DuyTa/cve-kgrag-db huggingface dataset:
CVE-2005-1087
CRLF injection vulnerability in the cmdIS.DLL plugin for AN HTTPD Server 1.42n allows remote attackers to spoof or hide entries in the logfile, and possibly read files using an injected type command, via CRLF sequences in an HTTP request.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: an-httpd
References: http://secunia.com/advisories/14861, http://securitytracker.com/id?1013666, http://www.osvdb.org/15362
CVE-2005-1154
Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to execute arbitrary script in other domains via a setter function for a variable in the target domain, which is executed when the user visits that domain, aka "Cross-site scripting through global scope pollution."
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mozilla, firefox
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt, http://secunia.com/advisories/14938, http://secunia.com/advisories/14992
CVE-2005-1227
Cross-site scripting (XSS) vulnerability in PHProjekt 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the chatroom text submission form.
CVSS v2.0 Score: 5.1 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Affected Products: phprojekt
References: http://marc.info/?l=bugtraq&m=111402374504496&w=2, http://secunia.com/advisories/15039, http://www.osvdb.org/15720
CVE-2005-4418
util-vserver before 0.30.208-1 with kernel-patch-vserver before 1.9.5.5 and 2.x before 2.3 for Debian GNU/Linux sets a default policy that trusts unknown capabilities, which could allow local users to conduct unauthorized activities.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: util-vserver
References: http://secunia.com/advisories/19333, http://secunia.com/advisories/19339, http://www.debian.org/security/2006/dsa-1011
CVE-2005-2525
CUPS in Mac OS X 10.3.9 and 10.4.2 does not properly close file descriptors when handling multiple simultaneous print jobs, which allows remote attackers to cause a denial of service (printing halt).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: mac_os_x, cups
References: http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html, http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html, http://securitytracker.com/id?1014698
CVE-2005-2380
Multiple cross-site scripting vulnerabilities in PHP Surveyor 0.98 allow remote attackers to inject arbitrary web script or HTML via the (1) sid, (2) start, and (3) id parameters to browse.php, or the sid parameter to (4) dataentry.php or (5) export.php.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: php_surveyor
References: http://marc.info/?l=bugtraq&m=112188282401681&w=2, http://secunia.com/advisories/16123, http://marc.info/?l=bugtraq&m=112188282401681&w=2
CVE-2005-0485
Cross-site scripting (XSS) vulnerability in comment.php for paNews 2.0b4 for PHP Arena allows remote attackers to inject arbitrary HTML and web script via the showpost parameter.
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: panews
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://marc.info/?l=bugtraq&m=110863062605906&w=2, http://www.securityfocus.com/bid/12576, https://exchange.xforce.ibmcloud.com/vulnerabilities/19359
CWE: CWE-79
CVE-2005-0415
Multiple memory leaks in the MQL parser in Emdros before 1.1.22 allow remote attackers to cause a denial of service (memory consumption) via malformed MQL statements.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: emdros_database_engine
References: http://sourceforge.net/project/shownotes.php?release_id=303465, http://sourceforge.net/tracker/index.php?func=detail&aid=1116935&group_id=37219&atid=419458, https://exchange.xforce.ibmcloud.com/vulnerabilities/19273
CVE-2005-2675
Note: the vendor has disputed this issue. Multiple SQL injection vulnerabilities in Land Down Under (LDU) 800 allow remote attackers to execute arbitrary SQL commands via the (1) s or (2) m parameter to forums.php, (3) o, (4) w, (5) s, or (6) p parameter to list.php, (7) m parameter to journal.php, (8) x or (9) n parameter to forums.php, or (10) w parameter to links.php.  NOTE: this issue has been disputed by the vendor, who says "None of the tricks written there are working, the variables are properly sanitized and no LDU version is affected.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: land_down_under
References: http://marc.info/?l=bugtraq&m=112456235729717&w=2, http://securitytracker.com/id?1014747, http://www.neocrome.net
CVE-2005-1213
Stack-based buffer overflow in the news reader for Microsoft Outlook Express (MSOE.DLL) 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute arbitrary code via a LIST response with a long second field.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: outlook_express
References: http://securitytracker.com/id?1014200, http://www.idefense.com/application/poi/display?id=263&type=vulnerabilities, http://www.kb.cert.org/vuls/id/130614
CVE-2005-2001
Directory traversal vulnerability in pafiledb.php in paFileDB 3.1 and earlier allows remote attackers to include arbitrary files via a .. (dot dot) in the action parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: pafiledb
References: http://marc.info/?l=bugtraq&m=111885787217807&w=2, http://www.gulftech.org/?node=research&article_id=00082-06142005, http://www.phparena.net/
CVE-2005-2377
nss_ldap 181 to versions before 213, as used in Mandrake Corporate Server and Mandrake 10.0, and other operating systems, does not properly handle a SIGPIPE signal when sending a search request to an LDAP directory server, which might allow remote attackers to cause a denial of service (crond and other application crash) if they can cause an LDAP server to become unavailable.  NOTE: it is not clear whether this attack scenario is sufficient to include this item in CVE.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: mandrake_linux_corporate_server, mandrake_linux
References: http://qa.mandriva.com/show_bug.cgi?id=13271, http://www.mandriva.com/security/advisories?name=MDKSA-2005:121, https://exchange.xforce.ibmcloud.com/vulnerabilities/40501
CVE-2005-1179
Unknown vulnerability in Xerox MicroServer Web Server for various WorkCentre products including M35/M45/M55 2.028.11.000 through 2.97.20.032 and 4.84.16.000 through 4.97.20.032, Pro 35/45/55 3.028.11.000 through 3.97.20.032, Pro 65/75/90 1.001.00.060 through 1.001.02.084, and others, related to SNMP authentication, allows remote attackers to modify system configuration, a different vulnerability than CVE-2005-0703.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: workcentre_175, workcentre_165, workcentre_90, workcentre_3545, workcentre_m55
References: http://secunia.com/advisories/14507, http://www.securityfocus.com/bid/13196, http://www.xerox.com/downloads/usa/en/c/cert_XRX05_005.pdf
CVE-2005-0245
Buffer overflow in gram.y for PostgreSQL 8.0.0 and earlier may allow attackers to execute arbitrary code via a large number of arguments to a refcursor function (gram.y), which leads to a heap-based buffer overflow, a different vulnerability than CVE-2005-0247.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: postgresql
References: http://archives.postgresql.org/pgsql-committers/2005-01/msg00298.php, http://archives.postgresql.org/pgsql-committers/2005-02/msg00049.php, http://archives.postgresql.org/pgsql-patches/2005-01/msg00216.php
CVE-2005-2900
Cross-site scripting (XSS) vulnerability in top.php in CjLinkOut 1.0 allows remote attackers to inject arbitrary web script or HTML via the 123 parameter.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: cjlinkout
References: http://marc.info/?l=bugtraq&m=112629507412619&w=2, http://marc.info/?l=bugtraq&m=112629507412619&w=2
CVE-2005-2170
The LCF component (lcfd) in IBM Tivoli Management Framework Endpoint allows remote attackers to cause a denial of service (process exit and connection loss) by connecting to LCF and ending the connection without sending any data.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: tivoli_management_framework
References: http://secunia.com/advisories/15953, http://securitytracker.com/id?1014424, http://www-1.ibm.com/support/entdocview.wss?uid=swg21210334
CVE-2005-1813
Directory traversal vulnerability in FutureSoft TFTP Server Evaluation Version 1.0.0.1 allows remote attackers to read arbitrary files via a TFTP GET request containing (1) "../" (dot dot slash) or (2) "..\" (dot dot backslash) sequences.
CVSS v2.0 Score: 7.8 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N
Affected Products: tftp_server_2000
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: http://secunia.com/advisories/15539, http://securitytracker.com/id?1014079, http://www.security.org.sg/vuln/tftp2000-1001.html
CWE: CWE-22
CVE-2005-3538
hfaxd in HylaFAX 4.2.3, when PAM support is disabled, accepts arbitrary passwords, which allows remote attackers to gain privileges.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: hylafax
References: http://bugs.hylafax.org/bugzilla/show_bug.cgi?id=719, http://secunia.com/advisories/18314, http://secunia.com/advisories/18337
CVE-2005-2984
Avocent CCM console server running firmware 2.1 CCM4850 allows remote authenticated attackers to bypass port restrictions by connecting to the server via SSH and using the connect command to access the serial port.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: avocent
References: http://drwetter.org/cs-probs/avocent-sshbug.txt, http://marc.info/?l=bugtraq&m=112680615103315&w=2, http://secunia.com/advisories/16836/
CVE-2005-4051
e107 0.6174 allows remote attackers to vote multiple times for a download via repeated requests to rate.php.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: e107
References: http://e107.org/e107_plugins/bugtrack/bugtrack.php?1625.show, http://secunia.com/advisories/17890/, http://www.securityfocus.com/archive/1/418577/100/0/threaded
CVE-2005-2028
SQL injection vulnerability in index.php for MercuryBoard 1.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: mercuryboard_message_board
References: http://marc.info/?l=bugtraq&m=111938068428037&w=2, http://www.securityfocus.com/bid/14015, http://marc.info/?l=bugtraq&m=111938068428037&w=2
CVE-2005-1564
post_bug.cgi in Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 allows remote authenticated users to "enter bugs into products that are closed for bug entry" by modifying the URL to specify the name of the product.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: bugzilla
References: http://marc.info/?l=bugtraq&m=111592031902962&w=2, http://secunia.com/advisories/15338, http://www.bugzilla.org/security/2.16.8/
CVE-2005-2160
IMail stores usernames and passwords in cleartext in a cookie, which allows remote attackers to obtain sensitive information.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: imail
Related CWEs: CWE-312
Related CAPECs: CAPEC-37
MITRE ATT&CK Techniques: T1005, T1552.004
MITRE ATT&CK Tactics: T1552
References: http://marc.info/?l=bugtraq&m=112060187204457&w=2, http://marc.info/?l=bugtraq&m=112060187204457&w=2
CWE: CWE-312
MITRE ATT&CK techniques: T1005, T1552.004
MITRE ATT&CK tactics: T1552
CVE-2005-2703
Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to modify HTTP headers of XML HTTP requests via XMLHttpRequest, and possibly use the client to exploit vulnerabilities in servers or proxies, including HTTP request smuggling and HTTP request splitting.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: mozilla_suite, firefox
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt, http://secunia.com/advisories/16911, http://secunia.com/advisories/16917
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2005-1406
The kernel in FreeBSD 4.x to 4.11 and 5.x to 5.4 does not properly clear certain fixed-length buffers when copying variable-length data for use by applications, which could allow those applications to read previously used sensitive memory.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: freebsd
References: ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:08.kmem.asc, http://lists.apple.com/archives/security-announce/2005/Oct/msg00000.html, http://secunia.com/advisories/17368
CVE-2005-1562
Multiple SQL injection vulnerabilities in MaxWebPortal 1.3.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) fpassword parameter to inc_functions.asp, (2) txtAddress, (3) message, or (4) subject parameter to post_info.asp, (5) andor parameter to search.asp, (6) verkey parameter to pop_profile.asp, or (7) Remove or (8) Delete parameter to pm_delete2.asp.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: maxwebportal
References: http://marc.info/?l=bugtraq&m=111584883727605&w=2, http://secunia.com/advisories/15329, http://www.hackerscenter.com/archive/view.asp?id=2542
CVE-2005-0602
Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges.
CVSS v2.0 Score: 6.2 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C
Affected Products: unzip
References: http://marc.info/?l=bugtraq&m=110960796331943&w=2, http://secunia.com/advisories/17045, http://secunia.com/advisories/17342
CVE-2005-2008
Yaws Webserver 1.55 and earlier allows remote attackers to obtain the source code for yaws scripts via a request to a yaw script with a trailing %00 (null).
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: webserver
References: http://marc.info/?l=bugtraq&m=111927717726371&w=2, http://secunia.com/advisories/15740, http://www.osvdb.org/17375
CVE-2005-1847
Multiple buffer overflows in YaMT before 0.5_2 allow attackers to execute arbitrary code via the (1) rename or (2) sort options.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: yamt
References: http://rpmfind.net/linux/RPM/suse/updates/8.2/i386/rpm/i586/yamt-0.5-1277.i586.html, http://www.vuxml.org/freebsd/99b5cfa5-d3d2-11d9-8ffb-00061bc2ad93.html, http://rpmfind.net/linux/RPM/suse/updates/8.2/i386/rpm/i586/yamt-0.5-1277.i586.html
CVE-2005-2995
bacula 1.36.3 and earlier allows local users to modify or read sensitive files via symlink attacks on (1) the temporary file used by autoconf/randpass when openssl is not available, or (2) the mtx.[PID] temporary file in mtx-changer.in.
CVSS v2.0 Score: 3.6 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N
Affected Products: bacula
References: http://bugs.gentoo.org/show_bug.cgi?id=104986, http://marc.info/?l=full-disclosure&m=112721654126735&w=2, http://www.novell.com/linux/security/advisories/2005_22_sr.html
CVE-2005-1818
Multiple SQL injection vulnerabilities in NewLife Blogger before 3.3.1 allow remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: newlife_blogger
References: http://secunia.com/advisories/15523, http://www.securityfocus.com/bid/13815, http://www.sevengraff.com/index.php
CVE-2005-0525
The php_next_marker function in image.c for PHP 4.2.2, 4.3.9, 4.3.10 and 5.0.3, as reachable by the getimagesize PHP function, allows remote attackers to cause a denial of service (infinite loop) via a JPEG image with an invalid marker value, which causes a negative length value to be passed to php_stream_seek.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: php
References: http://lists.apple.com/archives/security-announce/2005/Jun/msg00000.html, http://secunia.com/advisories/14792, http://securitytracker.com/id?1013619
CVE-2005-1260
bzip2 allows remote attackers to cause a denial of service (hard drive consumption) via a crafted bzip2 file that causes an infinite loop (a.k.a "decompression bomb").
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: debian_linux, ubuntu_linux, bzip2, mac_os_x
Related CWEs: CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: ftp://patches.sgi.com/support/free/security/advisories/20060301-01.U.asc, http://docs.info.apple.com/article.html?artnum=307041, http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html
CWE: CWE-400
MITRE ATT&CK techniques: T1499
CVE-2005-1700
SQL injection vulnerability in pnadmin.php in the Xanthia module in PostNuke 0.760-RC3 allows remote administrators to execute arbitrary SQL commands via the riga[0] parameter.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: postnuke
References: http://marc.info/?l=bugtraq&m=111670586322172&w=2, http://marc.info/?l=bugtraq&m=111670586322172&w=2
CVE-2005-2134
The (1) clcs and (2) emuxki drivers in NetBSD 1.6 through 2.0.2 allow local users to cause a denial of service (kernel crash) by using the set-parameters ioctl on an audio device to change the block size and set the pause state to "unpaused" in the same ioctl, which causes a divide-by-zero error.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: netbsd
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2005-002.txt.asc, ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2005-002.txt.asc
CVE-2005-4311
Cross-site scripting (XSS) vulnerability in DCForum 6.25 and earlier, and possibly DCForum+ 1.x, allows remote attackers to inject arbitrary web script or HTML via (1) the page parameter in dcboard.php and (2) unspecified search parameters.
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: dcforum\+, dcforum
References: http://pridels0.blogspot.com/2005/12/dcforum-xss-vuln.html, http://secunia.com/advisories/18093, http://www.securityfocus.com/bid/15885
CVE-2005-1995
Bitrix Site Manager 4.0.x allows remote attackers to obtain sensitive information via direct request to (1) subscr_form.php or (2) dbquery_error.php, which reveals the path in an error message.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: bitrix_site_manager
References: http://marc.info/?l=bugtraq&m=111885652331100&w=2, http://www.osvdb.org/17348, http://www.osvdb.org/17376
CVE-2005-0155
The PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to create arbitrary files via the PERLIO_DEBUG variable.
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: perl
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=001056, http://fedoranews.org/updates/FEDORA--.shtml, http://marc.info/?l=bugtraq&m=110737149402683&w=2
CVE-2005-4025
Help Desk Reloaded Free Help Desk does not remove or protect install.php once installation is complete, which allows remote attackers to gain privileges via a direct request to install.php, then navigating to accountsetup.php and creating a new user.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: free_help_desk
References: http://securitytracker.com/id?1015307, http://securitytracker.com/id?1015307
CVE-2005-1129
eGroupWare 1.0.6 and earlier, when an e-mail is composed with an attachment but not sent, will send that attachment in the next e-mail, which may cause sensitive information to be sent to the wrong recipient.
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: egroupware
References: http://archives.neohapsis.com/archives/bugtraq/2005-04/0157.html, http://secunia.com/advisories/14940, http://www.osvdb.org/15499
CVE-2005-0687
Format string vulnerability in Hashcash 1.16 allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via format string specifiers in a reply address, which is not properly handled when printing the header.
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: hashcash
References: http://bugs.gentoo.org/show_bug.cgi?id=83541, http://secunia.com/advisories/14487, http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml
CVE-2005-1107
McAfee Internet Security Suite 2005 uses insecure default ACLs for installed files, which allows local users to gain privileges or disable protection by modifying certain files.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: internet_security_suite
References: http://www.idefense.com/application/poi/display?id=233&type=vulnerabilities, http://www.idefense.com/application/poi/display?id=233&type=vulnerabilities
CVE-2005-2313
Check Point SecuRemote NG with Application Intelligence R54 allows attackers to obtain credentials and gain privileges via unknown attack vectors.
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: secureclient_ng
References: http://www.securityfocus.com/bid/14221, http://www.securityfocus.com/bid/14221
CVE-2005-2412
PHP remote file inclusion vulnerability in block.php in PHP FirstPost allows remote attackers to execute arbitrary PHP code via the Include parameter.
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected Products: php_firstpost
References: http://marc.info/?l=bugtraq&m=112230599222543&w=2, http://securitytracker.com/id?1014563, http://www.osvdb.org/18394
CVE-2005-2613
Unknown vulnerability in CPAINT Ajax Toolkit before 1.3-SP allows attackers to execute arbitrary PHP or ASP code or read files via unknown vectors.
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: cpaint
References: http://secunia.com/advisories/16462/, http://sourceforge.net/forum/forum.php?forum_id=488784, http://www.securityfocus.com/archive/1/408130