2005 CVEs (page 32)
Page 32 of 47 — CVEs published in 2005, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2005-1686 | | 2005-05-20 | Format string vulnerability in gedit 2.10.2 may allow attackers to cause a denial of service (application crash) via a bin file with format string specifiers i… | |
CVE-2005-1685 | | 2005-05-20 | episodex guestbook allows remote attackers to bypass authentication and edit scripts via a direct request to admin.asp. | |
CVE-2005-1684 | | 2005-05-20 | Cross-site scripting (XSS) vulnerability in default.asp for episodex guestbook allows remote attackers to inject arbitrary web script or HTML via the Name fiel… | |
CVE-2005-1683 | | 2005-05-20 | Buffer overflow in winword.exe 10.2627.6714 and earlier in Microsoft Word for the Macintosh, before SP3 for Word 2002, allows remote attackers to cause a denia… | |
CVE-2005-1682 | | 2005-05-20 | JavaMail API, as used by Solstice Internet Mail Server POP3 2.0, does not properly validate the message number in the MimeMessage constructor in javax.mail.int… | |
CVE-2005-1681 | | 2005-05-20 | PHP remote file inclusion vulnerability in common.php in phpATM 1.21, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code via… | |
CVE-2005-1680 | | 2005-05-20 | D-Link DSL-502T, DSL-504T, DSL-562T, and DSL-G604T, when /cgi-bin/firmwarecfg is executed, allows remote attackers to bypass authentication (1) if their IP add… | |
CVE-2005-1679 | | 2005-05-20 | Stack-based buffer overflow in the error directive in picasm 1.12b and earlier allows attackers to execute arbitrary code via a long error message. | |
CVE-2005-1678 | | 2005-05-20 | Groove Virtual Office before 3.1 build 2338, before 3.1a build 2364, and Groove Workspace before 2.5n build 1871 does not properly display file extensions on a… | |
CVE-2005-1677 | | 2005-05-20 | Unknown vulnerability in Groove Virtual Office before 3.1 build 2338, before 3.1a build 2364, and Groove Workspace before 2.5n build 1871 allows remote attacke… | |
CVE-2005-1676 | | 2005-05-20 | Multiple cross-site scripting (XSS) vulnerabilities in Groove Mobile Workspace in Groove Virtual Office before 3.1 build 2338, before 3.1a build 2364, and Groo… | |
CVE-2005-1675 | | 2005-05-20 | Groove Virtual Office before 3.1 build 2338, before 3.1a build 2364, and Groove Workspace before 2.5n build 1871 installs the client installation directories w… | |
CVE-2005-1934 | | 2005-05-19 | Gaim before 1.3.1 allows remote attackers to cause a denial of service (crash) via a malformed MSN message that leads to a memory allocation of a large size, p… | |
CVE-2005-1674 | Medium | 6.5 | 2005-05-19 | Cross-Site Request Forgery (CSRF) vulnerability in Help Center Live allows remote attackers to perform actions as the administrator via a link or IMG tag to vi… |
CVE-2005-1673 | | 2005-05-19 | Multiple SQL injection vulnerabilities in Help Center Live allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to index.php, (2)… | |
CVE-2005-1672 | | 2005-05-19 | Multiple cross-site scripting (XSS) vulnerabilities in Help Center Live allow remote attackers to inject arbitrary web script or HTML via the (1) find paramete… | |
CVE-2005-1671 | | 2005-05-19 | The Logfile feature in Yahoo! Messenger 5.x through 6.0 can be activated by a YMSGR: URL and writes all output to a single ypager.log file, even when there are… | |
CVE-2005-1670 | | 2005-05-19 | Unknown vulnerability in Extreme BlackDiamond 10808 and 8800 switches running ExtremeWare XOS 11.1 before 11.1.3.3, 11.0 before 11.0.2.4, and 10.x allows remot… | |
CVE-2005-1472 | | 2005-05-19 | Certain system calls in Apple Mac OS X 10.4.1 do not properly enforce the permissions of certain directories without the POSIX read bit set, but with the execu… | |
CVE-2005-1455 | | 2005-05-19 | Buffer overflow in the sql_escape_func function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote attackers to cause a denial of service (crash). | |
CVE-2005-1454 | | 2005-05-19 | SQL injection vulnerability in the radius_xlat function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote authenticated users to execute arbitra… | |
CVE-2005-1260 | | 2005-05-19 | bzip2 allows remote attackers to cause a denial of service (hard drive consumption) via a crafted bzip2 file that causes an infinite loop (a.k.a "decompression… | |
CVE-2005-0392 | | 2005-05-19 | ppxp does not drop root privileges before opening log files, which allows local users to execute arbitrary commands. | |
CVE-2005-0040 | | 2005-05-19 | Multiple cross-site scripting (XSS) vulnerabilities in DotNetNuke before 3.0.12 allow remote attackers to inject arbitrary web script or HTML via the (1) regis… | |
CVE-2005-1668 | | 2005-05-18 | YusASP Web Asset Manager 1.0 allows remote attackers to gain privileges via a direct request to assetmanager.asp. | |
CVE-2005-1667 | | 2005-05-18 | DataTrac Activity Console 1.1 allows remote attackers to cause a denial of service via a long HTTP GET request. | |
CVE-2005-1666 | | 2005-05-18 | Multiple buffer overflows in Orenosv HTTP/FTP Server 0.8.1 allow remote authenticated users to cause a denial of service (server crash) and possibly execute ar… | |
CVE-2005-1665 | | 2005-05-18 | The __VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not cryptographically signed, allows remote attackers to cause a denial of service (CPU consumptio… | |
CVE-2005-1664 | | 2005-05-18 | The __VIEWSTATE functionality in Microsoft ASP.NET 1.x allows remote attackers to conduct replay attacks to (1) apply a ViewState generated from one view to a… | |
CVE-2005-1663 | | 2005-05-18 | Jeuce Personal Web Server 2.13 allows remote attackers to cause a denial of service (server crash) via a GET request beginning with "://". | |
CVE-2005-1662 | | 2005-05-18 | Directory traversal vulnerability in Jeuce Personal Web Server 2.13 allows remote attackers to read arbitrary files via a .. (dot dot) in the URL. | |
CVE-2005-1661 | | 2005-05-18 | Jeuce Personal Webserver 2.13 allows remote attackers to cause a denial of service (server crash) via a long GET request, possibly triggering a buffer overflow. | |
CVE-2005-1660 | | 2005-05-18 | HTMLJunction EZGuestbook stores the guestbook.mdb file under the web document root with insufficient access control, which allows remote attackers to obtain se… | |
CVE-2005-1659 | | 2005-05-18 | Cross-site scripting (XSS) vulnerability in filemanager.cpp in MyServer 0.8 allows remote attackers to inject arbitrary Javascript via a URL with a "..." (tri… | |
CVE-2005-1658 | | 2005-05-18 | Directory traversal vulnerability in filemanager.cpp in MyServer 0.8 allows remote attackers to list the parent directory of the web root via a URL with a "… | |
CVE-2005-1657 | | 2005-05-18 | Multiple directory traversal vulnerabilities in Mercur Messaging 2005 SP2 allow remote attackers to perform unauthorized file operations via the Folder.Id para… | |
CVE-2005-1656 | | 2005-05-18 | Mercur Messaging 2005 SP2 allows remote attackers to read the source code of .ctml files via a URL with a trailing hex-encoded space ("%20"). | |
CVE-2005-1655 | | 2005-05-18 | AOL Instant Messenger 5.5.x and earlier allows remote attackers to cause a denial of service (client crash) via an invalid smiley icon location in the sml para… | |
CVE-2005-1654 | | 2005-05-18 | Hosting Controller 6.1 Hotfix 1.9 and earlier allows remote attackers to register arbitrary users via a direct request to addsubsite.asp with the loginname and… | |
CVE-2005-1653 | | 2005-05-18 | Cross-site scripting (XSS) vulnerability in message.htm for Woppoware PostMaster 4.2.2 (build 3.2.5) allows remote attackers to inject arbitrary web script or… | |
CVE-2005-1652 | | 2005-05-18 | message.htm for Woppoware PostMaster 4.2.2 (build 3.2.5) allows remote attackers to bypass authentication by modifying the email parameter. | |
CVE-2005-1651 | | 2005-05-18 | Directory traversal vulnerability in message.htm for Woppoware PostMaster 4.2.2 (build 3.2.5) allows remote attackers to determine the existence of arbitrary f… | |
CVE-2005-1650 | | 2005-05-18 | The web mail service in Woppoware PostMaster 4.2.2 (build 3.2.5) generates different error messages depending on whether a user exists or not, which allows rem… | |
CVE-2005-1649 | | 2005-05-18 | The IPv6 support in Windows XP SP2, 2003 Server SP1, and Longhorn, with Windows Firewall turned off, allows remote attackers to cause a denial of service (CPU… | |
CVE-2005-1648 | | 2005-05-18 | Gurgens (GASoft) Ultimate Forum 1.0 stores the db/Genid.dat database file under the web document root with insufficient access control, which allows remote att… | |
CVE-2005-1647 | | 2005-05-18 | Gurgens (GASoft) Guest Book 2.1 stores the db/Genid.dat database file under the web document root with insufficient access control, which allows remote attacke… | |
CVE-2005-1646 | | 2005-05-18 | The default installation of Fastream NETFile FTP/Web Server 7.4.6, which supports FXP, does not require that the IP address in a PORT command be the same as th… | |
CVE-2005-1645 | | 2005-05-18 | Keyvan1 ImageGallery stores the image.mdb database under the web document root with insufficient access control, which allows remote attackers to obtain sensit… | |
CVE-2005-1644 | | 2005-05-18 | Cross-site scripting (XSS) vulnerability in guestbook.php for 1Two Livre d'Or 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) li… | |
CVE-2005-0757 | | 2005-05-18 | The xattr file system code, as backported in Red Hat Enterprise Linux 3 on 64-bit systems, does not properly handle certain offsets, which allows local users t… | |
CVE-2005-0515 | | 2005-05-18 | Smc.exe in My Firewall Plus 5.0 build 1117, and possibly other versions, does not drop privileges before launching the Log Viewer export functionality, which a… | |
CVE-2005-0134 | | 2005-05-18 | The X server in SCO UnixWare 7.1.1, 7.1.3, and 7.1.4 does not properly create socket directories in /tmp, which could allow attackers to hijack local sockets. | |
CVE-2005-1643 | | 2005-05-17 | The ZCom_BitStream::Deserialize function in Zoidcom 1.0 beta 4 and earlier allows remote attackers to cause a denial of service via a crafted UDP packet with a… | |
CVE-2005-1642 | | 2005-05-17 | SQL injection vulnerability in the verify_email function in Woltlab Burning Board 2.x and earlier allows remote attackers to execute arbitrary SQL commands via… | |
CVE-2005-1641 | | 2005-05-17 | mod_channel in The Ignition Project ignitionServer 0.3.0 to 0.3.6, and possibly earlier versions, does not allow protected operators to access channels that ha… | |
CVE-2005-1640 | | 2005-05-17 | mod_channel.bas in The Ignition Project ignitionServer 0.3.0 to 0.3.6, and possibly earlier versions, does not properly verify whether a host has the owner pri… | |
CVE-2005-1639 | | 2005-05-17 | SQL injection vulnerability in Sigmaweb.DLL in Sigma ISP Manager 6.6 allows remote attackers to execute arbitrary SQL commands via the (1) username, (2) passwo… | |
CVE-2005-1638 | | 2005-05-17 | The _writeAttrs function in SafeHTML before 1.3.2 does not properly handle quotes in attribute values, which could allow remote attackers to exploit cross-site… | |
CVE-2005-1637 | | 2005-05-17 | Multiple SQL injection vulnerabilities in NPDS 4.8 and 5.0 allow remote attackers to execute arbitrary SQL commands via the thold parameter to (1) comments.php… | |
CVE-2005-1636 | | 2005-05-17 | mysql_install_db in MySQL 4.1.x before 4.1.12 and 5.x up to 5.0.4 creates the mysql_install_db.X file with a predictable filename and insecure permissions, whi… | |
CVE-2005-1635 | | 2005-05-17 | JGS-XA JGS-Portal 3.0.2 and earlier allows remote attackers to obtain the full server path via direct requests to (1) jgs_portal_ref.php, (2) jgs_portal_land.p… | |
CVE-2005-1634 | | 2005-05-17 | Multiple cross-site scripting (XSS) vulnerabilities in JGS-XA JGS-Portal 3.0.2 and earlier allow remote attackers to inject arbitrary web script or HTML via th… | |
CVE-2005-1633 | | 2005-05-17 | Multiple SQL injection vulnerabilities in JGS-XA JGS-Portal 3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) anzahl_beitr… | |
CVE-2005-1632 | | 2005-05-17 | Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitr… | |
CVE-2005-1631 | | 2005-05-17 | booby.php in Booby 1.0.0 and earlier allows remote attackers to view private bookmarks by guessing item IDs. | |
CVE-2005-1630 | | 2005-05-17 | Unknown vulnerability in Attachment Mod before 2.3.13, related to a "serious issue with realnames," has unknown impact and attack vectors. | |
CVE-2005-1629 | | 2005-05-17 | SQL injection vulnerability in member.php for Photopost PHP Pro allows remote attackers to execute arbitrary SQL commands via the verifykey parameter. | |
CVE-2005-1628 | | 2005-05-17 | apage.cgi in WebAPP 0.9.9.2.1, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the f parameter. | |
CVE-2005-1627 | | 2005-05-17 | Unknown vulnerability in Viewglob before 2.0.1, related to "a potential security issue with the Viewglob display and ssh X forwarding," has unknown impact. | |
CVE-2005-1626 | | 2005-05-17 | Multiple buffer overflows in handlers.c for Pico Server (pServ) before 3.3 may allow attackers to execute arbitrary code. | |
CVE-2005-1589 | | 2005-05-17 | The pkt_ioctl function in the pktcdvd block device ioctl handler (pktcdvd.c) in Linux kernel 2.6.12-rc4 and earlier calls the wrong function before passing an… | |
CVE-2005-1307 | | 2005-05-17 | The (1) stopserver.sh and (2) startserver.sh scripts in Adobe Version Cue on Mac OS X uses the current working directory to find and execute the productname.sh… | |
CVE-2005-1264 | | 2005-05-17 | Raw character devices (raw.c) in the Linux kernel 2.6.x call the wrong function before passing an ioctl to the block device, which crosses security boundaries… | |
CVE-2005-1622 | | 2005-05-16 | Cross-site scripting (XSS) vulnerability in productsByCategory.asp in MetaCart e-Shop allows remote attackers to inject arbitrary web script or HTML via the st… | |
CVE-2005-1621 | | 2005-05-16 | Directory traversal vulnerability in the pnModFunc function in pnMod.php for PostNuke 0.750 through 0.760rc4 allows remote attackers to read arbitrary files vi… | |
CVE-2005-1620 | | 2005-05-16 | Cross-site scripting (XSS) vulnerability in Skull-Splitter Guestbook 1.0, 2.0 and 2.2 allows remote attackers to inject arbitrary web script or HTML via the (1… | |
CVE-2005-1619 | | 2005-05-16 | Multiple cross-site scripting (XSS) vulnerabilities in (1) start_page.css.php3 (aka start-page.css.php3) or (2) style.css.php3 in PHPMyChat 0.14.5 allow remote… | |
CVE-2005-1618 | | 2005-05-16 | The YMSGR URL handler in Yahoo! Messenger 5.x through 6.0 allows remote attackers to cause a denial of service (disconnect) via a room login or a room join req… | |
CVE-2005-1617 | | 2005-05-16 | Willings WebCam and WebCam Lite 2.8 and earlier stores the password in memory in plaintext, which allows local users to gain sensitive information. | |
CVE-2005-1616 | | 2005-05-16 | viewforum.php in Ultimate PHP Board (UPB) 1.8 through 1.9.6 allows remote attackers to obtain sensitive information via an invalid (1) id or possibly (2) posto… | |
CVE-2005-1615 | | 2005-05-16 | viewforum.php in Ultimate PHP Board (UPB) 1.8 through 1.9.6 may allow remote attackers to read sensitive data via the postorder parameter, which is not properl… | |
CVE-2005-1614 | | 2005-05-16 | Cross-site scripting (XSS) vulnerability in viewforum.php in Ultimate PHP Board (UPB) 1.8 through 1.9.6 allows remote attackers to inject arbitrary web script… | |
CVE-2005-1613 | | 2005-05-16 | Cross-site scripting (XSS) vulnerability in member.php in Open Bulletin Board (OpenBB) 1.0.8 allows remote attackers to inject arbitrary web script or HTML via… | |
CVE-2005-1612 | | 2005-05-16 | SQL injection vulnerability in read.php in Open Bulletin Board (OpenBB) 1.0.8 allows remote attackers to execute arbitrary SQL commands via the TID parameter. | |
CVE-2005-1611 | | 2005-05-16 | Cross-site scripting (XSS) vulnerability in WebX in Web Crossing 5.x allows remote attackers to inject arbitrary web script or HTML via a URL with an "@" follo… | |
CVE-2005-1610 | | 2005-05-16 | Cross-site scripting (XSS) vulnerability in security.php for Tru-Zone NukeET 3.0 and 3.1 allows remote attackers to inject arbitrary web script or HTML via a b… | |
CVE-2005-1609 | | 2005-05-16 | Unknown vulnerability in Sun StorEdge 6130 Arrays (SE6130) with serial numbers between 0451AWF00G and 0513AWF00J allows local users and remote attackers to del… | |
CVE-2005-1608 | | 2005-05-16 | Multiple unknown vulnerabilities in the Blocks module in Spidean AutoTheme 1.7 and AT-Lite for PostNuke have unknown impact. | |
CVE-2005-1607 | | 2005-05-16 | Cross-site scripting (XSS) vulnerability in shop.cgi in Remote Cart allows remote attackers to inject arbitrary web script or HTML via the (1) merchant or (2)… | |
CVE-2005-1606 | | 2005-05-16 | H-Sphere Winbox 2.4.2 and 2.4.3 RC1 stores sensitive information such as username and password in plaintext in world-readable log files, which allows local use… | |
CVE-2005-1605 | | 2005-05-16 | Cross-site scripting (XSS) vulnerability in the guestbook for SiteStudio 1.6 allows remote attackers to inject arbitrary web script or HTML via the name field… | |
CVE-2005-1604 | | 2005-05-16 | PHP Advanced Transfer Manager (phpATM) 1.21 allows remote attackers to upload arbitrary files via filenames containing multiple file extensions, as demonstrate… | |
CVE-2005-1603 | | 2005-05-16 | NiteEnterprises Remote File Manager 1.0 allows remote attackers to cause a denial of service (crash) via a crafted string to TCP port 7080. | |
CVE-2005-1602 | | 2005-05-16 | SQL injection vulnerability in login.asp for Net56 Browser Based File Manager 1.0 allows remote attackers to execute arbitrary SQL commands and bypass authenti… | |
CVE-2005-1601 | | 2005-05-16 | MRO Maximo Self Service 4 and 5 stores certain information under the web document root using file extensions that are not processed by Tomcat, which allows rem… | |
CVE-2005-1600 | | 2005-05-16 | A "mathematical flaw" in the implementation of the El Gamal signature algorithm for LibTomCrypt 1.0 to 1.0.2 allows attackers to generate valid signatures with… | |
CVE-2005-1599 | | 2005-05-16 | Cross-site scripting (XSS) vulnerability in Kryloff Technologies Subject Search Server (SSServer) 1.1 allows remote attackers to inject arbitrary web script or… | |
CVE-2005-1598 | | 2005-05-16 | SQL injection vulnerability in Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via a crafted cookie pass… | |
CVE-2005-1597 | | 2005-05-16 | Cross-site scripting (XSS) vulnerability in (1) search.php and (2) topics.php for Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to injec… | |
CVE-2005-1596 | | 2005-05-16 | index.php in Fusion SBX 1.2 and earlier does not properly use the extract function, which allows remote attackers to bypass authentication by setting the is_lo… |