Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2005-4656 State: PUBLISHED Published: 2006-01-16T21:00:00 Last Updated: 2024-08-07T23:53:28.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in index.php in TClanPortal 1.1.3 and earlier allows remote attackers to execute arbitrary SQL commands, and retrieve all usernames and passwords, via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/20305 - http://secunia.com/advisories/17324 - http://www.vupen.com/english/advisories/2005/2187 - http://downloads.securityfocus.com/vulnerabilities/exploits/TClanPortal_sql_inj.pl - https://exchange.xforce.ibmcloud.com/vulnerabilities/22869 - http:
com/vulnerabilities/exploits/TClanPortal_sql_inj.pl - https://exchange.xforce.ibmcloud.com/vulnerabilities/22869 - http://www.securityfocus.com/bid/15173
CVE ID: CVE-2005-4657 State: PUBLISHED Published: 2006-01-16T21:00:00Z Last Updated: 2024-09-16T18:09:21.258Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ocean12 Calendar Manager Pro 1.01 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to /admin/view.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/15329
CVE ID: CVE-2005-4658 State: PUBLISHED Published: 2006-01-16T21:00:00 Last Updated: 2024-08-07T23:53:28.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in ASP-Programmers.com ASPKnowledgebase allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in the administrative interface. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/17517 - http://www.osvdb.org/20713 - http://seclists.org/lists/bugtraq/2005/Nov/0122.html - http://www.vupen.com/english/advisories/2005/2375
CVE ID: CVE-2005-4659 State: PUBLISHED Published: 2006-01-16T21:00:00 Last Updated: 2024-08-07T23:53:28.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: IPCop (aka IPCop Firewall) before 1.4.10 has world-readable permissions for the backup.key file, which might allow local users to overwrite system configuration files and gain privileges by creating a malicious encrypted backup archive owned by "nobody", then executing ipcoprscfg to restore from this backup. Additional Analyst Notes: - CVE Program Container: References: - http://sourceforge.net/project/shownotes.php?release_id=369759 - http://sourceforge.net/tracker/index.php?func=detail&aid=1344032&group_id=40604&atid=428516
tes.php?release_id=369759 - http://sourceforge.net/tracker/index.php?func=detail&aid=1344032&group_id=40604&atid=428516 - http://secunia.com/advisories/17513/ - http://www.securityfocus.com/bid/15377 - https://exchange.xforce.ibmcloud.com/vulnerabilities/23056
CVE ID: CVE-2005-4660 State: PUBLISHED Published: 2006-01-16T21:00:00Z Last Updated: 2024-09-17T00:31:41.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in IPCop (aka IPCop Firewall) before 1.4.10 might allow local users to overwrite system configuration files and gain privileges by replacing a backup archive during the time window when the archive is owned by "nobody" but not yet encrypted, then executing ipcoprscfg to restore from this backup. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/15378 - http://sourceforge.net/tracker/index.php?func=detail&aid=1344047&group_id=40604&atid=428516 - http://secunia.com/
5378 - http://sourceforge.net/tracker/index.php?func=detail&aid=1344047&group_id=40604&atid=428516 - http://secunia.com/advisories/17513/
CVE ID: CVE-2005-4661 State: PUBLISHED Published: 2006-01-16T21:00:00 Last Updated: 2024-08-07T23:53:28.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: The notifyendsubs cron job in Campsite before 2.3.3 sends an e-mail message containing a certain unencrypted MySQL password, which allows remote attackers to sniff the password. Additional Analyst Notes: - CVE Program Container: References: - http://sourceforge.net/project/shownotes.php?release_id=367403&group_id=66936 - https://exchange.xforce.ibmcloud.com/vulnerabilities/23106 - http://www.osvdb.org/20698 - http://secunia.com/advisories/17528
CVE ID: CVE-2005-4662 State: PUBLISHED Published: 2006-01-16T21:00:00 Last Updated: 2024-08-07T23:53:28.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in OcoMon 1.20, and possibly earlier versions, allow remote attackers to execute arbitrary SQL commands via unknown attack vectors in an unspecified input form, a different vulnerability than CVE-2005-4664. Additional Analyst Notes: - CVE Program Container: References: - http://sourceforge.net/project/showfiles.php?group_id=45554 - http://secunia.com/advisories/17470 - https://exchange.xforce.ibmcloud.com/vulnerabilities/23085 - http://www.securityfocus.com/bid/15386 - http://sourceforge.
ttps://exchange.xforce.ibmcloud.com/vulnerabilities/23085 - http://www.securityfocus.com/bid/15386 - http://sourceforge.net/project/shownotes.php?release_id=369163 - http://www.osvdb.org/20751
CVE ID: CVE-2005-4663 State: PUBLISHED Published: 2006-01-16T21:00:00 Last Updated: 2024-08-07T23:53:28.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in OcoMon 1.20, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://sourceforge.net/project/showfiles.php?group_id=45554 - http://secunia.com/advisories/17470 - http://sourceforge.net/project/shownotes.php?release_id=369163
CVE ID: CVE-2005-4664 State: PUBLISHED Published: 2006-01-16T21:00:00 Last Updated: 2024-08-07T23:53:28.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in OcoMon 1.21, and possibly other versions, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the logon page, a different vulnerability than CVE-2005-4662. Additional Analyst Notes: - CVE Program Container: References: - http://sourceforge.net/project/showfiles.php?group_id=45554 - http://secunia.com/advisories/17470 - https://exchange.xforce.ibmcloud.com/vulnerabilities/23085 - http://www.osvdb.org/20751
CVE ID: CVE-2005-4665 State: PUBLISHED Published: 2006-01-19T01:00:00 Last Updated: 2024-08-07T23:53:28.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in PunBB 1.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via Javascript contained in nested, malformed BBcode url tags. Additional Analyst Notes: - CVE Program Container: References: - http://www.punbb.org/changelogs/1.2.6_to_1.2.7.txt - http://www.vupen.com/english/advisories/2005/1708 - http://www.securityfocus.com/archive/1/422088/100/0/threaded - http://www.securityfocus.com/bid/14808 - http://www.osvdb.org/19382 - http://www.securityfocus.com/archiv
0/0/threaded - http://www.securityfocus.com/bid/14808 - http://www.osvdb.org/19382 - http://www.securityfocus.com/archive/1/422267/100/0/threaded - http://secunia.com/advisories/16775 - http://punbb.org/changelogs/1.2.6_to_1.2.7.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/22234
CVE ID: CVE-2005-4666 State: PUBLISHED Published: 2006-01-19T21:00:00 Last Updated: 2024-08-07T23:53:28.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in PHlyMail before 3.3 Beta1 allows remote attackers to inject arbitrary Javascript via unknown attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/20975 - https://exchange.xforce.ibmcloud.com/vulnerabilities/24237 - http://www.securityfocus.com/bid/16310 - http://secunia.com/advisories/18536 - http://www.vupen.com/english/advisories/2006/0261 - http://phlymail.de/forum/viewtopic.php?t=842
CVE ID: CVE-2005-4667 State: PUBLISHED Published: 2006-01-25T21:00:00 Last Updated: 2024-08-07T23:53:28.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/25098 - https://usn.ubuntu.com/248-2/ - http://www.info-zip.org/FAQ.html - http://www.securit
p://secunia.com/advisories/25098 - https://usn.ubuntu.com/248-2/ - http://www.info-zip.org/FAQ.html - http://www.securityfocus.com/archive/1/430300/100/0/threaded - http://www.mandriva.com/security/advisories?name=MDKSA-2006:050 - http://www.trustix.org/errata/2006/0006 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11252 - http://www.redhat.com/support/errata/RHSA-2007-0203.html - https://usn.ubuntu.com/248-1/ - http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0930.html - http://www.osvdb.org/22400 - http://www.securityfocus.com/bid/15968 - http://www.debian.org/security/2006/dsa-1012
CVE ID: CVE-2005-4668 State: PUBLISHED Published: 2006-01-26T22:00:00 Last Updated: 2024-08-07T23:53:28.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: The embedded HSQLDB in ParosProxy before 3.2.7, when running with JDK 1.4.2 before 1.4.2_08, allows local users to execute arbitrary comands via crafted SQL commands that interact with HSQLDB through JDBC, a similar vulnerability to CVE-2003-0845. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/20722 - http://securityreason.com/securityalert/147 - http://sourceforge.net/project/shownotes.php?release_id=367666&group_id=84378 - http://archives.neohapsis.com/archives/bugtraq/2005-11/0042.html
roject/shownotes.php?release_id=367666&group_id=84378 - http://archives.neohapsis.com/archives/bugtraq/2005-11/0042.html - http://archives.neohapsis.com/archives/sf/pentest/2005-11/0048.html
CVE ID: CVE-2005-4669 State: PUBLISHED Published: 2006-01-26T22:00:00Z Last Updated: 2024-09-16T16:18:06.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in RT Internet Solutions (RTIS) WebAdmin allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/20327 - http://archives.neohapsis.com/archives/bugtraq/2005-10/0170.html
CVE ID: CVE-2005-4670 State: PUBLISHED Published: 2006-01-27T23:00:00 Last Updated: 2024-08-07T23:53:28.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in message.php in CityPost Automated Link Exchange (LNKX) allows remote attackers to inject arbitrary web script or HTML via the msg parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/13255 - http://securitytracker.com/id?1013752 - https://exchange.xforce.ibmcloud.com/vulnerabilities/20167 - http://www.osvdb.org/15676 - http://secunia.com/advisories/15009
CVE ID: CVE-2005-4671 State: PUBLISHED Published: 2006-01-27T23:00:00 Last Updated: 2024-08-07T23:53:28.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in simple-upload-53.php in CityPost Simple PHP Upload 5.3 allows remote attackers to inject arbitrary web script or HTML via the message parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/13261 - http://securitytracker.com/id?1013749 - https://exchange.xforce.ibmcloud.com/vulnerabilities/20164
CVE ID: CVE-2005-4672 State: PUBLISHED Published: 2006-01-27T23:00:00 Last Updated: 2024-08-07T23:53:29.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in image-editor-52/index.php in CityPost Simple Image-Editor 0.52 allows remote attackers to inject arbitrary web script or HTML via the (1) m1, (2) m2, (3) m3, (4) imgsrc, and (5) m4 parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/20161 - http://secunia.com/advisories/15010 - http://www.securityfocus.com/bid/13260 - http://securitytracker.com/id?1013751
CVE ID: CVE-2005-4673 State: PUBLISHED Published: 2006-01-27T23:00:00Z Last Updated: 2024-09-17T03:34:27.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: ioFTPD 0.5.84 u responds with different messages depending on whether or not a username exists, which allows remote attackers to enumerate valid usernames. Additional Analyst Notes: - CVE Program Container: References: - http://www.security.nnov.ru/Kdocument79.html - http://www.securityfocus.com/bid/15253 - http://www.osvdb.org/22709 - http://www.critical.lt/?vulnerabilities/119
CVE ID: CVE-2005-4674 State: PUBLISHED Published: 2006-01-27T23:00:00 Last Updated: 2024-08-07T23:53:28.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in list.php in Complete PHP Counter allow remote attackers to execute arbitrary SQL commands via the (1) c or (2) s parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/20084 - https://exchange.xforce.ibmcloud.com/vulnerabilities/22758 - http://securitytracker.com/id?1015054 - http://www.securityfocus.com/bid/15111 - http://www.osvdb.org/20085
CVE ID: CVE-2005-4675 State: PUBLISHED Published: 2006-01-27T23:00:00 Last Updated: 2024-08-07T23:53:28.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in list.php in Complete PHP Counter allows remote attackers to inject arbitrary web script or HTML via the c parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/22759 - http://www.securityfocus.com/bid/15112 - http://securitytracker.com/id?1015054
CVE ID: CVE-2005-4676 State: PUBLISHED Published: 2006-01-31T11:00:00 Last Updated: 2024-08-07T23:53:28.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Andreas Huggel Exiv2 before 0.9 does not null terminate strings before calling the sscanf function, which allows remote attackers to cause a denial of service (application crash) via images with crafted IPTC metadata. Additional Analyst Notes: - CVE Program Container: References: - http://home.arcor.de/ahuggel/exiv2/changelog.html - http://dev.robotbattle.com/mantis/bug_view_advanced_page.php?bug_id=447 - http://www.vupen.com/english/advisories/2006/0345 - http://secunia.com/advisories/18619 - https://exchan
hp?bug_id=447 - http://www.vupen.com/english/advisories/2006/0345 - http://secunia.com/advisories/18619 - https://exchange.xforce.ibmcloud.com/vulnerabilities/24349 - http://www.securityfocus.com/bid/16400
CVE ID: CVE-2005-4677 State: PUBLISHED Published: 2006-02-01T02:00:00 Last Updated: 2024-08-07T23:53:28.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in additional_images.php (aka the Additional Images module) before 1.14 in osCommerce allows remote attackers to execute arbitrary SQL commands via the products_id parameter to product_info.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/19874 - http://secunia.com/advisories/17082 - http://www.securityfocus.com/bid/15023 - http://www.vupen.com/english/advisories/2005/1974 - http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0124.html - http://www
.com/english/advisories/2005/1974 - http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0124.html - http://www.oscommerce.com/community/contributions%2C1032 - https://exchange.xforce.ibmcloud.com/vulnerabilities/22528
CVE ID: CVE-2005-4678 State: PUBLISHED Published: 2006-02-01T02:00:00Z Last Updated: 2024-09-16T18:34:24.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apple Safari 2.0.2 (aka 416.12) allows remote attackers to spoof the URL in the status bar via the title in an image in a link to a trusted site within a form to the malicious site. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/17618
CVE ID: CVE-2005-4679 State: PUBLISHED Published: 2006-02-01T02:00:00Z Last Updated: 2024-09-16T18:49:01.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: Internet Explorer 6 for Windows XP Service Pack 2 allows remote attackers to spoof the URL in the status bar via the title in an image in a link to a trusted site within a form to the malicious site. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/17565
CVE ID: CVE-2005-4680 State: PUBLISHED Published: 2006-02-01T02:00:00 Last Updated: 2024-08-07T23:53:28.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sophos Anti-Virus before 4.02, 4.5.x before 4.5.9, 4.6.x before 4.6.9, and 5.x before 5.1.4 allow remote attackers to hide arbitrary files and data via crafted ARJ archives, which are not properly scanned. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2006/0347 - http://www.sophos.com/support/knowledgebase/article/3803.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/24345
CVE ID: CVE-2005-4681 State: PUBLISHED Published: 2006-02-01T02:00:00 Last Updated: 2024-08-07T23:53:28.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in mIRC 5.91, 6.03, 6.12, and 6.16 allows local users to execute arbitrary code via a long string that is entered after reaching the DCC Get Folder Dialog. NOTE: this issue has been disputed by the vendor, saying "as far as I can tell, this is neither an exploit nor a vulnerability. The above report describes a local bug in mIRC." It could be that this is only exploitable by the user of the application, and thus would not cross privilege boundaries unless under an otherwise restrictive environment such as a kio
plication, and thus would not cross privilege boundaries unless under an otherwise restrictive environment such as a kiosk Additional Analyst Notes: - CVE Program Container: References: - http://trout.snt.utwente.nl/ubbthreads/showflat.php?Cat=0&Number=146129&an=0&page=0#146129 - http://www.osvdb.org/24116 - http://www.shellsec.net/leer_advisory.php?id=9 - http://securityreason.com/securityalert/285 - http://www.packetstormsecurity.org/0512-exploits/mIRCexploitXPSP2eng.c - http://seclists.org/lists/bugtraq/2005/Dec/0263.html
CVE ID: CVE-2005-4682 State: PUBLISHED Published: 2006-02-01T02:00:00 Last Updated: 2024-08-07T23:53:28.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in error.asp in AudienceView allows remote attackers to inject arbitrary web script or HTML via the TSerrorMessage parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/23168 - http://www.osvdb.org/20880 - http://secunia.com/advisories/17582 - http://www.vupen.com/english/advisories/2005/2449
CVE ID: CVE-2005-4683 State: PUBLISHED Published: 2006-02-01T02:00:00 Last Updated: 2024-08-07T23:53:28.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: PADL MigrationTools 46, when a failure occurs, stores contents of /etc/shadow in a world-readable /tmp/nis.$$.ldif file, and possibly other sensitive information in other temporary files, which are not properly managed by (1) migrate_all_online.sh, (2) migrate_all_offline.sh, (3) migrate_all_netinfo_online.sh, (4) migrate_all_netinfo_offline.sh, (5) migrate_all_nis_online.sh, (6) migrate_all_nis_offline.sh, (7) migrate_all_nisplus_online.sh, and (8) migrate_all_nisplus_offline.sh. Additional Analyst Notes: - CVE Program Contai
7) migrate_all_nisplus_online.sh, and (8) migrate_all_nisplus_offline.sh. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/20839 - http://secunia.com/advisories/17530 - http://www.vupen.com/english/advisories/2005/2427 - https://exchange.xforce.ibmcloud.com/vulnerabilities/42335 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=338920
CVE ID: CVE-2005-4684 State: PUBLISHED Published: 2006-02-01T02:00:00 Last Updated: 2024-08-07T23:53:28.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: Konqueror can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers to trick a user into accepting a cookie for a hostname formed via search-list expansion of the hostname entered by the user, or steal a cookie for an expanded hostname, as demonstrated by an attacker who operates an ap1.com Internet web site to steal cookies associated with an ap1.com.example.com intranet web site. Additional Analyst Notes: - CVE Program Container: References: - h
ciated with an ap1.com.example.com intranet web site. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/15331 - http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0123.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/25291
CVE ID: CVE-2005-4685 State: PUBLISHED Published: 2006-02-01T02:00:00 Last Updated: 2024-08-07T23:53:28.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: Firefox and Mozilla can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers to trick a user into accepting a cookie for a hostname formed via search-list expansion of the hostname entered by the user, or steal a cookie for an expanded hostname, as demonstrated by an attacker who operates an ap1.com Internet web site to steal cookies associated with an ap1.com.example.com intranet web site. Additional Analyst Notes: - CVE Program Container: Refer
okies associated with an ap1.com.example.com intranet web site. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/15331 - http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0123.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/25291
CVE ID: CVE-2005-4686 State: PUBLISHED Published: 2006-02-01T02:00:00Z Last Updated: 2024-09-17T00:01:55.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: PunBB 1.2.9, when used alone or with F-ART BLOG:CMS, includes config.php before calling the unregister_globals function, which allows attackers to obtain unspecified sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/17433 - http://www.punbb.org/changelogs/1.2.9_to_1.2.10.txt - http://www.securityfocus.com/bid/15328 - http://secunia.com/advisories/17425
CVE ID: CVE-2005-4687 State: PUBLISHED Published: 2006-02-01T02:00:00Z Last Updated: 2024-09-16T19:24:59.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: PunBB 1.2.9, used alone or with F-ART BLOG:CMS, may trust a client's IP address as specified in the X-Forwarded-For HTTP header rather than the TCP/IP stack, which allows remote attackers to misrepresent their IP address by sending a modified header. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/15326 - http://secunia.com/advisories/17433 - http://www.punbb.org/changelogs/1.2.9_to_1.2.10.txt - http://secunia.com/advisories/17425