2005 CVEs (page 44)
Page 44 of 48 — CVEs published in 2005, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2005-1122 | | 2005-04-14 | Format string vulnerability in cgi.c for Monkey daemon (monkeyd) before 0.9.1 allows remote attackers to cause a denial of service and possibly execute arbitra… | |
CVE-2005-1118 | | 2005-04-14 | Cross-site scripting (XSS) vulnerability in IISWebAgentIF.dll in the RSA Authentication Agent for Web 5.2 allows remote attackers to inject arbitrary web scrip… | |
CVE-2005-1043 | | 2005-04-14 | exif.c in PHP before 4.3.11 allows remote attackers to cause a denial of service (memory consumption and crash) via an EXIF header with a large IFD nesting lev… | |
CVE-2005-0718 | | 2005-04-14 | Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (segmentation fault) by aborting the connection during a (1) PUT or (2) POST… | |
CVE-2005-0131 | | 2005-04-14 | The Quick Connection dialog in Konversation 0.15 inadvertently uses the user-provided password as the nickname instead of the user-provided nickname when conne… | |
CVE-2005-0130 | | 2005-04-14 | Certain Perl scripts in Konversation 0.15 allow remote attackers to execute arbitrary commands via shell metacharacters in (1) channel names or (2) song names… | |
CVE-2005-0129 | | 2005-04-14 | The Quick Buttons feature in Konversation 0.15 allows remote attackers to execute certain IRC commands via a channel name containing "%" variables, which are r… | |
CVE-2005-0124 | | 2005-04-14 | The coda_pioctl function in the coda functionality (pioctl.c) for Linux kernel 2.6.9 and 2.4.x before 2.4.29 may allow local users to cause a denial of service… | |
CVE-2005-0112 | | 2005-04-14 | The web-based administrative interface for 3Com OfficeConnect Wireless 11g Access Point (AP) 1.00.08, and possibly earlier versions before 1.03.07A, allows rem… | |
CVE-2005-0082 | | 2005-04-14 | The sapdbwa_GetUserData function in MySQL MaxDB 7.5.0.0, and other versions before 7.5.0.21, allows remote attackers to cause a denial of service (crash) via i… | |
CVE-2005-0081 | | 2005-04-14 | MySQL MaxDB 7.5.0.0, and other versions before 7.5.0.21, allows remote attackers to cause a denial of service (crash) via an HTTP request with invalid headers. | |
CVE-2005-0020 | | 2005-04-14 | Buffer overflow in playmidi before 2.4 allows local users to execute arbitrary code. | |
CVE-2005-0016 | | 2005-04-14 | Buffer overflow in the exported_display function in xatitv in gatos before 0.0.5 allows local users to execute arbitrary code. | |
CVE-2005-0004 | | 2005-04-14 | The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite… | |
CVE-2005-0003 | | 2005-04-14 | The 64 bit ELF support in Linux kernel 2.6 before 2.6.10, on 64-bit architectures, does not properly check for overlapping VMA (virtual memory address) allocat… | |
CVE-2005-1301 | | 2005-04-13 | nProtect:Netizen 2005.3.17.1 does not properly verify that the update module is downloaded from an authorized site, which allows remote malicious web sites to… | |
CVE-2005-1149 | | 2005-04-13 | SQL injection vulnerability in admin/login.asp in aspclick.it ACNews 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) username or (2)… | |
CVE-2005-1134 | | 2005-04-13 | SQL injection vulnerability in exit.php for Serendipity 0.8 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) url_id or (2) ent… | |
CVE-2005-1147 | | 2005-04-12 | calendar.pl in CalendarScript 3.20 allows remote attackers to obtain sensitive information via invalid (1) calendar or (2) template parameters, which leaks the… | |
CVE-2005-1146 | | 2005-04-12 | NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in the login command in calendar.pl in CalendarScript 3.21 allows r… | |
CVE-2005-1145 | | 2005-04-12 | NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in calendar.pl in CalendarScript 3.20 allows remote attackers to in… | |
CVE-2005-1144 | | 2005-04-12 | popup.php in EasyPHPCalendar before 6.2.8 allows remote attackers to obtain sensitive information via an invalid ev parameter, which reveals the full pathname… | |
CVE-2005-1143 | | 2005-04-12 | Cross-site scripting (XSS) vulnerability in index.php in EasyPHPCalendar before 6.2.8 allows remote attackers to inject arbitrary web script or HTML via the yr… | |
CVE-2005-1130 | | 2005-04-12 | Cross-site scripting (XSS) vulnerability in index.php in Pinnacle Cart allows remote attackers to inject arbitrary web script or HTML via the pg parameter. | |
CVE-2005-1103 | | 2005-04-12 | Sygate Security Agent (SSA) in Sygate Secure Enterprise 3.5 through 4.1 does not prevent the security policy from being updated by unprivileged users, which al… | |
CVE-2005-1099 | | 2005-04-12 | Multiple buffer overflows in the HandleChild function in server.c in Greylisting daemon (GLD) 1.3 and 1.4, when GLD is listening on a network interface, allow… | |
CVE-2005-1078 | | 2005-04-12 | XAMPP 1.4.x has multiple default or null passwords, which allows attackers to gain privileges. | |
CVE-2005-1077 | | 2005-04-12 | Multiple cross-site scripting (XSS) vulnerabilities in XAMPP 1.4.x allow remote attackers to inject arbitrary web script or HTML via (1) cds.php, (2) Guestbook… | |
CVE-2005-1071 | | 2005-04-12 | SQL injection vulnerability in banner.inc.php in JPortal Web Portal 2.3.1 allows remote attackers to execute arbitrary SQL commands via the haslo parameter. | |
CVE-2005-0610 | | 2005-04-12 | Multiple symlink vulnerabilities in portupgrade before 20041226_2 in FreeBSD allow local users to (1) overwrite arbitrary files and possibly replace packages t… | |
CVE-2005-0562 | | 2005-04-12 | GIF file validation error in MSN Messenger 6.2 allows remote attackers in a user's contact list to execute arbitrary code via a GIF image with an improper heig… | |
CVE-2005-0555 | | 2005-04-12 | Buffer overflow in the Content Advisor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a crafted Content… | |
CVE-2005-1089 | | 2005-04-11 | Unknown vulnerability in DC++ before 0.674 allows attackers to append data to arbitrary files. | |
CVE-2005-1070 | | 2005-04-11 | SQL injection vulnerability in index.php in Invision Power Board 1.3.1 Final and earlier allows remote attackers to execute arbitrary SQL commands via the st p… | |
CVE-2005-1064 | | 2005-04-10 | The copy_symlink function in rsnapshot 1.2.0 and 1.1.x before 1.1.7 changes the ownership of files that a symlink points to rather than the symlink itself, whi… | |
CVE-2005-1055 | | 2005-04-10 | TowerBlog 0.6 and earlier stores the login data file under the web root, which allows remote attackers to obtain the MD5 checksums of the username and password… | |
CVE-2005-1082 | | 2005-04-09 | Multiple SQL injection vulnerabilities in AzDGDatingPlatinum 1.1.0 allows remote attackers to execute arbitrary SQL commands via (1) the id parameter to view.p… | |
CVE-2005-1094 | | 2005-04-08 | FTP Now 2.6.14 stores usernames and passwords in plaintext in sites.xml, which is world-readable, which allows local users to gain privileges. | |
CVE-2005-1072 | | 2005-04-08 | Cross-site scripting (XSS) vulnerability in PunBB before 1.2.5 allows remote attackers to inject arbitrary web script or HTML. | |
CVE-2005-1067 | | 2005-04-08 | Vulnerability in Access_user Class before 1.75 allows local users to gain access as other users via the password "new". | |
CVE-2005-1087 | | 2005-04-07 | CRLF injection vulnerability in the cmdIS.DLL plugin for AN HTTPD Server 1.42n allows remote attackers to spoof or hide entries in the logfile, and possibly re… | |
CVE-2005-1047 | | 2005-04-07 | Meilad File upload script (up.php) mod for phpBB 2.0.x does not properly limit the types of files that can be uploaded, which allows remote authenticated users… | |
CVE-2005-0351 | | 2005-04-07 | Buffer overflow in (1) termsh, (2) atcronsh, and (3) auditsh in SCO OpenServer 5.0.6 and 5.0.7 might allow local users to execute arbitrary code via a long HOM… | |
CVE-2005-1096 | | 2005-04-06 | SQL injection vulnerability in main.asp for Ocean12 Membership Manager Pro 1.x allows remote attackers to execute arbitrary SQL commands via the UserID paramet… | |
CVE-2005-1029 | | 2005-04-06 | Multiple SQL injection vulnerabilities in Active Auction House allow remote attackers to execute arbitrary SQL commands via the (1) catid, (2) SortDir, or (3)… | |
CVE-2005-1035 | | 2005-04-05 | Multiple buffer overflows in Pavuk before 0.9.32 have unknown attack vectors and impact. | |
CVE-2005-0749 | | 2005-04-01 | The load_elf_library in the Linux kernel before 2.6.11.6 allows local users to cause a denial of service (kernel crash) via a crafted ELF library or executable… | |
CVE-2005-0957 | | 2005-03-31 | Bay Technical Associates RPC-3 Telnet Host 3.05 allows remote attackers to bypass authentication by pressing the escape and enter keys at the username prompt. | |
CVE-2005-0943 | | 2005-03-30 | Cisco VPN 3000 series Concentrator running firmware 4.1.7.A and earlier allows remote attackers to cause a denial of service (device reload or drop user connec… | |
CVE-2005-0487 | | 2005-03-30 | Cross-site scripting (XSS) vulnerability in index.php for Kayako ESupport 2.3.1, and possibly other versions, allows remote attackers to inject arbitrary HTML… | |
CVE-2005-0486 | | 2005-03-30 | Tarantella Secure Global Desktop Enterprise Edition 4.00 and 3.42, and Tarantella Enterprise 3 3.40 and 3.30, when using RSA SecurID and multiple users have th… | |
CVE-2005-0485 | | 2005-03-30 | Cross-site scripting (XSS) vulnerability in comment.php for paNews 2.0b4 for PHP Arena allows remote attackers to inject arbitrary HTML and web script via the… | |
CVE-2005-0484 | | 2005-03-30 | Format string vulnerability in gprostats for GProFTPD before 8.1.9 may allow remote attackers to execute arbitrary code via an FTP transfer with a crafted file… | |
CVE-2005-0483 | | 2005-03-30 | Multiple directory traversal vulnerabilities in sitenfo.sh, sitezipchk.sh, and siteziplist.sh in Glftpd 1.26 to 2.00 allow remote authenticated users to (1) de… | |
CVE-2005-0482 | | 2005-03-30 | TrackerCam 5.12 and earlier allows remote attackers to cause a denial of service (crash) via (1) a large number of connections with a negative Content-Length h… | |
CVE-2005-0481 | | 2005-03-30 | TrackerCam 5.12 and earlier allows remote attackers to read log files via the fn parameter in a direct request to the ComGetLogFile.php3 script. | |
CVE-2005-0480 | | 2005-03-30 | Cross-site scripting (XSS) vulnerability in TrackerCam 5.12 and earlier allows remote attackers to inject arbitrary HTML or web script via the login request, w… | |
CVE-2005-0479 | | 2005-03-30 | Directory traversal vulnerability in ComGetLogFile.php3 for TrackerCam 5.12 and earlier allows remote attackers to read arbitrary files via ".." sequences and… | |
CVE-2005-0478 | | 2005-03-30 | Multiple buffer overflows in TrackerCam 5.12 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) an HTT… | |
CVE-2005-0477 | | 2005-03-30 | Cross-site scripting (XSS) vulnerability in the SML code for Invision Power Board 1.3.1 FINAL allows remote attackers to inject arbitrary web script via (1) a… | |
CVE-2005-0476 | | 2005-03-30 | Cross-site scripting (XSS) vulnerability in hpm_guestbook.cgi allows remote attackers to inject arbitrary web script or HTML by posting a message. | |
CVE-2005-0475 | | 2005-03-30 | SQL injection vulnerability in paFAQ Beta4, and possibly other versions, allows remote attackers to execute arbitrary SQL code via the (1) offset, (2) limit, (… | |
CVE-2005-0474 | | 2005-03-30 | SQL injection vulnerability in the user_valid_crypt function in user.php in WebCalendar 0.9.45 allows remote attackers to execute arbitrary SQL commands via an… | |
CVE-2005-0950 | | 2005-03-29 | Directory traversal vulnerability in FastStone 4in1 Browser 1.2 allows remote attackers to read arbitrary files via a (1) ... (triple dot) or (2) ..\ (dot dot… | |
CVE-2005-0946 | | 2005-03-29 | SQL injection vulnerability in phpCoin 1.2.1b and earlier allows remote attackers to execute arbitrary SQL commands via the (1) term/keywords field on the sear… | |
CVE-2005-0931 | | 2005-03-29 | PHP remote file inclusion vulnerability in The Includer 1.0 and 1.1 allows remote attackers to execute arbitrary PHP code. | |
CVE-2005-0924 | | 2005-03-29 | Cross-site scripting (XSS) vulnerability in Adventia E-Data 2.0 allows remote attackers to inject arbitrary web script or HTML via a query keyword. | |
CVE-2005-0919 | | 2005-03-29 | Adventia Chat 3.1 and Server Pro 3.0 allows remote attackers to inject arbitrary web script or HTML into the chat space, which leaves other users vulnerable to… | |
CVE-2005-0911 | | 2005-03-28 | Multiple SQL injection vulnerabilities in exoops may allow remote attackers to execute arbitrary SQL commands via (1) the viewcat parameter to index.php or (2)… | |
CVE-2005-0908 | | 2005-03-28 | Multiple cross-site scripting (XSS) vulnerabilities in Valdersoft Shopping Cart 3.0 allow remote attackers to inject arbitrary web script or HTML via (1) the l… | |
CVE-2005-0892 | | 2005-03-28 | Buffer overflow in smail 3.2.0.120 allows remote attackers or local users to execute arbitrary code via a long string in the MAIL FROM command and possibly oth… | |
CVE-2005-0750 | | 2005-03-27 | The bluez_sock_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges… | |
CVE-2005-0914 | | 2005-03-26 | Multiple cross-site scripting (XSS) vulnerabilities in CPG Dragonfly 9.0.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) the profile… | |
CVE-2005-0900 | | 2005-03-26 | marks.php in NukeBookmarks 0.6 for PHP-Nuke allows remote attackers to obtain sensitive information via an invalid (1) file or (2) category parameter, which re… | |
CVE-2005-0898 | | 2005-03-26 | Cross-site scripting (XSS) vulnerability in downloadform.php in E-Store Kit-2 PayPal Edition allows remote attackers to inject arbitrary web script or HTML via… | |
CVE-2005-0592 | | 2005-03-25 | Heap-based buffer overflow in the UTF8ToNewUnicode function for Firefox before 1.0.1 and Mozilla before 1.7.6 might allow remote attackers to cause a denial of… | |
CVE-2005-0587 | Medium | 6.5 | 2005-03-25 | Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link… |
CVE-2005-0585 | | 2005-03-25 | Firefox before 1.0.1 and Mozilla before 1.7.6 truncates long sub-domains or paths for display, which may allow remote malicious web sites to spoof legitimate s… | |
CVE-2005-0912 | | 2005-03-24 | Unknown vulnerabilities in deplate before 0.7.2 have unknown impact, possibly involving elements.rb. | |
CVE-2005-0889 | | 2005-03-24 | Cross-site scripting (XSS) vulnerability in index.php for Dream4 Koobi CMS 4.2.3 allows remote attackers to inject arbitrary web script or HTML via the area pa… | |
CVE-2005-0887 | | 2005-03-24 | Eval injection vulnerability in Double Choco Latte before 0.9.4.3 allows remote attackers to execute arbitrary PHP code via the menuAction variable in (1) func… | |
CVE-2005-0883 | | 2005-03-23 | Multiple cross-site scripting (XSS) vulnerabilities in base.php for DigitalHive 2.0 allow remote attackers to inject arbitrary web script or HTML via (1) the m… | |
CVE-2005-0881 | | 2005-03-23 | Cross-site scripting (XSS) vulnerability in articles.newcomment for Interspire ArticleLive 2005 allows remote attackers to inject arbitrary web script or HTML… | |
CVE-2005-0878 | | 2005-03-23 | Cross-site scripting (XSS) vulnerability in MercuryBoard before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the title field of a P… | |
CVE-2005-0761 | | 2005-03-23 | Unknown vulnerability in ImageMagick before 6.1.8 allows remote attackers to cause a denial of service (application crash) via a crafted PSD file. | |
CVE-2005-0759 | | 2005-03-23 | ImageMagick before 6.0 allows remote attackers to cause a denial of service (application crash) via a TIFF image with an invalid tag. | |
CVE-2005-0143 | | 2005-03-23 | Firefox before 1.0 and Mozilla before 1.7.5 display the SSL lock icon when an insecure page loads a binary file from a trusted site, which could facilitate phi… | |
CVE-2005-0716 | | 2005-03-21 | Stack-based buffer overflow in the Core Foundation Library in Mac OS X 10.3.5 and 10.3.6, and possibly earlier versions, allows local users to execute arbitrar… | |
CVE-2005-0715 | | 2005-03-21 | AFP Server in Mac OS X before 10.3.8 uses insecure permissions for "Drop Boxes," which allows local users to read the contents of a Drop Box. | |
CVE-2005-0713 | | 2005-03-21 | The Bluetooth Setup Assistant for Mac OS X before 10.3.8 can be launched without a keyboard or Bluetooth device, which allows local users to bypass access rest… | |
CVE-2005-0352 | | 2005-03-16 | Servers Alive 4.1 and 5.0, when running as a service, does not drop SYSTEM privileges before loading local manual under the help menu, which allows local users… | |
CVE-2005-0799 | | 2005-03-15 | MySQL 4.1.9, and possibly earlier versions, allows remote attackers with certain privileges to cause a denial of service (application crash) via a use command… | |
CVE-2005-0798 | | 2005-03-15 | Novell iChain Mini FTP Server 2.3, and possibly earlier versions, does not limit the number of incorrect logins, which makes it easier for remote attackers to… | |
CVE-2005-0797 | | 2005-03-15 | Novell iChain Mini FTP Server 2.3 displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and… | |
CVE-2005-0794 | | 2005-03-15 | ZPanel 2.0 and 2.5 beta 10 does not remove or protect installation scripts after they have been used, which allows remote attackers to reinstall the software a… | |
CVE-2005-0793 | | 2005-03-15 | PHP remote file inclusion vulnerability in zpanel.php in ZPanel allows remote attackers to (1) execute arbitrary PHP code in ZPanel 2.0 or (2) include local fi… | |
CVE-2005-0792 | | 2005-03-15 | SQL injection vulnerability in ZPanel 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) uname parameter to index.php or (2) page parame… | |
CVE-2005-0767 | | 2005-03-15 | Race condition in the Radeon DRI driver for Linux kernel 2.6.8.1 allows local users with DRI privileges to execute arbitrary code as root. | |
CVE-2005-0384 | | 2005-03-15 | Unknown vulnerability in the PPP driver for the Linux kernel 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) via a pppd client. | |
CVE-2005-0795 | | 2005-03-14 | HolaCMS 1.4.9 does not restrict file access to the holaDB/votes directory, which allows remote attackers to overwrite arbitrary files via a modified vote_filen… |