DuyTa/cve-kgrag-db huggingface dataset:
CVE-2005-1868
I-Man 0.9, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code by uploading a file attachment with a .php extension.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: i-man
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: http://secunia.com/advisories/15558/, http://sourceforge.net/project/shownotes.php?release_id=331422, https://exchange.xforce.ibmcloud.com/vulnerabilities/20857
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2005-3980
SQL injection vulnerability in the ticket query module in Edgewall Trac 0.9 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the group parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: trac
References: http://projects.edgewall.com/trac/wiki/ChangeLog, http://secunia.com/advisories/17836/, http://securitytracker.com/id?1015302
CVE-2005-0391
geneweb 4.10 and earlier does not properly check file permissions and content during conversion, which allows attackers to modify arbitrary files.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: geneweb
References: http://www.debian.org/security/2005/dsa-712, https://exchange.xforce.ibmcloud.com/vulnerabilities/20176, http://www.debian.org/security/2005/dsa-712
CVE-2005-1103
Sygate Security Agent (SSA) in Sygate Secure Enterprise 3.5 through 4.1 does not prevent the security policy from being updated by unprivileged users, which allows local users to modify the policy by exporting the policy file, changing it, and importing it back into SSA.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: security_agent
References: http://marc.info/?l=bugtraq&m=111335219201828&w=2, http://marc.info/?l=bugtraq&m=111335219201828&w=2
CVE-2005-0962
SQL injection vulnerability in index.php for Lighthouse Squirrelcart allows remote attackers to execute arbitrary SQL commands via the (1) crn parameter in a show action or (2) rn parameter in a show_detail action.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: squirrelcart
References: http://digitalparadox.org/advisories/sqc.txt, http://secunia.com/advisories/14770, http://www.securityfocus.com/bid/12944
CVE-2005-3926
Direct static code injection vulnerability in error.php in GuppY 4.5.9 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via the _SERVER[REMOTE_ADDR] parameter, which is injected into a .inc script that is later included by the main script.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: guppy
References: http://rgod.altervista.org/guppy459_xpl.html, http://secunia.com/advisories/17790, http://securitytracker.com/id?1015279
CVE-2005-1670
Unknown vulnerability in Extreme BlackDiamond 10808 and 8800 switches running ExtremeWare XOS 11.1 before 11.1.3.3, 11.0 before 11.0.2.4, and 10.x allows remote authenticated users to execute arbitrary commands.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: blackdiamond_8800, extremeware_xos, blackdiamond_10808
References: http://secunia.com/advisories/15438, http://www.extremenetworks.com/services/documentation/FieldNotices_FN0215-Security_Alert_EXOS.asp, http://www.kb.cert.org/vuls/id/937838
CVE-2005-2052
Heap-based buffer overflow in vidplin.dll in RealPlayer 10 and 10.5 (6.0.12.1040 through 1069), RealOne Player v1 and v2, RealPlayer 8 and RealPlayer Enterprise allows remote attackers to execute arbitrary code via an .avi file with a modified strf structure value.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: realplayer, realone_player
References: http://marc.info/?l=bugtraq&m=111955853611840&w=2, http://service.real.com/help/faq/security/050623_player/EN/, http://marc.info/?l=bugtraq&m=111955853611840&w=2
CVE-2005-4369
Cross-site scripting (XSS) vulnerability in Acuity CMS 2.6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly strSearchKeywords to browse.asp.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: acuity_cms
References: http://pridels0.blogspot.com/2005/12/acuity-cms-26x-asp-xss-vuln.html, http://secunia.com/advisories/18070, http://www.osvdb.org/21794
CVE-2005-0386
Cross-site scripting (XSS) vulnerability in network.cgi in mailreader before 2.3.29 earlier allows remote attackers to inject arbitrary web script or HTML via MIME text/enriched or text/richtext messages.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: mailreader.com
References: http://secunia.com/advisories/14777, http://www.debian.org/security/2005/dsa-700, http://secunia.com/advisories/14777
CVE-2005-0105
Unknown vulnerability in typespeed 0.4.1 and earlier allows local users to gain privileges.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: typespeed
References: http://www.debian.org/security/2005/dsa-684, http://www.debian.org/security/2005/dsa-684
CVE-2005-0875
Multiple buffer overflows in the Yahoo plug-in for Trillian 2.0, 3.0, and 3.1 allow remote web servers to cause a denial of service (application crash) via a long string in an HTTP 1.1 response header.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: trillian
References: http://marc.info/?l=bugtraq&m=111171416802350&w=2, http://secunia.com/advisories/14689, http://marc.info/?l=bugtraq&m=111171416802350&w=2
CVE-2005-3380
Multiple interpretation error in Panda Titanium 2005 4.02.01 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: titanium_2005
References: http://marc.info/?l=bugtraq&m=113026417802703&w=2, http://www.securityelf.org/magicbyte.html, http://www.securityelf.org/magicbyteadv.html
CVE-2005-1701
SQL injection vulnerability in PortailPHP 1.3 allows remote attackers to execute arbitrary SQL commands via the id parameter to the (1) News, (2) File, (3) Liens, or (4) Faq modules.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: portailphp
References: http://marc.info/?l=bugtraq&m=111686643823025&w=2, http://securitytracker.com/id?1014036, http://www.securityfocus.com/bid/13708
CVE-2005-0488
Certain BSD-based Telnet clients, including those used on Solaris and SuSE Linux, allow remote malicious Telnet servers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: telnet_client, sunos, kerberos_5
References: http://idefense.com/application/poi/display?id=260&type=vulnerabilities, http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html, http://secunia.com/advisories/17135
CVE-2005-1465
Unknown vulnerability in the NCP dissector in Ethereal before 0.10.11 allow remote attackers to cause a denial of service (long loop).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: ethereal
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000963, http://www.ethereal.com/appnotes/enpa-sa-00019.html, http://www.ethereal.com/news/item_20050504_01.html
CVE-2005-3524
Buffer overflow in the SSL-ready version of linux-ftpd (linux-ftpd-ssl) 0.17 allows remote attackers to execute arbitrary code by creating a long directory name, then executing the XPWD command.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: linux-ftpd-ssl
References: http://seclists.org/lists/fulldisclosure/2005/Nov/0140.html, http://secunia.com/advisories/17465, http://secunia.com/advisories/17529
CVE-2005-2751
memberd in Mac OS X 10.4 up to 10.4.2, in certain situations, does not quickly synchronize access control checks with changes in group membership, which could allow users to access files and other resources after they have been removed from a group.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mac_os_x_server, mac_os_x
References: http://lists.apple.com/archives/security-announce/2005/Oct/msg00000.html, http://secunia.com/advisories/17368, http://securitytracker.com/id?1015125
CVE-2005-4356
SQL injection vulnerability in UStore allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ustore
References: http://secunia.com/advisories/18026, http://www.osvdb.org/21981, http://www.vupen.com/english/advisories/2005/2990
CVE-2005-3659
nsrd.exe in EMC Legato NetWorker 7.1.x before 7.1.4 and 7.2.x before 7.2.1.Build.314, and other products such as Sun Solstice Backup (SBU) 6.0 and 6.1 and StorEdge Enterprise Backup Software (EBS) 7.1 through 7.2L, allows remote attackers to cause a denial of service (nsrd service crash) via a malformed RPC request to RPC program number 390109, which triggers a null dereference.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: legato_networker
Related CWEs: CWE-399
References: ftp://ftp.legato.com/pub/NetWorker/Updates/LGTpa83990/README.TXT, http://secunia.com/advisories/18495, http://secunia.com/advisories/18615
CWE: CWE-399
CVE-2005-1466
Unknown vulnerability in the DICOM dissector in Ethereal before 0.10.11 allows remote attackers to cause a denial of service (large memory allocation) via unknown vectors.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: ethereal
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000963, http://www.ethereal.com/appnotes/enpa-sa-00019.html, http://www.ethereal.com/news/item_20050504_01.html
CVE-2005-1773
Multiple unknown vulnerabilities in L-Soft LISTSERV 14.3, 1.8e, and 1.8d allow remote attackers to execute arbitrary code or cause a denial of service.  NOTE: this candidate may be SPLIT in the future when more precise technical details become available.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: listserv
References: http://marc.info/?l=bugtraq&m=111705329308546&w=2, http://secunia.com/advisories/15498, http://securitytracker.com/id?1014051
CVE-2005-4266
WorldClient.dll in Alt-N MDaemon and WorldClient 8.1.3 trusts a Session parameter that contains a randomly generated session ID that is associated with a username, which allows remote attackers to perform actions as other users by guessing or sniffing the random value.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: worldclient, mdaemon
References: http://secunia.com/advisories/17990, http://www.ipomonis.com/advisories/mdaemon.zip, http://secunia.com/advisories/17990
CVE-2005-1262
Gaim 1.2.1 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed MSN message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: gaim
References: http://gaim.sourceforge.net/security/index.php?id=17, http://www.novell.com/linux/security/advisories/2005_36_sudo.html, http://www.redhat.com/support/errata/RHSA-2005-429.html
CVE-2005-4819
Cross-site scripting (XSS) vulnerability in Lotus Domino versions before 6.5.4 fix pack 1 (FP1) and versions before 7.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: lotus_domino
References: http://www-1.ibm.com/support/docview.wss?rs=0&uid=swg21201845, http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21217285, http://www.osvdb.org/displayvuln.php?osvdb_id=19614
CVE-2005-3418
Multiple cross-site scripting (XSS) vulnerabilities in phpBB 2.0.17 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) error_msg parameter to usercp_register.php, (2) forward_page parameter to login.php, and (3) list_cat parameter to search.php, which are not initialized as variables.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: phpbb
References: http://marc.info/?l=bugtraq&m=113081113317600&w=2, http://secunia.com/advisories/17366, http://secunia.com/advisories/18098
CVE-2005-1046
Buffer overflow in the kimgio library for KDE 3.4.0 allows remote attackers to execute arbitrary code via a crafted PCX image file.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: kde
References: http://bugs.kde.org/show_bug.cgi?id=102328, http://secunia.com/advisories/14908, http://secunia.com/advisories/28114
CVE-2005-1834
SQL injection vulnerability in login.asp in NEXTWEB (i)Site allows remote attackers to execute arbitrary SQL commands and bypass authentication via the password field.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: nextweb_\(i\)site
References: http://marc.info/?l=bugtraq&m=111764682925083&w=2, http://secunia.com/advisories/15560, http://securitytracker.com/id?1014085
CVE-2005-1057
Cisco IOS 12.2T, 12.3 and 12.3T, when using Easy VPN Server XAUTH version 6 authentication, allows remote attackers to bypass authentication via a "malformed packet."
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ios
References: http://www.cisco.com/warp/public/707/cisco-sa-20050406-xauth.shtml, https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5852, http://www.cisco.com/warp/public/707/cisco-sa-20050406-xauth.shtml
CVE-2005-0045
The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the "Server Message Block Vulnerability," and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: windows_2000, windows_nt, windows_xp, windows_2003_server
References: http://marc.info/?l=bugtraq&m=110792638401852&w=2, http://marc.info/?l=bugtraq&m=111040962600205&w=2, http://marc.info/?l=ntbugtraq&m=110795643831169&w=2
CVE-2005-3059
Multiple unspecified vulnerabilities in Opera 8.50 on Linux and Windows have unknown impact and attack vectors, related to (1) " handling of must-revalidate cache directive for HTTPS pages" or (2) a "display issue with cookie comment encoding."
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: linux_kernel, windows, opera_browser
References: http://secunia.com/advisories/16645, http://www.opera.com/docs/changelogs/linux/850/, http://www.opera.com/docs/changelogs/windows/850/
CVE-2005-2784
SQL injection vulnerability in the login function for the administration login panel in cosmoshop 8.10.78 allows remote attackers to execute arbitrary SQL commands and bypass authentication via unspecified vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: cosmoshop
References: http://marc.info/?l=bugtraq&m=112534390600093&w=2, http://secunia.com/advisories/16625/, http://www.securityfocus.com/bid/14689
CVE-2005-2609
index.php in VegaDNS 0.8.1, 0.9.8, and possibly other versions, allows remote attackers to obtain the full server path via an invalid VDNS_Sessid parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: vegadns
References: http://secunia.com/advisories/16370, http://vegadns.org/src/current/CHANGELOG, http://www.packetstormsecurity.org/0508-exploits/vegadns-dyn0.txt
CVE-2005-4407
Cross-site scripting (XSS) vulnerability in index.cfm in Mercury CMS 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) content and (2) criteria parameters.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: mercury_cms
References: http://pridels0.blogspot.com/2005/12/mercury-cms-vuln.html, http://www.osvdb.org/21863, http://pridels0.blogspot.com/2005/12/mercury-cms-vuln.html
CVE-2005-0653
phpMyAdmin 2.6.1 does not properly grant permissions on tables with an underscore in the name, which grants remote authenticated users more privileges than intended.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpmyadmin
References: http://bugs.gentoo.org/show_bug.cgi?id=83792, http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml, http://bugs.gentoo.org/show_bug.cgi?id=83792
CVE-2005-4624
The m_join function in channel.c for PTnet ircd 1.5 and 1.6 allows remote attackers to cause a denial of service (memory exhaustion that triggers a daemon restart) via a large number of requests to join a "charmed channel" such as PTnet, #PTnoticias and #*.log, which causes ircd to open the channel even though it does not have any valid users.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: ptnet_ircd
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-12/1476.html, http://securitytracker.com/id?1015425, http://www.securityfocus.com/bid/16089
CVE-2005-2244
The aupair service (aupair.exe) in Cisco CallManager (CCM) 3.2 and earlier, 3.3 before 3.3(5), 4.0 before 4.0(2a)SR2b, and 4.1 4.1 before 4.1(3)SR1 allows remote attackers to execute arbitrary code or corrupt memory via crafted packets that trigger a memory allocation failure and lead to a buffer overflow.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: call_manager
References: http://www.cisco.com/warp/public/707/cisco-sa-20050712-ccm.shtml, http://www.securityfocus.com/bid/14255, https://exchange.xforce.ibmcloud.com/vulnerabilities/19053
CVE-2005-4033
Nodezilla 0.4.13-corno-fulgure does not properly protect the evl_data directory, which could allow them to be shared when they are not protected by PRIVATEDATADIR in nodezilla.ini, which allows remote attackers to obtain sensitive information.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: nodezilla
References: http://secunia.com/advisories/17867, http://www.nodezilla.net/history.txt, http://www.securityfocus.com/bid/15704
CVE-2005-4138
Multiple cross-site scripting (XSS) vulnerabilities in ThWboard before 3 Beta 2.84 allow remote attackers to inject arbitrary web script or HTML via the (1) Wohnort and (2) Beruf fields in editprofile.php, (3) user parameter array in v_profile.php, and (4) the action parameter in misc.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: thwboard_beta
References: http://kapda.ir/advisory-149.html, http://www.securityfocus.com/archive/1/418837/100/0/threaded, http://www.securityfocus.com/bid/15763
CVE-2005-3686
SQL injection vulnerability in search.inc.php in Unclassified NewsBoard before 1.5.3 Patch 4 allows remote attackers to execute arbitrary SQL commands via the (1) DateFrom or (2) DateUntil parameter to forum.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: unclassified_newsboard
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: http://packetstormsecurity.org/0511-exploits/unb153pl3_xpl.html, http://rgod.altervista.org/unb153pl3_xpl.html, http://secunia.com/advisories/17614
CWE: CWE-89
CVE-2005-2663
masqmail before 0.2.18 allows local users to overwrite arbitrary files via a symlink attack on a log file.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: masqmail
References: http://secunia.com/advisories/16883, http://secunia.com/advisories/17109, http://www.debian.org/security/2005/dsa-848
CVE-2005-4062
Cross-site scripting (XSS) vulnerability in CPSearch.asp in XcClassified 3.x allows remote attackers to inject arbitrary web script or HTML via the search parameters.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: xcclassified
References: http://pridels0.blogspot.com/2005/12/xcclassified-v3x-xss-vuln.html, http://secunia.com/advisories/17903, http://www.osvdb.org/21470
CVE-2005-3775
PHP remote file inclusion vulnerability in pollvote.php in PollVote allows remote attackers to include arbitrary files via a URL in the pollname parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pollvote
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://marc.info/?l=bugtraq&m=113199182125058&w=2, http://secunia.com/advisories/17574/, http://securityreason.com/securityalert/177
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2005-3998
Cross-site scripting (XSS) vulnerability in search.asp in Solupress News 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: solupress_news
References: http://pridels0.blogspot.com/2005/12/solupress-news-xss-vuln.html, http://secunia.com/advisories/17854, http://www.osvdb.org/21430
CVE-2005-0983
Quake 3 engine, as used in multiple games, allows remote attackers to cause a denial of service (client disconnect) via a long message, which is not properly truncated and causes the engine to process the remaining data as if it were network data.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: quake_3_arena, star_wars_jedi_knight_ii_jedi_outcast, quake_3_engine, star_wars_jedi_knight_jedi_academy, quake_3_arena_server
References: http://aluigi.altervista.org/adv/q3msgboom-adv.txt, http://bani.anime.net/banimod/forums/viewtopic.php?p=27322, http://marc.info/?l=bugtraq&m=111246796918067&w=2
CVE-2005-0050
The License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, aka the "License Logging Service Vulnerability."
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_2000, windows_nt, windows_2003_server
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://www.kb.cert.org/vuls/id/130433, http://www.us-cert.gov/cas/techalerts/TA05-039A.html, https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-010
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2005-2505
Buffer overflow in CoreFoundation in Mac OS X 10.3.9 allows attackers to execute arbitrary code via command line arguments to an application that uses CoreFoundation.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mac_os_x
References: http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html, http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html, http://securitytracker.com/id?1014697
CVE-2005-3844
SQL injection vulnerability in phpWordPress PHP News and Article Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the (1) poll and (2) category parameters to index.php, and (3) the ctg parameter in an archive action.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php_news_and_article_manager
References: http://forum.word-press.net/index.php?&showtopic=76&st=0&#entry181, http://pridels0.blogspot.com/2005/11/phpwordpress-30-sql-inj.html, http://secunia.com/advisories/17733
CVE-2005-4742
Unspecified vulnerability in Echelog 0.6.2 allows attackers to "exploit function stacks on some architectures," with unknown impact and attack vectors.
CVSS v2.0 Score: 4.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C
Affected Products: echelog
References: http://sourceforge.net/project/shownotes.php?release_id=365508, http://www.osvdb.org/20244, http://sourceforge.net/project/shownotes.php?release_id=365508
CVE-2005-3571
PHP file inclusion vulnerability in protection.php in CodeGrrl (a) PHPCalendar 1.0, (b) PHPClique 1.0, (c) PHPCurrently 2.0, (d) PHPFanBase 2.1, and (e) PHPQuotes 1.0 allows remote attackers to include arbitrary local files via the siteurl parameter when register_globals is enabled.  NOTE: It was later reported that PHPFanBase 2.2 is also affected.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: phpcalendar, phpquotes, phpfanbase, phpclique, phpcurrently
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://marc.info/?l=bugtraq&m=113199214723444&w=2, http://secunia.com/advisories/17542, http://securityreason.com/securityalert/176
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2005-1123
Monkey daemon (monkeyd) before 0.9.1 allows remote attackers to cause a denial of service (memory corruption) via a request for a zero byte file.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: monkey
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://bugs.gentoo.org/show_bug.cgi?id=87916, http://secunia.com/advisories/14953, http://security.gentoo.org/glsa/glsa-200504-14.xml
CWE: CWE-119
CVE-2005-1981
Unknown vulnerability in Microsoft Windows 2000 Server and Windows Server 2003 domain controllers allows remote authenticated users to cause a denial of service (system crash) via a crafted Kerberos message.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: windows_2000, windows_2003_server
References: http://secunia.com/advisories/16368/, http://securitytracker.com/id?1014642, http://www.kb.cert.org/vuls/id/610133
CVE-2005-2539
Multiple cross-site scripting (XSS) vulnerabilities in FlatNuke 2.5.5 and possibly earlier versions allow remote attackers to inject arbitrary web script or HTML via the (1) bodycolor, (2) backimage, (3) theme, or (4) logo parameter to structure.php, (5) admin, (6) admin_mail, or (7) back parameter to footer.php, or (8) the message body in a news post.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: flatnuke
References: http://marc.info/?l=bugtraq&m=112327238030127&w=2, http://secunia.com/advisories/16330, http://www.osvdb.org/18551
CVE-2005-0631
delpm.php in PBLang 4.63 allows remote authenticated users to delete arbitrary PM files by modifying the "id" and "a" parameters.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: pblang
References: http://marc.info/?l=bugtraq&m=110970738214608&w=2, http://pblforum.drmartinus.de/post.php?cat=2&fid=2&pid=42&page=1, http://www.securityfocus.com/bid/12694
CVE-2005-1608
Multiple unknown vulnerabilities in the Blocks module in Spidean AutoTheme 1.7 and AT-Lite for PostNuke have unknown impact.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: autotheme, at-lite
References: http://news.postnuke.com/Article2687.html, http://secunia.com/advisories/15289, http://securitytracker.com/id?1013908
CVE-2005-2235
Buffer overflow in the diagTasksWebSM command in IBM AIX 5.1, 5.2 and 5.3, might allow local users to execute arbitrary code via long command line arguments.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: aix
References: http://secunia.com/advisories/15636, http://securitytracker.com/id?1014132, http://www.caughq.org/advisories/CAU-2005-0004.txt
CVE-2005-2532
OpenVPN before 2.0.1 does not properly flush the OpenSSL error queue when a packet can not be decrypted by the server, which allows remote authenticated attackers to cause a denial of service (client disconnection) via a large number of packets that can not be decrypted.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: openvpn
References: http://openvpn.net/changelog.html, http://secunia.com/advisories/16463, http://secunia.com/advisories/17103
CVE-2005-4536
Mail::Audit module in libmail-audit-perl 2.1-5, when logging is enabled without a default log file specified, uses predictable log filenames, which allows local users to overwrite arbitrary files via a symlink attack on the [PID]-audit.log temporary file.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: libmail-audit-perl
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=344029, http://secunia.com/advisories/18652, http://secunia.com/advisories/18656
CVE-2005-4197
tunnelform.yaws in Nortel SSL VPN 4.2.1.6 allows remote attackers to execute arbitrary commands via a link in the a parameter, which is executed with extra privileges in a cryptographically signed Java Applet.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ssl_vpn
References: http://secunia.com/advisories/17974, http://securitytracker.com/id?1015341, http://www.sec-consult.com/247.html
CVE-2005-2794
store.c in Squid 2.5.STABLE10 and earlier allows remote attackers to cause a denial of service (crash) via certain aborted requests that trigger an assert error related to STORE_PENDING.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: squid
References: http://fedoranews.org/updates/FEDORA--.shtml, http://secunia.com/advisories/16977, http://secunia.com/advisories/17027
CVE-2005-0280
Format string vulnerability in Soldner Secret Wars 30830 and earlier allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in a message.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: soldner_secret_wars
References: http://marc.info/?l=bugtraq&m=110486654213504&w=2, http://secunia.com/advisories/13716, http://www.securityfocus.com/bid/12162
CVE-2005-3509
Multiple SQL injection vulnerabilities in JPortal allow remote attackers to execute arbitrary SQL commands via (1) banner.php or the id parameter to (2) print.php, (3) comment.php, and (4) news.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: jportal_web_portal
References: http://foro.elhacker.net/index.php?topic=93436.0, http://www.security.nnov.ru/Kdocument105.html, http://www.securityfocus.com/bid/15324
CVE-2005-2173
The Flag::validate and Flag::modify functions in Bugzilla 2.17.1 to 2.18.1 and 2.19.1 to 2.19.3 do not verify that the flag ID is appropriate for the given bug or attachment ID, which allows users to change flags on arbitrary bugs and obtain a bug summary via process_bug.cgi.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: bugzilla
References: http://securitytracker.com/id?1014428, http://www.bugzilla.org/security/2.18.1/, https://bugzilla.mozilla.org/show_bug.cgi?id=293159
CVE-2005-0562
GIF file validation error in MSN Messenger 6.2 allows remote attackers in a user's contact list to execute arbitrary code via a GIF image with an improper height and width.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: msn_messenger
References: http://secunia.com/advisories/14915/, http://www.kb.cert.org/vuls/id/633446, http://www.us-cert.gov/cas/techalerts/TA05-102A.html
CVE-2005-2969
The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: openssl
References: ftp://ftp.software.ibm.com/pc/pccbbs/pc_servers/dir5.10.3_docs_relnotes.pdf, http://docs.info.apple.com/article.html?artnum=302847, http://itrc.hp.com/service/cki/docDisplay.do?docId=c00805100
CVE-2005-4344
Adobe (formerly Macromedia) ColdFusion MX 7.0 does not honor when the CFOBJECT /CreateObject(Java) setting is disabled, which allows local users to create an object despite the specified configuration.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: coldfusion
References: http://secunia.com/advisories/18078, http://securitytracker.com/id?1015371, http://www.macromedia.com/devnet/security/security_zone/mpsb05-14.html
CVE-2005-4576
Multiple cross-site scripting (XSS) vulnerabilities in the UpdateEngine program in Fatwire UpdateEngine 6.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) COUNTRYNAME, (2) EMAIL, and (3) FUELAP_TEMPLATENAME parameters.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: updateengine
References: http://pridels0.blogspot.com/2005/12/fatwire-updateengine-62-multiple-xss.html, http://secunia.com/advisories/18259, http://www.osvdb.org/21936
CVE-2005-2012
Multiple SQL injection vulnerabilities in login in paFAQ 1.0 Beta 4 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) id parameters.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pafaq
References: http://marc.info/?l=bugtraq&m=111928841328681&w=2, http://www.gulftech.org/?node=research&article_id=00083-06202005, http://marc.info/?l=bugtraq&m=111928841328681&w=2
CVE-2005-3137
The (1) cfmailfilter and (2) cfcron.in files for cfengine 1.6.5 allow local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CVE-2005-2960.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: cfengine
References: http://bugs.gentoo.org/show_bug.cgi?id=107871, http://groups.google.com/group/gnu.cfengine.help/browse_thread/thread/fc25e7d98f8ba401/38151ed821803be0#38151ed821803be0, http://secunia.com/advisories/17037/
CVE-2005-1768
Race condition in the ia32 compatibility code for the execve system call in Linux kernel 2.4 before 2.4.31 and 2.6 before 2.6.6 allows local users to cause a denial of service (kernel panic) and possibly execute arbitrary code via a concurrent thread that increments a pointer count after the nargs function has counted the pointers, but before the count is copied from user space to kernel space, which leads to a buffer overflow.
CVSS v2.0 Score: 3.7 (LOW)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P
Affected Products: linux_kernel
References: ftp://patches.sgi.com/support/free/security/advisories/20060402-01-U, http://marc.info/?l=bugtraq&m=112110120216116&w=2, http://secunia.com/advisories/15980
CVE-2005-2003
Ultimate PHP Board (UPB) 1.9.6 GOLD allows remote attackers to obtain sensitive information via an invalid (zero) id parameter to (1) viewtopic.php, (2) profile.php, or (3) newpost.php, which reveals the path in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: ultimate_php_board
References: http://marc.info/?l=bugtraq&m=111893777504821&w=2, http://secunia.com/advisories/15732, http://marc.info/?l=bugtraq&m=111893777504821&w=2
CVE-2005-3533
Buffer overflow in OSH before 1.7-15 allows local users to execute arbitrary code via a long current working directory and filename.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: osh
References: http://secunia.com/advisories/17967, http://www.debian.org/security/2005/dsa-918, http://www.osvdb.org/21576
CVE-2005-0820
Microsoft Office InfoPath 2003 SP1 includes sensitive information in the Manifest.xsf file in a custom .xsn form, which allows attackers to obtain printer and network information, obtain the database name, username, and password, or obtain the internal web server name.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: office_infopath
References: http://securitytracker.com/id?1013454, http://support.microsoft.com/kb/867443, http://www.osvdb.org/14882
CVE-2005-2156
SQL injection vulnerability in news.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the prevnext parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: phpnews
References: http://sourceforge.net/project/shownotes.php?group_id=66322&release_id=339317, http://www.securityfocus.com/bid/14133, http://sourceforge.net/project/shownotes.php?group_id=66322&release_id=339317
CVE-2005-0319
Direct remote injection vulnerability in modalfram.wdm in Alt-N WebAdmin 3.0.4 allows remote attackers to load external webpages that appear to come from the WebAdmin server, which allows remote attackers to inject arbitrary HTML or web script to facilitate cross-site scripting (XSS) and phishing attacks.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: webadmin
References: http://marc.info/?l=bugtraq&m=110692897003614&w=2, http://www.securityfocus.com/bid/12395, https://exchange.xforce.ibmcloud.com/vulnerabilities/19162
CVE-2005-0986
NLSCCSTR.DLL in the web service in IBM Lotus Domino Server 6.5.1, 6.0.3, and possibly other versions allows remote attackers to cause a denial of service (deep recursion and nHTTP.exe process crash) via a long GET request containing UNICODE decimal value 430 characters, which causes the stack to be exhausted.  NOTE: IBM has reported that it is unable to replicate this issue.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: lotus_domino_server
References: http://news.zdnet.co.uk/software/applications/0%2C39020384%2C39194293%2C00.htm, http://secunia.com/advisories/14858, http://www-1.ibm.com/support/docview.wss?uid=swg21202446
CVE-2005-3281
Directory traversal vulnerability in NukeFixes 3.1 for PHP-Nuke 7.8 allows remote attackers to include arbitrary files via the file parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: nukefixes
References: http://secunia.com/advisories/17218, http://secunia.com/advisories/17218
CVE-2005-3760
Double free vulnerability in the BBOORB module in IBM WebSphere Application Server for z/OS 5.0 allows attackers to cause a denial of service (ABEND).
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: websphere_application_server
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://secunia.com/advisories/17658, http://securitytracker.com/id?1015255, http://www-1.ibm.com/support/docview.wss?uid=swg1PK13936
CWE: CWE-119
CVE-2005-0948
SQL injection vulnerability in ad_click.asp for PortalApp allows remote attackers to execute arbitrary SQL commands via the banner_id parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: portalapp
References: http://icis.digitalparadox.org/~dcrab/portalapp.txt, http://marc.info/?l=bugtraq&m=111213291118273&w=2, http://secunia.com/advisories/14749
CVE-2005-1987
Buffer overflow in Collaboration Data Objects (CDO), as used in Microsoft Windows and Microsoft Exchange Server, allows remote attackers to execute arbitrary code when CDOSYS or CDOEX processes an e-mail message with a large header name, as demonstrated using the "Content-Type" string.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: windows_2000, windows_server_2003, windows_xp, exchange_server
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0289.html, http://marc.info/?l=bugtraq&m=112915118302012&w=2, http://secunia.com/advisories/17167
CWE: CWE-120
CVE-2005-3710
Integer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a TIFF image file with modified image height and width (ImageWidth) tags.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: quicktime
Related CWEs: CWE-189
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0440.html, http://docs.info.apple.com/article.html?artnum=303101, http://secunia.com/advisories/18370
CWE: CWE-189
CVE-2005-4516
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion 6.00.200 through 6.00.300 allow remote attackers to inject arbitrary web script or HTML via (1) the sortby parameter in members.php and (2) IMG tags.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: php_fusion
References: http://secunia.com/advisories/18190/, http://securityreason.com/securityalert/272, http://www.osvdb.org/22048
CVE-2005-2536
pstotext before 1.8g does not properly use the "-dSAFER" option when calling Ghostscript to extract plain text from PostScript and PDF files, which allows remote attackers to execute arbitrary commands via a malicious PostScript file.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pstotext
References: http://secunia.com/advisories/16183/, http://secunia.com/advisories/16305, http://secunia.com/advisories/16624
CVE-2005-2362
Unknown vulnerability several dissectors in Ethereal 0.9.0 through 0.10.11 allows remote attackers to cause a denial of service (application crash) by reassembling certain packets.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: ethereal
References: http://secunia.com/advisories/16225, http://www.ethereal.com/appnotes/enpa-sa-00020.html, http://www.gentoo.org/security/en/glsa/glsa-200507-27.xml
CVE-2005-4564
The Internet Key Exchange version 1 (IKEv1) implementation in ADTRAN NetVanta before 10.03.03.E might allow remote attackers to cause a denial of service via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: netvanta
References: http://secunia.com/advisories/18179, http://www.securityfocus.com/bid/16028, http://www.vupen.com/english/advisories/2005/3027
CVE-2005-4490
Multiple cross-site scripting (XSS) vulnerabilities in SCOOP! 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) keyword and (2) invalid parameter to articleSearch.asp; (3) username and (4) invalid parameter to lostPassword.asp; (5) Username, (6) Password, and (7) invalid parameter to account_login.asp; (8) area, (9) articleZoneID, (10) r, and (11) invalid parameters to category.asp; and invalid parameters to (12) articleZone.asp, (13) prePurchaserRegistration.asp, and (14) requestDemo.asp.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: scoop
References: http://pridels0.blogspot.com/2005/12/scoop-multiple-xss-vuln.html, http://www.securityfocus.com/bid/16015, http://www.vupen.com/english/advisories/2005/3049
CVE-2005-1343
Stack-based buffer overflow in the VPN daemon (vpnd) for Mac OS X before 10.3.9 allows local users to execute arbitrary code via a long -i (Server_id) argument.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: mac_os_x_server, mac_os_x
References: http://lists.apple.com/archives/security-announce/2005/Jun/msg00000.html, http://lists.apple.com/archives/security-announce/2005/May/msg00001.html, http://www.kb.cert.org/vuls/id/706838
CVE-2005-4821
Multiple SQL injection vulnerabilities in Land Down Under (LDU) v801 and earlier allow remote attackers to execute arbitrary SQL commands via parameters including (1) the m parameter in auth.php, (2) the f parameter in events.php, or (3) the e parameter in plug.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: land_down_under
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0381.html, http://www.g-0.org/code/ldu-adv.html, http://www.osvdb.org/19504
CVE-2005-0527
Firefox 1.0 allows remote attackers to execute arbitrary code via plugins that load "privileged content" into frames, as demonstrated using certain XUL events when a user drags a scrollbar two times, aka "Firescrolling."
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: firefox
References: http://marc.info/?l=bugtraq&m=110935267500395&w=2, http://securitytracker.com/id?1013301, http://www.gentoo.org/security/en/glsa/glsa-200503-10.xml
CVE-2005-0447
Solaris 7, 8, and 9 allows remote attackers to cause a denial of service (hang) via a flood of certain ARP packets.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: sunos, solaris
References: http://secunia.com/advisories/14286, http://securitytracker.com/id?1013179, http://sunsolve.sun.com/search/document.do?assetkey=1-26-57673-1
CVE-2005-1638
The _writeAttrs function in SafeHTML before 1.3.2 does not properly handle quotes in attribute values, which could allow remote attackers to exploit cross-site scripting (XSS) vulnerabilities in applications that rely on SafeHTML for protection.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: safehtml
References: http://pixel-apes.com/safehtml/feed, http://secunia.com/advisories/15371, http://www.osvdb.org/16612
CVE-2005-4810
Microsoft Internet Explorer 7.0 Beta3 and earlier allows remote attackers to cause a denial of service (crash) via a "text/html" HTML Content-type header sent in response to an XMLHttpRequest (AJAX).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: internet_explorer
References: http://archives.neohapsis.com/archives/bugtraq/2005-07/0434.html, http://www.osvdb.org/18510, https://exchange.xforce.ibmcloud.com/vulnerabilities/21553
CVE-2005-4502
Cross-site scripting (XSS) vulnerability in httprint v202, and possibly other versions before v301, allows remote attackers to inject arbitrary web script or HTML via the Server field in an HTTP response, which is not sanitized before being displayed to the user.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: httprint
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/040532.html, http://net-square.com/httprint/#history, http://secunia.com/advisories/18208
CVE-2005-3356
The mq_open system call in Linux kernel 2.6.9, in certain situations, can decrement a counter twice ("double decrement") as a result of multiple calls to the mntput function when the dentry_open function call fails, which allows local users to cause a denial of service (panic) via unspecified attack vectors.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: linux_kernel
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169130, http://lists.suse.de/archive/suse-security-announce/2006-Feb/0010.html, http://rhn.redhat.com/errata/RHSA-2006-0101.html