Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2005-0360
The Microsoft Log Sink Class ActiveX control in pkmcore.dll is marked as "safe for scripting" for Internet Explorer, which allows remote attackers to create or append to arbitrary files.
Affected Products: n/a
References: [{'name': 'VU#165022', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/165022'}]
CVE State: PUBLISHED
Explain CVE-2005-0362
awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pluginmode", (2) "loadplugin", or (3) "noloadplugin" parameters.
Affected Products: n/a
References: [{'name': '16089', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/16089'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488'}]
CVE State: PUBLISHED
Explain CVE-2005-0363
awstats.pl in AWStats 4.0 and 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the config parameter.
Affected Products: n/a
References: [{'name': 'DSA-682', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2005/dsa-682'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488'}]
CVE State: PUBLISHED
Explain CVE-2005-0364
Unknown vulnerability in BIND 9.2.0 in HP-UX B.11.00, B.11.11, and B.11.23 allows remote attackers to cause a denial of service.
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:5690', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5690'}, {'name': 'hpux-bind-dos(19276)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19276'}, {'name': '14220', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14220/'}, {'name': 'HPSBUX01117', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=110805105200470&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-0365
The dcopidlng script in KDE 3.2.x and 3.3.x creates temporary files with predictable filenames, which allows local users to overwrite arbitrary files via a symlink attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kde.org/info/security/advisory-20050316-2.txt'}, {'name': '20050211 insecure temporary file creation in kdelibs 3.3.2', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110814653804757&w=2'}, {'name': 'MDKSA-2005:058', 'tags': ['vendor-advisory', 'x_refsource_MANDRAKE'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2005:058'}, {'name': 'FEDORA-2005-245', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://fedoranews.org/updates/FEDORA-2005-245.shtml'}, {'name': '1013525', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013525'}, {'name': 'RHSA-2005:325', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-325.html'}, {'name': '14254', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14254'}, {'name': 'oval:org.mitre.oval:def:10676', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10676'}, {'name': 'MDKSA-2005:045', 'tags': ['vendor-advisory', 'x_refsource_MANDRAKE'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2005:045'}, {'name': 'GLSA-200503-14', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200503-14.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.kde.org/show_bug.cgi?id=97608'}]
CVE State: PUBLISHED
Explain CVE-2005-0366
The integrity check feature in OpenPGP, when handling a message that was encrypted using cipher feedback (CFB) mode, allows remote attackers to recover part of the plaintext via a chosen-ciphertext attack when the first 2 bytes of a message block are known, and an oracle or other mechanism is available to determine whether an integrity check failed.
Affected Products: n/a
References: [{'name': 'GLSA-200503-29', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200503-29.xml'}, {'name': '13775', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/13775'}, {'name': 'MDKSA-2005:057', 'tags': ['vendor-advisory', 'x_refsource_MANDRAKE'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2005:057'}, {'name': 'VU#303094', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/303094'}, {'name': '1013166', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013166'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.pgp.com/library/ctocorner/openpgp.html'}, {'name': '12529', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12529'}, {'name': 'SUSE-SR:2005:007', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2005_07_sr.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://eprint.iacr.org/2005/033.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://eprint.iacr.org/2005/033'}]
CVE State: PUBLISHED
Explain CVE-2005-0367
Multiple directory traversal vulnerabilities in ArGoSoft Mail Server 1.8.7.3 allow remote authenticated users to read, delete, or upload arbitrary files via a .. (dot dot) in (1) the filename of an e-mail attachment, (2) the _msgatt.rec file, (3) and the /msg, /delete, /folderadd, and /folderdelete operations for the Folder parameter.
Affected Products: n/a
References: [{'name': '20050209 [SIG^2 G-TEC] ArGoSoft Mail Server Webmail Multiple Directory Traversal Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110796956011699&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.security.org.sg/vuln/argosoftmail1873.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0368
Multiple SQL injection vulnerabilities in CMScore allow remote attackers to execute arbitrary SQL commands via the (1) EntryID or (2) searchterm parameter to index.php, or (3) username parameter to authenticate.php.
Affected Products: n/a
References: [{'name': '20050209 CMS Core SQL injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110803385223054&w=2'}, {'name': '12457', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12457'}, {'name': '14142', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14142/'}, {'name': 'cmscore-multiple-sql-injection(19235)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19235'}]
CVE State: PUBLISHED
Explain CVE-2005-0369
Armagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 earlier allows remote attackers to cause a denial of service (application crash) via a packet with a large (1) descriptor ID or (2) claim_id, which exceeds the boundaries of an array.
Affected Products: n/a
References: [{'name': '20050210 Crashes and socket unreacheable in Armagetron Advanced 0.2.7.0', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110811699206052&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-0370
Armagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 and earlier allow remote attackers to cause a denial of service (network disconnection) via an empty UDP packet, which is not properly distinguished from the "no new packets" state of the associated socket.
Affected Products: n/a
References: [{'name': '20050210 Crashes and socket unreacheable in Armagetron Advanced 0.2.7.0', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110811699206052&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-0371
Armagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 and earlier allow remote attackers to cause a denial of service (freeze) via a large number of player connections that do not send any data.
Affected Products: n/a
References: [{'name': '20050210 Crashes and socket unreacheable in Armagetron Advanced 0.2.7.0', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110811699206052&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-0372
Directory traversal vulnerability in gftp before 2.0.18 for GTK+ allows remote malicious FTP servers to read arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command.
Affected Products: n/a
References: [{'name': 'MDKSA-2005:050', 'tags': ['vendor-advisory', 'x_refsource_MANDRAKE'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2005:050'}, {'name': 'oval:org.mitre.oval:def:9923', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9923'}, {'name': 'CLSA-2005:957', 'tags': ['vendor-advisory', 'x_refsource_CONECTIVA'], 'url': 'http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000957'}, {'name': 'GLSA-200502-27', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200502-27.xml'}, {'name': '12539', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12539'}, {'name': 'FEDORA-2005-309', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://www.securityfocus.com/advisories/8379'}, {'name': 'oval:org.mitre.oval:def:717', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A717'}, {'name': 'RHSA-2005:410', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-410.html'}, {'name': 'DSA-686', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2005/dsa-686'}, {'name': 'FEDORA-2005-310', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://www.securityfocus.com/advisories/8380'}]
CVE State: PUBLISHED
Explain CVE-2005-0373
Buffer overflow in digestmd5.c CVS release 1.170 (also referred to as digestmda5.c), as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows remote attackers to execute arbitrary code.
Affected Products: n/a
References: [{'name': 'SUSE-SR:2005:006', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.linuxcompatible.org/print42495.html'}, {'name': 'MDKSA-2005:054', 'tags': ['vendor-advisory', 'x_refsource_MANDRAKE'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2005:054'}, {'name': '[openbsd-ports] 20040717 UPDATE: cyrus-sasl-2.1.19', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.monkey.org/openbsd/archive/ports/0407/msg00265.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c?rev=1.171&content-type=text/x-cvsweb-markup'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c.diff?r1=1.170&r2=1.171'}, {'name': '11347', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/11347'}, {'name': 'GLSA-200410-05', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200410-05.xml'}, {'name': 'cyrus-sasl-digestmda5-bo(17642)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/17642'}]
CVE State: PUBLISHED
Explain CVE-2005-0374
Cross-site scripting (XSS) vulnerability in Bitboard 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via an [img] bbcode image tag with an event such as mouseover.
Affected Products: n/a
References: [{'name': '20050112 Security Advisory: BiTBOARD xss', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110555988111899&w=2'}, {'name': 'bitshifters-bitboard-xss(18871)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/18871'}, {'name': '12248', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12248'}, {'name': '1012864', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1012864'}]
CVE State: PUBLISHED
Explain CVE-2005-0375
imageview.php in SGallery 1.01 allows remote attackers to obtain sensitive information via an HTTP request with (1) idalbum and (2) idimage unset, which reveals the installation path in an error message for the sql_fetch_row function.
Affected Products: n/a
References: [{'name': '20050112 [waraxe-2005-SA#039] - Critical Sql Injection in Sgallery module for PhpNuke', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110557050700947&w=2'}, {'name': '20050112 [waraxe-2005-SA#039] - Critical Sql Injection in Sgallery module for PhpNuke', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2005-January/030844.html'}, {'name': 'sgallery-path-disclosure(18877)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/18877'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-39.html'}, {'name': '1012868', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1012868'}]
CVE State: PUBLISHED
Explain CVE-2005-0376
PHP remote file inclusion vulnerability in SGallery 1.01 allows local and possibly remote attackers to execute arbitrary PHP code by modifying the DOCUMENT_ROOT parameter to reference a URL on a remote web server that contains (1) config.php or (2) sql_layer.php.
Affected Products: n/a
References: [{'name': '20050112 [waraxe-2005-SA#039] - Critical Sql Injection in Sgallery module for PhpNuke', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110557050700947&w=2'}, {'name': '20050112 [waraxe-2005-SA#039] - Critical Sql Injection in Sgallery module for PhpNuke', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2005-January/030844.html'}, {'name': '13824', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/13824'}, {'name': 'sgallery-file-include(18878)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/18878'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-39.html'}, {'name': '1012868', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1012868'}]
CVE State: PUBLISHED
Explain CVE-2005-0377
SQL injection vulnerability in imageview.php for SGallery 1.01 allows remote attackers to execute arbitrary SQL commands via the (1) idalbum or (2) idimage parameters.
Affected Products: n/a
References: [{'name': '20050112 [waraxe-2005-SA#039] - Critical Sql Injection in Sgallery module for PhpNuke', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110557050700947&w=2'}, {'name': '12249', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12249'}, {'name': '20050112 [waraxe-2005-SA#039] - Critical Sql Injection in Sgallery module for PhpNuke', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2005-January/030844.html'}, {'name': '13824', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/13824'}, {'name': 'sgallery-imageview-sql-injection(18876)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/18876'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-39.html'}, {'name': '1012868', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1012868'}]
CVE State: PUBLISHED
Explain CVE-2005-0378
Multiple cross-site scripting (XSS) vulnerabilities in Horde 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter to prefs.php or (2) url parameter to index.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.hyperdose.com/advisories/H2005-01.txt'}, {'name': '20050113 Cross Site Scripting holes found in Horde 3.0', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110564059322774&w=2'}, {'name': '12255', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12255'}, {'name': '1012892', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1012892'}, {'name': 'horde-prefs-index-xss(18881)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/18881'}]
CVE State: PUBLISHED
Explain CVE-2005-0379
Multiple directory traversal vulnerabilities in ZeroBoard 4.1pl5 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the _zb_path parameter to (1) _head.php or (2) outlogin.php, or the dir parameter to (3) write.php.
Affected Products: n/a
References: [{'name': '12257', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12257'}, {'name': '1012884', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1012884'}, {'name': '20050113 STG Security Advisory: [SSA-20050113-25] ZeroBoard multiple vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110565373407474&w=2'}, {'name': 'zeroboard-file-disclosure(18891)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/18891'}]
CVE State: PUBLISHED
Explain CVE-2005-0380
Multiple PHP remote file inclusion vulnerabilities in (1) print_category.php, (2) login.php, (3) setup.php, (4) ask_password.php, or (5) error.php in ZeroBoard 4.1pl5 and earlier allow remote attackers to execute arbitrary PHP code by modifying the dir parameter to reference a URL on a remote web server that contains the code.
Affected Products: n/a
References: [{'name': '12206', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12206'}, {'name': '1012884', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1012884'}, {'name': '13769', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/13769'}, {'name': '12930', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/12930'}, {'name': '12932', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/12932'}, {'name': '12929', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/12929'}, {'name': '20050113 STG Security Advisory: [SSA-20050113-25] ZeroBoard multiple vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110565373407474&w=2'}, {'name': 'zeroboard-printcategory-file-include(18892)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/18892'}, {'name': '12931', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/12931'}, {'name': '12258', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12258'}, {'name': '12928', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/12928'}, {'name': 'zeroboard-zero-vote-file-include(18893)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/18893'}]
CVE State: PUBLISHED
Explain CVE-2005-0381
Cross-site scripting (XSS) vulnerability in f.aspx in forumKIT 1.0 allows remote attackers to inject arbitrary web script or HTML via the members parameter.
Affected Products: n/a
References: [{'name': '20050113 XSS Vulnerability in ForumKIT', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110563769413994&w=2'}, {'name': '12256', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12256'}, {'name': '1012895', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1012895'}, {'name': 'forumkit-members-xss(18880)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/18880'}]
CVE State: PUBLISHED
Explain CVE-2005-0382
Breed patch 1 and earlier allows remote attackers to cause a denial of service (application crash) via an empty UDP packet, which triggers a null dereference.
Affected Products: n/a
References: [{'name': '13211', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/13211'}, {'name': '20050113 Server crash in Breed patch #1', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110565587010998&w=2'}, {'name': '12262', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12262'}, {'name': 'breed-udp-datagram-dos(18890)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/18890'}]
CVE State: PUBLISHED
Explain CVE-2005-0383
Trend Micro Control Manager 3.0 Enterprise Edition allows remote attackers to gain privileges via a replay attack of the encrypted username and password.
Affected Products: n/a
References: [{'name': '20050113 Trend Micro Control Manager - Enterprise Edition 3.0 Web application Replay attack', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110564369316593&w=2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.cirt.dk/advisories/cirt-28-advisory.pdf'}, {'name': 'control-manager-replay-attack(18887)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/18887'}, {'name': '20050113 Trend Micro Control Manager - Enterprise Edition 3.0 Web application Replay attack', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110565281205427&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-0384
Unknown vulnerability in the PPP driver for the Linux kernel 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) via a pppd client.
Affected Products: n/a
References: [{'name': '20163', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/20163'}, {'name': '2005-0009', 'tags': ['vendor-advisory', 'x_refsource_TRUSTIX'], 'url': 'http://www.trustix.org/errata/2005/0009/'}, {'name': 'DSA-1082', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1082'}, {'name': 'RHSA-2005:366', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-366.html'}, {'name': '12810', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12810'}, {'name': 'RHSA-2005:283', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-283.html'}, {'name': 'SUSE-SA:2005:018', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2005_18_kernel.html'}, {'name': 'DSA-1070', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1070'}, {'name': 'DSA-1067', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1067'}, {'name': 'DSA-1069', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1069'}, {'name': 'FLSA:152532', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152532'}, {'name': 'oval:org.mitre.oval:def:9562', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9562'}, {'name': 'RHSA-2005:293', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-293.html'}, {'name': 'RHSA-2005:284', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-284.html'}, {'name': 'USN-95-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/95-1/'}, {'name': '20202', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/20202'}, {'name': '20338', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/20338'}]
CVE State: PUBLISHED
Explain CVE-2005-0385
Buffer overflow in luxman before 0.41, if used with certain insecure svgalib libraries, allows local users to execute arbitrary code via a long -f command line argument.
Affected Products: n/a
References: [{'name': 'DSA-693', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2005/dsa-693'}, {'name': "20050314 DMA[2005-0310a] - 'Frank McIngvale LuxMan buffer overflow'", 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/393195/2005-03-13/2005-03-19/0'}, {'name': 'luxman-bo-execute-commands(19680)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19680'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.digitalmunition.com/DMA%5B2005-0310a%5D.txt'}, {'name': '12797', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12797'}, {'name': '14582', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14582'}]
CVE State: PUBLISHED
Explain CVE-2005-0386
Cross-site scripting (XSS) vulnerability in network.cgi in mailreader before 2.3.29 earlier allows remote attackers to inject arbitrary web script or HTML via MIME text/enriched or text/richtext messages.
Affected Products: n/a
References: [{'name': 'DSA-700', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2005/dsa-700'}, {'name': '14777', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14777'}]
CVE State: PUBLISHED
Explain CVE-2005-0387
remstats 1.0.13 and earlier, when processing uptime data, allows local users to create or overwrite arbitrary files via a symlink attack on temporary files.
Affected Products: n/a
References: [{'name': 'DSA-704', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2005/dsa-704'}]
CVE State: PUBLISHED
Explain CVE-2005-0388
Unknown vulnerability in the remoteping service in remstats 1.0.13 and earlier allows remote attackers to execute arbitrary commands "due to missing input sanitising."
Affected Products: n/a
References: [{'name': 'DSA-704', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2005/dsa-704'}]
CVE State: PUBLISHED
Explain CVE-2005-0390
Buffer overflow in the HTTP redirection capability in conn.c for Axel before 1.0b may allow remote attackers to execute arbitrary code.
Affected Products: n/a
References: [{'name': '14831', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14831'}, {'name': 'DSA-706', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2005/dsa-706'}, {'name': '13059', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13059'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mail-archive.com/debian-devel-changes%40lists.debian.org/msg118978.html'}, {'name': 'GLSA-200504-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200504-09.xml'}]
CVE State: PUBLISHED
Explain CVE-2005-0391
geneweb 4.10 and earlier does not properly check file permissions and content during conversion, which allows attackers to modify arbitrary files.
Affected Products: n/a
References: [{'name': 'geneweb-insecure-file-permission(20176)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/20176'}, {'name': 'DSA-712', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2005/dsa-712'}]
CVE State: PUBLISHED
Explain CVE-2005-0392
ppxp does not drop root privileges before opening log files, which allows local users to execute arbitrary commands.
Affected Products: n/a
References: [{'name': '13681', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/13681'}, {'name': 'DSA-725', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2005/dsa-725'}]
CVE State: PUBLISHED
Explain CVE-2005-0393
The helper scripts for crip 3.5 do not properly use temporary files, which allows local users to have an unknown impact with unknown attack vectors.
Affected Products: n/a
References: [{'name': 'DSA-733', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2005/dsa-733'}]
CVE State: PUBLISHED
Explain CVE-2005-0396
Desktop Communication Protocol (DCOP) daemon, aka dcopserver, in KDE before 3.4 allows local users to cause a denial of service (dcopserver consumption) by "stalling the DCOP authentication process."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kde.org/info/security/advisory-20050316-1.txt'}, {'name': 'FLSA:178606', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://www.securityfocus.com/archive/1/427976/100/0/threaded'}, {'name': 'MDKSA-2005:058', 'tags': ['vendor-advisory', 'x_refsource_MANDRAKE'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2005:058'}, {'name': '12820', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12820'}, {'name': 'RHSA-2005:325', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-325.html'}, {'name': 'RHSA-2005:307', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-307.html'}, {'name': 'oval:org.mitre.oval:def:10432', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10432'}, {'name': 'GLSA-200503-22', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200503-22.xml'}, {'name': '20050316 Multiple KDE Security Advisories (2005-03-16)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111099766716483&w=2'}]
CVE State: PUBLISHED
Explain CVE-2005-0397
Format string vulnerability in the SetImageInfo function in image.c for ImageMagick before 6.0.2.5 may allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a filename argument to convert, which may be called by other web applications.
Affected Products: n/a
References: [{'name': '20050303 [USN-90-1] Imagemagick vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=110987256010857&w=2'}, {'name': 'imagemagick-filename-format-string(19586)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19586'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=83542'}, {'name': 'SUSE-SA:2005:017', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2005_17_imagemagick.html'}, {'name': 'RHSA-2005:320', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-320.html'}, {'name': 'GLSA-200503-11', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200503-11.xml'}, {'name': 'DSA-702', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2005/dsa-702'}, {'name': 'oval:org.mitre.oval:def:10302', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10302'}, {'name': 'RHSA-2005:070', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-070.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0398
The KAME racoon daemon in ipsec-tools before 0.5 allows remote attackers to cause a denial of service (crash) via malformed ISAKMP packets.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=109966&action=view'}, {'name': 'MDKSA-2005:062', 'tags': ['vendor-advisory', 'x_refsource_MANDRAKE'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2005:062'}, {'name': 'GLSA-200503-33', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200503-33.xml'}, {'name': 'racoon-isakmp-header-dos(19707)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19707'}, {'name': '12804', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12804'}, {'name': 'ADV-2005-0264', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2005/0264'}, {'name': '[ipsec-tools-devel] 20050312 potential remote crash in racoon', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://sourceforge.net/mailarchive/forum.php?thread_id=6787713&forum_id=32000'}, {'name': '14584', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14584'}, {'name': 'RHSA-2005:232', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-232.html'}, {'name': 'oval:org.mitre.oval:def:10028', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10028'}, {'name': '1013433', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013433'}]
CVE State: PUBLISHED
Explain CVE-2005-0400
The ext2_make_empty function call in the Linux kernel before 2.6.11.6 does not properly initialize memory when creating a block for a new directory entry, which allows local users to obtain potentially sensitive information by reading the block.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://arkoon.net/advisories/ext2-make-empty-leak.txt'}, {'name': '18684', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18684'}, {'name': 'RHSA-2005:366', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-366.html'}, {'name': '14713', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14713/'}, {'name': 'USN-103-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/103-1/'}, {'name': 'RHSA-2006:0190', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2006-0190.html'}, {'name': '20050401 Information leak in the Linux kernel ext2 implementation', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111238764720696&w=2'}, {'name': '17002', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/17002'}, {'name': 'FLSA:152532', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152532'}, {'name': 'oval:org.mitre.oval:def:10336', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10336'}, {'name': 'kernel-ext2-information-disclosure(19866)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19866'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.11.6'}, {'name': 'RHSA-2005:663', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-663.html'}, {'name': 'ADV-2005-1878', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2005/1878'}, {'name': '12932', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12932'}, {'name': 'RHSA-2006:0191', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2006-0191.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0401
FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka "Firescrolling 2."
Affected Products: n/a
References: [{'name': 'RHSA-2005:336', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-336.html'}, {'name': 'ADV-2005-0296', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2005/0296'}, {'tags': ['x_refsource_MISC'], 'url': 'http://mikx.de/firescrolling2/'}, {'name': 'RHSA-2005:335', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-335.html'}, {'name': 'oval:org.mitre.oval:def:9650', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9650'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/mfsa2005-32.html'}, {'name': '12885', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12885'}, {'name': 'oval:org.mitre.oval:def:100026', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100026'}, {'name': 'RHSA-2005:384', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-384.html'}, {'name': 'GLSA-200503-30', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200503-30.xml'}, {'name': '20050324 Firescrolling 2 [Firefox 1.0.1]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=111168413007891&w=2'}, {'name': '14654', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14654'}]
CVE State: PUBLISHED
Explain CVE-2005-0402
Firefox before 1.0.2 allows remote attackers to execute arbitrary code by tricking a user into saving a page as a Firefox sidebar panel, then using the sidebar panel to inject Javascript into a privileged page.
Affected Products: n/a
References: [{'name': 'RHSA-2005:336', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-336.html'}, {'name': 'oval:org.mitre.oval:def:100027', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100027'}, {'name': 'ADV-2005-0296', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2005/0296'}, {'name': 'oval:org.mitre.oval:def:11868', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11868'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/mfsa2005-31.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=284627'}, {'name': '14654', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14654'}]
CVE State: PUBLISHED
Explain CVE-2005-0403
init_dev in tty_io.c in the Red Hat backport of NPTL to Red Hat Enterprise Linux 3 does not properly clear controlling tty's in multi-threaded applications, which allows local users to cause a denial of service (crash) and possibly gain tty access via unknown attack vectors that trigger an access of a pointer to a freed structure.
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:9435', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9435'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=144059'}, {'name': 'RHSA-2005:293', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2005-293.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0404
KMail 1.7.1 in KDE 3.3.2 allows remote attackers to spoof email information, such as whether the email has been digitally signed or encrypted, via HTML formatted email.
Affected Products: n/a
References: [{'name': '[kmail-devel] 20050215 [Bug 96020] HTML Allows Spoofing of Emails Content', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail.kde.org/pipermail/kmail-devel/2005-February/015490.html'}, {'name': '14925', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14925'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.kde.org/show_bug.cgi?id=96020'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securiteam.com/unixfocus/5GP0B0AFFE.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0406
A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, which could lead to an information leak of potentially sensitive visual information that had been removed from the main JPEG image.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.redteam-pentesting.de/advisories/rt-sa-2005-008.txt'}, {'name': '20050214 Advisory: JPEG EXIF information disclosure', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/lists/fulldisclosure/2005/Feb/0343.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0407
Cross-site scripting (XSS) vulnerability in Openconf 1.04, and possibly other versions before 1.10, allows remote attackers to inject arbitrary HTML and web script via the paper title.
Affected Products: n/a
References: [{'name': '12554', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12554'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.redteam-pentesting.de/advisories/rt-sa-2005-007.txt'}, {'name': '14294', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14294'}, {'name': '20050214 Advisory: Cross Site Scripting Vulnerability in Openconf Conference Management Software', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/lists/fulldisclosure/2005/Feb/0347.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0408
CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the "boogaadeeboo" string, which is hard-coded in the $hidden_hash variable.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.redteam-pentesting.de/advisories/rt-sa-2005-002.txt'}, {'name': '20050214 Advisory: Authentication bypass in CitrusDB', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031707.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0409
CitrusDB 0.3.6 and earlier does not verify authorization for the (1) importcc.php and (2) uploadcc.php, which allows remote attackers to upload credit card data and obtain sensitive information such as the pathnames for temporary files that store credit card data, and facilitates the exploitation of other vulnerabilities.
Affected Products: n/a
References: [{'name': '20050214 Advisory: Upload Authorization bypass in CitrusDB', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031707.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.redteam-pentesting.de/advisories/rt-sa-2005-003.txt'}]
CVE State: PUBLISHED
Explain CVE-2005-0410
SQL injection vulnerability in importcc.php for CitrusDB 0.3.6 and earlier allows remote attackers to inject data via the fields of a CSV file.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.redteam-pentesting.de/advisories/rt-sa-2005-004.txt'}, {'name': '20050214 Advisory: SQL-Injection in CitrusDB', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031709.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0411
Directory traversal vulnerability in index.php for CitrusDB 0.3.6 and earlier allows remote attackers and local users to include arbitrary PHP files via .. (dot dot) sequences in the load parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.redteam-pentesting.de/advisories/rt-sa-2005-005.txt'}, {'name': '20050214 Advisory: Directory traversal in CitrusDB', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031710.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0412
Cross-site scripting (XSS) vulnerability in Spidean PostWrap allows remote attackers to inject arbitrary HTML and web script via the page parameter.
Affected Products: n/a
References: [{'name': '1013130', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013130'}, {'name': 'postwrap-xss(19261)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19261'}, {'name': '20050208 XSS VULNERABILITY AT MODULE PostWrap', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2005-02/0065.html'}]
CVE State: PUBLISHED
Explain CVE-2005-0413
Multiple SQL injection vulnerabilities in MyPHP Forum 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the fid in forum.php, (2) the member parameter in member.php, (3) the email parameter in forgot.php, or (4) the nbuser or nbpass parameters in include.php.  NOTE: it was later reported that vector 2 exists in 3.0 and earlier.
Affected Products: n/a
References: [{'name': '12501', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/12501'}, {'name': '4822', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/4822'}, {'name': '27083', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/27083'}, {'name': 'myphpforum-multiple-sql-injection(19272)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/19272'}, {'name': '20050209 Several SQL injection bugs in myPHP Forum v.1.0', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://seclists.org/lists/bugtraq/2005/Feb/0125.html'}, {'name': '1013136', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1013136'}, {'name': 'myphpforum-member-sql-injection(39348)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/39348'}, {'name': '14205', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/14205'}]
CVE State: PUBLISHED