Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2005-1333
Directory traversal vulnerability in the Bluetooth file and object exchange (OBEX) services in Mac OS X 10.3.9 allows remote attackers to read arbitrary files.
Affected Products: n/a
References: [{'name': '13491', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13491'}, {'name': 'APPLE-SA-2005-06-08', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2005/Jun/msg00000.html'}, {'name': 'APPLE-SA-2005-05-03', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2005/May/msg00001.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.digitalmunition.com/DMA%5B2005-0502a%5D.txt'}]
CVE State: PUBLISHED
Explain CVE-2005-1335
Unknown vulnerability in Mac OS X 10.3.9 allows local users to gain privileges via (1) chfn, (2) chpass, and (3) chsh, which "use external helper programs in an insecure manner."
Affected Products: n/a
References: [{'name': 'TA05-136A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA05-136A.html'}, {'name': 'VU#331694', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/331694'}, {'name': 'APPLE-SA-2005-05-03', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2005/May/msg00001.html'}]
CVE State: PUBLISHED
Explain CVE-2005-1336
Buffer overflow in the Foundation framework for Mac OS X 10.3.9 allows local users to execute arbitrary code via a long environment variable.
Affected Products: n/a
References: [{'name': 'VU#582934', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/582934'}, {'name': 'TA05-136A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA05-136A.html'}, {'name': 'APPLE-SA-2005-05-03', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2005/May/msg00001.html'}]
CVE State: PUBLISHED
Explain CVE-2005-1337
Apple Help Viewer 2.0.7 and 3.0.0 in Mac OS X 10.3.9 allows remote attackers to read and execute arbitrary scrpts with less restrictive privileges via a help:// URI.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2005-05-03', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2005/May/msg00001.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://remahl.se/david/vuln/004/'}]
CVE State: PUBLISHED
Explain CVE-2005-1338
Mac OS X 10.3.9, when using an LDAP server that does not use ldap_extended_operation, may store initial LDAP passwords for new accounts in plaintext.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2005-05-03', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2005/May/msg00001.html'}]
CVE State: PUBLISHED
Explain CVE-2005-1339
lukemftpd in Mac OS X 10.3.9 allows remote authenticated users to escape the chroot environment by logging in with their full name.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2005-05-03', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2005/May/msg00001.html'}]
CVE State: PUBLISHED
Explain CVE-2005-1340
The HTTP proxy service in Server Admin for Mac OS X 10.3.9 does not restrict access when it is enabled, which allows remote attackers to use the proxy.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2005-05-03', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2005/May/msg00001.html'}]
CVE State: PUBLISHED
Explain CVE-2005-1341
Apple Terminal 1.4.4 allows attackers to execute arbitrary commands via terminal escape sequences.
Affected Products: n/a
References: [{'name': '13480', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13480'}, {'name': '15227', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15227'}, {'name': 'ADV-2005-0455', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2005/0455'}, {'name': '1013882', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013882'}, {'name': 'APPLE-SA-2005-05-03', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2005/May/msg00001.html'}, {'name': 'VU#994510', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/994510'}, {'name': '16083', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/16083'}, {'tags': ['x_refsource_MISC'], 'url': 'http://remahl.se/david/vuln/012/'}]
CVE State: PUBLISHED
Explain CVE-2005-1342
The x-man-page: URI handler for Apple Terminal 1.4.4 in Mac OS X 10.3.9 does not cleanse terminal escape sequences, which allows remote attackers to execute arbitrary commands.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://remahl.se/david/vuln/011/'}, {'name': '13480', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13480'}, {'name': 'TA05-136A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA05-136A.html'}, {'name': '16084', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/16084'}, {'name': '15227', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15227'}, {'name': 'VU#356070', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/356070'}, {'name': 'ADV-2005-0455', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2005/0455'}, {'name': 'APPLE-SA-2005-05-03', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2005/May/msg00001.html'}]
CVE State: PUBLISHED
Explain CVE-2005-1343
Stack-based buffer overflow in the VPN daemon (vpnd) for Mac OS X before 10.3.9 allows local users to execute arbitrary code via a long -i (Server_id) argument.
Affected Products: n/a
References: [{'name': 'VU#706838', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/706838'}, {'name': 'TA05-136A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA05-136A.html'}, {'name': 'APPLE-SA-2005-06-08', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2005/Jun/msg00000.html'}, {'name': 'APPLE-SA-2005-05-03', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2005/May/msg00001.html'}]
CVE State: PUBLISHED
Explain CVE-2005-1344
Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument.  NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program.  Therefore this may not be a vulnerability.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2005-05-03', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2005/May/msg00001.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.lucaercoli.it/advs/htdigest.txt'}, {'name': 'APPLE-SA-2005-08-15', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html'}, {'name': '12848', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/12848'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securiteam.com/unixfocus/5EP061FEKC.html'}, {'name': 'APPLE-SA-2005-08-17', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html'}, {'name': '13537', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13537'}]
CVE State: PUBLISHED
Explain CVE-2005-1345
Squid 2.5.STABLE9 and earlier does not trigger a fatal error when it identifies missing or invalid ACLs in the http_access configuration, which could lead to less restrictive ACLs than intended by the administrator.
Affected Products: n/a
References: [{'name': 'FLSA-2006:152809', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://fedoranews.org/updates/FEDORA--.shtml'}, {'name': 'CLA-2005:948', 'tags': ['vendor-advisory', 'x_refsource_CONECTIVA'], 'url': 'http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000948'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.squid-cache.org/bugs/show_bug.cgi?id=1255'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-acl_error'}, {'name': 'oval:org.mitre.oval:def:10513', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10513'}, {'name': 'RHSA-2005:415', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-415.html'}, {'name': 'DSA-721', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2005/dsa-721'}]
CVE State: PUBLISHED
Explain CVE-2005-1346
Multiple Symantec AntiVirus products, including Norton AntiVirus 2005 11.0.0, Web Security Web Security 3.0.1.72, Mail Security for SMTP 4.0.5.66, AntiVirus Scan Engine 4.3.7.27, SAV/Filter for Domino NT 3.1.1.87, and Mail Security for Exchange 4.5.4.743, when running on Windows, allows remote attackers to cause a denial of service (component crash) and avoid detection via a crafted RAR file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://securityresponse.symantec.com/avcenter/security/Content/2005.04.27.html'}]
CVE State: PUBLISHED
Explain CVE-2005-1347
** UNVERIFIABLE **  NOTE: this issue describes a problem that can not be independently verified as of 20050421.  Adobe Acrobat reader (AcroRd32.exe) 6.0 and earlier allows remote attackers to cause a denial of service ("Invalid-ID-Handle-Error" error) and modify memory beginning at a particular address, possibly allowing the execution of arbitrary code, via a crafted PDF file.  NOTE: the vendor has stated that the reporter refused to provide sufficient details to confirm the issue.  In addition, due to the lack of details in the original advisory, an independent verification is not possible.  Finally, the reliability of the original reporter is unknown.  This item has only been assigned a CVE identifier for tracking purposes, and to serve as a concrete example of the newly defined UNVERIFIABLE and PRERELEASE content decisions in CVE, which must be discussed by the Editorial Board. Without additional details or independent verification by reliable sources, it is highly likely that this item will be REJECTED.
Affected Products: n/a
References: [{'name': '13265', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13265'}, {'name': '15850', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/15850'}, {'name': '1013774', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013774'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.alphahackers.com/advisories/acrobat6.txt'}, {'name': 'acrobat-reader-invalid-id-handle-bo(20216)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20216'}]
CVE State: PUBLISHED
Explain CVE-2005-1348
Buffer overflow in HTTPMail in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to execute arbitrary code via a long HTTP Authorization header.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.x0n3-h4ck.org/upload/x0n3-h4ck_mailenable_https.pl'}, {'name': '15737', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/15737'}, {'name': '1013786', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013786'}, {'name': '20050424 MailEnable HTTPS Buffer Overflow [x0n3-h4ck]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111445834220015&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-1349
Buffer overflow in Convert-UUlib (Convert::UUlib) before 1.051 allows remote attackers to execute arbitrary code via a malformed parameter to a read operation.
Affected Products: n/a
References: [{'name': '13401', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13401'}, {'name': 'convert-uulib-bo(20275)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20275'}, {'name': '15130', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15130'}, {'name': 'MDKSA-2006:022', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2006:022'}, {'name': 'GLSA-200504-26', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200504-26.xml'}]
CVE State: PUBLISHED
Explain CVE-2005-1350
The ad.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument.
Affected Products: n/a
References: [{'name': '20050424 remote command execution in ad.cgi script', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111446285915444&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-1351
The ad.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
Affected Products: n/a
References: [{'name': '20050424 remote command execution in ad.cgi script', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111446285915444&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-1352
Cross-site scripting (XSS) vulnerability in the ad.cgi script allows remote attackers to inject arbitrary web script or HTML via the argument.
Affected Products: n/a
References: [{'name': '20050424 remote command execution in ad.cgi script', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111446285915444&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-1353
The forum.pl script allows remote attackers to read arbitrary files via a full pathname in the argument.
Affected Products: n/a
References: [{'name': '20050424 remote command execution in forum.pl script', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111446056205059&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-1354
The forum.pl script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
Affected Products: n/a
References: [{'name': '20050424 remote command execution in forum.pl script', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111446056205059&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-1355
includer.cgi in The Includer allows remote attackers to read arbitrary files via a full pathname in the argument, a similar vulnerability to CVE-2005-0801.
Affected Products: n/a
References: [{'name': '20050424 remote command execution in includer.cgi script', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111445548126797&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-1356
Cross-site scripting (XSS) vulnerability in includer.cgi script in The Includer allows remote attackers to inject arbitrary web script or HTML via the argument.
Affected Products: n/a
References: [{'name': '20050424 remote command execution in includer.cgi script', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111445548126797&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-1357
text.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument.
Affected Products: n/a
References: [{'name': '20050425 remote command execution in text.cgi script', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111445867315415&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-1358
text.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
Affected Products: n/a
References: [{'name': '20050425 remote command execution in text.cgi script', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111445867315415&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-1359
Cross-site scripting (XSS) vulnerability in text.cgi script allows remote attackers to inject arbitrary web script or HTML via the argument.
Affected Products: n/a
References: [{'name': '20050425 remote command execution in text.cgi script', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111445867315415&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-1360
PHP remote file inclusion vulnerability in error.php in GrayCMS 1.1 allows remote attackers to execute arbitrary PHP code by modifying the path_prefix parameter to reference a URL on a remote web server that contains the code.
Affected Products: n/a
References: [{'name': 'graycms-pathprefix-error-include(20278)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20278'}, {'name': '20050426 GrayCMS php code injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111454354214982&w=2'}, {'name': '15133', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15133'}, {'name': '15860', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/15860'}, {'name': '13381', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13381'}]
CVE State: PUBLISHED
Explain CVE-2005-1361
Multiple SQL injection vulnerabilities in MetaCart e-Shop 8.0 allow remote attackers to execute arbitrary SQL commands via the (1) intProdID parameter in product.asp or (2) strCatalog_NAME parameter to productsByCategory.asp.
Affected Products: n/a
References: [{'name': '13376', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13376'}, {'name': '20050426 Multiple SQL Injections in MetaCart e-Shop V-8', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111453994718211&w=2'}, {'name': '13377', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13377'}, {'name': 'metacart-eshop-sql-injection(20283)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20283'}]
CVE State: PUBLISHED
Explain CVE-2005-1362
Multiple SQL injection vulnerabilities in MetaCart 2.0 for Paypal allow remote attackers to execute arbitrary SQL commands via the (1) intProdID parameter to product.asp, (2) intCatalogID or (3) strSubCatalogID parameters to productsByCategory.asp, (4) chkText, (5) strText, (6) chkPrice, (7) intPrice, (8) chkCat, or (9) strCat parameters to searchAction.asp.
Affected Products: n/a
References: [{'name': '20050426 Multiple SQL Injections in MetaCart2 for SQL Server Special Edition U.K', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111454090503662&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-1363
Multiple SQL injection vulnerabilities in MetaCart 2.0 for PayFlow allow remote attackers to execute arbitrary commands via (1) intCatalogID, (2) strSubCatalogID, or (3) strSubCatalog_NAME parameter to productsByCategory.asp, (4) curCatalogID, (5) strSubCatalog_NAME, (6) intCatalogID, or (7) page parameter to productsByCategory.asp or (8) intProdID parameter to product.asp.
Affected Products: n/a
References: [{'name': '20050426 MetaCart2 for PayFlow Multiple Sql Injection Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111454142832023&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-1364
Multiple SQL injection vulnerabilities in MetaBid Auctions allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password fields in logIn.asp, or (3) intAuctionID parameter to item.asp.
Affected Products: n/a
References: [{'name': '15869', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/15869'}, {'name': '13395', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13395'}, {'name': '15136', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15136'}, {'name': '15868', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/15868'}, {'name': 'metabid-item-login-sql-injection(20286)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20286'}, {'name': '20050426 Multiple SQL Injections in MetaBid Auctions', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111454192928364&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://digitalparadox.org/advisories/metabid.txt'}]
CVE State: PUBLISHED
Explain CVE-2005-1365
Pico Server (pServ) 3.2 and earlier allows remote attackers to execute arbitrary commands via a URL with multiple leading "/" (slash) characters and ".." sequences.
Affected Products: n/a
References: [{'name': '20050516 Advisory: Pico Server (pServ) Remote Command Injection', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=111625635716712&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.redteam-pentesting.de/advisories/rt-sa-2005-010.txt'}, {'name': '13642', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13642'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=327708'}]
CVE State: PUBLISHED
Explain CVE-2005-1366
Pico Server (pServ) 3.2 and earlier allows remote attackers to obtain the source code for CGI scripts via "dirname/../cgi-bin" in a URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.redteam-pentesting.de/advisories/rt-sa-2005-011.txt'}, {'name': '13638', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13638'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=327708'}, {'name': '20050516 Pico Server (pServ) Information Disclosure Of CGI Sources', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=111625623909003&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-1367
Pico Server (pServ) 3.2 and earlier allows local users to read arbitrary files as the pServ user via a symlink to a file outside of the web document root.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.redteam-pentesting.de/advisories/rt-sa-2005-012.txt'}, {'name': '20050516 Pico Server (pServ) Local Information Disclosure', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=111625623909003&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-1368
The key_user_lookup function in security/keys/key.c in Linux kernel 2.6.10 to 2.6.11.8 may allow attackers to cause a denial of service (oops) via SMP.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.11.8'}, {'name': 'FLSA:157459-3', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://www.securityfocus.com/archive/1/427980/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://linux.bkbits.net:8080/linux-2.6/cset%40423078fafVa6mAyny23YZ87hDipmTw'}]
CVE State: PUBLISHED
Explain CVE-2005-1369
The (1) it87 and (2) via686a drivers in I2C for Linux 2.6.x before 2.6.11.8, and 2.6.12 before 2.6.12-rc2, create the sysfs "alarms" file with write permissions, which allows local users to cause a denial of service (CPU consumption) by attempting to write to the file, which does not have an associated store function.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.11.8'}, {'name': 'FLSA:157459-3', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://www.securityfocus.com/archive/1/427980/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://lkml.org/lkml/2005/4/20/159'}]
CVE State: PUBLISHED
Explain CVE-2005-1370
Unknown vulnerability in Radia Management Agent (RMA) in HP OpenView Radia Management Portal (RMP) 1.x and 2.x allows remote attackers to execute arbitrary commands via unknown vectors.
Affected Products: n/a
References: [{'name': 'HPSBMA01138', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2005-04/0490.html'}, {'name': '15089', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15089'}, {'name': '13414', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13414'}, {'name': 'SSRT5958', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2005-04/0490.html'}, {'name': 'hp-openview-radia-gain-access(20307)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20307'}, {'name': '20050428 High risk flaw in HP OpenView Radia Management Agent', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111471365231909&w=2'}, {'name': '15960', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/15960'}, {'name': '1013829', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013829'}]
CVE State: PUBLISHED
Explain CVE-2005-1371
BPFTPServer service in BulletProof FTP Server 2.4.0.31 does not properly drop privileges before opening files through the Help menu, which allows local users to gain privileges.
Affected Products: n/a
References: [{'name': '20050427 Privilege escalation in BulletProof FTP Server v2.4.0.31', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111464474828477&w=2'}, {'name': '13410', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13410'}, {'name': '15152', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15152'}, {'name': '15898', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/15898'}, {'name': 'ADV-2005-0419', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2005/0419'}, {'name': 'bpftp-gain-privilege(20301)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20301'}]
CVE State: PUBLISHED
Explain CVE-2005-1372
nvstatsmngr.exe process in BakBone NetVault 7.1 does not properly drop privileges before opening files, which allows local users to gain privileges via the Help menu.
Affected Products: n/a
References: [{'name': 'bakbone-netvault-gain-privileges(20302)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20302'}, {'name': '20050427 Privilege escalation in BakBone NetVault 7.1', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111464410324243&w=2'}, {'name': '15900', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/15900'}, {'name': '15158', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15158/'}, {'name': 'ADV-2005-0420', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2005/0420'}, {'name': '13408', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13408'}]
CVE State: PUBLISHED
Explain CVE-2005-1373
Multiple SQL injection vulnerabilities in index.php in Dream4 Koobi CMS 4.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) q or (2) p parameters.
Affected Products: n/a
References: [{'name': '20050427 SQL-injections in koobi-cms', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111464009913703&w=2'}, {'name': '13413', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13413'}, {'name': 'koobi-parameter-search-sql-injection(20293)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20293'}, {'name': '13412', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13412'}, {'name': '15997', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/15997'}, {'name': '14696', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14696'}]
CVE State: PUBLISHED
Explain CVE-2005-1374
Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to inject arbitrary web script or HTML via (1) exercise_result.php, (2) exercice_submit.php, (3) agenda.php, (4) learningPathList.php, (5) learningPathAdmin.php, (6) learningPath.php, (7) userLog.php, (8) tool parameter to toolaccess_details.php, (9) data parameter to user_access_details.php, or (10) coursePath parameter to myagenda.php.
Affected Products: n/a
References: [{'name': '13407', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13407'}, {'name': '15161', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15161'}, {'name': 'claroline-multiple-scripts-xss(20295)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20295'}, {'name': '20050427 ZRCSA-200501 - Multiple vulnerabilities in Claroline', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111464607103407&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.claroline.net/news.php#85'}, {'name': '1013822', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013822'}, {'name': '15725', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15725'}]
CVE State: PUBLISHED
Explain CVE-2005-1375
Multiple SQL injection vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to execute arbitrary SQL commands via (1) learningPath.php, (2) learningPathAdmin.php, (3) learnPath_details.php, (4) modules_pool.php, (5) module.php, (6) uInfo parameter in userInfo.php, or (7) exo_id parameter to exercises_details.php.
Affected Products: n/a
References: [{'name': '13407', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13407'}, {'name': '15161', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15161'}, {'name': '20050427 ZRCSA-200501 - Multiple vulnerabilities in Claroline', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111464607103407&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.claroline.net/news.php#85'}, {'name': 'claroline-multiple-sql-injection(20298)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20298'}, {'name': '1013822', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013822'}, {'name': '15725', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15725'}]
CVE State: PUBLISHED
Explain CVE-2005-1376
Multiple directory traversal vulnerabilities in (1) document.php or (2) insertMyDoc.php in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote project administrators to upload arbitrary files.
Affected Products: n/a
References: [{'name': '13407', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13407'}, {'name': '15161', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15161'}, {'name': '20050427 ZRCSA-200501 - Multiple vulnerabilities in Claroline', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111464607103407&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.claroline.net/news.php#85'}, {'name': 'claroline-document-directory-traversal(20287)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20287'}, {'name': '1013822', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013822'}, {'name': '15725', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15725'}]
CVE State: PUBLISHED
Explain CVE-2005-1377
Multiple PHP remote file inclusion vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to execute arbitrary PHP code via unknown vectors.
Affected Products: n/a
References: [{'name': '13407', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13407'}, {'name': '15161', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15161'}, {'name': '20050427 ZRCSA-200501 - Multiple vulnerabilities in Claroline', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111464607103407&w=2'}, {'name': 'claroline-file-include(20300)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20300'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.claroline.net/news.php#85'}, {'name': '1013822', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013822'}, {'name': '15725', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15725'}]
CVE State: PUBLISHED
Explain CVE-2005-1378
SQL injection vulnerability in posting_notes.php in the notes module for phpBB allows remote attackers to execute arbitrary SQL commands via the p parameter, which is used in the $post_id variable, and other attack vectors.
Affected Products: n/a
References: [{'name': '20050427 phpBB Notes Mod SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111471606518372&w=2'}, {'name': '1013827', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013827'}, {'name': '13417', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13417'}, {'name': 'ADV-2005-0416', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2005/0416'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.gulftech.org/?node=research&article_id=00070-04272005'}, {'name': '15899', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/15899'}, {'name': '15154', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15154/'}, {'name': 'phpbb-notes-module-sql-injection(20303)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20303'}]
CVE State: PUBLISHED
Explain CVE-2005-1379
The LAM runtime environment package (lam-runtime-7.0.6-2mdk) on Mandrake Linux installs the mpi user without a password, which allows local users to gain privileges.
Affected Products: n/a
References: [{'name': '13431', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13431'}, {'name': '20050428 insecure user account lam-runtime-7.0.6-2mdk rpm', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111472262231060&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-1380
Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server parameter to a JndiFramesetAction action.
Affected Products: n/a
References: [{'name': '15128', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15128'}, {'name': '15895', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/15895'}, {'name': 'weblogic-jndiframesetaction-xss(20276)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20276'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.red-database-security.com/advisory/bea_css_in_admin_console.html'}, {'name': '1013817', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/alerts/2005/Apr/1013817.html'}, {'name': '20050428 Cross Site Scripting in BEA Admin Console', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111472745503010&w=2'}, {'name': '13400', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13400'}]
CVE State: PUBLISHED
Explain CVE-2005-1381
Multiple cross-site scripting (XSS) vulnerabilities in Oracle Webcache 9i allow remote attackers to inject arbitrary web script or HTML via the (1) cache_dump_file or (2) PartialPageErrorPage parameter.
Affected Products: n/a
References: [{'name': 'oracle9ias-application-cache-xss(20309)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20309'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.red-database-security.com/advisory/oracle_webcache_CSS_vulnerabilities.html'}, {'name': '20050428 Cross Site Scripting in Oracle Webcache 9i Adminstrator Application', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111472423409560&w=2'}, {'name': '13421', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13421'}, {'name': '13422', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13422'}, {'name': '15143', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15143'}, {'name': '15910', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/15910'}]
CVE State: PUBLISHED
Explain CVE-2005-1382
The webcacheadmin module in Oracle Webcache 9i allows remote attackers to corrupt arbitrary files via a full pathname in the cache_dump_file parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.red-database-security.com/advisory/oracle_webcache_append_file_vulnerabilitiy.html'}, {'name': '20050428 File appending vulnerability in Oracle Webcache 9i', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111472615519295&w=2'}, {'name': '15143', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15143'}, {'name': '15909', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/15909'}, {'name': '13420', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13420'}, {'name': 'oracle9ias-application-cache-file-corruption(20310)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20310'}]
CVE State: PUBLISHED
Explain CVE-2005-1383
The OHS component 1.0.2 through 10.x, when UseWebcacheIP is disabled, in Oracle Application Server allows remote attackers to bypass HTTP Server mod_access restrictions via a request to the webcache TCP port 7778.
Affected Products: n/a
References: [{'name': '13418', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13418'}, {'name': '20050428 Webcache Client Requests Bypass OHS mod_access Restrictions', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111472266123952&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.red-database-security.com/advisory/oracle_webcache_bypass.html'}, {'name': '15908', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/15908'}, {'name': '15143', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15143'}, {'name': 'oracle9ias-application-cache-url-bypass(20311)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20311'}]
CVE State: PUBLISHED
Explain CVE-2005-1384
Multiple SQL injection vulnerabilities in phpCoin 1.2.2 allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to index.php, (2) phpcoinsessid parameter to login.php, (3) id, (4) dtopic_id, or (5) dcat_id to mod.php.
Affected Products: n/a
References: [{'name': 'phpcoin-multiple-sql-injection(20308)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20308'}, {'name': '20050428 Multiple Sql injections in phpCoin v1.2.2 and below', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111473522804665&w=2'}, {'name': '1013834', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013834'}, {'tags': ['x_refsource_MISC'], 'url': 'http://pridels0.blogspot.com/2006/03/phpcoin-poc.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://digitalparadox.org/viewadvisories.ah?view=36'}, {'name': '13433', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13433'}, {'name': 'ADV-2005-0423', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2005/0423'}]
CVE State: PUBLISHED
Explain CVE-2005-1385
Safari 1.3 allows remote attackers to cause a denial of service (application crash) via a long https URL that triggers a NULL pointer dereference.
Affected Products: n/a
References: [{'name': '16006', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/16006'}, {'name': '20050428 Safari HTTPS Overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111473570624498&w=2'}, {'name': '20050429 Re: Safari HTTPS Overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111479299730011&w=2'}, {'name': '20050429  Re: Safari HTTPS Overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111479346119272&w=2'}, {'name': '1013835', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013835'}]
CVE State: PUBLISHED
Explain CVE-2005-1386
PHP-Nuke 7.6 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) ipban.php, (2) db.php, (3) lang-norwegian.php, (4) lang-indonesian.php, (5) lang-greek.php, (6) a request to Web_Links with the portuguese language (lang-portuguese.php), (7) a request to Web_Links with the indonesian language (lang-indonesian.php), (8) a request to the survey module with the indonesian language (lang-indonesian.php), (9) a request to the Reviews module with the portuguese language, or (10) a request to the Journal module with the portuguese language, which reveal the path in an error message.
Affected Products: n/a
References: [{'name': '20050429 Multiples Full Path Disclosure in php-nuke 7.6 (and below)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111478982629035&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-1387
Cocktail 3.5.4 and possibly earlier in Mac OS X passes the administrative password on the command line to sudo in cleartext, which allows local users to gain sensitive information by running listing processes.
Affected Products: n/a
References: [{'name': '13449', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13449'}, {'name': '20050429 Mac OS X Cocktail 3.5.4 admin password disclosure', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111480898530362&w=2'}, {'name': '16046', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/16046'}, {'name': '15201', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15201'}]
CVE State: PUBLISHED
Explain CVE-2005-1388
Cross-site scripting (XSS) vulnerability in SURVIVOR before 0.9.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Affected Products: n/a
References: [{'name': '13415', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13415'}, {'name': '15905', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/15905'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.columbia.edu/acis/dev/projects/survivor/doc/todo.html#changelog'}]
CVE State: PUBLISHED
Explain CVE-2005-1391
Buffer overflow in the add_port function in APSIS Pound 1.8.2 and earlier allows remote attackers to execute arbitrary code via a long Host HTTP header.
Affected Products: n/a
References: [{'name': 'DSA-934', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2005/dsa-934'}, {'name': '1013824', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013824'}, {'name': '[pound_list] 20050426 remote buffer overflow in pound 1.8.2 + question abotu Host header', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.apsis.ch/pound/pound_list/archive/2005/2005-04/1114516112000'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=307852'}, {'name': '15963', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/15963'}, {'name': '15202', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15202'}, {'name': 'GLSA-200504-29', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200504-29.xml'}, {'name': 'ADV-2005-0437', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2005/0437'}, {'name': '15679', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15679'}, {'name': 'pound-addport-bo(20316)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20316'}, {'name': '13436', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13436'}, {'name': '18381', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18381'}, {'name': '15142', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/15142'}]
CVE State: PUBLISHED
Explain CVE-2005-1392
The SQL install script in phpMyAdmin 2.6.2 is created with world-readable permissions, which allows local users to obtain the initial database password by reading the script.
Affected Products: n/a
References: [{'name': '16053', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/16053'}, {'name': 'ADV-2005-0436', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2005/0436'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=88831'}, {'name': 'GLSA-200504-30', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200504-30.xml'}]
CVE State: PUBLISHED