Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2005-4752 State: PUBLISHED Published: 2006-04-01T02:00:00Z Last Updated: 2024-09-16T16:17:28.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, might allow local users to gain privileges by using the run-as deployment descriptor element to change the privileges of a web application or EJB from the Deployer security role to the Admin security role. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/15052 - http://secunia.com/advisories/17138 - http://dev2dev.bea.com/pub/advisory/142
CVE ID: CVE-2005-4753 State: PUBLISHED Published: 2006-04-01T02:00:00Z Last Updated: 2024-09-16T16:32:49.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain "heavy usage" scenarios, report incorrect severity levels for an audit event, which might allow attackers to perform unauthorized actions and avoid detection. Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/143 - http://www.securityfocus.com/bid/15052 - http://secunia.com/advisories/17138
CVE ID: CVE-2005-4754 State: PUBLISHED Published: 2006-04-01T02:00:00Z Last Updated: 2024-09-16T20:47:01.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allow remote attackers to obtain sensitive information (intranet IP addresses) via unknown attack vectors involving "network address translation." Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/144 - http://www.securityfocus.com/bid/15052 - http://secunia.com/advisories/17138
CVE ID: CVE-2005-4755 State: PUBLISHED Published: 2006-04-01T02:00:00Z Last Updated: 2024-09-16T17:15:20.768Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private key passphrase in cleartext (2) on a terminal or (3) in a log file, which might allow local users to obtain cryptographic keys. Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/145 - http://dev2dev.bea.com/pub/advisory/150 - http:/
gram Container: References: - http://dev2dev.bea.com/pub/advisory/145 - http://dev2dev.bea.com/pub/advisory/150 - http://www.securityfocus.com/bid/15052 - http://secunia.com/advisories/17138
CVE ID: CVE-2005-4756 State: PUBLISHED Published: 2006-04-01T02:00:00Z Last Updated: 2024-09-16T20:01:31.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not properly validate derived Principals with multiple PrincipalValidators, which might allow attackers to gain privileges. Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/146 - http://www.securityfocus.com/bid/15052 - http://secunia.com/advisories/17138
CVE ID: CVE-2005-4757 State: PUBLISHED Published: 2006-04-01T02:00:00Z Last Updated: 2024-09-16T20:27:40.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly "constrain" a "/" (slash) servlet root URL pattern, which might allow remote attackers to bypass intended servlet protections. Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/147 - http://www.securityfocus.com/bid/15052 - http://secunia.com/advisories/17138
CVE ID: CVE-2005-4758 State: PUBLISHED Published: 2006-04-01T02:00:00Z Last Updated: 2024-09-16T17:59:13.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Administration server in BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allows remote authenticated Admin users to read arbitrary files via unknown attack vectors related to an "internal servlet" accessed through HTTP. Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/148 - http://www.securityfocus.com/bid/15052 - http://secunia.com/advisories/17138
CVE ID: CVE-2005-4759 State: PUBLISHED Published: 2006-04-01T02:00:00Z Last Updated: 2024-09-16T19:00:48.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEA WebLogic Server and WebLogic Express 8.1 and 7.0, during a migration across operating system platforms, do not warn the administrative user about platform differences in URLResource case sensitivity, which might cause local users to inadvertently lose protection of Web Application pages. Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/149 - http://www.securityfocus.com/bid/15052 - http://secunia.com/advisories/17138
CVE ID: CVE-2005-4760 State: PUBLISHED Published: 2006-04-01T02:00:00Z Last Updated: 2024-09-16T23:20:59.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, when fullyDelegatedAuthorization is enabled for a servlet, does not cause servlet deployment to fail when failures occur in authorization or role providers, which might prevent the servlet from being "fully protected." Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/151 - http://www.securityfocus.com/bid/15052 - http://secunia.com/advisories/17138
CVE ID: CVE-2005-4761 State: PUBLISHED Published: 2006-04-01T02:00:00Z Last Updated: 2024-09-16T17:47:51.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which might include sensitive information (passwords or keyphrases) in the server log file when the -D option is used. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/15052 - http://dev2dev.bea.com/pub/advisory/152 - http://secunia.com/advisories/17138
CVE ID: CVE-2005-4762 State: PUBLISHED Published: 2006-04-01T02:00:00Z Last Updated: 2024-09-16T20:17:21.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier sometimes stores the boot password in the registry in cleartext, which might allow local users to gain administrative privileges. Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/153 - http://www.securityfocus.com/bid/15052 - http://secunia.com/advisories/17138
CVE ID: CVE-2005-4763 State: PUBLISHED Published: 2006-04-01T02:00:00Z Last Updated: 2024-09-16T16:53:44.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier, when Internet Inter-ORB Protocol (IIOP) is used, sometimes include a password in an exception message that is sent to a client or stored in a log file, which might allow remote attackers to perform unauthorized actions. Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/154 - http://www.securityfocus.com/bid/15052 - http://secunia.com/advisories/17138
CVE ID: CVE-2005-4764 State: PUBLISHED Published: 2006-04-01T02:00:00Z Last Updated: 2024-09-17T03:43:22.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEA WebLogic Server and WebLogic Express 9.0, 8.1, and 7.0 lock out the admin user account after multiple incorrect password guesses, which allows remote attackers who know or guess the admin account name to cause a denial of service (blocked admin logins). Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/155 - http://www.securityfocus.com/bid/15052 - http://secunia.com/advisories/17138
CVE ID: CVE-2005-4765 State: PUBLISHED Published: 2006-04-01T02:00:00Z Last Updated: 2024-09-17T01:06:46.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier and 7.0 SP6 and earlier, when using the weblogic.Deployer command with the t3 protocol, does not use the secure t3s protocol even when an Administration port is enabled on the Administration server, which might allow remote attackers to sniff the connection. Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/156 - http://www.securityfocus.com/bid/15052 - http://secunia.com/advisories/17138
CVE ID: CVE-2005-4766 State: PUBLISHED Published: 2006-04-01T02:00:00Z Last Updated: 2024-09-16T17:29:12.822Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicast traffic, which might allow remote attackers to read sensitive cluster synchronization messages by sniffing the multicast traffic. Additional Analyst Notes: - CVE Program Container: References: - http://dev2dev.bea.com/pub/advisory/157 - http://www.securityfocus.com/bid/15052 - http://secunia.com/advisories/17138
CVE ID: CVE-2005-4767 State: PUBLISHED Published: 2006-04-01T02:00:00Z Last Updated: 2024-09-16T19:35:00.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/password authentication, does not lock out a username after the maximum number of invalid login attempts, which makes it easier for remote attackers to guess the password. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/15052 - http://dev2dev.bea.com/pub/advisory/161 - http://secunia.com/advisories/17138 - http://dev2dev.bea.com/pub/advisory/178 - http://www.securityfocus
/advisory/161 - http://secunia.com/advisories/17138 - http://dev2dev.bea.com/pub/advisory/178 - http://www.securityfocus.com/bid/17168
CVE ID: CVE-2005-4768 State: PUBLISHED Published: 2006-04-07T10:00:00Z Last Updated: 2024-09-16T23:40:55.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in manage_account.php in Tux Racer TuxBank 0.7x and 0.8 allows remote attackers to execute arbitrary SQL commands via the id parameter in a manageaccount action to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/24052 - http://osvdb.org/ref/24/24052-tuxbank.txt - http://www.securityfocus.com/bid/17376
CVE ID: CVE-2005-4769 State: PUBLISHED Published: 2006-04-07T10:00:00Z Last Updated: 2024-09-16T22:09:02.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in addrbook.php in Belchior Foundry vCard PRO 3.1 allows remote attackers to execute arbitrary SQL commands via the addr_id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/15254
CVE ID: CVE-2005-4770 State: PUBLISHED Published: 2006-04-07T10:00:00 Last Updated: 2024-08-08T00:01:22.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in an unspecified Accelerated Enterprise Solutions product, possibly Accelerated E Solutions, allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/15077 - http://www.osvdb.org/26548
CVE ID: CVE-2005-4771 State: PUBLISHED Published: 2006-04-07T10:00:00Z Last Updated: 2024-09-16T23:50:48.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trusted Mobility Agent PC Policy in Trust Digital Trusted Mobility Suite provides a cancel button that bypasses the domain-authentication prompt, which allows local users to sync a handheld (PDA) device despite a policy setting that sync is unauthorized. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/413417 - http://www.securityfocus.com/bid/15109
CVE ID: CVE-2005-4772 State: PUBLISHED Published: 2006-04-07T10:00:00 Last Updated: 2024-08-08T00:01:22.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: liby2util in Yet another Setup Tool (YaST) in SUSE Linux before 20051007 preserves permissions and ownerships when copying a remote repository, which might allow local users to read or modify sensitive files, possibly giving local users the ability to exploit CVE-2005-3013. Additional Analyst Notes: - CVE Program Container: References: - http://www.novell.com/linux/security/advisories/2005_22_sr.html - http://www.securityfocus.com/bid/15026
CVE ID: CVE-2005-4773 State: PUBLISHED Published: 2006-04-13T10:00:00Z Last Updated: 2024-09-16T18:18:59.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: The configuration of VMware ESX Server 2.x, 2.0.x, 2.1.x, and 2.5.x allows local users to cause a denial of service (shutdown) via the (1) halt, (2) poweroff, and (3) reboot scripts executed at the service console. Additional Analyst Notes: - CVE Program Container: References: - http://www.vmware.com/support/kb/enduser/std_adp.php?p_sid=dsxk%2ABWh&p_lva=&p_faqid=1817 - http://www.osvdb.org/21584
CVE ID: CVE-2005-4774 State: PUBLISHED Published: 2006-04-13T10:00:00 Last Updated: 2024-08-08T00:01:22.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Xerver 4.17 allows remote attackers to inject arbitrary web script or HTML after a /%00/ sequence at the end of the URI. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/20077 - https://exchange.xforce.ibmcloud.com/vulnerabilities/22787 - http://www.securityfocus.com/bid/15135 - http://securitytracker.com/id?1015079 - http://secunia.com/advisories/17243
CVE ID: CVE-2005-4775 State: PUBLISHED Published: 2006-04-13T10:00:00Z Last Updated: 2024-09-17T03:53:01.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: Michael Scholz and Sebastian Stein Contineo 2.0, when the admin account lacks an e-mail address attribute, displays the password hash in a warning upon page reload, which might allow remote attackers to view the hash. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/20704 - http://sourceforge.net/tracker/index.php?func=detail&aid=1350700&group_id=88385&atid=586478
CVE ID: CVE-2005-4776 State: PUBLISHED Published: 2006-04-13T10:00:00Z Last Updated: 2024-09-16T17:58:04.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the FreeBSD compatibility code (freebsd_misc.c) in NetBSD-current, NetBSD-3, NetBSD-2.0, and NetBSD-2 before 20050913; and NetBSD-1.6 before 20050914; allows local users to cause a denial of service (heap corruption or system crash) and possibly gain root privileges. Additional Analyst Notes: - CVE Program Container: References: - http://mail-index.netbsd.org/source-changes/2005/09/13/0024.html - ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2005-008.txt.asc - http://www.osvdb.org/20757
CVE ID: CVE-2005-4777 State: PUBLISHED Published: 2006-04-13T10:00:00 Last Updated: 2024-08-08T00:01:22.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tashcom ASPEdit 2.9 stores the administration password (aka the FTP password) in cleartext in the registry, which might allow local users to view the password. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/19744 - http://k.domaindlx.com/shellcore/advisories.asp?bug_report=display&infamous_group=94 - http://securitytracker.com/id?1014989 - http://securityreason.com/securityalert/37
CVE ID: CVE-2005-4778 State: PUBLISHED Published: 2006-04-13T10:00:00Z Last Updated: 2024-09-17T02:15:54.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: The powersave daemon in SUSE Linux 10.0 before 20051007 has an unspecified "configuration problem," which allows local users to suspend the computer and possibly perform certain other unauthorized actions. Additional Analyst Notes: - CVE Program Container: References: - http://lists.suse.com/archive/suse-security-announce/2005-Oct/0002.html - http://www.securityfocus.com/bid/15042
CVE ID: CVE-2005-4779 State: PUBLISHED Published: 2006-04-13T10:00:00Z Last Updated: 2024-09-16T19:30:13.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: verifiedexecioctl in verified_exec.c in NetBSD 2.0.2 calls NDINIT with UIO_USERSPACE rather than UID_SYSSPACE, which removes the functionality of the verified exec kernel subsystem and might allow local users to execute Trojan horse programs. Additional Analyst Notes: - CVE Program Container: References: - http://releng.netbsd.org/cgi-bin/req-2-0.cgi?show=1988 - http://mail-index.netbsd.org/netbsd-announce/2005/10/31/0000.html - http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/verified_exec.c.diff?r1=1.4&r2=1.4.2.1&f=h - http:
005/10/31/0000.html - http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/verified_exec.c.diff?r1=1.4&r2=1.4.2.1&f=h - http://www.osvdb.org/20725
CVE ID: CVE-2005-4780 State: PUBLISHED Published: 2006-04-14T10:00:00 Last Updated: 2025-01-16T20:03:59.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Fidra Lighthouse CMS 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in a query_string to the home page. NOTE: The vendor disputes this issue, saying "Lighthouse does not in any way make use of the PHP technology. [It] is an application server ... A technology like this cannot be susceptible to client-side cross-site-scripting-attacks on its own, but only applications created based on such a technology. This does not only appl
oss-site-scripting-attacks on its own, but only applications created based on such a technology. This does not only apply to Lighthouse, but also to Perl, PHP or web applications based on Java Servlet technology." Since the original researcher is known to test demo pages and is sometimes inaccurate, it is likely that this issue will be REJECTED Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/15952 - https://exchange.xforce.ibmcloud.com/vulnerabilities/23668 - http://www.lighthouse-cms.de/en/news/ - http://www.osvdb.org/21852 - http://pridels0.blogspot.com/2005/12/lighthouse-cms-xss-vuln.html
CVE ID: CVE-2005-4781 State: PUBLISHED Published: 2006-04-14T10:00:00 Last Updated: 2024-08-08T00:01:23.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in SergiDs Top Music module 3.0 PR3 and earlier for PHP-Nuke allow remote attackers to execute arbitrary SQL commands via the (1) idartist, (2) idsong, and (3) idalbum parameters to modules.php. Additional Analyst Notes: - CVE Program Container: References: - http://pridels0.blogspot.com/2005_11_27_pridels_archive.html - http://www.sergids.com/topmusic-changelog.html - http://www.securityfocus.com/bid/15581 - http://www.osvdb.org/21397
CVE ID: CVE-2005-4782 State: PUBLISHED Published: 2006-04-14T10:00:00Z Last Updated: 2024-09-16T18:39:40.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetBSD 2.0 before 2.0.4, 2.1 before 2.1.1, and 3, when the kernel is compiled with "options DIAGNOSTIC," allows local users to cause a denial of service (kernel assertion panic) via a negative linger time in the SO_LINGER socket option. Additional Analyst Notes: - CVE Program Container: References: - http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/kern/uipc_socket.c.diff?r1=1.111&r2=1.112 - http://mail-index.netbsd.org/netbsd-announce/2005/11/08/0010.html - http://mail-index.netbsd.org/source-changes/2005/10/21/0038.html - http:/
bsd.org/netbsd-announce/2005/11/08/0010.html - http://mail-index.netbsd.org/source-changes/2005/10/21/0038.html - http://www.securityfocus.com/bid/15289
CVE ID: CVE-2005-4783 State: PUBLISHED Published: 2006-04-14T10:00:00Z Last Updated: 2024-09-17T03:03:18.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernfs_xread in kernfs_vnops.c in NetBSD before 20050831 does not check for a negative offset when reading the message buffer, which allows local users to read arbitrary kernel memory. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1015132 - http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/miscfs/kernfs/kernfs_vnops.c.diff?r1=1.110&r2=1.111&f=h - http://releng.netbsd.org/cgi-bin/req-3.cgi?show=727 - http://www.osvdb.org/20729 - http://www.packetstormsecurity.org/0601-advisories/NetBS
d.org/cgi-bin/req-3.cgi?show=727 - http://www.osvdb.org/20729 - http://www.packetstormsecurity.org/0601-advisories/NetBSD-SA2006-001.txt - http://mail-index.netbsd.org/netbsd-announce/2005/10/31/0000.html - http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/miscfs/kernfs/kernfs_vnops.c
CVE ID: CVE-2005-4784 State: PUBLISHED Published: 2006-04-14T10:00:00Z Last Updated: 2024-09-16T19:36:13.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflows in the POSIX readdir_r function, as used in multiple packages, allow local users to cause a denial of service and possibly execute arbitrary code via (1) a symlink attack that exploits a race condition between opendir and pathcon calls and changes the filesystem to one with a larger maximum directory-entry name length, or (2) possibly via programmer-introduced errors on operating systems with a small struct dirent, such as Solaris or BeOS, as demonstrated in packages including (a) gcj, (b) KDE, (c) l
stems with a small struct dirent, such as Solaris or BeOS, as demonstrated in packages including (a) gcj, (b) KDE, (c) libwww, (d) the Rudiments library, (e) teTeX, (f) xmail, (g) bfbtester, (h) ncftp, (i) netwib, (j) OpenOffice.org, (k) Pike, (l) reprepro, (m) Tcl, and (n) xgsmlib. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/416002/30/0/threaded - http://www.securityfocus.com/archive/1/415781 - http://www.securityfocus.com/archive/1/415790/30/0/threaded - http://www.securityfocus.com/bid/15259 - http://www.securityfocus.com/archive/1/415999/30/0/threaded - http://www.securityfocus.com/archive/1/415998/30/0/threaded - http://www.sec
yfocus.com/archive/1/415999/30/0/threaded - http://www.securityfocus.com/archive/1/415998/30/0/threaded - http://www.securityfocus.com/archive/1/415995/30/0/threaded - http://womble.decadentplace.org.uk/readdir_r-advisory.html - http://www.securityfocus.com/archive/1/416048/30/0/threaded
CVE ID: CVE-2005-4785 State: PUBLISHED Published: 2006-04-14T23:00:00 Last Updated: 2024-08-08T00:01:22.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in QuickBlogger 1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) author ("your name") and (2) "comment" section. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1014386 - https://exchange.xforce.ibmcloud.com/vulnerabilities/21244 - http://exploitlabs.com/files/advisories/EXPL-A-2005-011-quickblogger.txt - http://secunia.com/advisories/15942 - http://www.vupen.com/english/advisories/2005/0987 - http:
5-011-quickblogger.txt - http://secunia.com/advisories/15942 - http://www.vupen.com/english/advisories/2005/0987 - http://archives.neohapsis.com/archives/fulldisclosure/2005-07/0090.html - http://www.securityfocus.com/bid/14152