2005 CVEs (page 22)
Page 22 of 47 — CVEs published in 2005, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2005-2803 | | 2005-09-06 | Cross-site scripting (XSS) vulnerability in Hiki 0.8.1 to 0.8.2 allows remote attackers to inject arbitrary web script or HTML via a page name in a Login link… | |
CVE-2005-2336 | | 2005-09-06 | Cross-site scripting (XSS) vulnerability in Hiki 0.8.0 to 0.8.2 allows remote attackers to inject arbitrary web script or HTML via "missing pages" in which the… | |
CVE-2005-2801 | High | 7.5 | 2005-09-06 | xattr.c in the ext2 and ext3 file system code for Linux kernel 2.6 does not properly compare the name_index fields when sharing xattr blocks, which could preve… |
CVE-2005-2800 | | 2005-09-06 | Memory leak in the seq_file implementation in the SCSI procfs interface (sg.c) in Linux kernel 2.6.13 and earlier allows local users to cause a denial of servi… | |
CVE-2005-2798 | | 2005-09-06 | sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, allows GSSAPI credentials to be delegated to clients who log in using non-GSSAPI methods… | |
CVE-2005-2797 | | 2005-09-06 | OpenSSH 4.0, and other versions before 4.2, does not properly handle dynamic port forwarding ("-D" option) when a listen address is not provided, which may cau… | |
CVE-2005-2793 | | 2005-09-02 | PHP remote file inclusion vulnerability in welcome.php in phpLDAPadmin 0.9.6 and 0.9.7 allows remote attackers to execute arbitrary PHP code via the custom_wel… | |
CVE-2005-2792 | | 2005-09-02 | Directory traversal vulnerability in welcome.php in phpLDAPadmin 0.9.6 and 0.9.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the cust… | |
CVE-2005-2791 | | 2005-09-02 | BFCommand & Control Server Manager BFCC 1.22_A and earlier, and BFVCC 2.14_B and earlier, allows remote attackers to cause a denial of service (refused new con… | |
CVE-2005-2790 | | 2005-09-02 | BFCommand & Control Server Manager BFCC 1.22_A and earlier, and BFVCC 2.14_B and earlier, relies on the client to enforce permissions and perform actions such… | |
CVE-2005-2789 | | 2005-09-02 | BFCommand & Control Server Manager BFCC 1.22_A and earlier, and BFVCC 2.14_B and earlier, allows remote attackers to bypass authentication via (1) an unknown a… | |
CVE-2005-2788 | | 2005-09-02 | Multiple SQL injection vulnerabilities in Land Down Under (LDU) 801 and earlier allow remote attackers to execute arbitrary SQL commands via the c parameter to… | |
CVE-2005-2787 | | 2005-09-02 | comment_delete_cgi.php in Simple PHP Blog allows remote attackers to delete arbitrary files via the comment parameter. | |
CVE-2005-2786 | | 2005-09-02 | Directory traversal vulnerability in bestmail_edit.cgi in cosmoshop 8.10.78 and earlier allows remote administrators to read arbitrary files via ".." sequences… | |
CVE-2005-2785 | | 2005-09-02 | cosmoshop 8.10.78 and earlier stores passwords in plaintext in the database, which allows local users to obtain sensitive information. | |
CVE-2005-2784 | | 2005-09-02 | SQL injection vulnerability in the login function for the administration login panel in cosmoshop 8.10.78 allows remote attackers to execute arbitrary SQL comm… | |
CVE-2005-2783 | | 2005-09-02 | Cross-site scripting (XSS) vulnerability in PHP-Fusion 6.00.107 and earlier allows remote attackers to inject arbitrary web script or HTML via nested, malforme… | |
CVE-2005-2782 | | 2005-09-02 | PHP remote file inclusion vulnerability in al_initialize.php for AutoLinks Pro 2.1 allows remote attackers to execute arbitrary PHP code via an "ftp://" URL in… | |
CVE-2005-2781 | | 2005-09-02 | The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitrary PHP code via a… | |
CVE-2005-2780 | | 2005-09-02 | Cross-site scripting (XSS) vulnerability in Land Down Under (LDU) allows remote attackers to inject arbitrary web script or HTML via a signature. | |
CVE-2005-2779 | | 2005-09-02 | The iTAN Online-Banking Security System allows remote attackers to obtain TAN numbers via a man-in-the-middle (MITM) attack while the transaction is taking pla… | |
CVE-2005-2778 | | 2005-09-02 | SQL injection vulnerability in member.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL statements via the fid parameter. | |
CVE-2005-2777 | | 2005-09-02 | Looking Glass 20040427 allows remote attackers to execute arbitrary commands via shell metacharacters in the DNS lookup query field. | |
CVE-2005-2776 | | 2005-09-02 | Multiple cross-site scripting (XSS) vulnerabilities in Looking Glass 20040427 allow remote attackers to inject arbitrary web script or HTML via the (1) version… | |
CVE-2005-2775 | | 2005-09-02 | php_api.php in phpWebNotes 2.0.0 uses the extract function to modify key variables such as $t_path_core, which leads to a PHP file inclusion vulnerability that… | |
CVE-2005-2774 | | 2005-09-02 | Format string vulnerability in Lithium II mod 1.24 for Quake 2 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitra… | |
CVE-2005-2773 | Critical | 9.8 | 2005-09-02 | HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to c… |
CVE-2005-2772 | | 2005-09-02 | Multiple stack-based buffer overflows in University of Minnesota gopher client 3.0.9 allow remote malicious servers to execute arbitrary code via (1) a long "+… | |
CVE-2005-2771 | | 2005-09-02 | WRQ Reflection for Secure IT Windows Server 6.0 (formerly known as F-Secure SSH server) processes access and deny lists in a case-sensitive manner, when previo… | |
CVE-2005-2770 | | 2005-09-02 | WRQ Reflection for Secure IT Windows Server 6.0 (formerly known as F-Secure SSH server) does not properly handle when the Windows Administrator or Guest accoun… | |
CVE-2005-2769 | | 2005-09-02 | Cross-site scripting (XSS) vulnerability in SqWebMail 5.0.4 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via an H… | |
CVE-2005-2768 | | 2005-09-02 | Heap-based buffer overflow in the Sophos Antivirus Library, as used by Sophos Antivirus, PureMessage, MailMonitor, and other products, allows remote attackers… | |
CVE-2005-2767 | | 2005-09-02 | Buffer overflow in LeapFTP allows remote attackers to execute arbitrary code via a long Host string in a Site Queue (.lsq) file. | |
CVE-2005-1857 | | 2005-09-02 | Format string vulnerability in simpleproxy before 3.4 allows remote malicious HTTP proxies to execute arbitrary code via format string specifiers in a reply. | |
CVE-2005-2496 | | 2005-09-02 | The xntpd ntp (ntpd) daemon before 4.2.0b, when run with the -u option and using a string to specify the group, uses the group ID of the user instead of the gr… | |
CVE-2005-1915 | | 2005-09-02 | The log4sh_readProperties function in log4sh 1.2.5 and earlier allows local users to overwrite arbitrary files via a symlink attack on predictable log4sh.$$ fi… | |
CVE-2005-2766 | | 2005-09-02 | Symantec AntiVirus Corporate Edition 9.0.1.x and 9.0.4.x, and possibly other versions, when obtaining updates from an internal LiveUpdate server, stores sensit… | |
CVE-2005-2765 | | 2005-09-01 | The user interface in the Windows Firewall does not properly display certain malformed entries in the Windows Registry, which makes it easier for attackers wit… | |
CVE-2005-0403 | | 2005-09-01 | init_dev in tty_io.c in the Red Hat backport of NPTL to Red Hat Enterprise Linux 3 does not properly clear controlling tty's in multi-threaded applications, wh… | |
CVE-2005-2761 | | 2005-08-31 | Cross-site scripting (XSS) vulnerability in phpGroupWare 0.9.16.000 allows administrators to inject arbitrary web script or HTML by modifying the main screen m… | |
CVE-2005-2655 | | 2005-08-30 | lockmail in maildrop before 1.5.3 does not drop privileges before executing commands, which allows local users to gain privileges via command line arguments. | |
CVE-2005-2654 | | 2005-08-30 | phpldapadmin before 0.9.6c allows remote attackers to gain anonymous access to the LDAP server, even when disable_anon_bind is set, via an HTTP request to logi… | |
CVE-2005-2737 | | 2005-08-30 | Cross-site scripting (XSS) vulnerability in PhotoPost PHP Pro 5.1 allows remote attackers to inject arbitrary web script or HTML via EXIF data, such as the Cam… | |
CVE-2005-2736 | | 2005-08-30 | Cross-site scripting (XSS) vulnerability in YaPig 0.95 and earlier allows remote attackers to inject arbitrary web script or HTML via EXIF data, such as the Ca… | |
CVE-2005-2735 | | 2005-08-30 | Cross-site scripting (XSS) vulnerability in phpGraphy 0.9.9a and earlier allows remote attackers to inject arbitrary web script or HTML via EXIF data, such as… | |
CVE-2005-2734 | | 2005-08-30 | Cross-site scripting (XSS) vulnerability in Gallery 1.5.1-RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via EXIF data, such as… | |
CVE-2005-2733 | | 2005-08-30 | upload_img_cgi.php in Simple PHP Blog (SPHPBlog) does not properly restrict file extensions of uploaded files, which could allow remote attackers to execute ar… | |
CVE-2005-2732 | | 2005-08-30 | AWStats 6.4, and possibly earlier versions, allows remote attackers to obtain sensitive information via a file that does not exist in the config parameter, whi… | |
CVE-2005-2731 | | 2005-08-30 | Directory traversal vulnerability in Astaro Security Linux 6.0, when using Webmin, allows remote authenticated webmin users to read arbitrary files via a .. (… | |
CVE-2005-2730 | | 2005-08-30 | The HTTP proxy in Astaro Security Linux 6.0 allows remote attackers to obtain sensitive information via an invalid request, which reveals a Proxy-authorization… | |
CVE-2005-2729 | | 2005-08-30 | The HTTP proxy in Astaro Security Linux 6.0 does not properly filter HTTP CONNECT requests to localhost, which allows remote attackers to bypass firewall rules… | |
CVE-2005-2728 | | 2005-08-30 | The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Ran… | |
CVE-2005-2727 | | 2005-08-30 | Home Ftp Server 1.0.7 stores sensitive user information and server information in the same directory as the user's home directory, which allows remote authenti… | |
CVE-2005-2726 | | 2005-08-30 | Directory traversal vulnerability in Home Ftp Server 1.0.7 allows remote authenticated users to read arbitrary files via "C:\" (Windows drive letter) sequences… | |
CVE-2005-2725 | | 2005-08-30 | The inputtrap utility in QNX RTOS 6.1.0, 6.3, and possibly earlier versions does not properly check permissions when the -t flag is specified, which allows loc… | |
CVE-2005-2724 | | 2005-08-30 | Cross-site scripting (XSS) vulnerability in SqWebMail 5.0.4 allows remote attackers to inject arbitrary web script or HTML via a file attachment that is proces… | |
CVE-2005-2723 | | 2005-08-30 | SQL injection vulnerability in auth.php in PaFileDB 3.1, when authmethod is set to cookies, allows remote attackers to execute arbitrary SQL commands via the u… | |
CVE-2005-2722 | | 2005-08-30 | Foojan PHP Weblog allows remote attackers to obtain sensitive information via (1) a direct request to /daylinks/index.php or (2) a negative value in the daylin… | |
CVE-2005-2721 | | 2005-08-30 | Multiple cross-site scripting (XSS) vulnerabilities in (1) index.php or (2) admin.php in Foojan PHP Weblog allow remote attackers to inject arbitrary web scrip… | |
CVE-2005-2720 | | 2005-08-30 | Stack-based buffer overflow in the ACE archive decompression library (vrAZace.dll) in HAURI Anti-Virus products including ViRobot Expert 4.0, Advanced Server… | |
CVE-2005-2719 | | 2005-08-30 | Ventrilo 2.1.2 through 2.3.0 allows remote attackers to cause a denial of service (application crash) via a status packet that contains less data than specifie… | |
CVE-2005-2017 | | 2005-08-30 | Symantec AntiVirus 9 Corporate Edition allows local users to gain privileges via the "Scan for viruses" option, which launches a help window with raised privil… | |
CVE-2005-1856 | | 2005-08-30 | The CD-burning feature in backup-manager 0.5.8 and earlier uses a fixed filename in a world-writable directory for logging, which allows local users to overwri… | |
CVE-2005-1855 | | 2005-08-30 | Backup Manager (backup-manager) before 0.5.8 creates backup files with world-readable default permissions, which allows local users to obtain sensitive informa… | |
CVE-2005-2718 | | 2005-08-29 | Buffer overflow in ad_pcm.c in MPlayer 1.0pre7 and earlier allows remote attackers to execute arbitrary code via crafted PCM audio data, as demonstrated using… | |
CVE-2005-2717 | | 2005-08-29 | PHP remote file inclusion vulnerability in WebCalendar before 1.0.1 allows remote attackers to execute arbitrary PHP code when opening settings.php, possibly v… | |
CVE-2005-2716 | | 2005-08-29 | The event_pin_code_request function in the btsrv daemon (btsrv.c) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary commands via shel… | |
CVE-2005-2699 | | 2005-08-26 | Unrestricted file upload vulnerability in admin/admin.php in PHPKit 1.6.1 allows remote authenticated administrators to execute arbitrary PHP code by uploading… | |
CVE-2005-2698 | | 2005-08-26 | Cross-site scripting (XSS) vulnerability in browse.php in Nephp Publisher Enterprise 3.04 allows remote attackers to inject arbitrary web script or HTML via a… | |
CVE-2005-2697 | | 2005-08-26 | SQL injection vulnerability in search.php for MyBulletinBoard (MyBB) 1.00 Release Candidate 1 through 4 allows remote attackers to execute arbitrary SQL comman… | |
CVE-2005-2696 | | 2005-08-26 | IBM Lotus Notes does not properly restrict access to password hashes in the Notes Address Book (NAB), which allows remote attackers to obtain sensitive informa… | |
CVE-2005-2695 | | 2005-08-26 | Unspecified vulnerability in the SSL certificate checking functionality in Cisco CiscoWorks Management Center for IDS Sensors (IDSMC) 2.0 and 2.1, and Monitori… | |
CVE-2005-2694 | | 2005-08-26 | Buffer overflow in WinAce 2.6.0.5, and possibly earlier versions, allows remote attackers to execute arbitrary code via a temporary (.tmp) file that contains a… | |
CVE-2005-2693 | | 2005-08-26 | cvsbug in CVS 1.12.12 and earlier creates temporary files insecurely, which allows local users to overwrite arbitrary files and execute arbitrary code via a sy… | |
CVE-2005-2692 | | 2005-08-24 | Multiple SQL injection vulnerabilities in RunCMS 1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) addquery and (2) subquery… | |
CVE-2005-2691 | | 2005-08-24 | includes/common.php in RunCMS 1.2 and earlier calls the extract function with EXTR_OVERWRITE on HTTP POST variables, which allows remote attackers to overwrite… | |
CVE-2005-2690 | | 2005-08-24 | SQL injection vulnerability in the Downloads module in PostNuke 0.760-RC4b allows PostNuke administrators to execute arbitrary SQL commands via the show parame… | |
CVE-2005-2689 | | 2005-08-24 | Multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.760-RC4b allows remote attackers to inject arbitrary web script or HTML via (1) the moderate… | |
CVE-2005-2688 | | 2005-08-24 | Multiple cross-site scripting (XSS) vulnerabilities in SaveWebPortal 3.4 allow remote attackers to inject arbitrary web script or HTML via a large number of pa… | |
CVE-2005-2687 | | 2005-08-24 | PHP remote file inclusion vulnerability in SaveWebPortal 3.4 allows remote attackers to execute arbitrary PHP code via the (1) SITE_Path parameter to menu_dx.p… | |
CVE-2005-2686 | | 2005-08-24 | Directory traversal vulnerability in SaveWebPortal 3.4 allows remote attackers to include arbitrary files and execute arbitrary local PHP programs via ".." seq… | |
CVE-2005-2685 | | 2005-08-24 | SaveWebPortal 3.4 allows remote attackers to execute arbitrary PHP code via a direct request to admin/PhpMyExplorer/editerfichier.php, then editing the desired… | |
CVE-2005-2556 | | 2005-08-24 | core/database_api.php in Mantis 0.19.0a1 through 1.0.0a3, with register_globals enabled, allows remote attackers to connect to internal databases by modifying… | |
CVE-2005-2534 | | 2005-08-24 | Race condition in OpenVPN before 2.0.1, when --duplicate-cn is not enabled, allows remote attackers to cause a denial of service (server crash) via simultaneou… | |
CVE-2005-2533 | | 2005-08-24 | OpenVPN before 2.0.1, when running in "dev tap" Ethernet bridging mode, allows remote authenticated clients to cause a denial of service (memory exhaustion) vi… | |
CVE-2005-2532 | | 2005-08-24 | OpenVPN before 2.0.1 does not properly flush the OpenSSL error queue when a packet can not be decrypted by the server, which allows remote authenticated attack… | |
CVE-2005-2531 | | 2005-08-24 | OpenVPN before 2.0.1, when running with "verb 0" and without TLS authentication, does not properly flush the OpenSSL error queue when a client fails certificat… | |
CVE-2005-1843 | | 2005-08-24 | VCNative for Adobe Version Cue 1.0 and 1.0.1, as used in Creative Suite 1.0 and 1.3, and when running on Mac OS X with Version Cue Workspace, allows local user… | |
CVE-2005-1842 | | 2005-08-24 | VCNative for Adobe Version Cue 1.0 and 1.0.1, as used in Creative Suite 1.0 and 1.3, and when running on Mac OS X with Version Cue Workspace, creates temporary… | |
CVE-2005-2684 | | 2005-08-23 | nquser.php in Virtual Edge Netquery 3.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the host parameter to a dig query. | |
CVE-2005-2683 | | 2005-08-23 | Multiple SQL injection vulnerabilities in PHPKit 1.6.1 allow remote attackers to execute arbitrary SQL commands via the (1) letter parameter to login/member.ph… | |
CVE-2005-2682 | | 2005-08-23 | aspell_setup.php in the SpellChecker plugin in DTLink AreaEdit before 0.4.3 allows remote attackers to execute arbitrary commands via shell metacharacters in t… | |
CVE-2005-2681 | | 2005-08-23 | Unspecified vulnerability in the command line processing (CLI) logic in Cisco Intrusion Prevention System 5.0(1) and 5.0(2) allows local users with OPERATOR or… | |
CVE-2005-2680 | | 2005-08-23 | Unspecified vulnerability in BEA WebLogic Portal 8.1 through SP4, when using entitlements, allows remote attackers to bypass access restrictions for the pages… | |
CVE-2005-2679 | | 2005-08-23 | Buffer overflow in Sysinternals Process Explorer 9.23, and other versions before 9.25, allows local users to execute arbitrary code via a long CompanyName fiel… | |
CVE-2005-2678 | | 2005-08-23 | Microsoft IIS 5.1 and 6 allows remote attackers to spoof the SERVER_NAME variable to bypass security checks and conduct various attacks via a GET request with… | |
CVE-2005-2677 | | 2005-08-23 | ACNews stores the database in a file under the web document root with a db.inc extension and insufficient access control, which allows remote attackers to obta… | |
CVE-2005-2676 | | 2005-08-23 | Cross-site scripting (XSS) vulnerability in displayimage.php in Coppermine Photo Gallery before 1.3.4 allows remote attackers to inject arbitrary web script or… | |
CVE-2005-2675 | | 2005-08-23 | Note: the vendor has disputed this issue. Multiple SQL injection vulnerabilities in Land Down Under (LDU) 800 allow remote attackers to execute arbitrary SQL c… | |
CVE-2005-2674 | | 2005-08-23 | Note: the vendor has disputed this issue. Multiple cross-site scripting (XSS) vulnerabilities in Land Down Under (LDU) 800 allow remote attackers to inject arb… |