Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2005-2058 State: PUBLISHED Published: 2005-06-28T04:00:00 Last Updated: 2024-08-07T22:15:37.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Infopop UBB.Threads before 6.5.2 Beta allow remote attackers to execute arbitrary SQL commands via the Number parameter to (1) download.php, (2) modifypost.php, (3) mailthread.php, or (4) notifymod.php, (5) month or (6) year parameter to calendar.php, (7) message parameter to viewmessage.php, (8) main parameter to addfav.php, or (9) posted parameter to grabnext.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubbcentral.com/boards/showflat.php/Cat/0/Numb
dditional Analyst Notes: - CVE Program Container: References: - http://www.ubbcentral.com/boards/showflat.php/Cat/0/Number/42351/Main/42351/#Post42351 - http://www.gulftech.org/?node=research&article_id=00084-06232005 - http://marc.info/?l=bugtraq&m=111963737202040&w=2
CVE ID: CVE-2005-2059 State: PUBLISHED Published: 2005-06-28T04:00:00 Last Updated: 2024-08-07T22:15:37.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in (1) addaddress.php, (2) toggleignore.php, (3) removeignore.php, and (4) removeaddress.php in Infopop UBB.Threads before 6.5.2 Beta allow remote attackers to modify settings as another user via a link or IMG tag. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubbcentral.com/boards/showflat.php/Cat/0/Number/42351/Main/42351/#Post42351 - http://www.gulftech.org/?node=research&article_id=00084-06232005 - http://marc.info/?l=bugtraq&m=1119637
51/#Post42351 - http://www.gulftech.org/?node=research&article_id=00084-06232005 - http://marc.info/?l=bugtraq&m=111963737202040&w=2
CVE ID: CVE-2005-2060 State: PUBLISHED Published: 2005-06-28T04:00:00 Last Updated: 2024-08-07T22:15:36.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple HTTP Response Splitting vulnerabilities in (1) toggleshow.php, (2) togglecats.php, and (3) showprofile.php in Infopop UBB.Threads before 6.5.2 Beta allow remote attackers to spoof web content and poison web caches via CRLF ("%0d%0a") sequences in the Cat parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubbcentral.com/boards/showflat.php/Cat/0/Number/42351/Main/42351/#Post42351 - http://www.gulftech.org/?node=research&article_id=00084-06232005 - http://marc.info/?l=bugtraq&m=111963
351/#Post42351 - http://www.gulftech.org/?node=research&article_id=00084-06232005 - http://marc.info/?l=bugtraq&m=111963737202040&w=2
CVE ID: CVE-2005-2061 State: PUBLISHED Published: 2005-06-28T04:00:00 Last Updated: 2024-08-07T22:15:37.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: Infopop UBB.Threads before 6.5.2 Beta allows remote attackers to include arbitrary files via the language parameter in a cookie followed by a null (%00) byte. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubbcentral.com/boards/showflat.php/Cat/0/Number/42351/Main/42351/#Post42351 - http://www.gulftech.org/?node=research&article_id=00084-06232005 - http://marc.info/?l=bugtraq&m=111963737202040&w=2
CVE ID: CVE-2005-2062 State: PUBLISHED Published: 2005-06-28T04:00:00 Last Updated: 2024-08-07T22:15:37.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in ActiveBuyAndSell 6.2 allow remote attackers to execute arbitrary SQL commands via the catid parameter to (1) default.asp or (2) buyersend.asp, (3) Administrator ID field in admin.asp, E-mail field in (4) advertiserstart.asp or (5) buyer.asp, or Keyword field in search.asp. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/33183 - http://www.vupen.com/english/advisories/2007/1096 - https://www.exploit-db.com/exploits/35
d.com/vulnerabilities/33183 - http://www.vupen.com/english/advisories/2007/1096 - https://www.exploit-db.com/exploits/3550 - http://marc.info/?l=bugtraq&m=111963341429906&w=2 - http://www.securityfocus.com/bid/23110 - http://echo.or.id/adv/adv21-theday-2005.txt
CVE ID: CVE-2005-2063 State: PUBLISHED Published: 2005-06-28T04:00:00 Last Updated: 2024-08-07T22:15:37.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in ActiveBuyAndSell 6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Title parameter to sendpassword.asp or (2) Keyword field in search.asp. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=111963341429906&w=2 - http://echo.or.id/adv/adv21-theday-2005.txt
CVE ID: CVE-2005-2064 State: PUBLISHED Published: 2005-06-28T04:00:00 Last Updated: 2024-08-07T22:15:36.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting vulnerabilities in ASP Nuke 0.80 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to forgot_password.asp, or the (2) FirstName, (3) LastName, (4) Username, (5) Password, (6) Address1, (7) Address2, (8) City, (9) ZipCode, (10) Email parameter to register.asp. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/14062 - http://marc.info/?l=bugtraq&m=111989223906484&w=2
CVE ID: CVE-2005-2065 State: PUBLISHED Published: 2005-06-28T04:00:00 Last Updated: 2024-08-07T22:15:37.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: HTTP response splitting vulnerability in language_select.asp in ASP Nuke 0.80 allows remote attackers to spoof web content and poison web caches via CRLF ("%0d%0a") sequences in the LangCode parameter. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=111989223906484&w=2 - http://www.securityfocus.com/bid/14063
CVE ID: CVE-2005-2066 State: PUBLISHED Published: 2005-06-28T04:00:00 Last Updated: 2024-08-07T22:15:37.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in comment_post.asp in ASP Nuke 0.80 allows remote attackers to execute arbitrary SQL statements via the TaskID parameter. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=111999188612055&w=2 - http://www.securityfocus.com/bid/14064 - http://marc.info/?l=bugtraq&m=111989223906484&w=2
CVE ID: CVE-2005-2067 State: PUBLISHED Published: 2005-06-28T04:00:00 Last Updated: 2024-08-07T22:15:37.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in article.asp in unknown versions of aspnuke allows remote attackers to execute arbitrary SQL commands via the articleid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/18215 - http://marc.info/?l=bugtraq&m=111989828622112&w=2 - http://downloads.securityfocus.com/vulnerabilities/exploits/ASPNuke-0601-sql.txt
CVE ID: CVE-2005-2068 State: PUBLISHED Published: 2005-06-30T04:00:00Z Last Updated: 2024-09-16T16:53:31.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: FreeBSD 4.x through 4.11 and 5.x through 5.4 allows remote attackers to modify certain TCP options via a TCP packet with the SYN flag set for an already established session. Additional Analyst Notes: - CVE Program Container: References: - ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:15.tcp.asc
CVE ID: CVE-2005-2069 State: PUBLISHED Published: 2005-06-29T04:00:00 Last Updated: 2024-08-07T22:15:37.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote attackers to sniff the password. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=161990 - http://www.gentoo.org/security/en/glsa/glsa-200507-13.xml - http://bugs.gentoo.org/show_bug.cgi?id=96767 - http://support.avaya.com/e
ntoo.org/security/en/glsa/glsa-200507-13.xml - http://bugs.gentoo.org/show_bug.cgi?id=96767 - http://support.avaya.com/elmodocs2/security/ASA-2006-157.htm - http://www.securityfocus.com/bid/14126 - http://www.redhat.com/support/errata/RHSA-2005-751.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/21245 - http://www.osvdb.org/17692 - http://www.openldap.org/its/index.cgi/Incoming?id=3791 - http://archives.neohapsis.com/archives/fulldisclosure/2005-07/0060.html - http://bugzilla.padl.com/show_bug.cgi?id=210 - http://secunia.com/advisories/17845 - http://www.securityfocus.com/bid/14125 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9445 - htt
yfocus.com/bid/14125 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9445 - http://bugzilla.padl.com/show_bug.cgi?id=211 - http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2005:121 - http://secunia.com/advisories/21520 - http://www.redhat.com/support/errata/RHSA-2005-767.html - http://secunia.com/advisories/17233 - http://www.ubuntu.com/usn/usn-152-1
CVE ID: CVE-2005-2070 State: PUBLISHED Published: 2005-06-29T04:00:00 Last Updated: 2024-08-07T22:15:37.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ClamAV Mail fILTER (clamav-milter) 0.84 through 0.85d, when used in Sendmail using long timeouts, allows remote attackers to cause a denial of service by keeping an open connection, which prevents ClamAV from reloading. Additional Analyst Notes: - CVE Program Container: References: - http://www.novell.com/linux/security/advisories/2005_38_clamav.html - http://seclists.org/lists/bugtraq/2005/Jun/0197.html - http://www.debian.org/security/2005/dsa-737 - http://www.securityfocus.com/bid/14047
CVE ID: CVE-2005-2071 State: PUBLISHED Published: 2005-06-29T04:00:00 Last Updated: 2024-08-07T22:15:37.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: traceroute in Sun Solaris 10 on x86 systems allows local users to execute arbitrary code with PRIV_NET_RAWACCESS privileges via (1) a large number of -g arguments or (2) a malformed -s argument with a trailing . (dot). Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=111964580023012&w=2 - http://marc.info/?l=bugtraq&m=111963068714114&w=2 - http://marc.info/?l=bugtraq&m=111963809801731&w=2 - http://sunsolve.sun.com/search/document.do?assetkey=1-26-102060-1 - http://securitytracker.c
raq&m=111963809801731&w=2 - http://sunsolve.sun.com/search/document.do?assetkey=1-26-102060-1 - http://securitytracker.com/id?1015261 - http://www.vupen.com/english/advisories/2005/2564 - http://www.securityfocus.com/bid/14049 - http://secunia.com/advisories/17708
CVE ID: CVE-2005-2072 State: PUBLISHED Published: 2005-06-29T04:00:00 Last Updated: 2024-08-07T22:15:36.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: The runtime linker (ld.so) in Solaris 8, 9, and 10 trusts the LD_AUDIT environment variable in setuid or setgid programs, which allows local users to gain privileges by (1) modifying LD_AUDIT to reference malicious code and possibly (2) using a long value for LD_AUDIT. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2005/0908 - http://sunsolve.sun.com/search/document.do?assetkey=1-26-101794-1 - http://www.opensolaris.org/jive/thread.jspa?messageID=3497 - http://securityt
earch/document.do?assetkey=1-26-101794-1 - http://www.opensolaris.org/jive/thread.jspa?messageID=3497 - http://securitytracker.com/id?1014537 - http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034731.html - http://secunia.com/advisories/15841 - http://www.securityfocus.com/bid/14074 - http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034730.html - http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034738.html
CVE ID: CVE-2005-2073 State: PUBLISHED Published: 2005-06-29T04:00:00Z Last Updated: 2024-09-17T03:38:37.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unknown vulnerability in IBM DB2 8.1.4 through 8.1.9 and 8.2.0 through 8.2.2 allows local users with SELECT privileges to conduct unauthorized activities and insert, update or delete table contents. Additional Analyst Notes: - CVE Program Container: References: - http://www-1.ibm.com/support/search.wss?rs=0&q=IY73104&apar=only
CVE ID: CVE-2005-2074 State: PUBLISHED Published: 2005-06-29T04:00:00 Last Updated: 2024-08-07T22:15:37.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in PHP-Fusion 6.0.105 allows remote attackers to inject arbitrary web script or HTML via a news or article post, possibly involving the (1) news_body, (2) article_description, or (3) article_body parameters to submit.php. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/15830 - http://dark-assassins.com/forum/viewtopic.php?t=145 - http://www.securityfocus.com/bid/14066 - http://www.vupen.com/english/advisories/2005/0888
CVE ID: CVE-2005-2075 State: PUBLISHED Published: 2005-06-29T04:00:00 Last Updated: 2024-08-07T22:15:36.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP-Fusion 5.0 and 6.0 stores the database file with a predictable filename under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to the filename in the administration/db_backups directory in PHP-Fusion 6.0 or the fusion_admin/db_backups directory in 5.0. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/15830 - http://www.vupen.com/english/advisories/2005/0888 - http://dark-assassins.com/foru
http://secunia.com/advisories/15830 - http://www.vupen.com/english/advisories/2005/0888 - http://dark-assassins.com/forum/viewtopic.php?t=142
CVE ID: CVE-2005-2076 State: PUBLISHED Published: 2005-06-29T04:00:00Z Last Updated: 2024-09-16T19:24:17.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: HP Version Control Repository Manager (VCRM) before 2.1.1.730 does not properly handle the "@" character in a proxy password, which could allow attackers with physical access to obtain portions of the password when it is displayed to the screen. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/advisories/8734 - http://secunia.com/advisories/15790 - http://www.securityfocus.com/advisories/8734 - http://securitytracker.com/id?1014267 - http://www.securityfocus.com/bid/14032
CVE ID: CVE-2005-2077 State: PUBLISHED Published: 2005-06-29T04:00:00 Last Updated: 2024-08-07T22:15:37.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in error.asp for Hosting Controller allows remote attackers to inject arbitrary web script or HTML via the error parameter. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1016456 - http://www.securityfocus.com/archive/1/419597/100/0/threaded - http://marc.info/?l=bugtraq&m=111997456519685&w=2 - http://www.securityfocus.com/bid/14080
CVE ID: CVE-2005-2078 State: PUBLISHED Published: 2005-06-29T04:00:00Z Last Updated: 2024-09-17T03:23:16.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: BisonFTP Server V4R1 allows remote authenticated users to cause a denial of service via an invalid command with a long argument. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/14079
CVE ID: CVE-2005-2079 State: PUBLISHED Published: 2005-06-29T04:00:00 Last Updated: 2024-08-07T22:15:37.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the Admin Plus Pack Option for VERITAS Backup Exec 9.0 through 10.0 for Windows Servers allows remote attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - http://seer.support.veritas.com/docs/276607.htm - http://www.kb.cert.org/vuls/id/352625 - http://seer.support.veritas.com/docs/277429.htm - http://www.us-cert.gov/cas/techalerts/TA05-180A.html - http://www.securityfocus.com/bid/14023 - http://secunia.com/advisories/15789
CVE ID: CVE-2005-2080 State: PUBLISHED Published: 2005-06-29T04:00:00 Last Updated: 2024-08-07T22:15:37.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unknown vulnerability in Remote Agent for Windows Servers (RAWS) in VERITAS Backup Exec 9.0 through 10.0 for Windows, and 9.0.4019 through 9.1.307 for NetWare, allows remote attackers to gain privileges by copying the handle for the server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/14026 - http://seer.support.veritas.com/docs/277429.htm - http://seer.support.veritas.com/docs/276608.htm - http://secunia.com/advisories/15789
CVE ID: CVE-2005-2081 State: PUBLISHED Published: 2005-06-30T04:00:00 Last Updated: 2024-08-07T22:15:37.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the function that parses commands in Asterisk 1.0.7, when the 'write = command' option is enabled, allows remote attackers to execute arbitrary code via a command that has two double quotes followed by a tab character. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=111946399501080&w=2 - https://exchange.xforce.ibmcloud.com/vulnerabilities/21115 - http://www.portcullis-security.com/advisory/advisory-05-013.txt
CVE ID: CVE-2005-2082 State: PUBLISHED Published: 2005-06-30T04:00:00 Last Updated: 2024-08-07T22:15:37.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: im_trbbs.cgi in imTRSET 1.02 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the df parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.cgi-club.com/imTRBBS/ - http://marc.info/?l=bugtraq&m=112006605026261&w=2
CVE ID: CVE-2005-2083 State: PUBLISHED Published: 2005-06-30T04:00:00 Last Updated: 2024-08-07T22:15:37.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: Format string vulnerability in IMAP4 in IA eMailServer Corporate Edition 5.2.2 build 1051 allows remote attackers to cause a denial of service (application crash) via a LIST command with format string specifiers as the second argument. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=111988945819448&w=2 - https://exchange.xforce.ibmcloud.com/vulnerabilities/21169 - http://securitytracker.com/alerts/2005/Jun/1014301.html
CVE ID: CVE-2005-2084 State: PUBLISHED Published: 2005-06-30T04:00:00 Last Updated: 2024-08-07T22:15:37.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in SearchResults.aspx in Community Forum allows remote attackers to inject arbitrary web script or HTML via the q parameter. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=111998009409469&w=2
CVE ID: CVE-2005-2085 State: PUBLISHED Published: 2005-06-30T04:00:00 Last Updated: 2024-08-07T22:15:37.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Inframail Advantage Server Edition 6.0 through 6.7 allows remote attackers to cause a denial of service (process crash) via a long (1) SMTP FROM field or possibly (2) FTP NLST command. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=111998161006731&w=2
CVE ID: CVE-2005-2086 State: PUBLISHED Published: 2005-06-30T04:00:00 Last Updated: 2024-08-07T22:15:37.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in viewtopic.php in phpBB 2.0.15 and earlier allows remote attackers to execute arbitrary PHP code. Additional Analyst Notes: - CVE Program Container: References: - http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=302011 - http://marc.info/?l=bugtraq&m=111999905917019&w=2
CVE ID: CVE-2005-2087 State: PUBLISHED Published: 2005-06-30T04:00:00 Last Updated: 2024-08-07T22:15:37.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll). NOTE: the researcher says that the vendor could not reproduce this problem. Additional Analyst Notes: - CVE Program Container: References: - http://m
t the vendor could not reproduce this problem. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=112006764714946&w=2 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1326 - http://www.kb.cert.org/vuls/id/959049 - http://www.us-cert.gov/cas/techalerts/TA05-193A.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A793 - http://www.kb.cert.org/vuls/id/939605 - http://securitytracker.com/id?1014329 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1506 - http://www.securityfocus.com/bid/14087 - http://www.securityfocus.com/archive/1/
on/oval%3Aorg.mitre.oval%3Adef%3A1506 - http://www.securityfocus.com/bid/14087 - http://www.securityfocus.com/archive/1/404055 - http://www.microsoft.com/technet/security/advisory/903144.mspx - https://exchange.xforce.ibmcloud.com/vulnerabilities/21193 - http://secunia.com/advisories/15891 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-037 - http://www.osvdb.org/17680 - http://www.auscert.org.au/render.html?it=5225 - http://www.vupen.com/english/advisories/2005/0935 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1518
CVE ID: CVE-2005-2088 State: PUBLISHED Published: 2005-06-30T04:00:00 Last Updated: 2024-08-07T22:15:37.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling." Additional Analyst Notes: - CVE P
ceiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling." Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/17319 - http://www.novell.com/linux/security/advisories/2005_18_sr.html - http://www.redhat.com/support/errata/RHSA-2005-582.html - http://www.novell.com/linux/security/advisories/2005_46_apache.html - http://www.ubuntu.com/usn/usn-160-2 - http://www.vupen.com/english/advisories/2005/2140 - http://secunia.com/advisories/17813 - http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm - http://www.vupen.com/english/advisories/2005/2659 - http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html
//www.vupen.com/english/advisories/2005/2659 - http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html - http://www-1.ibm.com/support/search.wss?rs=0&q=PK13959&apar=only - http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.600000 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A840 - http://www.vupen.com/english/advisories/2006/1018 - http://www.securityfocus.com/archive/1/428138/100/0/threaded - http://www.mandriva.com/security/advisories?name=MDKSA-2005:130 - http://www.apache.org/dist/httpd/CHANGES_1.3 - http://secunia.com/advisories/19185 - http://www.apache.org/dist/httpd/CHANGES_2.0 - http:/