2005 CVEs (page 39)
Page 39 of 47 — CVEs published in 2005, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2005-0832 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in PHP-Post before 0.33 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. | |
CVE-2005-0831 | | 2005-05-02 | PHP-Post allows remote attackers to spoof the names of other users by registering with a username containing hex-encoded characters. | |
CVE-2005-0830 | | 2005-05-02 | Multiple buffer overflows in Xzabite DYNDNSUpdate 0.6.15 and earlier, including the ipcheck function in dyndnsupdate.c, allow remote attackers who spoof a dynd… | |
CVE-2005-0829 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in setuser.php of the Digitanium addon to PHP-Fusion 5.01 allows remote attackers to inject arbitrary web script or HT… | |
CVE-2005-0828 | | 2005-05-02 | highlight.php in (1) RUNCMS 1.1A, (2) CIAMOS 0.9.2 RC1, (3) e-Xoops 1.05 Rev3, and possibly other products based on e-Xoops (exoops), allows remote attackers t… | |
CVE-2005-0827 | | 2005-05-02 | Viewcat.php in (1) RUNCMS 1.1A, (2) Ciamos 0.9.2 RC1, e-Xoops 1.05 Rev3, and possibly other products based on e-Xoops (exoops), allow remote attackers to obtai… | |
CVE-2005-0826 | | 2005-05-02 | OllyDbg 1.10 and earlier allows remote attackers to cause a denial of service (application crash) via a dynamic link library (DLL) with a long filename. | |
CVE-2005-0825 | | 2005-05-02 | Buffer overflow in LTris before 1.0.10 allows local users to execute arbitrary code via a crafted highscores file. | |
CVE-2005-0824 | Medium | 5.5 | 2005-05-02 | The internal_dump function in Mathopd before 1.5p5, and 1.6x before 1.6b6 BETA, when Mathopd is running with the -n option, allows local users to overwrite arb… |
CVE-2005-0823 | | 2005-05-02 | ThePoolClub (1) iPool and (2) iSnooker 1.6.81 and earlier stores usernames and passwords in cleartext in the MyDetails.txt file, which allows local users to ga… | |
CVE-2005-0822 | | 2005-05-02 | Citrix Metaframe Password Manager 2.5 and earlier stores a password in cleartext although it is obfuscated when presented to a user, which allows users to view… | |
CVE-2005-0821 | | 2005-05-02 | Unknown vulnerability in Citrix MetaFrame Conferencing Manager 3.0 allows conference members to bypass organizer restrictions to control the keyboard and mouse. | |
CVE-2005-0820 | | 2005-05-02 | Microsoft Office InfoPath 2003 SP1 includes sensitive information in the Manifest.xsf file in a custom .xsn form, which allows attackers to obtain printer and… | |
CVE-2005-0819 | | 2005-05-02 | The xvesa code in Novell Netware 6.5 SP2 and SP3 allows remote attackers to redirect the xsession without authentication via a direct request to GUIMirror/Star… | |
CVE-2005-0818 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in PunBB 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the (1) email or (2) Jabber paramete… | |
CVE-2005-0817 | | 2005-05-02 | Unknown vulnerability in the DNSd proxy, as used in Symantec Gateway Security 5400 2.x and 5300 1.x, Enterprise Firewall 7.0.x and 8.x, and VelociRaptor 1100/1… | |
CVE-2005-0816 | | 2005-05-02 | Buffer overflow in newgrp in Solaris 7 through 9 allows local users to gain root privileges. | |
CVE-2005-0815 | | 2005-05-02 | Multiple "range checking flaws" in the ISO9660 filesystem handler in Linux 2.6.11 and earlier may allow attackers to cause a denial of service or corrupt memor… | |
CVE-2005-0814 | | 2005-05-02 | Unknown vulnerability in lshd in Lysator LSH 1.x and 2.x before 2.0.1 allows remote attackers to cause a denial of service via unknown vectors. | |
CVE-2005-0813 | | 2005-05-02 | Buffer overflow in Initial Redirect (ir) Squid Proxy Plug-In 0.1 and 0.2 may allow attackers to cause a denial of service and execute arbitrary code via unknow… | |
CVE-2005-0812 | | 2005-05-02 | The web interface in NotifyLink 3.0 displays passwords in cleartext on the administrative page, which could allow remote attackers or local users to obtain sen… | |
CVE-2005-0811 | | 2005-05-02 | The web interface in NotifyLink 3.0 does not properly restrict access to functions that have been disabled in the GUI, which allows remote authenticated users… | |
CVE-2005-0810 | | 2005-05-02 | SQL injection vulnerability in NotifyLink before 3.0 allows remote attackers to execute arbitrary SQL commands via the URL. | |
CVE-2005-0809 | | 2005-05-02 | NotifyLink, when configured for client key retrieval, allows remote attackers to obtain AES keys via a direct request to /hwp/get.asp, then uses a weak encrypt… | |
CVE-2005-0808 | | 2005-05-02 | Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007. | |
CVE-2005-0807 | | 2005-05-02 | Multiple buffer overflows in Cain & Abel before 2.67 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary cod… | |
CVE-2005-0806 | | 2005-05-02 | Evolution 2.0.3 allows remote attackers to cause a denial of service (application crash or hang) via crafted messages, possibly involving charsets in attachmen… | |
CVE-2005-0805 | | 2005-05-02 | SQL injection vulnerability in index.php in Subdreamer Light, when magic_quotes_gpc is enabled, allows remote attackers to execute arbitrary SQL commands via c… | |
CVE-2005-0804 | | 2005-05-02 | Format string vulnerability in MailEnable 1.8 allows remote attackers to cause a denial of service (application crash) via format string specifiers in the mail… | |
CVE-2005-0803 | | 2005-05-02 | The GetEnhMetaFilePaletteEntries API in GDI32.DLL in Windows 2000 allows remote attackers to cause a denial of service (application crash) via a crafted Enhanc… | |
CVE-2005-0802 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in search.asp in ACS Blog 0.8 through 1.1b allows remote attackers to execute arbitrary web script or HTML via the sea… | |
CVE-2005-0801 | | 2005-05-02 | Directory traversal vulnerability in includer.cgi in The Includer allows remote attackers to read arbitrary files via (1) a .. (dot dot) or (2) a full pathname… | |
CVE-2005-0800 | | 2005-05-02 | PHP remote file inclusion vulnerability in install.php in mcNews 1.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the l param… | |
CVE-2005-0796 | | 2005-05-02 | Directory traversal vulnerability in HolaCMS 1.4.9-1 allows remote attackers to overwrite arbitrary files via a "holaDB/votes" followed by a .. (dot dot) in th… | |
CVE-2005-0787 | | 2005-05-02 | Wine 20050211 and earlier creates temp files with world readable permissions and predictable file names, which allows local users to obtain sensitive informati… | |
CVE-2005-0785 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in usersrecentposts in YaBB 2.0 rc1 allows remote attackers to inject arbitrary web script or HTML via the username pa… | |
CVE-2005-0784 | | 2005-05-02 | Multiple cross-site scripting (XSS) vulnerabilities in Phorum before 5.0.15 allow remote attackers to inject arbitrary web script or HTML via (1) the subject l… | |
CVE-2005-0783 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in Phorum before 5.0.14a allows remote attackers to inject arbitrary web script or HTML via the filename of an attache… | |
CVE-2005-0782 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in (1) viewall.php and (2) category.php for paFileDB 3.1 and earlier allows remote attackers to inject arbitrary web s… | |
CVE-2005-0781 | | 2005-05-02 | SQL injection vulnerability in (1) viewall.php and (2) category.php in paFileDB 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via t… | |
CVE-2005-0779 | | 2005-05-02 | PlatinumFTP 1.0.18, and possibly earlier versions, allows remote attackers to cause a denial of service (server crash) via multiple connection attempts with a… | |
CVE-2005-0778 | | 2005-05-02 | PhotoPost PHP 5.0 RC3 does not fully verify that an uploaded file is an image file, which allows remote attackers to inject arbitrary Javascript by uploading n… | |
CVE-2005-0777 | | 2005-05-02 | Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP 5.0 RC3 allow remote attackers to inject arbitrary web script or HTML via (1) the check_ta… | |
CVE-2005-0776 | | 2005-05-02 | adm-photo.php in PhotoPost PHP 5.0 RC3 does not properly verify administrative privileges before manipulating photos, which could allow remote attackers to man… | |
CVE-2005-0775 | | 2005-05-02 | The reportpost action in misc.php for PhotoPost PHP 5.0 RC3 does not limit the logging data that is sent to the administrator, which allows remote attackers to… | |
CVE-2005-0770 | | 2005-05-02 | Format string vulnerability in DataRescue Interactive Disassembler and Debugger (IDA) Pro 4.7.0.830 allows remote attackers or local users to cause a denial of… | |
CVE-2005-0769 | | 2005-05-02 | Multiple buffer overflows in OpenSLP before 1.1.5 allow remote attackers to have an unknown impact via malformed SLP packets. | |
CVE-2005-0768 | | 2005-05-02 | Buffer overflow in the administration web server for GoodTech Telnet Server 4.0 and 5.0, and possibly all versions before 5.0.7, allows remote attackers to exe… | |
CVE-2005-0766 | | 2005-05-02 | Unknown vulnerability in the sFlow dissector in Ethereal 0.9.14 through 0.10.9 allows remote attackers to cause a denial of service (application crash). | |
CVE-2005-0764 | | 2005-05-02 | Buffer overflow in command.C for rxvt-unicode before 5.3 allows remote attackers to execute arbitrary code via a crafted file containing long escape sequences. | |
CVE-2005-0763 | | 2005-05-02 | Buffer overflow in Midnight Commander (mc) 4.5.55 and earlier may allow attackers to execute arbitrary code. | |
CVE-2005-0762 | | 2005-05-02 | Heap-based buffer overflow in the SGI parser in ImageMagick before 6.0 allows remote attackers to execute arbitrary code via a crafted SGI image file. | |
CVE-2005-0760 | | 2005-05-02 | The TIFF decoder in ImageMagick before 6.0 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file. | |
CVE-2005-0746 | | 2005-05-02 | The Mini FTP server in Novell iChain 2.2 and 2.3 SP2 and earlier allows remote unauthenticated attackers to obtain the full path of the server via the PWD comm… | |
CVE-2005-0744 | | 2005-05-02 | The web GUI for Novell iChain 2.2 and 2.3 SP2 and SP3 allows attackers to hijack sessions and gain administrator privileges by (1) sniffing the connection on T… | |
CVE-2005-0743 | | 2005-05-02 | The custom avatar uploading feature (uploader.php) for XOOPS 2.0.9.2 and earlier allows remote attackers to upload arbitrary PHP scripts, whose file extensions… | |
CVE-2005-0742 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in Sun Java System Application Server 7 allows remote attackers to inject arbitrary web script or HTML via unknown vec… | |
CVE-2005-0739 | | 2005-05-02 | The IAPP dissector (packet-iapp.c) for Ethereal 0.9.1 to 0.10.9 does not properly use certain routines for formatting strings, which could leave it vulnerable… | |
CVE-2005-0738 | | 2005-05-02 | Stack consumption vulnerability in Microsoft Exchange Server 2003 SP1 allows users to cause a denial of service (hang) by deleting or moving a folder with deep… | |
CVE-2005-0737 | | 2005-05-02 | Buffer overflow in Yahoo! Messenger allows remote attackers to execute arbitrary code via the offline mode. | |
CVE-2005-0735 | | 2005-05-02 | newsscript.pl for NewsScript allows remote attackers to gain privileges by setting the mode parameter to admin. | |
CVE-2005-0734 | | 2005-05-02 | PY Software Active Webcam WebServer (webcam.exe) 5.5 allows remote attackers to cause a denial of service (memory exhaustion and process crash) via a large num… | |
CVE-2005-0733 | | 2005-05-02 | PY Software Active Webcam WebServer (webcam.exe) 5.5 allows remote attackers to determine the existence of files via an HTTP request with a full pathname, whic… | |
CVE-2005-0732 | | 2005-05-02 | PY Software Active Webcam WebServer (webcam.exe) 5.5 allows remote attackers to obtain the full path of the web server via a request for a non-existent filenam… | |
CVE-2005-0730 | | 2005-05-02 | PY Software Active Webcam WebServer (webcam.exe) 5.5 allows remote attackers to cause a denial of service via a request to a file on the floppy drive, as demon… | |
CVE-2005-0729 | | 2005-05-02 | Format string vulnerability in Xpand Rally 1.1.0.0 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a message. | |
CVE-2005-0726 | | 2005-05-02 | SQL injection vulnerability in editpost.php in UBB.threads 6.0 allows remote attackers to execute arbitrary SQL commands via the Number parameter. | |
CVE-2005-0724 | | 2005-05-02 | paFileDB 3.1 and earlier allows remote attackers to obtain sensitive information via (1) an invalid str parameter to pafiledb.php, or a direct request to (2) v… | |
CVE-2005-0721 | | 2005-05-02 | PHP remote file inclusion vulnerability in modules.php in eXPerience2 allows remote attackers to execute arbitrary PHP code by modifying the file parameter to… | |
CVE-2005-0712 | | 2005-05-02 | Mac OS X before 10.3.8 users world-writable permissions for certain directories, which may allow local users to gain privileges, possibly via the receipt cache… | |
CVE-2005-0711 | | 2005-05-02 | MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, uses predictable file names when creating temporary tables, which allows local users with CREATE TEMPORARY TA… | |
CVE-2005-0710 | | 2005-05-02 | MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to bypass library path restrictions and e… | |
CVE-2005-0709 | | 2005-05-02 | MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by using CREATE… | |
CVE-2005-0708 | | 2005-05-02 | The sendfile system call in FreeBSD 4.8 through 4.11 and 5 through 5.4 can transfer portions of kernel memory if a file is truncated while it is being sent, wh… | |
CVE-2005-0707 | | 2005-05-02 | Buffer overflow in the IMAP daemon (IMAP4d32.exe) for Ipswitch Collaboration Suite (ICS) before 8.15 Hotfix 1 allows remote authenticated users to execute arbi… | |
CVE-2005-0706 | | 2005-05-02 | Buffer overflow in discdb.c for grip 3.1.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing the cddb lookup… | |
CVE-2005-0705 | | 2005-05-02 | The GPRS-LLC dissector in Ethereal 0.10.7 through 0.10.9, with the "ignore cipher bit" option enabled. allows remote attackers to cause a denial of service (ap… | |
CVE-2005-0704 | | 2005-05-02 | Buffer overflow in the Etheric dissector in Ethereal 0.10.7 through 0.10.9 allows remote attackers to cause a denial of service (application crash) and possibl… | |
CVE-2005-0682 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in common.inc in Drupal before 4.5.2 allows remote attackers to inject arbitrary web script or HTML via certain inputs. | |
CVE-2005-0679 | | 2005-05-02 | PHP remote file inclusion vulnerability in tell_a_friend.inc.php for Tell A Friend Script 2.7 before 20050305 allows remote attackers to execute arbitrary PHP… | |
CVE-2005-0678 | | 2005-05-02 | PHP remote file inclusion vulnerability in formmail.inc.php for Form Mail Script 2.3 and earlier allows remote attackers to execute arbitrary PHP code by modif… | |
CVE-2005-0677 | | 2005-05-02 | index.php for Zorum 3.5 allows remote attackers to perform certain actions as other users by modifying the id parameter. | |
CVE-2005-0675 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in index.php for Zorum 3.5 allows remote attackers to inject arbitrary web script or HTML via the (1) list or (2) from… | |
CVE-2005-0673 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in usercp_register.php for phpBB 2.0.13 allows remote attackers to inject arbitrary web script or HTML by setting the… | |
CVE-2005-0672 | | 2005-05-02 | Carsten's 3D Engine (Ca3DE), March 2004 version and earlier, allows remote attackers to execute arbitrary code via text strings that are not null terminated, w… | |
CVE-2005-0670 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in phpCOIN 1.2.0 through 1.2.1b allows remote attackers to inject arbitrary web script or HTML via (1) the new paramet… | |
CVE-2005-0669 | | 2005-05-02 | Multiple SQL injection vulnerabilities in mod.php for phpCOIN 1.2.0 through 1.2.1b allow remote attackers to execute arbitrary SQL commands via the (1) the faq… | |
CVE-2005-0666 | | 2005-05-02 | Unknown vulnerability in PaX from the September 2003 release to 2.2 before 2005.03.05, related to SEGMEXEC or RANDEXEC and VMA mirroring, allows local users an… | |
CVE-2005-0665 | | 2005-05-02 | Format string vulnerability in xv before 3.10a allows remote attackers to execute arbitrary code via format string specifiers in a filename. | |
CVE-2005-0664 | | 2005-05-02 | Buffer overflow in the EXIF library (libexif) 0.6.9 does not properly validate the structure of the EXIF tags, which allows remote attackers to cause a denial… | |
CVE-2005-0663 | | 2005-05-02 | SQL injection vulnerability in index.php for MercuryBoard 1.1.2 allows remote attackers to inject arbitrary SQL commands via the f parameter. | |
CVE-2005-0662 | | 2005-05-02 | Cross-site scripting (XSS) vulnerability in index.php for MercuryBoard 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the Avatar fiel… | |
CVE-2005-0661 | | 2005-05-02 | SQL injection vulnerability in the getwbbuserdata function in session.php for Woltlab Burning Board 2.0.3 through 2.3.0 allows remote attackers to execute arbi… | |
CVE-2005-0660 | | 2005-05-02 | Multiple cross-site scripting (XSS) vulnerabilities in D-Forum 1.11 allows remote attackers to inject arbitrary web script or HTML via certain fields, as demon… | |
CVE-2005-0659 | | 2005-05-02 | phpBB 2.0.13 and earlier allows remote attackers to obtain sensitive information via a direct request to oracle.php, which reveals the path in a PHP error mess… | |
CVE-2005-0658 | | 2005-05-02 | SQL injection vulnerability in a third party extension to TYPO3 allows remote attackers to execute arbitrary SQL commands via the category_uid parameter. | |
CVE-2005-0657 | | 2005-05-02 | Directory traversal vulnerability in Computalynx CProxy 3.3.x and 3.4.x through 3.4.4 allows remote attackers to read arbitrary files or cause a denial of serv… | |
CVE-2005-0656 | | 2005-05-02 | Multiple cross-site scripting (XSS) vulnerabilities in auraCMS 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) hits parameter to… | |
CVE-2005-0655 | | 2005-05-02 | auraCMS 1.5 allows remote attackers to obtain sensitive information via an HTTP request with an invalid id parameter to (1) teman.php, (2) hal.php, or (3) arsi… | |
CVE-2005-0654 | | 2005-05-02 | gifload.exe in GIMP 2.0.5, 2.2.3, and possibly 2.2.4 allows remote attackers or local users to cause a denial of service (application crash) via the image desc… |