deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-3922
Published: 2005-11-30
Description: Heap-based buffer overflow in pskcmp.dll in Panda Software Antivirus library allows remote attackers to execute arbitrary code via a crafted ZOO archive.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17765; http://securityreason.com/securityalert/216; http://securitytracker.com/id?1015295
CVE: CVE-2005-3923
Published: 2005-11-30
Description: NetObjects Fusion 9 (NOF9) allows remote attackers to obtain sensitive information, including passwords, by downloading the _versioning_repository_/rollbacklog.xml file, then using it to download and modify the associated ZIP file to edit and republish the site.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17667; http://www.schneier.com/blog/archives/2005/11/possible_net_ob.html; http://www.vupen.com/english/advisories/2005/2555
CVE: CVE-2005-3924
Published: 2005-11-30
Description: SQL injection vulnerability in themes/kategorie/index.php in Randshop allows remote attackers to execute arbitrary SQL commands via the (1) kategorieid and (2) katid parameters.
CVSS Score: 7.5 (HIGH)
References: http://cert.uni-stuttgart.de/archive/bugtraq/2005/11/msg00333.html; http://secunia.com/advisories/17782; http://securityreason.com/securityalert/213
CVE: CVE-2005-3925
Published: 2005-11-30
Description: Multiple SQL injection vulnerabilities in Central Manchester CLC Helpdesk Issue Manager 0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) detail[], (2) orderdir, and (3) orderby parameters to find.php, and the (4) id parameter to issue.php.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/helpdesk-issue-manager-v09-sql-inj.html; http://secunia.com/advisories/17714; http://www.osvdb.org/21114
CVE: CVE-2005-3926
Published: 2005-11-30
Description: Direct static code injection vulnerability in error.php in GuppY 4.5.9 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via the _SERVER[REMOTE_ADDR] parameter, which is injected into a .inc script that is later included by the main script.
CVSS Score: 7.5 (HIGH)
References: http://rgod.altervista.org/guppy459_xpl.html; http://secunia.com/advisories/17790; http://securitytracker.com/id?1015279
CVE: CVE-2005-3927
Published: 2005-11-30
Description: Multiple directory traversal vulnerabilities in GuppY 4.5.9 and earlier allow remote attackers to read and include arbitrary files via (1) the meskin parameter to admin/editorTypetool.php, or the lng parameter to the in admin/inc scripts (2) archbatch.php, (3) dbbatch.php, and (4) nwlmail.php.
CVSS Score: 6.4 (MEDIUM)
References: http://rgod.altervista.org/guppy459_xpl.html; http://secunia.com/advisories/17790; http://securityreason.com/securityalert/212
CVE: CVE-2005-3928
Published: 2005-11-30
Description: Buffer overflow in phgrafx in QNX 6.2.1 and 6.3.0 allows local users to execute arbitrary code via a long command line argument.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/17781; http://securitytracker.com/id?1015599; http://www.idefense.com/intelligence/vulnerabilities/display.php?id=384
CVE: CVE-2005-3929
Published: 2005-11-30
Description: Directory traversal vulnerability in the create function in xarMLSXML2PHPBackend.php in Xaraya 1.0 allows remote attackers to create directories and overwrite arbitrary files via ".." sequences in the module parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
References: http://rgod.altervista.org/xaraya1DOS.hmtl; http://secunia.com/advisories/17788; http://securityreason.com/securityalert/217
CVE: CVE-2005-2757
Published: 2005-12-01
Description: Heap-based buffer overflow in CoreFoundation in Mac OS X and OS X Server 10.4 through 10.4.3 allows remote attackers to execute arbitrary code via unknown attack vectors involving "validation of URLs."
CVSS Score: 7.5 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=302847; http://secunia.com/advisories/17813; http://securitytracker.com/id?1015285
CVE: CVE-2005-3700
Published: 2005-12-01
Description: Unknown vulnerability in iodbcadmintool in the ODBC Administrator utility in Mac OS X and OS X Server 10.3.9 and 10.4.3 allows local users to execute arbitrary code via unknown attack vectors.
CVSS Score: 4.6 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=302847; http://secunia.com/advisories/17813; http://securitytracker.com/id?1015289
CVE: CVE-2005-3701
Published: 2005-12-01
Description: Unspecified vulnerability in passwordserver in Mac OS X Server 10.3.9 and 10.4.3, when creating an Open Directory master server, allows local users to gain privileges via unknown attack vectors.
CVSS Score: 7.2 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=302847; http://secunia.com/advisories/17813; http://securitytracker.com/id?1015290
CVE: CVE-2005-3702
Published: 2005-12-01
Description: Safari in Mac OS X and OS X Server 10.3.9 and 10.4.3 allows remote attackers to cause files to be downloaded to locations outside the download directory via a long file name.
CVSS Score: 5.0 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=302847; http://secunia.com/advisories/17813; http://securitytracker.com/id?1015294
CVE: CVE-2005-3704
Published: 2005-12-01
Description: System log server in Mac OS X and OS X Server 10.4 through 10.4.3 allows remote attackers to spoof syslog messages in log files by injecting various control characters such as newline (NL).
CVSS Score: 5.0 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=302847; http://secunia.com/advisories/17813; http://securitytracker.com/id?1015293
CVE: CVE-2005-3705
Published: 2005-12-01
Description: Heap-based buffer overflow in WebKit in Mac OS X and OS X Server 10.3.9 and 10.4.3, as used in applications such as Safari, allows remote attackers to execute arbitrary code via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=302847; http://secunia.com/advisories/17813; http://securitytracker.com/id?1015294
CVE: CVE-2005-3930
Published: 2005-12-01
Description: SQL injection vulnerability in index.php in N-13 News 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17785; http://www.osvdb.org/21247; http://www.securityfocus.com/archive/1/418092/100/0/threaded
CVE: CVE-2005-3931
Published: 2005-12-01
Description: SQL injection vulnerability in default.asp in ASP-Rider 1.6 allows remote attackers to execute arbitrary SQL commands via the HTTP referer.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17792; http://securityreason.com/securityalert/218; http://www.osvdb.org/21248
CVE: CVE-2005-3932
Published: 2005-12-01
Description: SQL injection vulnerability in okiraku.php in O-Kiraku Nikki 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the day_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/o-kiraku-nikki-v13-sql-inj-vuln.html; http://secunia.com/advisories/17795; http://www.osvdb.org/21268
CVE: CVE-2005-3933
Published: 2005-12-01
Description: SQL injection vulnerability in index.php in 88Script's Event Calendar 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/88scripts-event-calendar-v20-sql-inj.html; http://secunia.com/advisories/17796; http://www.osvdb.org/21269
CVE: CVE-2005-3934
Published: 2005-12-01
Description: Buffer overflow in Symantec pcAnywhere 11.0.1, 11.5.1, and all other 32-bit versions allows remote attackers to cause a denial of service (application crash) via unknown attack vectors.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/17797; http://securitytracker.com/id?1015284; http://www.securityfocus.com/bid/15646
CVE: CVE-2005-3935
Published: 2005-12-01
Description: SQL injection vulnerability in SocketKB 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) node and (2) art_id parameters.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/socketkb-11x-vuln.html; http://secunia.com/advisories/17807; http://www.securityfocus.com/bid/15650
CVE: CVE-2005-3936
Published: 2005-12-01
Description: PHP file include vulnerability in SocketKB 1.1.0 and earlier allows remote attackers to include arbitrary local files via the __f parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/socketkb-11x-vuln.html; http://secunia.com/advisories/17807; http://www.osvdb.org/21251
CVE: CVE-2005-3937
Published: 2005-12-01
Description: SQL injection vulnerability in Softbiz B2B Trading Marketplace Script 1.1 and earler allows remote attackers to execute arbitrary SQL commands via the cid parameter in (1) selloffers.php, (2) buyoffers.php, (3) products.php, or (4) profiles.php.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/softbiz-b2b-trading-marketplace-script.html; http://secunia.com/advisories/17808; http://www.osvdb.org/21252
CVE: CVE-2005-3938
Published: 2005-12-01
Description: SQL injection vulnerability in Softbiz FAQ Script 1.1 and earler allows remote attackers to execute arbitrary SQL commands via the id parameter in (1) index.php, (2) faq_qanda.php, (3) refer_friend.php, (4) print_article.php, or (5) add_comment.php.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/softbiz-faq-script-multiple-sql-vuln.html; http://secunia.com/advisories/17809; http://www.osvdb.org/21257
CVE: CVE-2005-3939
Published: 2005-12-01
Description: Multiple SQL injection vulnerabilities in WSN Knowledge Base 1.2.0 and earler allow remote attackers to execute arbitrary SQL commands via the (1) catid, (2) perpage, (3) ascdesc, and (4) orderlinks in a displaycat action in (a) index.php; and the (5) id parameter in (b) comments.php and (c) memberlist.php.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/wsn-knowledge-base-sql-inj-vuln.html; http://secunia.com/advisories/17810; http://www.osvdb.org/21262
CVE: CVE-2005-3940
Published: 2005-12-01
Description: SQL injection vulnerability in ringmaker.php in Orca Ringmaker 2.3c and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/orca-ringmaker-sql-inj-vuln.html; http://secunia.com/advisories/17803; http://www.greywyvern.com/orca#ring
CVE: CVE-2005-3941
Published: 2005-12-01
Description: SQL injection vulnerability in blog.php in Orca Blog 1.3b and earlier allows remote attackers to execute arbitrary SQL commands via the msg parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/orca-blog-sql-inj-vuln.html; http://secunia.com/advisories/17804; http://www.greywyvern.com/orca#blog
CVE: CVE-2005-3942
Published: 2005-12-01
Description: SQL injection vulnerability in knowledgebase-control.php in Orca Knowledgebase 2.1b and earlier allows remote attackers to execute arbitrary SQL commands via the qid parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/orca-knowledgebase-sql-vuln.html; http://secunia.com/advisories/17805; http://www.greywyvern.com/orca#know
CVE: CVE-2005-3943
Published: 2005-12-01
Description: Multiple SQL injection vulnerabilities in ilyav FAQ System 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) FAQ_ID and (2) action parameters in (a) viewFAQ.php; and (3) CATEGORY_ID parameter in (b) index.php.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/faq-system-11-sql-inj-vuln.html; http://secunia.com/advisories/17801; http://www.osvdb.org/21202
CVE: CVE-2005-3944
Published: 2005-12-01
Description: SQL injection vulnerability in survey.php in ilyav Survey System 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the SURVEY_ID parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/survey-system-11-sql-inj-vuln.html; http://secunia.com/advisories/17800; http://www.osvdb.org/21200
CVE: CVE-2005-3945
Published: 2005-12-01
Description: The SynAttackProtect protection in Microsoft Windows 2003 before SP1 and Windows 2000 before SP4 with Update Roll-up uses a hash of predictable data, which allows remote attackers to cause a denial of service (CPU consumption) via a flood of SYN packets that produce identical hash values, which slows down the hash table lookups.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/archive/1/417952/100/0/threaded; http://www.securityfocus.com/bid/15613; http://www.securityfocus.com/archive/1/417952/100/0/threaded
CVE: CVE-2005-3946
Published: 2005-12-01
Description: Opera 8.50 allows remote attackers to cause a denial of service (crash) via a Java applet with a large string argument to the removeMember JNI method for the com.opera.JSObject class.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.illegalaccess.org/exploit/opera85/OperaApplet.html; http://www.securityfocus.com/archive/1/418201/100/0/threaded; http://www.securityfocus.com/archive/1/418274/100/0/threaded
CVE: CVE-2005-3947
Published: 2005-12-01
Description: Directory traversal vulnerability in index.php in PHP Upload Center allows remote attackers to read arbitrary files via "../" sequences in the filename parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://liz0.3yr.net/phpuploadcenter.txt; http://www.blogcu.com/Liz0ziM/126975; http://www.securityfocus.com/bid/15621
CVE: CVE-2005-3948
Published: 2005-12-01
Description: Directory traversal vulnerability in main.php in PHPAlbum 0.2.3 and earlier allows remote attackers to read arbitrary files via the (1) cmd and (2) var1 parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2005/11/phpalbum-local-file-include-vuln.html; http://www.osvdb.org/21410; http://www.phpalbum.net/dw
CVE: CVE-2005-3949
Published: 2005-12-01
Description: Multiple SQL injection vulnerabilities in WebCalendar 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) startid parameter to activity_log.php, (2) startid parameter to admin_handler.php, (3) template parameter to edit_template.php, and (4) multiple parameters to export_handler.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17784; http://secunia.com/advisories/19240; http://securityreason.com/securityalert/215
CVE: CVE-2005-3950
Published: 2005-12-01
Description: nuauth in NuFW 1.0.x before 1.0.16 and 1.1 allows authenticated users to cause a denial of service via malformed packets.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/17754; http://www.nufw.org/+NUFW-1-16-minor-security-fix+.html; http://www.securityfocus.com/bid/15645
CVE: CVE-2005-3951
Published: 2005-12-01
Description: SQL injection vulnerability in survey.php in PHP Labs Survey Wizard allows remote attackers to execute arbitrary SQL commands via the sid parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/survey-wizard-sid-sql-injection-vuln.html; http://secunia.com/advisories/17686; http://www.osvdb.org/21104
CVE: CVE-2005-3952
Published: 2005-12-01
Description: SQL injection vulnerability in PHP Labs Top Auction allows remote attackers to execute arbitrary SQL commands via the (1) category and (2) type parameters to viewcat.php, or (3) certain search parameters. NOTE: later a disclosure reported the affected version as 1.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://pridels0.blogspot.com/2005/11/top-auction-multiple-sql-vuln.html; http://secunia.com/advisories/17687; http://www.osvdb.org/21105
CVE: CVE-2005-3953
Published: 2005-12-01
Description: SQL injection vulnerability in Bedeng PSP 1.1 allows remote attackers to execute arbitrary SQL commands via the cwhere parameter to (1) index.php and (2) download.php, or (3) ckode parameter to baca.php.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/bedengpsp-sql-inj-vuln.html; http://secunia.com/advisories/17760; http://www.osvdb.org/21174
CVE: CVE-2005-3954
Published: 2005-12-01
Description: Cross-site scripting (XSS) vulnerability in blogBuddies 0.3 allows remote attackers to inject arbitrary web script or HTML via the u parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/17741; http://securitytracker.com/id?1015264; http://sourceforge.net/forum/forum.php?forum_id=514600
CVE: CVE-2005-3955
Published: 2005-12-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in MagpieRSS 7.1, as used in (a) blogBuddiesv 0.3, (b) Jaws 0.6.2, and possibly other products, allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to (a) magpie_debug.php and (2) rss_url parameter to (b) magpie_slashbox.php and (c) simple_smarty.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://retrogod.altervista.org/JAWS_062_sql.html; http://seclists.org/fulldisclosure/2015/May/35; http://secunia.com/advisories/17741
CVE: CVE-2005-3956
Published: 2005-12-01
Description: Multiple SQL injection vulnerabilities in index.php in DMANews 0.904 and 0.910 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a comments action and the (2) sortorder and (3) display_num parameters in a news_list action.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/dmanews-multiple-sql-inj-vuln.html; http://secunia.com/advisories/17759; http://www.osvdb.org/21165
CVE: CVE-2005-3957
Published: 2005-12-01
Description: Unspecified vulnerability in the Trackback functionality in DotClear 1.2.1 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/17769; http://www.dotclear.net/forum/viewtopic.php?id=12895; http://www.securityfocus.com/bid/15624
CVE: CVE-2005-3958
Published: 2005-12-01
Description: SQL injection vulnerability in index.php in Entergal MX 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) idcat parameter in a showcat action and (2) the action parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/entergal-mx-v20-sql-vuln.html; http://secunia.com/advisories/17753; http://www.osvdb.org/21164
CVE: CVE-2005-3959
Published: 2005-12-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in FreeWebStat 1.0 rev37 allow remote attackers to inject arbitrary web script or HTML via the (1) site, (2) jsref, (3) jsres, and (4) jscolor parameters to pixel.php, which are not sanitized before being included in the logdb.html file, and (5) the search key to stat.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/17783; http://securitytracker.com/id?1015301; http://www.freewebstat.com/changelog-english.html
CVE: CVE-2005-3960
Published: 2005-12-01
Description: Kadu 0.4.2 and 0.5.0pre allows remote attackers to cause a denial of service (crash or generated traffic) via a malformed message, possibly with incomplete information.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/17764; http://www.osvdb.org/21215; http://www.securityfocus.com/archive/1/417920/100/0/threaded
CVE: CVE-2005-3961
Published: 2005-12-01
Description: export_handler.php in WebCalendar 1.0.1 allows remote attackers to overwrite WebCalendar data files via a modified id parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17784; http://secunia.com/advisories/19240; http://securityreason.com/securityalert/215
CVE: CVE-2005-3962
Published: 2005-12-01
Description: Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-189
References: ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/007_perl.patch; ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/001_perl.patch; ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U
CVE: CVE-2005-3963
Published: 2005-12-02
Description: SQL injection vulnerability in session.php in DotClear before 1.2.3 allows remote attackers to execute arbitrary SQL commands via the dc_xd parameter in a cookie.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-11/1052.html; http://secunia.com/advisories/17830; http://www.dotclear.net/forum/viewtopic.php?id=13876
CVE: CVE-2005-3964
Published: 2005-12-02
Description: Multiple buffer overflows in libUil (libUil.so) in OpenMotif 2.2.3, and possibly other versions, allows attackers to execute arbitrary code via the (1) diag_issue_diagnostic function in UilDiags.c and (2) open_source_file function in UilSrcSrc.c.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]5897&w=2; http://securitytracker.com/id?1015303; http://www.redhat.com/support/errata/RHSA-2006-0272.html
CVE: CVE-2005-3965
Published: 2005-12-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2004-2607.  Reason: This candidate is a duplicate of CVE-2004-2607.  Notes: All CVE users should reference CVE-2004-2607 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-3966
Published: 2005-12-03
Description: Cross-site scripting (XSS) vulnerability in search.jsp in Java Search Engine (JSE) 0.9.34 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/jse-xss-vuln.html; http://secunia.com/advisories/17834; http://www.osvdb.org/21376
CVE: CVE-2005-3967
Published: 2005-12-03
Description: Cross-site scripting (XSS) vulnerability in the dosearchsite.action module in Atlassian Confluence 2.0.1 Build 321 allows remote attackers to inject arbitrary web script or HTML via the searchQuery.queryString search module parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/confluence-enterprise-wiki-xss-vuln.html; http://secunia.com/advisories/17833; http://www.osvdb.org/21377
CVE: CVE-2005-3968
Published: 2005-12-03
Description: SQL injection vulnerability in auth.inc.php in PHPX 3.5.9 and earlier allows remote attackers to execute arbitrary SQL commands, bypass authentication, and upload arbitrary PHP code via the username parameter.
CVSS Score: 7.5 (HIGH)
References: http://rgod.altervista.org/phpx_359_xpl.html; http://secunia.com/advisories/17858; http://securitytracker.com/id?1015300
CVE: CVE-2005-3969
Published: 2005-12-03
Description: SQL injection vulnerability in MXChange before 0.2.0-pre10 PL492 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17793; http://www.osvdb.org/21339; http://www.securityfocus.com/bid/15672
CVE: CVE-2005-3970
Published: 2005-12-03
Description: Cross-site scripting (XSS) vulnerability in MXChange before 0.2.0-pre10 PL492 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/17793; http://www.osvdb.org/21338; http://www.securityfocus.com/bid/15672
CVE: CVE-2005-3971
Published: 2005-12-03
Description: Cross-site scripting (XSS) vulnerability in the login form in Citrix MetaFrame Secure Access Manager 2.0 through 2.2 and NFuse Elite 1.0 allows remote attackers to inject arbitrary web script or HTML via the username field.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/17819; http://securitytracker.com/id?1015304; http://securitytracker.com/id?1015305