DuyTa/cve-kgrag-db huggingface dataset:
CVE-2005-4300
Format string vulnerability in the lire_pop function in pop.c in libremail 1.1.0 and earlier, with compiled with the debug option, allows remote attackers to execute arbitrary code via a crafted e-mail or POP server response.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: libremail
References: http://www.securityfocus.com/archive/1/419639/100/0/threaded, http://www.securityfocus.com/bid/15906, http://www.securityfocus.com/archive/1/419639/100/0/threaded
CVE-2005-2440
SQL injection vulnerability in login.asp in Thomson Web Skill Vantage Manager allows remote attackers to execute arbitrary SQL commands via the svmPassword parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: web_skill_vantage_manager
References: http://marc.info/?l=bugtraq&m=112258777107822&w=2, http://secunia.com/advisories/16268/, http://www.osvdb.org/18330
CVE-2005-0805
SQL injection vulnerability in index.php in Subdreamer Light, when magic_quotes_gpc is enabled, allows remote attackers to execute arbitrary SQL commands via certain parameters that are used as global variables, as demonstrated using the imageid parameter, which is not properly handled by imagegallery.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: subdreamer_light
References: http://marc.info/?l=bugtraq&m=111116479910230&w=2, http://www.securityfocus.com/archive/1/437983/100/200/threaded, http://www.securityfocus.com/bid/12839
CVE-2005-3056
TWiki allows arbitrary shell command execution via the Include function
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: twiki
Related CWEs: CWE-74
Related CAPECs: CAPEC-53, CAPEC-51, CAPEC-9
MITRE ATT&CK Techniques: T1574.006, T1574.007, T1027
MITRE ATT&CK Tactics: T1562, T1574
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=330733, https://security-tracker.debian.org/tracker/CVE-2005-3056, https://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithInclude
CWE: CWE-74
MITRE ATT&CK techniques: T1574.006, T1574.007, T1027, T1562.003
MITRE ATT&CK tactics: T1562, T1574
CVE-2005-3719
Hitachi IP5000 VOIP WIFI Phone 1.5.6 has a hard-coded administrator password of "0000", which allows attackers with physical access to obtain sensitive information and modify the phone's configuration.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ip5000_voip_wifi_phone
References: http://marc.info/?l=full-disclosure&m=113217425618951&w=2, http://secunia.com/advisories/17628, http://www.hitachi-cable.co.jp/ICSFiles/infosystem/security/76659792_e.pdf
CVE-2005-3852
SQL injection vulnerability in search.asp in Online Work Order Suite (OWOS) Lite Edition for ASP 3.0 allows remote attackers to execute arbitrary SQL commands via the keyword parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: owos_lite
References: http://pridels0.blogspot.com/2005/11/owos-lite-30-sql-inj.html, http://secunia.com/advisories/17711, http://www.osvdb.org/21116
CVE-2005-0194
Squid 2.5, when processing the configuration file, parses empty Access Control Lists (ACLs), including proxy_auth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warnings.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: squid
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000923, http://fedoranews.org/updates/FEDORA--.shtml, http://marc.info/?l=bugtraq&m=110901183320453&w=2
CVE-2005-0258
Directory traversal vulnerability in (1) usercp_register.php and (2) usercp_avatar.php for phpBB 2.0.11, and possibly other versions, with gallery avatars enabled, allows remote attackers to delete (unlink) arbitrary files via "/../" sequences in the avatarselect parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: phpbb
References: http://www.gentoo.org/security/en/glsa/glsa-200503-02.xml, http://www.idefense.com/application/poi/display?id=205&type=vulnerabilities, http://www.phpbb.com/support/documents.php?mode=changelog
CVE-2005-1433
Multiple unknown vulnjerabilities HP OpenView Event Correlation Services (OV ECS) 3.32 and 3.33 allow attackers to cause a denial of service or execute arbitrary code.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: openview_event_correlation_services
References: http://secunia.com/advisories/15226, http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBMA01141, http://secunia.com/advisories/15226
CVE-2005-2949
pam_per_user before 0.4 does not verify if the user name changes between authentication attempts and uses the same subrequest handle, which allows remote attackers or local users to login as other users by using certain applications that allow the username to be changed during authentication, such as /bin/login.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pam_per_user
References: http://marc.info/?l=bugtraq&m=112654636915661&w=2, http://secunia.com/advisories/16781/, http://securityreason.com/securityalert/2
CVE-2005-2596
User.php in Gallery, as used in Postnuke, allows users with any Admin privileges to gain access to all galleries.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: gallery
References: http://gallery.menalto.com/index.php?name=PNphpBB2&file=viewtopic&t=7048, http://secunia.com/advisories/16389, http://secunia.com/advisories/17367
CVE-2005-2759
** SPLIT ** The jlucaller program in LiveUpdate for Symantec Norton AntiVirus 9.0.3 on Macintosh runs setuid when executing Java programs, which allows local users to gain privileges.  NOTE: due to a CNA error, this candidate was also originally assigned to an issue in DiskMountNotify.  Use CVE-2005-3270 for the DiskMountNotify issue, and CVE-2005-2759 for the LiveUpdate issue.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: norton_antivirus
References: http://secunia.com/advisories/17268, http://securitytracker.com/id?1015083, http://www.idefense.com/application/poi/display?id=324&type=vulnerabilities
CVE-2005-4453
UserProfile.cs in Ultraapps Issue Manager before 2.1 allows remote authenticated users to gain administrator privileges by modifying the original (1) p_User_user_id and (2) User_user_id parameters to UserProfile.aspx, then modifying the password field.
CVSS v2.0 Score: 9.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Affected Products: ultraapps_issue_manager
References: http://secunia.com/advisories/18174, http://www.irmplc.com/advisory013.htm, http://www.securityfocus.com/archive/1/419910/100/0/threaded
CVE-2005-0213
Directory traversal vulnerability in WinHKI 1.4d allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a zip file.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: winhki
References: http://marc.info/?l=bugtraq&m=110505334903257&w=2, http://secunia.com/advisories/13738, http://securitytracker.com/id?1012798
CVE-2005-0923
The SmartScan feature in the Auto-Protect module for Symantec Norton AntiVirus 2004 and 2005, as also used in Internet Security 2004/2005 and System Works 2004/2005, allows attackers to cause a denial of service (CPU consumption and system crash) by renaming a file on a network share.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: norton_antivirus, norton_internet_security, norton_system_works
References: http://secunia.com/advisories/14741, http://securityresponse.symantec.com/avcenter/security/Content/2005.03.28.html, http://securitytracker.com/id?1013585
CVE-2005-2752
An unspecified kernel interface in Mac OS X 10.4.2 and earlier does not properly clear memory before reusing it, which could allow attackers to obtain sensitive information, a different vulnerability than CVE-2005-1126 and CVE-2005-1406.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: mac_os_x_server, mac_os_x
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: http://lists.apple.com/archives/security-announce/2005/Oct/msg00000.html, http://secunia.com/advisories/17368, http://securitytracker.com/id?1015127
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2005-4874
The XMLHttpRequest object in Mozilla 1.7.8 supports the HTTP TRACE method, which allows remote attackers to obtain (1) proxy authentication passwords via a request with a "Max-Forwards: 0" header or (2) arbitrary local passwords on the web server that hosts this object.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: mozilla
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: https://bugzilla.mozilla.org/show_bug.cgi?id=297078, https://bugzilla.mozilla.org/show_bug.cgi?id=302489, https://exchange.xforce.ibmcloud.com/vulnerabilities/41553
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2005-1194
Stack-based buffer overflow in the ieee_putascii function for nasm 0.98 and earlier allows attackers to execute arbitrary code via a crafted asm file, a different vulnerability than CVE-2004-1287.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: enterprise_linux, enterprise_linux_desktop, linux_advanced_workstation
References: http://www.redhat.com/support/errata/RHSA-2005-381.html, http://www.securityfocus.com/bid/13506, https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11256
CVE-2005-2836
Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to register.php or (2) a signature of a logged-in user in "My Control Center," which is not properly handled by control.php.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: phorum
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0018.html, http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0048.html, http://secunia.com/advisories/16667
CVE-2005-0232
Firefox 1.0 allows remote attackers to modify Boolean configuration parameters for the about:config site by using a plugin such as Flash, and the -moz-opacity filter, to display the about:config site then cause the user to double-click at a certain screen position, aka "Fireflashing."
CVSS v2.0 Score: 2.6 (LOW)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N
Affected Products: firefox
References: http://marc.info/?l=bugtraq&m=110781055630856&w=2, http://www.gentoo.org/security/en/glsa/glsa-200503-10.xml, http://www.gentoo.org/security/en/glsa/glsa-200503-30.xml
CVE-2005-2521
Buffer overflow in traceroute in Mac OS X 10.3.9 allows local users to execute arbitrary code via unknown vectors.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mac_os_x
References: http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html, http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html, http://securitytracker.com/id?1014702
CVE-2005-3186
Integer overflow in the GTK+ gdk-pixbuf XPM image rendering library in GTK+ 2.4.0 allows attackers to execute arbitrary code via an XPM file with a number of colors that causes insufficient memory to be allocated, which leads to a heap-based buffer overflow.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: gtk\+, gdkpixbuf
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.8/SCOSA-2006.8.txt, http://secunia.com/advisories/17522, http://secunia.com/advisories/17538
CVE-2005-2878
Format string vulnerability in search.c in the imap4d server in GNU Mailutils 0.6 allows remote authenticated users to execute arbitrary code via format string specifiers in the SEARCH command.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mailutils
References: http://marc.info/?l=bugtraq&m=112785181316043&w=2, http://savannah.gnu.org/patch/index.php?func=detailitem&item_id=4407, http://secunia.com/advisories/16783
CVE-2005-3087
The SecureW2 3.0 TLS implementation uses weak random number generators (rand and srand from system time) during generation of the pre-master secret (PMS), which makes it easier for attackers to guess the secret and decrypt sensitive data.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: securew2
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/037352.html, http://secunia.com/advisories/16909, http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/037352.html
CVE-2005-1398
phpcart.php in PHPCart 3.2 allows remote attackers to change product price information by modifying the (1) price or (2) postage parameters.  NOTE: it was later reported that 3.4 through 4.6.4 are also affected.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: phpcart
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: http://lostmon.blogspot.com/2005/04/phpcart-price-manipulation.html, http://secunia.com/advisories/15147, http://www.osvdb.org/15859
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2005-3184
Buffer overflow vulnerability in the unicode_to_bytes in the Service Location Protocol (srvloc) dissector (packet-srvloc.c) in Ethereal allows remote attackers to execute arbitrary code via a srvloc packet with a modified length value.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: ethereal
References: http://secunia.com/advisories/17254, http://secunia.com/advisories/17286, http://secunia.com/advisories/17327
CVE-2005-2240
xpvm.tcl in xpvm 1.2.5 allows local users to overwrite arbitrary files via a symlink attack on the xpvm.trace.$user temporary file.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: xpvm
References: http://secunia.com/advisories/16040, http://secunia.com/advisories/19251, http://www.debian.org/security/2006/dsa-1003
CVE-2005-3619
Cross-site scripting (XSS) vulnerability in the management interface for VMware ESX 2.5.x before 2.5.2 upgrade patch 2, 2.1.x before 2.1.2 upgrade patch 6, and 2.0.x before 2.0.1 upgrade patch 6 allows remote attackers to inject arbitrary web script or HTML via messages that are not sanitized when viewing syslog log files.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: esx
References: http://www.corsaire.com/advisories/c051114-002.txt, http://www.securityfocus.com/archive/1/435610/100/0/threaded, http://www.securityfocus.com/archive/1/435888/100/0/threaded
CVE-2005-0472
Gaim before 1.1.3 allows remote attackers to cause a denial of service (infinite loop) via malformed SNAC packets from (1) AIM or (2) ICQ.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: enterprise_linux, mandrake_linux, mandrake_linux_corporate_server, gaim, enterprise_linux_desktop
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000933, http://gaim.sourceforge.net/security/index.php?id=10, http://marc.info/?l=bugtraq&m=110935655500670&w=2
CVE-2005-3999
Cross-site scripting (XSS) vulnerability in Search.asp in SiteBeater MP3 Catalog 2.03 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: sitebeater_mp3_catalog
References: http://pridels0.blogspot.com/2005/12/sitebeater-mp3-catalog-xss-vuln.html, http://secunia.com/advisories/17856, http://www.osvdb.org/21424
CVE-2005-0316
WebWasher Classic 2.2.1 and 3.3, when running in server mode, does not properly drop CONNECT requests to the localhost from external systems, which could allow remote attackers to bypass intended access restrictions.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: webwasher_classic
References: http://marc.info/?l=bugtraq&m=110693045507245&w=2, http://secunia.com/advisories/14058, http://securitytracker.com/id?1013036
CVE-2005-3094
Avi Alkalay man-cgi script allows remote attackers to execute arbitrary code via shell metacharacters in the topic parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: man_cgi
References: http://secunia.com/advisories/16887, http://www.alkalay.net/software, http://www.cirt.net/advisories/alkalay.shtml
CVE-2005-2081
Stack-based buffer overflow in the function that parses commands in Asterisk 1.0.7, when the 'write = command' option is enabled, allows remote attackers to execute arbitrary code via a command that has two double quotes followed by a tab character.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: asterisk
References: http://marc.info/?l=bugtraq&m=111946399501080&w=2, http://www.portcullis-security.com/advisory/advisory-05-013.txt, https://exchange.xforce.ibmcloud.com/vulnerabilities/21115
CVE-2005-0043
Buffer overflow in Apple iTunes 4.7 allows remote attackers to execute arbitrary code via a long URL in (1) .m3u or (2) .pls playlist files.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: itunes
References: http://lists.apple.com/archives/security-announce/2005/Jan/msg00000.html, http://secunia.com/advisories/13804, http://securitytracker.com/id?1012839
CVE-2005-1662
Directory traversal vulnerability in Jeuce Personal Web Server 2.13 allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: jeuce_personal_web_server
References: http://secunia.com/advisories/13732, http://securitytracker.com/id?1012791, http://www.osvdb.org/12718
CVE-2005-1514
commands.c in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long SMTP command without a space character, which causes an array to be referenced with a negative index.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: qmail
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-05/0101.html, http://packetstormsecurity.com/files/157805/Qualys-Security-Advisory-Qmail-Remote-Code-Execution.html, http://seclists.org/fulldisclosure/2020/May/42
CVE-2005-1180
HTTP Response Splitting vulnerability in the Surveys module in PHP-Nuke 7.6 allows remote attackers to spoof web content and poison web caches via hex-encoded CRLF ("%0d%0a") sequences in the forwarder parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: php-nuke
References: http://marc.info/?l=bugtraq&m=111359804013536&w=2, http://secunia.com/advisories/14965, http://www.digitalparadox.org/advisories/pnuke.txt
CVE-2005-1133
The POP3 server in IBM iSeries AS/400 returns different error messages when the user exists or not, which allows remote attackers to determine valid user IDs on the server.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: iseries_as_400
References: http://marc.info/?l=bugtraq&m=111358863001693&w=2, http://www.securityfocus.com/bid/13156, http://marc.info/?l=bugtraq&m=111358863001693&w=2
CVE-2005-1510
PwsPHP 1.2.2 allows remote attackers to obtain sensitive information via a direct request to the admin directory, which reveals the path in an error message.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pwsphp
References: http://marc.info/?l=bugtraq&m=111565808024581&w=2, http://secunia.com/advisories/15315, http://www.osvdb.org/16234
CVE-2005-1307
The (1) stopserver.sh and (2) startserver.sh scripts in Adobe Version Cue on Mac OS X uses the current working directory to find and execute the productname.sh script, which allows local users to execute arbitrary code by copying and calling the scripts from a user-controlled directory.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: mac_os_x, version_cue
References: http://archives.neohapsis.com/archives/bugtraq/2004-12/0040.html, http://marc.info/?l=bugtraq&m=111627622403544&w=2, http://secunia.com/advisories/13399
CVE-2005-3455
Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5 up to 11.5.10 have unknown impact and attack vectors, as identified by Oracle Vuln# (1) APPS01 in Application Install; (2) APPS02 and (3) APPS03 in Application Object Library; (4) APPS05 and (5) APPS06 in Applications Technology Stack; (6) APPS07 in Applications Utilities; (7) APPS09, (8) APPS10, and (9) APPS11 in HRMS; (10) APPS12 in Mobile Application Foundation; (11) APPS13 in SDP Number Portability; (12) APPS14 in Oracle Service; (13) APPS15 in Service Fulfillment Manage, (14) APPS16 in Universal Work Queue; and (15) APPS20 in Workflow Cartridge.
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: e-business_suite
References: http://secunia.com/advisories/17250, http://www.kb.cert.org/vuls/id/150508, http://www.kb.cert.org/vuls/id/210524
CVE-2005-3900
Macromedia Breeze Communication Server and Breeze Live Server does 5.1 and earlier not sufficiently validate certain RTMP data, which allows attackers to cause a denial of service (instability or crash), as demonstrated using an alpha release build of Flash Player 8.5 (build 133).
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: breeze
References: http://secunia.com/advisories/17611, http://securitytracker.com/id?1015220, http://www.macromedia.com/devnet/security/security_zone/mpsb05-10.html
CVE-2005-1888
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.5 allows remote attackers to inject arbitrary web script via HTML attributes in page templates.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: mediawiki
References: http://sourceforge.net/project/shownotes.php?release_id=332231, http://www.novell.com/linux/security/advisories/2005_19_sr.html, http://www.securityfocus.com/bid/13861
CVE-2005-4290
Cross-site scripting (XSS) vulnerability in index.cgi in ECW-Cart 2.03 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) kword, (2) max, (3) min, (4) comp, and (5) f parameters.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: ecw-cart
References: http://pridels0.blogspot.com/2005/12/ecw-cart-xss-vuln.html, http://secunia.com/advisories/18025, http://www.osvdb.org/21715
CVE-2005-0704
Buffer overflow in the Etheric dissector in Ethereal 0.10.7 through 0.10.9 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ethereal
References: http://www.ethereal.com/appnotes/enpa-sa-00018.html, http://www.gentoo.org/security/en/glsa/glsa-200503-16.xml, http://www.mandriva.com/security/advisories?name=MDKSA-2005:053
CVE-2005-1022
ColdFusion 6.1 Updater 1 places Java .class files under the web root in the /WEB-INF/cfclasses directory, which allows remote attackers to obtain sensitive information.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: coldfusion
References: http://marc.info/?l=bugtraq&m=111290407411801&w=2, http://www.macromedia.com/devnet/security/security_zone/mpsb05-02.html, http://marc.info/?l=bugtraq&m=111290407411801&w=2
CVE-2005-2708
The search_binary_handler function in exec.c in Linux 2.4 kernel on 64-bit x86 architectures does not check a return code for a particular function call when virtual memory is low, which allows local users to cause a denial of service (panic), as demonstrated by running a process using the bash ulimit -v command.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: linux_kernel
Related CWEs: CWE-399
References: http://secunia.com/advisories/18523, http://secunia.com/advisories/18562, http://secunia.com/advisories/18684
CWE: CWE-399
CVE-2005-4864
Stack-based buffer overflow in libdb2.so in IBM DB2 7.x and 8.1 allows local users to execute arbitrary code via a long DB2LPORT environment variable.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: db2_universal_database
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://marc.info/?l=bugtraq&m=110495092105541&w=2, http://secunia.com/advisories/12733/, http://www-1.ibm.com/support/docview.wss?uid=swg1IY62042
CWE: CWE-119
CVE-2005-1200
PHP remote file inclusion vulnerability in main_index.php in AZ Bulletin Board (AZbb) 1.0.07a through 1.0.07c allows remote attackers to execute arbitrary PHP code by modifying the (1) dir_src or (2) abs_layer parameter to reference a URL on a remote web server that contains the code.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: az_bulletin_board
References: http://azbb.cyaccess.com/azbb.php?1091778548, http://marc.info/?l=bugtraq&m=111401838521857&w=2, http://secunia.com/advisories/15013
CVE-2005-3507
Directory traversal vulnerability in CuteNews 1.4.1 allows remote attackers to include arbitrary files, execute code, and gain privileges via "../" sequences in the template parameter to (1) show_archives.php and (2) show_news.php.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: cutenews
References: http://rgod.altervista.org/cute141.html, http://secunia.com/advisories/17435, http://www.osvdb.org/20472
CVE-2005-1495
Oracle Database 9i and 10g disables Fine Grained Audit (FGA) after the SYS user executes a SELECT statement on an FGA object, which makes it easier for attackers to escape detection.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: application_server, oracle9i, oracle10g
References: http://marc.info/?l=bugtraq&m=111531683824209&w=2, http://www.kb.cert.org/vuls/id/777773, http://www.red-database-security.com/advisory/oracle-fine-grained-auditing-issue.html
CVE-2005-1742
BEA WebLogic Server and WebLogic Express 8.1 SP2 and SP3 allows users with the Monitor security role to "shrink or reset JDBC connection pools."
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: weblogic_portal, weblogic_server
References: http://dev2dev.bea.com/pub/advisory/125, http://secunia.com/advisories/15486, http://securitytracker.com/id?1014049
CVE-2005-2866
Mercora IMRadio 4.0.0.0 stores usernames and passwords in plaintext in the MercoraClient\Profiles registry key, which allows local users to gain privileges.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: imradio
References: http://securitytracker.com/id?1014780, http://securitytracker.com/id?1014780
CVE-2005-0069
The (1) tcltags or (2) vimspell.sh scripts in vim 6.3 allow local users to overwrite or create arbitrary files via a symlink attack on temporary files.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: vim
References: http://marc.info/?l=bugtraq&m=110608387001863&w=2, http://secunia.com/advisories/13841/, http://securitytracker.com/id?1012938
CVE-2005-1956
File Upload Manager allows remote attackers to upload arbitrary files by modifying the test variable to contain a value of '~~~~~~' (six tildes), which bypasses the file extension checks.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: file_upload_manager
References: http://marc.info/?l=bugtraq&m=111868578006615&w=2, http://www.osvdb.org/20257, http://marc.info/?l=bugtraq&m=111868578006615&w=2
CVE-2005-4628
SQL injection vulnerability in index.php in HelpDeskPoint 2.38 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: helpdeskpoint
References: http://pridels0.blogspot.com/2005/11/helpdeskpoint-free-help-desk-software.html, http://www.osvdb.org/21318, http://pridels0.blogspot.com/2005/11/helpdeskpoint-free-help-desk-software.html
CVE-2005-2225
Microsoft MSN Messenger allows remote attackers to cause a denial of service via a plaintext message containing the ".pif" string, which is interpreted as a malicious file extension and causes users to be kicked from a group conversation. NOTE: it has been reported that Gaim is also affected, so this may be an issue in the protocol or MSN servers.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: msn_messenger_service
References: http://securitytracker.com/id?1014444, http://www.digitalparadox.org/viewadvisories.ah?view=45, http://www.messenger-blog.com/?p=146
CVE-2005-3255
The (1) cgiwrap and (2) php-cgiwrap packages before 3.9 in Debian GNU/Linux provide access to debugging CGIs under the web document root, which allows remote attackers to obtain sensitive information via direct requests to those CGIs.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: cgiwrap
References: http://lists.alioth.debian.org/pipermail/secure-testing-announce/2005-August/000003.html, http://lists.alioth.debian.org/pipermail/secure-testing-announce/2005-August/000003.html
CVE-2005-0479
Directory traversal vulnerability in ComGetLogFile.php3 for TrackerCam 5.12 and earlier allows remote attackers to read arbitrary files via ".." sequences and (1) "/" slash), (2) "\" (backslash), or (3) hex-encoded characters in the fn parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: trackercam
References: http://www.securityfocus.com/archive/1/390918, http://www.securityfocus.com/bid/12592, https://exchange.xforce.ibmcloud.com/vulnerabilities/19414
CVE-2005-3409
OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service (segmentation fault) by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: openvpn_access_server, openvpn
References: http://openvpn.net/changelog.html, http://secunia.com/advisories/17376, http://secunia.com/advisories/17447
CVE-2005-4772
liby2util in Yet another Setup Tool (YaST) in SUSE Linux before 20051007 preserves permissions and ownerships when copying a remote repository, which might allow local users to read or modify sensitive files, possibly giving local users the ability to exploit CVE-2005-3013.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: suse_linux, suse_linux_standard_server, suse_linux_school_server, suse_sled_beagle, suse_linux_openexchange_server
References: http://www.novell.com/linux/security/advisories/2005_22_sr.html, http://www.securityfocus.com/bid/15026, http://www.novell.com/linux/security/advisories/2005_22_sr.html
CVE-2005-1996
PHP remote file inclusion vulnerability in start.php in Bitrix Site Manager 4.0.x allows remote attackers to execute arbitrary PHP code via the _SERVER[DOCUMENT_ROOT] parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: bitrix_site_manager
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://marc.info/?l=bugtraq&m=111885605913761&w=2, http://secunia.com/advisories/15726, http://www.bitrixsoft.com/sitemanager/versions.php?module=main
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2005-3080
contrib/example.php in GeSHi before 1.0.7.3 allows remote attackers to read arbitrary files via the language field without a source field set.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: geshi
References: http://sourceforge.net/project/shownotes.php?release_id=358285, http://www.securityfocus.com/bid/14903, http://sourceforge.net/project/shownotes.php?release_id=358285
CVE-2005-0524
The php_handle_iff function in image.c for PHP 4.2.2, 4.3.9, 4.3.10 and 5.0.3, as reachable by the getimagesize PHP function, allows remote attackers to cause a denial of service (infinite loop) via a -8 size value.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: php
References: http://lists.apple.com/archives/security-announce/2005/Jun/msg00000.html, http://secunia.com/advisories/14792, http://securitytracker.com/id?1013619
CVE-2005-2136
Raritan Dominion SX (DSX) Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 set (1) world-readable permissions for /etc/shadow and (2) world-writable permissions for /bin/busybox, which allows local users to obtain hashed passwords or execute arbitrary code as other users.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: dominion_sx16_firmware, dominion_sx16, dominion_sxa-48_firmware, dominion_sx32_firmware, dominion_sx32
Related CWEs: CWE-863
References: http://seclists.org/lists/bugtraq/2005/Jun/0251.html, http://secunia.com/advisories/15853, http://www.securityfocus.com/bid/14084
CWE: CWE-863
CVE-2005-3523
Format string vulnerability in friendsd2 in GpsDrive allows remote attackers to execute arbitrary code via the dir (direction) field.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: gpsdrive
References: http://seclists.org/lists/fulldisclosure/2005/Nov/0130.html, http://secunia.com/advisories/17473, http://secunia.com/advisories/17477
CVE-2005-4552
The (1) slsmgr and (2) slsadmin programs in Sun Solaris PC NetLink 2.0 create temporary files insecurely, which allows local users to gain privileges.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: solaris_pc_netlink
References: http://secunia.com/advisories/18230, http://securitytracker.com/id?1015408, http://securitytracker.com/id?1015409
CVE-2005-4769
SQL injection vulnerability in addrbook.php in Belchior Foundry vCard PRO 3.1 allows remote attackers to execute arbitrary SQL commands via the addr_id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: vcard_pro
References: http://www.securityfocus.com/bid/15254, http://www.securityfocus.com/bid/15254
CVE-2005-3876
Multiple SQL injection vulnerabilities in adcbrowres.php in AD Center ADC2000 NG Pro 1.2 and NG Pro Lite allow remote attackers to execute arbitrary SQL commands via the (1) cat and (2) lang parameters.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: adc2000_ng_pro, adc2000_ng_pro_lite
References: http://pridels0.blogspot.com/2005/11/adc2000-ng-pro-sql-inj-vuln.html, http://secunia.com/advisories/17744, http://www.osvdb.org/21131
CVE-2005-3321
chkstat in SuSE Linux 9.0 through 10.0 allows local users to modify permissions of files by creating a hardlink to a file from a world-writable directory, which can cause the link count to drop to 1 when the file is deleted or replaced, which is then modified by chkstat to use weaker permissions.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: suse_linux
References: http://secunia.com/advisories/17290/, http://www.novell.com/linux/security/advisories/2005_62_permissions.html, http://www.osvdb.org/20263
CVE-2005-4171
The "Upload new image" command in the "Manage Images" eFiction 1.1, when members are allowed to upload images, allows remote attackers to execute arbitrary PHP code by uploading a filename with a .php extension that contains a GIF header, which passes the image validity check but executes any PHP code within the file.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: efiction
References: http://archives.neohapsis.com/archives/bugtraq/2005-11/0301.html, http://rgod.altervista.org/efiction2_xpl.html, http://secunia.com/advisories/17777
CVE-2005-3474
The aries.sys driver in Sony First4Internet XCP DRM software hides any file, registry key, or process with a name that starts with "$sys$", which allows attackers to hide activities on a system that uses XCP.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: first4internet_xcp_content_management
References: http://secunia.com/advisories/17408, http://securitytracker.com/id?1015145, http://www.osvdb.org/20435
CVE-2005-0159
The tpkg-* scripts in the toolchain-source 3.0.4 package on Debian GNU/Linux 3.0 allow local users to overwrite arbitrary files via a symlink attack on temporary files.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: debian_linux, toolchain-source
References: http://secunia.com/advisories/14277, http://www.debian.org/security/2005/dsa-679, http://www.securityfocus.com/bid/12540
CVE-2005-2284
Multiple SQL injection vulnerabilities in WebEOC before 6.0.2 allow remote attackers to modify SQL statements via unknown attack vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: webeoc
References: http://www.kb.cert.org/vuls/id/372797, http://www.kb.cert.org/vuls/id/JGEI-6C8Q27, http://www.kb.cert.org/vuls/id/372797
CVE-2005-1587
Cross-site scripting (XSS) vulnerability in index.php for Quick.cart 0.3.0 allows remote attackers to inject arbitrary web script or HTML via the sWord parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: quick.cart
References: http://lostmon.blogspot.com/2005/05/quickcart-sword-variable-xss-and.html, http://opensolution.org/forum/?p=readTopic&nr=948, http://secunia.com/advisories/15297
CVE-2005-1430
Mac OS X 10.3.x and earlier uses insecure permissions for a pseudo terminal tty (pty) that is managed by a non-setuid program, which allows local users to read or modify sessions of other users.
CVSS v2.0 Score: 3.6 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N
Affected Products: mac_os_x_server, mac_os_x
References: http://www.security-focus.com/archive/1/397306, http://www.security-focus.com/archive/1/397306
CVE-2005-0089
The SimpleXMLRPCServer library module in Python 2.2, 2.3 before 2.3.5, and 2.4, when used by XML-RPC servers that use the register_instance method to register an object without a _dispatch method, allows remote attackers to read or modify globals of the associated module, and possibly execute arbitrary code, via dotted attributes.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: python
References: http://marc.info/?l=bugtraq&m=110746469728728&w=2, http://python.org/security/PSF-2005-001/patch-2.2.txt, http://secunia.com/advisories/14128
CVE-2005-1042
Integer overflow in the exif_process_IFD_TAG function in exif.c in PHP before 4.3.11 may allow remote attackers to execute arbitrary code via an IFD tag that leads to a negative byte count.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: php
References: http://cvs.php.net/diff.php/php-src/ext/exif/exif.c?r1=1.118.2.33&r2=1.118.2.34&ty=u, http://lists.apple.com/archives/security-announce/2005/Jun/msg00000.html, http://www.gentoo.org/security/en/glsa/glsa-200504-15.xml
CVE-2005-4386
Cross-site scripting (XSS) vulnerability in Colony CMS 2.75 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: colony_enterprise_cms, colony_cms, colony_e-commerce_cms, colony_government_cms
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://pridels0.blogspot.com/2005/12/colony-cms-xss-vuln.html, http://www.osvdb.org/21853, http://www.securityfocus.com/bid/15941
CWE: CWE-79
CVE-2005-1081
Cross-site scripting (XSS) vulnerability in view.php in AzDGDatingPlatinum 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: azdgdating
References: http://www.securityfocus.com/archive/1/395530, http://www.securityfocus.com/bid/13082, https://exchange.xforce.ibmcloud.com/vulnerabilities/20052
CVE-2005-3530
Cross-site scripting (XSS) vulnerability in Antville 1.1 allows remote attackers to inject arbitrary web script or HTML via the notfound.skin error document.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: antville
References: http://marc.info/?l=bugtraq&m=113156739212557&w=2, http://moritz-naumann.com/adv/0004/antvxss/0004.txt, http://secunia.com/advisories/17520/
CVE-2005-3353
The exif_read_data function in the Exif module in PHP before 4.4.1 allows remote attackers to cause a denial of service (infinite loop) via a malformed JPEG image.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: php
References: http://bugs.php.net/bug.php?id=34704, http://docs.info.apple.com/article.html?artnum=303382, http://itrc.hp.com/service/cki/docDisplay.do?docId=c00786522
CVE-2005-3224
Multiple interpretation error in unspecified versions of AntiVir Antivirus allows remote attackers to bypass virus detection via a malicious executable in a specially crafted RAR file with malformed central and local headers, which can still be opened by products such as Winrar and PowerZip, even though they are rejected as corrupted by Winzip and BitZipper.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: antivir_personal
References: http://marc.info/?l=bugtraq&m=112879611919750&w=2, http://shadock.net/secubox/AVCraftedArchive.html, http://marc.info/?l=bugtraq&m=112879611919750&w=2
CVE-2005-0001
Race condition in the page fault handler (fault.c) for Linux kernel 2.2.x to 2.2.7, 2.4 to 2.4.29, and 2.6 to 2.6.10, when running on multiprocessor machines, allows local users to execute arbitrary code via concurrent threads that share the same virtual memory space and simultaneously request stack expansion.
CVSS v2.0 Score: 6.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Affected Products: linux_kernel, enterprise_linux_desktop, secure_linux, enterprise_linux
References: http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000930, http://isec.pl/vulnerabilities/isec-0022-pagefault.txt, http://lists.grok.org.uk/pipermail/full-disclosure/2005-January/030826.html
CVE-2005-2780
Cross-site scripting (XSS) vulnerability in Land Down Under (LDU) allows remote attackers to inject arbitrary web script or HTML via a signature.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: land_down_under
References: http://marc.info/?l=bugtraq&m=112534018805818&w=2, http://www.securityfocus.com/bid/14677, http://marc.info/?l=bugtraq&m=112534018805818&w=2
CVE-2005-0994
Multiple SQL injection vulnerabilities in ProductCart 2.7 allow remote attackers to execute arbitrary SQL commands via (1) the Category or resultCnt parameters to advSearch_h.asp, and possibly (2) the offset parameter to tarinasworld_butterflyjournal.asp. NOTE: it is possible that item (2) is the result of a typo or editing error from the original research report.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: productcart
References: http://digitalparadox.org/advisories/prodcart.txt, http://secunia.com/advisories/14833, http://www.osvdb.org/15263
CVE-2005-2230
Electronic Mail Operator (elmo) 1.3.2-r1 and earlier creates the elmostats temporary file insecurely, which allows local users to overwrite arbitrary files.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: elmo
References: http://secunia.com/advisories/15977, http://www.securityfocus.com/bid/14235, http://www.zataz.net/adviso/elmo-06272005.txt
CVE-2005-4324
Hitachi Groupmax Mail SMTP 06-50 through 06-52-/A and 07-00 through 07-20 allows remote attackers to cause a denial of service (service stop) via an e-mail message with an "invalid format."
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Affected Products: groupmax_mail_smtp
References: http://secunia.com/advisories/17635/, http://securitytracker.com/alerts/2005/Nov/1015243.html, http://www.hitachi-support.com/security_e/vuls_e/HS05-024_e/01-e.html
CVE-2005-3880
Multiple SQL injection vulnerabilities in Omnistar KBase 4.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter in users/comments.php, (2) category_id and (3) id parameters in users/kb.php.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: omnistar_kbase
References: http://pridels0.blogspot.com/2005/11/omnistar-kbase-sql-inj-vuln.html, http://secunia.com/advisories/17773, http://www.osvdb.org/21203
CVE-2005-1476
Firefox 1.0.3 allows remote attackers to execute arbitrary Javascript in other domains by using an IFRAME and causing the browser to navigate to a previous javascript: URL, which can lead to arbitrary code execution when combined with CVE-2005-1477.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: firefox
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt, http://greyhatsecurity.org/firefox.htm, http://greyhatsecurity.org/vulntests/ffrc.htm
CVE-2005-2096
zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: zlib
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:16.zlib.asc, ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.6/SCOSA-2006.6.txt, http://lists.apple.com/archives/security-announce//2008/Nov/msg00001.html
CVE-2005-0842
Cross-site scripting (XSS) vulnerability in index.php in Kayako eSupport 2.3 allows remote attackers to inject arbitrary web script or HTML via the (1) _i or (2) _c parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: esupport
References: http://marc.info/?l=bugtraq&m=111151292704335&w=2, http://secunia.com/advisories/13563, http://marc.info/?l=bugtraq&m=111151292704335&w=2
CVE-2005-0115
Stack-based buffer overflow in DataRescue Interactive Disassembler (IDA) Pro 4.7 allows attackers to execute arbitrary code via a PE file with an Import Address Table containing a long import library name.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: ida
References: http://secunia.com/advisories/13980, http://securitytracker.com/id?1012975, http://www.datarescue.com/ubb/ultimatebb.php?/topic/2/146.html