Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2005-0221
Cross-site scripting (XSS) vulnerability in login.php in Gallery 2.0 Alpha allows remote attackers to inject arbitrary web script or HTML via the g2_form[subject] field.
Affected Products: n/a
References: [{'name': '20050117 Gallery v1.3.4-pl1, v1.4.4-pl2, 2.0 Alpha Cross Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110608459222364&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://theinsider.deep-ice.com/texts/advisory69.txt'}, {'name': 'gallery-g2formsubject-xss(43472)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/43472'}, {'name': 'gallery-multiple-xss(18938)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/18938'}, {'name': '20050117 [VulnWatch] Gallery v1.3.4-pl1, v1.4.4-pl2, 2.0 Alpha Cross Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_VULNWATCH'], 'url': 'http://archives.neohapsis.com/archives/vulnwatch/2005-q1/0031.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=147'}]
CVE State: PUBLISHED
Explain CVE-2005-0222
main.php in Gallery 2.0 Alpha allows remote attackers to gain sensitive information by changing the value of g2_subView parameter, which reveals the path in an error message.
Affected Products: n/a
References: [{'name': '20050117 Gallery v1.3.4-pl1, v1.4.4-pl2, 2.0 Alpha Cross Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110608459222364&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://theinsider.deep-ice.com/texts/advisory69.txt'}, {'name': 'gallery-mainphp-obtain-information(18940)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/18940'}, {'name': '20050117 [VulnWatch] Gallery v1.3.4-pl1, v1.4.4-pl2, 2.0 Alpha Cross Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_VULNWATCH'], 'url': 'http://archives.neohapsis.com/archives/vulnwatch/2005-q1/0031.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=147'}]
CVE State: PUBLISHED
Explain CVE-2005-0223
The Software Development Kit (SDK) and Run Time Environment (RTE) 1.4.1 and 1.4.2 for Tru64 UNIX allows remote attackers to cause a denial of service (Java Virtual Machine hang) via object deserialization.
Affected Products: n/a
References: [{'name': 'SSRT4875', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=110719624029320&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-0224
Unknown vulnerability in HP-UX B.11.04 running Virtualvault 4.5 through 4.7, when running the TGA daemon, allows remote attackers to cause a denial of service via certain network traffic.
Affected Products: n/a
References: [{'name': '14082', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14082/'}, {'name': 'SSRT5900', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=110726808700080&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-0225
firehol.sh in FireHOL before 1.224 creates temporary files with predictable file names, which could allow local users to overwrite arbitrary files via a symlink attack.
Affected Products: n/a
References: [{'name': 'GLSA-200502-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200502-01.xml'}, {'name': '14102', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14102'}, {'name': '13970', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/13970'}, {'name': '12336', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12336'}, {'name': '1012969', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1012969'}, {'name': 'firehol-symlink(19032)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19032'}, {'name': '13137', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/13137'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cvs.sourceforge.net/viewcvs.py/firehol/firehol/firehol.sh'}]
CVE State: PUBLISHED
Explain CVE-2005-0226
Format string vulnerability in the Log_Resolver function in log.c for ngIRCd 0.8.2 and earlier, when compiled with IDENT, logging to SYSLOG, and with DEBUG enabled, allows remote attackers to execute arbitrary code.
Affected Products: n/a
References: [{'name': '20050203 ngIRCd <= v0.8.2 Format String Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110746413108183&w=2'}, {'name': '14114', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14114/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nosystem.com.ar/advisories/advisory-11.txt'}, {'name': '12434', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12434'}]
CVE State: PUBLISHED
Explain CVE-2005-0227
PostgreSQL (pgsql) 7.4.x, 7.2.x, and other versions allows local users to load arbitrary shared libraries and execute code via the LOAD extension.
Affected Products: n/a
References: [{'name': '200502-08', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200502-08.xml'}, {'name': '2005-0003', 'tags': ['vendor-advisory', 'x_refsource_TRUSTIX'], 'url': 'http://www.trustix.org/errata/2005/0003/'}, {'name': 'DSA-668', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2005/dsa-668'}, {'name': '[pgsql-announce] 20050201 PostgreSQL Security Release', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://archives.postgresql.org/pgsql-announce/2005-02/msg00000.php'}, {'name': '12411', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12411'}, {'name': 'MDKSA-2005:040', 'tags': ['vendor-advisory', 'x_refsource_MANDRAKE'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2005:040'}, {'name': '[pgsql-bugs] 20050121 Privilege escalation via LOAD', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php'}, {'name': 'oval:org.mitre.oval:def:10234', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10234'}, {'name': 'RHSA-2005:138', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-138.html'}, {'name': '12948', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12948'}, {'name': 'RHSA-2005:150', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-150.html'}, {'name': '20050201 [USN-71-1] PostgreSQL vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110726899107148&w=2'}, {'name': 'SUSE-SA:2005:036', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2005_36_sudo.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0229
CitrusDB 0.3.5 and earlier stores the newfile.txt temporary data file under the web root, which allows remote attackers to steal credit card information via a direct request to newfile.txt.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.citrusdb.org/forums/viewtopic.php?t=49'}, {'name': '1013040', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013040'}, {'name': 'citrus-information-disclosure(19145)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19145'}, {'name': '12402', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12402'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.redteam-pentesting.de/advisories/rt-sa-2005-001.txt'}, {'name': '20050212 Credit Card data disclosure in CitrusDB', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=110824766519417&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-0230
Firefox 1.0 does not prevent the user from dragging an executable file to the desktop when it has an image/gif content type but has a dangerous extension such as .bat or .exe, which allows remote attackers to bypass the intended restriction and execute arbitrary commands via malformed GIF files that can still be parsed by the Windows batch file parser, aka "firedragging."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/mfsa2005-25.html'}, {'name': 'oval:org.mitre.oval:def:100033', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100033'}, {'name': '19823', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19823'}, {'name': '20050207 Firedragging [Firefox 1.0]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110780995232064&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.mikx.de/firedragging/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=279945'}, {'name': 'GLSA-200503-30', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200503-30.xml'}, {'name': 'GLSA-200503-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200503-10.xml'}, {'name': 'SUSE-SA:2006:022', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2006_04_25.html'}, {'name': '12468', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12468'}]
CVE State: PUBLISHED
Explain CVE-2005-0231
Firefox 1.0 does not invoke the Javascript Security Manager when a user drags a javascript: or data: URL to a tab, which allows remote attackers to bypass the security model, aka "firetabbing."
Affected Products: n/a
References: [{'name': 'SUSE-SA:2005:016', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2005_16_mozilla_firefox.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=280056'}, {'name': 'oval:org.mitre.oval:def:10079', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10079'}, {'name': '20050207 Firetabbing [Firefox 1.0]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110781134617144&w=2'}, {'name': 'oval:org.mitre.oval:def:100032', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100032'}, {'name': 'mozilla-firefox-tab-gain-access(19264)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19264'}, {'name': 'RHSA-2005:176', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-176.html'}, {'name': 'RHSA-2005:384', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-384.html'}, {'name': 'GLSA-200503-30', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200503-30.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/mfsa2005-26.html'}, {'name': 'GLSA-200503-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200503-10.xml'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.mikx.de/firetabbing/'}]
CVE State: PUBLISHED
Explain CVE-2005-0232
Firefox 1.0 allows remote attackers to modify Boolean configuration parameters for the about:config site by using a plugin such as Flash, and the -moz-opacity filter, to display the about:config site then cause the user to double-click at a certain screen position, aka "Fireflashing."
Affected Products: n/a
References: [{'name': '20050207 Fireflashing [Firefox 1.0]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110781055630856&w=2'}, {'name': 'RHSA-2005:323', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-323.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/mfsa2005-27.html'}, {'name': 'SUSE-SA:2005:016', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2005_16_mozilla_firefox.html'}, {'name': 'mozilla-firefox-aboutconfig-modify(19266)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19266'}, {'name': 'RHSA-2005:176', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-176.html'}, {'name': 'RHSA-2005:384', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-384.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=280664'}, {'name': 'oval:org.mitre.oval:def:10967', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10967'}, {'name': 'GLSA-200503-30', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200503-30.xml'}, {'name': 'GLSA-200503-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200503-10.xml'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.mikx.de/fireflashing/'}]
CVE State: PUBLISHED
Explain CVE-2005-0233
The International Domain Name (IDN) support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.shmoo.com/idn/homograph.txt'}, {'name': 'multiple-browsers-idn-spoof(19236)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19236'}, {'name': '20050206 state of homograph attacks', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.shmoo.com/idn'}, {'name': 'SUSE-SA:2005:016', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2005_16_mozilla_firefox.html'}, {'name': 'oval:org.mitre.oval:def:11229', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11229'}, {'name': 'oval:org.mitre.oval:def:100029', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100029'}, {'name': 'RHSA-2005:176', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-176.html'}, {'name': 'RHSA-2005:384', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-384.html'}, {'name': 'GLSA-200503-30', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200503-30.xml'}, {'name': 'GLSA-200503-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200503-10.xml'}, {'name': '20050208 International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110782704923280&w=2'}, {'name': '12461', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12461'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/mfsa2005-29.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0234
The International Domain Name (IDN) support in Safari 1.2.5 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.shmoo.com/idn/homograph.txt'}, {'name': 'multiple-browsers-idn-spoof(19236)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19236'}, {'name': '20050206 state of homograph attacks', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.shmoo.com/idn'}, {'name': 'APPLE-SA-2005-03-21', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html'}, {'name': '20050208 International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110782704923280&w=2'}, {'name': '12461', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12461'}]
CVE State: PUBLISHED
Explain CVE-2005-0235
The International Domain Name (IDN) support in Opera 7.54 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.shmoo.com/idn/homograph.txt'}, {'name': 'multiple-browsers-idn-spoof(19236)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19236'}, {'name': '20050206 state of homograph attacks', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.shmoo.com/idn'}, {'name': 'SUSE-SA:2005:031', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2005_31_opera.html'}, {'name': '20050208 International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110782704923280&w=2'}, {'name': '12461', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12461'}]
CVE State: PUBLISHED
Explain CVE-2005-0236
The International Domain Name (IDN) support in Omniweb 5 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.shmoo.com/idn/homograph.txt'}, {'name': 'multiple-browsers-idn-spoof(19236)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19236'}, {'name': '20050206 state of homograph attacks', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.shmoo.com/idn'}, {'name': '20050208 International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110782704923280&w=2'}, {'name': '12461', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12461'}]
CVE State: PUBLISHED
Explain CVE-2005-0237
The International Domain Name (IDN) support in Konqueror 3.2.1 on KDE 3.2.1 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.shmoo.com/idn/homograph.txt'}, {'name': 'multiple-browsers-idn-spoof(19236)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19236'}, {'name': '20050206 state of homograph attacks', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kde.org/info/security/advisory-20050316-2.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.shmoo.com/idn'}, {'name': '20050206 Re: state of homograph attacks', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031460.html'}, {'name': 'FLSA:178606', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://www.securityfocus.com/archive/1/427976/100/0/threaded'}, {'name': 'MDKSA-2005:058', 'tags': ['vendor-advisory', 'x_refsource_MANDRAKE'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2005:058'}, {'name': '14162', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14162'}, {'name': 'RHSA-2005:325', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-325.html'}, {'name': 'oval:org.mitre.oval:def:10671', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10671'}, {'name': '12461', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12461'}]
CVE State: PUBLISHED
Explain CVE-2005-0238
The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.shmoo.com/idn/homograph.txt'}, {'name': 'multiple-browsers-idn-spoof(19236)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19236'}, {'name': '20050206 state of homograph attacks', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.shmoo.com/idn'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/beta/show_bug.cgi?id=147399'}, {'name': '12461', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12461'}]
CVE State: PUBLISHED
Explain CVE-2005-0239
viewcert.php in the S/MIME plugin 0.4 and 0.5 for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the cert parameter.
Affected Products: n/a
References: [{'name': 'squirrelmail-smime-command-execution(19242)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19242'}, {'name': 'VU#502328', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/502328'}, {'name': '20050207 SquirrelMail S/MIME Plugin Command Injection Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://www.idefense.com/application/poi/display?id=191&type=vulnerabilities&flashstatus=false'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.squirrelmail.org/plugin_view.php?id=54'}]
CVE State: PUBLISHED
Explain CVE-2005-0240
Format string vulnerability in chdev on IBM AIX 5.2 allows local users to execute arbitrary code via format string specifiers in a command line argument, which is not properly handled when printing an error message.
Affected Products: n/a
References: [{'name': 'IY67455', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=isg1IY67455'}, {'name': '20050207 IBM AIX chdev Local Format String Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://www.idefense.com/application/poi/display?type=vulnerabilities'}, {'name': 'aix-chdev-format-string(19244)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19244'}, {'name': 'IY67654', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=isg1IY67654'}]
CVE State: PUBLISHED
Explain CVE-2005-0241
The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size.
Affected Products: n/a
References: [{'name': '14091', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14091'}, {'name': 'VU#823350', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/823350'}, {'name': '12412', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12412'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.squid-cache.org/bugs/show_bug.cgi?id=1216'}, {'name': 'oval:org.mitre.oval:def:10998', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10998'}, {'name': 'FLSA-2006:152809', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://fedoranews.org/updates/FEDORA--.shtml'}, {'name': 'RHSA-2005:061', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-061.html'}, {'name': 'squid-http-cache-poisoning(19060)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19060'}, {'name': 'CLA-2005:931', 'tags': ['vendor-advisory', 'x_refsource_CONECTIVA'], 'url': 'http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000931'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-oversize_reply_headers'}, {'name': 'SUSE-SA:2005:006', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2005_06_squid.html'}, {'name': 'RHSA-2005:060', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-060.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch'}]
CVE State: PUBLISHED
Explain CVE-2005-0242
The Audio Setup Wizard (asw.dll) in Yahoo! Messenger 6.0.0.1750, and possibly other versions, allows attackers to arbitrary code by placing a malicious ping.exe program into the Messenger program directory, which is installed with weak default permissions.
Affected Products: n/a
References: [{'name': '11815', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/11815'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secunia.com/secunia_research/2004-6/advisory/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://messenger.yahoo.com/security/update6.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0243
Yahoo! Messenger 6.0.0.1750, and possibly other versions before 6.0.0.1921, does not properly display long filenames in file dialog boxes, which could allow remote attackers to trick users into downloading and executing programs via file names containing a large number of spaces and multiple file extensions.
Affected Products: n/a
References: [{'name': '13712', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/13712'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secunia.com/secunia_research/2005-2/advisory/'}]
CVE State: PUBLISHED
Explain CVE-2005-0244
PostgreSQL 8.0.0 and earlier allows local users to bypass the EXECUTE permission check for functions by using the CREATE AGGREGATE command.
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:10927', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10927'}, {'name': 'MDKSA-2005:040', 'tags': ['vendor-advisory', 'x_refsource_MANDRAKE'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2005:040'}, {'name': '20050210 [USN-79-1] PostgreSQL vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110806034116082&w=2'}, {'name': 'RHSA-2005:138', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-138.html'}, {'name': '[pgsql-hackers] 20050127 Permissions on aggregate component functions', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://archives.postgresql.org/pgsql-hackers/2005-01/msg00922.php'}, {'name': '12948', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12948'}, {'name': '12417', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12417'}, {'name': 'postgresql-security-bypass(19184)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19184'}, {'name': 'SUSE-SA:2005:036', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2005_36_sudo.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0245
Buffer overflow in gram.y for PostgreSQL 8.0.0 and earlier may allow attackers to execute arbitrary code via a large number of arguments to a refcursor function (gram.y), which leads to a heap-based buffer overflow, a different vulnerability than CVE-2005-0247.
Affected Products: n/a
References: [{'name': 'postgresql-cursor-bo(19188)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19188'}, {'name': '[pgsql-committers] 20050207 pgsql: Prevent 4 more buffer overruns in the PL/PgSQL parser.', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://archives.postgresql.org/pgsql-committers/2005-02/msg00049.php'}, {'name': 'MDKSA-2005:040', 'tags': ['vendor-advisory', 'x_refsource_MANDRAKE'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2005:040'}, {'name': '20050210 [USN-79-1] PostgreSQL vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110806034116082&w=2'}, {'name': 'oval:org.mitre.oval:def:10175', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10175'}, {'name': '[pgsql-patches] 20050120 Re: WIP: pl/pgsql cleanup', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://archives.postgresql.org/pgsql-patches/2005-01/msg00216.php'}, {'name': 'RHSA-2005:138', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-138.html'}, {'name': '12948', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12948'}, {'name': 'RHSA-2005:150', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-150.html'}, {'name': '[pgsql-committers] 20050121 pgsql: Prevent overrunning a heap-allocated buffer is more than 1024', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://archives.postgresql.org/pgsql-committers/2005-01/msg00298.php'}, {'name': '12417', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12417'}, {'name': 'DSA-683', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2005/dsa-683'}, {'name': 'SUSE-SA:2005:036', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2005_36_sudo.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0246
The intagg contrib module for PostgreSQL 8.0.0 and earlier allows attackers to cause a denial of service (crash) via crafted arrays.
Affected Products: n/a
References: [{'name': '[pgsql-committers] 20050127 pgsql: Fix security and 64-bit issues in contrib/intagg.', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://archives.postgresql.org/pgsql-committers/2005-01/msg00401.php'}, {'name': 'MDKSA-2005:040', 'tags': ['vendor-advisory', 'x_refsource_MANDRAKE'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2005:040'}, {'name': '20050210 [USN-79-1] PostgreSQL vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110806034116082&w=2'}, {'name': 'postgresql-contribintagg-dos(19185)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19185'}, {'name': 'RHSA-2005:138', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-138.html'}, {'name': '12948', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/12948'}, {'name': 'oval:org.mitre.oval:def:10148', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10148'}, {'name': '12417', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12417'}, {'name': 'SUSE-SA:2005:036', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2005_36_sudo.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0247
Multiple buffer overflows in gram.y for PostgreSQL 8.0.1 and earlier may allow attackers to execute arbitrary code via (1) a large number of variables in a SQL statement being handled by the read_sql_construct function, (2) a large number of INTO variables in a SELECT statement being handled by the make_select_stmt function, (3) a large number of arbitrary variables in a SELECT statement being handled by the make_select_stmt function, and (4) a large number of INTO variables in a FETCH statement being handled by the make_fetch_stmt function, a different set of vulnerabilities than CVE-2005-0245.
Affected Products: n/a
References: [{'name': '[pgsql-committers] 20050207 pgsql: Prevent 4 more buffer overruns in the PL/PgSQL parser.', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://archives.postgresql.org/pgsql-committers/2005-02/msg00049.php'}, {'name': 'postgresql-makeselectstmt-arbitrary-bo(19377)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19377'}, {'name': 'GLSA-200502-19', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200502-19.xml'}, {'name': 'MDKSA-2005:040', 'tags': ['vendor-advisory', 'x_refsource_MANDRAKE'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2005:040'}, {'name': '20050210 [USN-79-1] PostgreSQL vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110806034116082&w=2'}, {'name': 'SUSE-SA:2005:027', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2005_27_postgresql.html'}, {'name': 'postgresql-readsqlconstruct-bo(19375)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19375'}, {'name': 'RHSA-2005:138', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-138.html'}, {'name': 'postgresql-makeselectstmt-input-bo(19376)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19376'}, {'name': 'RHSA-2005:150', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-150.html'}, {'name': 'postgresql-fetch-makefetchstmt-bo(19378)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19378'}, {'name': 'oval:org.mitre.oval:def:9345', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9345'}, {'name': '12417', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12417'}, {'name': 'DSA-683', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2005/dsa-683'}, {'name': 'SUSE-SA:2005:036', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2005_36_sudo.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0248
The Solaris Management Console (SMC) GUI for Solaris 8 and 9, when creating user accounts that are configured for password aging, creates the accounts with a blank password, which allows remote or local attackers to break into those accounts.
Affected Products: n/a
References: [{'name': '12260', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12260'}, {'name': '1012860', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1012860'}, {'name': '57717', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-57717-1'}, {'name': 'P-096', 'tags': ['third-party-advisory', 'government-resource', 'x_refsource_CIAC'], 'url': 'http://www.ciac.org/ciac/bulletins/p-096.shtml'}, {'name': 'solaris-smc-blank-password(18868)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/18868'}, {'name': '13803', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/13803/'}]
CVE State: PUBLISHED
Explain CVE-2005-0249
Heap-based buffer overflow in the DEC2EXE module for Symantec AntiVirus Library allows remote attackers to execute arbitrary code via a UPX compressed file containing a negative virtual offset to a crafted PE header.
Affected Products: n/a
References: [{'name': 'VU#107822', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/107822'}, {'name': '20050208 Symantec AntiVirus Library Heap Overflow', 'tags': ['third-party-advisory', 'x_refsource_ISS'], 'url': 'http://xforce.iss.net/xforce/alerts/id/187'}, {'name': '1013133', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013133'}, {'name': 'upx-engine-gain-control(18869)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/18869'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.symantec.com/avcenter/security/Content/2005.02.08.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0250
Format string vulnerability in auditselect on IBM AIX 5.1, 5.2, and 5.3 allows local users to execute arbitrary code via format string specifiers in a command line argument.
Affected Products: n/a
References: [{'name': 'VU#896729', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/896729'}, {'name': 'aix-auditselect-format-string(19255)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19255'}, {'name': 'IY67519', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=isg1IY67519'}, {'name': 'IY67802', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=isg1IY67802'}, {'name': '14198', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14198'}, {'name': '1013103', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013103'}, {'name': '12496', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12496'}, {'name': 'IY67472', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=isg1IY67472'}, {'name': '20050208 IBM AIX auditselect Local Format String Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://www.idefense.com/application/poi/display?id=193&type=vulnerabilities&flashstatus=false'}]
CVE State: PUBLISHED
Explain CVE-2005-0251
Cross-site scripting (XSS) vulnerability in bibindex.php for BibORB 1.3.2, and possibly earlier versions, allows remote attackers to inject arbitrary HTML and web script via the search parameter.
Affected Products: n/a
References: [{'name': '12583', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12583'}, {'name': '20050217 Advisory: Multiple Vulnerabilities in BibORB', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110868948719773&w=2'}, {'name': '20050217 Advisory: Multiple Vulnerabilities in BibORB', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=110864983905770&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-0252
SQL injection vulnerability in BibORB 1.3.2, and possibly earlier versions, allows remote attackers to execute arbitrary SQL commands via the (1) Username or (2) Password.
Affected Products: n/a
References: [{'name': '12583', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12583'}, {'name': '20050217 Advisory: Multiple Vulnerabilities in BibORB', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110868948719773&w=2'}, {'name': '20050217 Advisory: Multiple Vulnerabilities in BibORB', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=110864983905770&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-0253
Directory traversal vulnerability in index.php for BibORB 1.3.2, and possibly earlier versions, allows remote attackers to delete arbitrary files via a Delete action and .. (dot dot) sequences in the database_name parameter.
Affected Products: n/a
References: [{'name': '12583', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12583'}, {'name': '20050217 Advisory: Multiple Vulnerabilities in BibORB', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110868948719773&w=2'}, {'name': '20050217 Advisory: Multiple Vulnerabilities in BibORB', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=110864983905770&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-0254
BibORB 1.3.2, and possibly earlier versions, does not properly enforce a restriction for uploading only PDF and PS files, which allows remote attackers to upload arbitrary files that are presented to other users with PDF or PS icons, which may trick some users into downloading and executing those files.
Affected Products: n/a
References: [{'name': '12583', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12583'}, {'name': '20050217 Advisory: Multiple Vulnerabilities in BibORB', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110868948719773&w=2'}, {'name': '20050217 Advisory: Multiple Vulnerabilities in BibORB', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://marc.info/?l=full-disclosure&m=110864983905770&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-0255
String handling functions in Mozilla 1.7.3, Firefox 1.0, and Thunderbird before 1.0.2, such as the nsTSubstring_CharT::Replace function, do not properly check the return values of other functions that resize the string, which allows remote attackers to cause a denial of service and possibly execute arbitrary code by forcing an out-of-memory state that causes a reallocation to fail and return a pointer to a fixed address, which leads to heap corruption.
Affected Products: n/a
References: [{'name': '12659', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12659'}, {'name': 'SUSE-SA:2005:016', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2005_16_mozilla_firefox.html'}, {'name': '19823', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19823'}, {'name': 'oval:org.mitre.oval:def:9111', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9111'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/mfsa2005-18.html'}, {'name': 'oval:org.mitre.oval:def:100040', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100040'}, {'name': '20050228 Mozilla Firefox and Mozilla Browser Out Of Memory Heap Corruption Design Error', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://www.idefense.com/application/poi/display?id=200&type=vulnerabilities'}, {'name': 'RHSA-2005:176', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-176.html'}, {'name': 'GLSA-200503-30', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200503-30.xml'}, {'name': 'RHSA-2005:277', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-277.html'}, {'name': 'GLSA-200503-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200503-10.xml'}, {'name': 'SUSE-SA:2006:022', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2006_04_25.html'}, {'name': 'RHSA-2005:337', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-337.html'}]
CVE State: PUBLISHED