mail 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) messa… | |
CVE-2005-2900 | | 2005-09-14 | Cross-site scripting (XSS) vulnerability in top.php in CjLinkOut 1.0 allows remote attackers to inject arbitrary web script or HTML via the 123 parameter. | |
CVE-2005-2899 | | 2005-09-14 | Multiple cross-site scripting (XSS) vulnerabilities in details.php in CjTagBoard 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1)… | |
CVE-2005-2898 | | 2005-09-14 | NOTE: this issue has been disputed by the vendor. FileZilla 2.2.14b and 2.2.15, and possibly earlier versions, when "Use secure mode" is disabled, uses a weak… | |
CVE-2005-2897 | | 2005-09-14 | WEB//NEWS 1.4 allows remote attackers to obtain sensitive information via a direct request to files in the actions directory, which reveal the path in an error… | |
CVE-2005-2896 | | 2005-09-14 | SQL injection vulnerability in WEB//NEWS 1.4 allows remote attackers to execute arbitrary SQL commands via the (1) wn_userpw parameter to startup.php, (2) cat… | |
CVE-2005-2895 | | 2005-09-14 | setcookie.php in PBLang 4.65, and possibly earlier versions, allows remote attackers to obtain sensitive information via a %00 (a null byte) in the u parameter… | |
CVE-2005-2894 | | 2005-09-14 | Cross-site scripting (XSS) vulnerability in the user registration in PBLang 4.65, and possibly earlier versions, allows remote attackers to inject arbitrary we… | |
CVE-2005-2893 | | 2005-09-14 | Direct static code injection vulnerability in setcookie.php in PBLang 4.65, and possibly earlier versions, allows remote attackers to execute arbitrary PHP cod… | |
CVE-2005-2892 | | 2005-09-14 | Directory traversal vulnerability in setcookie.php in PBLang 4.65, and possibly earlier versions, allows remote attackers to read arbitrary files via ".." sequ… | |
CVE-2005-2891 | | 2005-09-14 | WebArchiveX.dll 5.5.0.76 installed before September 6th, 2005 is marked safe for scripting by default, which allows remote attackers to read or write to arbitr… | |
CVE-2005-2890 | | 2005-09-14 | SecureOL VE2 1.05.1008 does not properly restrict public access to physical memory, which allows local users to bypass intended restrictions and gain access to… | |
CVE-2005-2889 | | 2005-09-14 | Check Point NGX R60 does not properly verify packets against the predefined service group "CIFS" rule, which allows remote attackers to bypass intended restric… | |
CVE-2005-2888 | | 2005-09-14 | Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) Preview Release 2 allow remote attackers to execute arbitrary SQL commands via the (1) fid par… | |
CVE-2005-2887 | | 2005-09-14 | MAXdev MD-Pro 1.0.73, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to (1) wiki.php, (2) AutoThem… | |
CVE-2005-2886 | | 2005-09-14 | Multiple cross-site scripting (XSS) vulnerabilities in MAXdev MD-Pro 1.0.73, and possibly earlier versions, allow remote attackers to inject arbitrary web scri… | |
CVE-2005-2885 | | 2005-09-14 | The Downloads page in MAXdev MD-Pro 1.0.73, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which could all… | |
CVE-2005-2884 | | 2005-09-14 | Cross-site scripting (XSS) vulnerability in events.php in Land Down Under (LDU) 801 and earlier allows remote attackers to inject arbitrary web script or HTML… | |
CVE-2005-2882 | | 2005-09-14 | Multiple cross-site scripting (XSS) vulnerabilities in phpCommunityCalendar 4.0.3, and possibly earlier versions, allow remote attackers to inject arbitrary we… | |
CVE-2005-2881 | | 2005-09-14 | phpCommunityCalendar 4.0.3 allows remote attackers to bypass authentication and gain unauthorized access via a direct request to the admin directory. | |
CVE-2005-2880 | | 2005-09-14 | Multiple SQL injection vulnerabilities in phpCommunityCalendar 4.0.3, and possibly earlier versions, allow remote attackers to execute arbitrary SQL commands v… | |
CVE-2005-2879 | | 2005-09-14 | Advansysperu Software USB Lock Auto-Protect (AP) 1.5 uses a weak encryption scheme to encrypt passwords, which allows local users to gain sensitive information… | |
CVE-2005-2492 | | 2005-09-14 | The raw_sendmsg function in the Linux kernel 2.6 before 2.6.13.1 allows local users to cause a denial of service (change hardware state) or read from arbitrary… | |
CVE-2005-2490 | | 2005-09-14 | Stack-based buffer overflow in the sendmsg function call in the Linux kernel 2.6 before 2.6.13.1 allows local users to execute arbitrary code by calling sendms… | |
CVE-2005-1913 | | 2005-09-14 | The Linux kernel 2.6 before 2.6.12.1 allows local users to cause a denial of service (kernel panic) via a non group-leader thread executing a different program… | |
CVE-2005-2878 | | 2005-09-13 | Format string vulnerability in search.c in the imap4d server in GNU Mailutils 0.6 allows remote authenticated users to execute arbitrary code via format string… | |
CVE-2005-2876 | | 2005-09-13 | umount in util-linux 2.8 to 2.12q, 2.13-pre1, and 2.13-pre2, and other packages such as loop-aes-utils, allows local users with unmount permissions to gain pri… | |
CVE-2005-2875 | | 2005-09-13 | Py2Play allows remote attackers to execute arbitrary Python code via pickled objects, which Py2Play unpickles and executes. | |
CVE-2005-2874 | | 2005-09-13 | The is_path_absolute function in scheduler/client.c for the daemon in CUPS before 1.1.23 allows remote attackers to cause a denial of service (CPU consumption… | |
CVE-2005-2873 | | 2005-09-09 | The ipt_recent kernel module (ipt_recent.c) in Linux kernel 2.6.12 and earlier does not properly perform certain time tests when the jiffies value is greater t… | |
CVE-2005-2872 | | 2005-09-09 | The ipt_recent kernel module (ipt_recent.c) in Linux kernel before 2.6.12, when running on 64-bit processors such as AMD64, allows remote attackers to cause a… | |
CVE-2005-2871 | | 2005-09-09 | Buffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attackers to c… | |
CVE-2005-2870 | | 2005-09-08 | Unknown vulnerability in the net-svc script on Solaris 10 allows remote authenticated users to execute arbitrary code on a DHCP client via certain DHCP respons… | |
CVE-2005-2869 | | 2005-09-08 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the Userna… | |
CVE-2005-2868 | | 2005-09-08 | ZipTorrent 1.3.7.3 stores sensitive information in plaintext in the pref.txt file, which allows local users to obtain sensitive information such as proxy serve… | |
CVE-2005-2867 | | 2005-09-08 | SQL injection vulnerability in BlueWhaleCRM allows remote attackers to execute arbitrary SQL commands via the Account ID field. | |
CVE-2005-2866 | | 2005-09-08 | Mercora IMRadio 4.0.0.0 stores usernames and passwords in plaintext in the MercoraClient\Profiles registry key, which allows local users to gain privileges. | |
CVE-2005-2865 | | 2005-09-08 | Multiple PHP remote file inclusion vulnerabilities in aMember Pro 2.3.4 allow remote attackers to execute arbitrary PHP code via the config[root_dir] parameter… | |
CVE-2005-2864 | | 2005-09-08 | URBAN 1.5.3_1 allows local users to overwrite arbitrary files via a symlink attack on the (1) high score or (2) save game files. | |
CVE-2005-2863 | | 2005-09-08 | Cross-site scripting (XSS) vulnerability in openwebmail-main.pl in OpenWebMail 2.41 allows remote attackers to inject arbitrary web script or HTML via the sess… | |
CVE-2005-2862 | | 2005-09-08 | ADSL Road Runner modem in the Annex A family has a service running on port 224, which allows remote attackers to login to the modem with a blank password and g… | |
CVE-2005-2861 | | 2005-09-08 | Cross-site scripting (XSS) vulnerability in N-Stealth Commercial Edition before 5.8.0.38 and Free Edition before 5.8.1.03 allows remote attackers to inject arb… | |
CVE-2005-2860 | | 2005-09-08 | Cross-site scripting (XSS) vulnerability in Nikto 1.35 and earlier allows remote attackers to inject arbitrary web script or HTML via the Server field in an HT… | |
CVE-2005-2859 | | 2005-09-08 | Savant Web Server stores user credentials in plaintext in the Savant\Users registry key, which allows local users to gain privileges. | |
CVE-2005-2858 | | 2005-09-08 | The Fetch.FetchContact.1 ActiveX control (Fetch.dll) for Rediff Bol 7.0 allows remote attackers to read the Windows Address Book via the FullAddressBook method. | |
CVE-2005-2857 | | 2005-09-08 | Free SMTP Server 2.2 allows remote attackers to use the server as an open mail relay (spam proxy). | |
CVE-2005-2856 | | 2005-09-08 | Stack-based buffer overflow in the WinACE UNACEV2.DLL third-party compression utility before 2.6.0.0, as used in multiple products including (1) ALZip 5.51 thr… | |
CVE-2005-2855 | | 2005-09-08 | Cross-site scripting (XSS) vulnerability in Unclassified NewsBoard 1.5.3 allows remote attackers to inject arbitrary web script or HTML via the description fie… | |
CVE-2005-2854 | | 2005-09-08 | CRLF injection vulnerability in thesitewizard.com chfeedback.pl Feedback Form Perl Script 2.0.1 allows remote attackers to use the script as a mail relay (spam… | |
CVE-2005-2853 | | 2005-09-08 | Multiple cross-site scripting (XSS) vulnerabilities in GuppY 4.5.3a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the pg pa… | |
CVE-2005-2852 | | 2005-09-08 | Unknown vulnerability in CIFS.NLM in Novell Netware 6.5 SP2 and SP3, 5.1, and 6.0 allows remote attackers to cause a denial of service (ABEND) via an incorrect… | |
CVE-2005-2851 | | 2005-09-08 | smb4k 0.4 and other versions before 0.6.3 allows local users to read sensitive files via a symlink attack on the (1) smb4k.tmp or (2) sudoers temporary files. | |
CVE-2005-2850 | | 2005-09-08 | SlimFTPd 3.17 allows remote attackers to cause a denial of service (crash) via certain (1) USER and (2) PASS commands, possibly due to a buffer overflow or off… | |
CVE-2005-2849 | | 2005-09-08 | Argument injection vulnerability in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote attackers to (1) read portions of source code via… | |
CVE-2005-2848 | | 2005-09-08 | Directory traversal vulnerability in img.pl in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote attackers to read arbitrary files via a… | |
CVE-2005-2847 | | 2005-09-08 | img.pl in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote attackers to execute arbitrary commands via shell metacharacters in the f pa… | |
CVE-2005-2846 | | 2005-09-08 | PHP remote file inclusion vulnerability in lang.php in CMS Made Simple 0.10 and earlier allows remote attackers to execute arbitrary PHP code via the nls[file]… | |
CVE-2005-2845 | | 2005-09-08 | Ariba Spend Management System sends the username and password to the server in plaintext in a POST request, which allows remote attackers to obtain sensitive i… | |
CVE-2005-2844 | | 2005-09-08 | Buffer overflow in MMClient.exe in Indiatimes Messenger 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbit… | |
CVE-2005-2843 | | 2005-09-08 | Helpdesk software Hesk 0.92 does not properly verify usernames and passwords, which allows remote attackers to bypass authentication via a direct request to ad… | |
CVE-2005-2842 | | 2005-09-08 | Buffer overflow in dwrcs.exe in DameWare Mini Remote Control before 4.9.0 allows remote attackers to execute arbitrary code via the username. | |
CVE-2005-2841 | | 2005-09-08 | Buffer overflow in Firewall Authentication Proxy for FTP and/or Telnet Sessions for Cisco IOS 12.2ZH and 12.2ZL, 12.3 and 12.3T, and 12.4 and 12.4T allows remo… | |
CVE-2005-2020 | | 2005-09-08 | Directory traversal vulnerability in the web server for 3Com Network Supervisor 5.0.2 allows remote attackers to read arbitrary files via ".." sequences in the… | |
CVE-2005-2840 | | 2005-09-07 | Multiple unknown vulnerabilities in MAXdev MD-Pro 1.0.72 and earlier have unknown impact and unspecified attack vectors, in one or more of the (1) Download, (2… | |
CVE-2005-2839 | | 2005-09-07 | Multiple cross-site scripting (XSS) vulnerabilities in MAXdev MD-Pro 1.0.72 allow remote attackers to inject arbitrary web script or HTML via (1) dl-search.php… | |
CVE-2005-2838 | | 2005-09-07 | SQL injection vulnerability in login.php in myBloggie 2.1.3-beta and earlier allows remote attackers to execute arbitrary SQL commands via the username paramet… | |
CVE-2005-2837 | | 2005-09-07 | Multiple eval injection vulnerabilities in PlainBlack Software WebGUI before 6.7.3 allow remote attackers to execute arbitrary Perl code via (1) Help.pm, (2) I… | |
CVE-2005-2836 | | 2005-09-07 | Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the use… | |
CVE-2005-2820 | | 2005-09-07 | Cross-site scripting (XSS) vulnerability in SqWebMail 5.0.4 allows remote attackers to inject arbitrary web script or HTML via an e-mail message containing Int… | |
CVE-2005-2819 | | 2005-09-07 | DownFile 1.3 allows remote attackers to gain administrator privileges via a direct request to (1) update.php, (2) del.php, and (3) add_form.php. | |
CVE-2005-2818 | | 2005-09-07 | Cross-site scripting (XSS) vulnerability in DownFile 1.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter to (1) email.php,(… | |
CVE-2005-2817 | | 2005-09-07 | Simple Machines Forum (SMF) 1-0-5 and earlier supports the use of URLs for avatar images, which allows remote attackers to monitor sensitive information of for… | |
CVE-2005-2816 | | 2005-09-07 | Cross-site scripting (XSS) vulnerability in Greymatter allows remote attackers to inject arbitrary web script or HTML via a post comment, which is recorded in… | |
CVE-2005-2815 | | 2005-09-07 | print.php in FlatNuke 2.5.6 allows remote attackers to obtain sensitive information (path disclosure on error) or cause a denial of service (resource consumpti… | |
CVE-2005-2814 | | 2005-09-07 | Cross-site scripting (XSS) vulnerability in FlatNuke 2.5.6 allows remote attackers to inject arbitrary web script or HTML via the usr parameter in a vis_reg op… | |
CVE-2005-2813 | | 2005-09-07 | Directory traversal vulnerability in FlatNuke 2.5.6 and possibly earlier allows remote attackers to read arbitrary files via ".." sequences and "%00" (trailing… | |
CVE-2005-2812 | | 2005-09-07 | man2web allows remote attackers to execute arbitrary commands via -P arguments. | |
CVE-2005-2811 | | 2005-09-07 | Untrusted search path vulnerability in Net-SNMP 5.2.1.2 and earlier, on Gentoo Linux, installs certain Perl modules with an insecure DT_RPATH, which could allo… | |
CVE-2005-2810 | | 2005-09-07 | Multiple stack-based buffer overflows in urban before 1.5.3 allow local users to gain privileges via a long HOME environment variable to (1) config.cc, (2) gam… | |
CVE-2005-2809 | | 2005-09-07 | silc daemon (silcd.c) in Secure Internet Live Conferencing (SILC) 1.0 and earlier allows local users to overwrite arbitrary files via a symlink attack on the s… | |
CVE-2005-2808 | | 2005-09-07 | frox 0.7.16 and 0.7.17 does not properly parse certain Deny ACLs, which might allow attackers to bypass intended restrictions and access blocked hosts. | |
CVE-2005-2807 | | 2005-09-07 | frox 0.7.18, when running setuid root, does not properly drop privileges when reading a configuration file, which allows local users to read portions of arbitr… | |
CVE-2005-2796 | | 2005-09-07 | The sslConnectTimeout function in ssl.c for Squid 2.5.STABLE10 and earlier allows remote attackers to cause a denial of service (segmentation fault) via certai… | |
CVE-2005-2794 | | 2005-09-07 | store.c in Squid 2.5.STABLE10 and earlier allows remote attackers to cause a denial of service (crash) via certain aborted requests that trigger an assert erro… | |
CVE-2005-2763 | | 2005-09-06 | Multiple format string vulnerabilities in OpenTTD before 0.4.0.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary cod… | |
CVE-2005-2700 | | 2005-09-06 | ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVer… | |
CVE-2005-2656 | | 2005-09-06 | Polygen before 1.0.6 generates precompiled grammar objects with world-writable permissions, which allows local users to cause a denial of service (disk consump… | |
CVE-2005-2494 | | 2005-09-06 | kcheckpass in KDE 3.2.0 up to 3.4.2 allows local users to gain root access via a symlink attack on lock files. | |
CVE-2005-2806 | | 2005-09-06 | client.cpp in BNBT EasyTracker 7.7r3.2004.10.27 and earlier allows remote attackers to cause a denial of service (application hang) via an HTTP header containi… | |
CVE-2005-2805 | | 2005-09-06 | forum_post.php in e107 0.6 allows remote attackers to post to non-existent forums by modifying the forum number. |