2005 CVEs (page 35)
Page 35 of 47 — CVEs published in 2005, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2005-1397 | | 2005-05-03 | SQL injection vulnerability in search.php for PHP-Calendar before 0.10.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors. | |
CVE-2005-1396 | | 2005-05-03 | Race condition in Ce/Ceterm (aka ARPUS/Ce) 2.5.4 and earlier allows local users to write to arbitrary files via a symlink attack on the ce_edit_log temporary f… | |
CVE-2005-1395 | | 2005-05-03 | Buffer overflow in Ce/Ceterm (aka ARPUS/Ce) 2.5.4 and earlier may allow local users to gain privileges via a long (1) XAPPLRESLANGPATH or (2) XAPPLRESDIR envir… | |
CVE-2005-1394 | | 2005-05-03 | Format string vulnerability in ArcGIS for ESRI ArcInfo Workstation 9.0 allows local users to gain privileges via format string specifiers in the ARCHOME enviro… | |
CVE-2005-1393 | | 2005-05-03 | Multiple buffer overflows in ArcGIS for ESRI ArcInfo Workstation 9.0 allow local users to execute arbitrary code via long command line arguments to (1) asmaste… | |
CVE-2005-1392 | | 2005-05-03 | The SQL install script in phpMyAdmin 2.6.2 is created with world-readable permissions, which allows local users to obtain the initial database password by read… | |
CVE-2005-1391 | | 2005-05-03 | Buffer overflow in the add_port function in APSIS Pound 1.8.2 and earlier allows remote attackers to execute arbitrary code via a long Host HTTP header. | |
CVE-2005-1388 | | 2005-05-03 | Cross-site scripting (XSS) vulnerability in SURVIVOR before 0.9.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. | |
CVE-2005-1387 | | 2005-05-03 | Cocktail 3.5.4 and possibly earlier in Mac OS X passes the administrative password on the command line to sudo in cleartext, which allows local users to gain s… | |
CVE-2005-1386 | | 2005-05-03 | PHP-Nuke 7.6 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) ipban.php, (2) db.php, (3) lang-norwegian.php, (4)… | |
CVE-2005-1385 | | 2005-05-03 | Safari 1.3 allows remote attackers to cause a denial of service (application crash) via a long https URL that triggers a NULL pointer dereference. | |
CVE-2005-1384 | | 2005-05-03 | Multiple SQL injection vulnerabilities in phpCoin 1.2.2 allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to index.php, (2)… | |
CVE-2005-1383 | | 2005-05-03 | The OHS component 1.0.2 through 10.x, when UseWebcacheIP is disabled, in Oracle Application Server allows remote attackers to bypass HTTP Server mod_access res… | |
CVE-2005-1382 | | 2005-05-03 | The webcacheadmin module in Oracle Webcache 9i allows remote attackers to corrupt arbitrary files via a full pathname in the cache_dump_file parameter. | |
CVE-2005-1381 | | 2005-05-03 | Multiple cross-site scripting (XSS) vulnerabilities in Oracle Webcache 9i allow remote attackers to inject arbitrary web script or HTML via the (1) cache_dump_… | |
CVE-2005-1380 | | 2005-05-03 | Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server parameter to a… | |
CVE-2005-1379 | | 2005-05-03 | The LAM runtime environment package (lam-runtime-7.0.6-2mdk) on Mandrake Linux installs the mpi user without a password, which allows local users to gain privi… | |
CVE-2005-1378 | | 2005-05-03 | SQL injection vulnerability in posting_notes.php in the notes module for phpBB allows remote attackers to execute arbitrary SQL commands via the p parameter, w… | |
CVE-2005-1377 | | 2005-05-03 | Multiple PHP remote file inclusion vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to execute a… | |
CVE-2005-1376 | | 2005-05-03 | Multiple directory traversal vulnerabilities in (1) document.php or (2) insertMyDoc.php in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos… | |
CVE-2005-1375 | | 2005-05-03 | Multiple SQL injection vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to execute arbitrary SQL… | |
CVE-2005-1374 | | 2005-05-03 | Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to inject a… | |
CVE-2005-1373 | | 2005-05-03 | Multiple SQL injection vulnerabilities in index.php in Dream4 Koobi CMS 4.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) q or (2) p p… | |
CVE-2005-1372 | | 2005-05-03 | nvstatsmngr.exe process in BakBone NetVault 7.1 does not properly drop privileges before opening files, which allows local users to gain privileges via the Hel… | |
CVE-2005-1371 | | 2005-05-03 | BPFTPServer service in BulletProof FTP Server 2.4.0.31 does not properly drop privileges before opening files through the Help menu, which allows local users t… | |
CVE-2005-1370 | | 2005-05-03 | Unknown vulnerability in Radia Management Agent (RMA) in HP OpenView Radia Management Portal (RMP) 1.x and 2.x allows remote attackers to execute arbitrary com… | |
CVE-2005-1343 | | 2005-05-03 | Stack-based buffer overflow in the VPN daemon (vpnd) for Mac OS X before 10.3.9 allows local users to execute arbitrary code via a long -i (Server_id) argument. | |
CVE-2005-0157 | | 2005-05-03 | The confirm add-on in SmartList 3.15 and earlier allows attackers to subscribe arbitrary e-mail addresses by using a valid cookie that specifies an address oth… | |
CVE-2005-0106 | | 2005-05-03 | SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGD_PATH variable, which allows local users to… | |
CVE-2005-1369 | | 2005-05-02 | The (1) it87 and (2) via686a drivers in I2C for Linux 2.6.x before 2.6.11.8, and 2.6.12 before 2.6.12-rc2, create the sysfs "alarms" file with write permission… | |
CVE-2005-1368 | | 2005-05-02 | The key_user_lookup function in security/keys/key.c in Linux kernel 2.6.10 to 2.6.11.8 may allow attackers to cause a denial of service (oops) via SMP. | |
CVE-2005-1364 | | 2005-05-02 | Multiple SQL injection vulnerabilities in MetaBid Auctions allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password fields… | |
CVE-2005-1363 | | 2005-05-02 | Multiple SQL injection vulnerabilities in MetaCart 2.0 for PayFlow allow remote attackers to execute arbitrary commands via (1) intCatalogID, (2) strSubCatalog… | |
CVE-2005-1362 | | 2005-05-02 | Multiple SQL injection vulnerabilities in MetaCart 2.0 for Paypal allow remote attackers to execute arbitrary SQL commands via the (1) intProdID parameter to p… | |
CVE-2005-1361 | | 2005-05-02 | Multiple SQL injection vulnerabilities in MetaCart e-Shop 8.0 allow remote attackers to execute arbitrary SQL commands via the (1) intProdID parameter in produ… | |
CVE-2005-1360 | | 2005-05-02 | PHP remote file inclusion vulnerability in error.php in GrayCMS 1.1 allows remote attackers to execute arbitrary PHP code by modifying the path_prefix paramete… | |
CVE-2005-1359 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in text.cgi script allows remote attackers to inject arbitrary web script or HTML via the argument. | |
CVE-2005-1358 | | 2005-05-02 | text.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument. | |
CVE-2005-1357 | | 2005-05-02 | text.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument. | |
CVE-2005-1356 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in includer.cgi script in The Includer allows remote attackers to inject arbitrary web script or HTML via the argument. | |
CVE-2005-1355 | | 2005-05-02 | includer.cgi in The Includer allows remote attackers to read arbitrary files via a full pathname in the argument, a similar vulnerability to CVE-2005-0801. | |
CVE-2005-1354 | | 2005-05-02 | The forum.pl script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument. | |
CVE-2005-1353 | | 2005-05-02 | The forum.pl script allows remote attackers to read arbitrary files via a full pathname in the argument. | |
CVE-2005-1352 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in the ad.cgi script allows remote attackers to inject arbitrary web script or HTML via the argument. | |
CVE-2005-1351 | | 2005-05-02 | The ad.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument. | |
CVE-2005-1350 | | 2005-05-02 | The ad.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument. | |
CVE-2005-1349 | | 2005-05-02 | Buffer overflow in Convert-UUlib (Convert::UUlib) before 1.051 allows remote attackers to execute arbitrary code via a malformed parameter to a read operation. | |
CVE-2005-1348 | | 2005-05-02 | Buffer overflow in HTTPMail in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to execute arbitrary code via a… | |
CVE-2005-1347 | | 2005-05-02 | ** UNVERIFIABLE ** NOTE: this issue describes a problem that can not be independently verified as of 20050421. Adobe Acrobat reader (AcroRd32.exe) 6.0 and ea… | |
CVE-2005-1346 | | 2005-05-02 | Multiple Symantec AntiVirus products, including Norton AntiVirus 2005 11.0.0, Web Security Web Security 3.0.1.72, Mail Security for SMTP 4.0.5.66, AntiVirus Sc… | |
CVE-2005-1345 | | 2005-05-02 | Squid 2.5.STABLE9 and earlier does not trigger a fatal error when it identifies missing or invalid ACLs in the http_access configuration, which could lead to l… | |
CVE-2005-1344 | | 2005-05-02 | Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only lo… | |
CVE-2005-1329 | | 2005-05-02 | owOfflineCC.asp in OneWorldStore allows remote attackers to obtain sensitive information by modifying the idOrder parameter. | |
CVE-2005-1328 | | 2005-05-02 | OneWorldStore allows remote attackers to cause a denial of service (application crash) via a direct request to owConnections/chksettings.asp. | |
CVE-2005-1327 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in pms.php for Woltlab Burning Board 2.3.1 PL2 and earlier allows remote attackers to inject arbitrary web script or H… | |
CVE-2005-1326 | | 2005-05-02 | Buffer overflow in VooDoo cIRCle BOTNET before 1.0.33 allows remote authenticated attackers to cause a denial of service (client crash) via a crafted packet. | |
CVE-2005-1325 | | 2005-05-02 | set_lang.php in phpMyVisites 1.3 allows remote attackers to read and include arbitrary files via the mylang parameter. | |
CVE-2005-1324 | | 2005-05-02 | Multiple cross-site scripting (XSS) vulnerabilities in index.php for phpMyVisites allow remote attackers to inject arbitrary web script or HTML via the (1) par… | |
CVE-2005-1323 | | 2005-05-02 | Buffer overflow in NetFtpd for NetTerm 5.1.1 and earlier allows remote attackers to execute arbitrary code via a long USER command. | |
CVE-2005-1322 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in Horde Nag Task List Manager before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the par… | |
CVE-2005-1321 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in Horde Vacation module before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via the parent's… | |
CVE-2005-1320 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in Horde Mnemo Note Manager before 1.1.4 allows remote attackers to inject arbitrary web script or HTML via the parent… | |
CVE-2005-1319 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in Horde IMP Webmail client before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the parent… | |
CVE-2005-1318 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in Horde Forwards E-Mail Forwarding Manager before 2.2.2 allows remote attackers to inject arbitrary web script or HTM… | |
CVE-2005-1316 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in Horde Accounts module before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the parent's… | |
CVE-2005-1315 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in Horde Turba module before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the parent's fra… | |
CVE-2005-1314 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in Horde Kronolith module before 1.1.4 allows remote attackers to inject arbitrary web script or HTML via the parent's… | |
CVE-2005-1313 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in Horde Passwd module before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via the parent's fr… | |
CVE-2005-1311 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in Yappa-NG before 2.3.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. | |
CVE-2005-1309 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in bBlog 0.7.4 allows remote attackers to inject arbitrary web script or HTML via the (1) entry title field or (2) com… | |
CVE-2005-1305 | | 2005-05-02 | The hyper.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument. | |
CVE-2005-1304 | | 2005-05-02 | The citat.pl script allows remote attackers to execute arbitrary files via shell metacharacters in the argument. | |
CVE-2005-1302 | | 2005-05-02 | SQL injection vulnerability in Confixx 3.08 and earlier allows remote attackers to execute arbitrary SQL commands via the "change user" field. | |
CVE-2005-1293 | | 2005-05-02 | Multiple SQL injection vulnerabilities in default.asp in StorePortal 2.63 allow remote attackers to execute arbitrary SQL commands via the (1) language, (2) bp… | |
CVE-2005-1292 | | 2005-05-02 | Multiple cross-site scripting (XSS) vulnerabilities in CartWIZ ASP Cart allow remote attackers to inject arbitrary web script or HTML via the idProduct paramet… | |
CVE-2005-1290 | | 2005-05-02 | Multiple cross-site scripting (XSS) vulnerabilities in phpBB 2.0.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) u par… | |
CVE-2005-1289 | | 2005-05-02 | index.cgi in E-Cart 2004 1.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) art and possibly (2) cat par… | |
CVE-2005-1288 | | 2005-05-02 | inc_login_check.asp ACS Blog 0.8 through 1.1.3 allows remote attackers to gain administrator privileges via the "in" value in a cookie. | |
CVE-2005-1286 | | 2005-05-02 | Unquoted Windows search path vulnerability in BitDefender 8 allows local users to prevent BitDefender from starting by creating a malicious C:\program.exe, pos… | |
CVE-2005-1284 | | 2005-05-02 | The addnew script in Argosoft Mail Server Pro 1.8.7.6 allows remote attackers to create arbitrary accounts, even if "Allow Creation of Accounts From the Web In… | |
CVE-2005-1282 | | 2005-05-02 | Multiple cross-site scripting (XSS) vulnerabilities in Argosoft Mail Server Pro 1.8.7.6 allow remote attackers to inject arbitrary web script or HTML via (1) t… | |
CVE-2005-1280 | | 2005-05-02 | The rsvp_print function in tcpdump 3.9.1 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted RSVP packet of length 4. | |
CVE-2005-1279 | | 2005-05-02 | tcpdump 3.8.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted (1) BGP packet, which is not properly handled by R… | |
CVE-2005-1278 | | 2005-05-02 | The isis_print function, as called by isoclns_print, in tcpdump 3.9.1 and earlier allows remote attackers to cause a denial of service (infinite loop) via a ze… | |
CVE-2005-1245 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.2, when using HTML Tidy ($wgUseTidy), allows remote attackers to inject arbitrary web script o… | |
CVE-2005-1243 | | 2005-05-02 | Directory traversal vulnerability in the third party tool from SafeStone, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access ar… | |
CVE-2005-1242 | | 2005-05-02 | Directory traversal vulnerability in the third party tool from Bsafe, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitr… | |
CVE-2005-1239 | | 2005-05-02 | Directory traversal vulnerability in the third party tool from Raz-Lee, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbi… | |
CVE-2005-1238 | | 2005-05-02 | By design, the built-in FTP server for iSeries AS/400 systems does not support a restricted document root, which allows attackers to read or write arbitrary fi… | |
CVE-2005-1237 | | 2005-05-02 | SQL injection vulnerability in news.php in FlexPHPNews 0.0.3 allows remote attackers to execute arbitrary SQL commands via the newsid parameter. | |
CVE-2005-1236 | | 2005-05-02 | Multiple SQL injection vulnerabilities in DUware DUportal 3.1.2 and 3.1.2 SQL allow remote attackers to execute arbitrary SQL commands via the (1) iChannel par… | |
CVE-2005-1235 | | 2005-05-02 | auction_my_auctions.php in phpbb-Auction 1.2m and earlier allows remote attackers to obtain sensitive information via an invalid mode parameter, which leaks th… | |
CVE-2005-1234 | | 2005-05-02 | Multiple SQL injection vulnerabilities in phpbb-Auction allow remote attackers to execute arbitrary SQL commands via the (1) u parameter to auction_rating.php… | |
CVE-2005-1232 | | 2005-05-02 | Buffer overflow in Sun Java System Web Proxy Server (aka Sun ONE Proxy Server) 3.6 SP6 allows remote attackers to execute arbitrary code via unknown vectors. | |
CVE-2005-1231 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in the NewTerm function in GlossaryModel.php in JAWS 0.4 allows remote attackers to inject arbitrary web script or HTM… | |
CVE-2005-1230 | | 2005-05-02 | Directory traversal vulnerability in Yawcam 0.2.5 allows remote attackers to read arbitrary files via "..\" (dot dot backslash) sequences in a GET request. | |
CVE-2005-1229 | | 2005-05-02 | Directory traversal vulnerability in cpio 2.6 and earlier allows remote attackers to write to arbitrary directories via a .. (dot dot) in a cpio file. | |
CVE-2005-1228 | | 2005-05-02 | Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. (dot dot) in the… | |
CVE-2005-1226 | | 2005-05-02 | Coppermine Photo Gallery 1.3.2 stores passwords in plaintext, which allows remote attackers to obtain sensitive information. | |
CVE-2005-1225 | | 2005-05-02 | SQL injection vulnerability in Coppermine Photo Gallery 1.3.2 allows remote attackers to execute arbitrary SQL commands via the favs parameter to (1) init.inc… |