deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-3466
Published: 2005-11-02
Description: Unspecified vulnerability in Enterprise CRM Sales in Oracle 8.81 up to 8.9 has unknown impact and attack vectors, as identified by Oracle Vuln# CRM01.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/17250; http://www.kb.cert.org/vuls/id/210524; http://www.oracle.com/technetwork/topics/security/cpuoct2005-090497.html
CVE: CVE-2005-3467
Published: 2005-11-02
Description: Serv-U FTP Server before 6.1.0.4 allows attackers to cause a denial of service (crash) via (1) malformed packets and possibly other unspecified issues with unknown impact and attack vectors including (2) use of "~" in a pathname, and (3) memory consumption of the daemon.  NOTE: it is not clear whether items (2) and above are vulnerabilities.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/17409; http://securitytracker.com/id?1015151; http://www.securityfocus.com/bid/15273
CVE: CVE-2005-3468
Published: 2005-11-02
Description: Directory traversal vulnerability in F-Secure Anti-Virus for Microsoft Exchange 6.40 and Internet Gatekeeper 6.40 to 6.42 allows limited remote attackers to bypass Web Console authentication and read files.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17361; http://securitytracker.com/id?1015142; http://securitytracker.com/id?1015143
CVE: CVE-2005-3469
Published: 2005-11-02
Description: SQL injection vulnerability in index.php in News2Net 3.0.0.0 allows remote attackers to execute arbitrary SQL commands via the category parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17396; http://www.osvdb.org/20450; http://www.securityfocus.com/bid/15274
CVE: CVE-2005-3470
Published: 2005-11-02
Description: SQL injection vulnerability in in the authenticate function in MailWatch for MailScanner 1.0.2 allows remote attackers to execute arbitrary SQL commands.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17405; http://sourceforge.net/project/shownotes.php?release_id=367923; http://www.osvdb.org/20451
CVE: CVE-2005-3471
Published: 2005-11-02
Description: Directory traversal vulnerability in the ruleset view for MailWatch for MailScanner 1.0.2 allows remote attackers to access arbitrary files.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17405; http://sourceforge.net/project/shownotes.php?release_id=367923; http://www.vupen.com/english/advisories/2005/2276
CVE: CVE-2005-3472
Published: 2005-11-03
Description: Unspecified vulnerability in Sun Java System Communications Express 2005Q1 and 2004Q2 allows local and remote attackers to read sensitive information from configuration files.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17395; http://securitytracker.com/id?1015135; http://sunsolve.sun.com/search/document.do?assetkey=1-26-101948-1
CVE: CVE-2005-3473
Published: 2005-11-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog 0.4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) entry, (2) blog_subject, and (3) blog_text parameters (involving the temp_subject variable) in (a) preview_cgi.php and (b) preview_static_cgi.php, or (4) scheme_name parameter and (5) bg_color parameters (involving the preset_name and result variables) in (c) colors.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/17404; http://securityreason.com/securityalert/138; http://www.osvdb.org/20436
CVE: CVE-2005-3474
Published: 2005-11-03
Description: The aries.sys driver in Sony First4Internet XCP DRM software hides any file, registry key, or process with a name that starts with "$sys$", which allows attackers to hide activities on a system that uses XCP.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/17408; http://securitytracker.com/id?1015145; http://www.osvdb.org/20435
CVE: CVE-2005-3475
Published: 2005-11-03
Description: Hasbani Web Server (WindWeb) 2.0 allows remote attackers to cause a denial of service (infinite loop) via HTTP crafted GET requests.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0572.html; http://www.osvdb.org/20447; http://www.securityfocus.com/bid/15225
CVE: CVE-2005-3476
Published: 2005-11-03
Description: Unspecified vulnerability in HP OpenVMS Integrity 8.2-1 and 8.2, and OpenVMS Alpha 7.3-2 and 8.2, allows local users to cause a denial of service.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/17402; http://securitytracker.com/id?1015128; http://www.osvdb.org/20487
CVE: CVE-2005-3477
Published: 2005-11-03
Description: Multiple interpretation error in the image upload handling code in Invision Gallery 2.0.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML or script in an image whose type does not match its extension, which is rendered by Internet Explorer due to CVE-2005-3312.  NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer and the proper fix should be in that browser; if so, then this should not be treated as a vulnerability in Invision Gallery.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0519.html; http://secunia.com/advisories/17393; http://securityreason.com/securityalert/105
CVE: CVE-2005-3478
Published: 2005-11-03
Description: SQL injection vulnerability in index.php in PHPCafe.net Tutorials Manager 1.0 Beta 2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/22795; http://www.securityfocus.com/archive/1/435206/100/0/threaded; http://www.securityfocus.com/bid/15244
CVE: CVE-2005-3479
Published: 2005-11-03
Description: Cross-site scripting (XSS) vulnerability in login.asp in Ringtail CaseBook 6.1.0 allows remote attackers to inject arbitrary web script or HTML via the users parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/17383; http://www.osvdb.org/20423; http://www.procheckup.com/Vulner_PR0412.php
CVE: CVE-2005-3480
Published: 2005-11-03
Description: login.asp in Ringtail CaseBook 6.1.0 displays different error messages depending on whether a user exists or not, which allows remote attackers to determine valid usernames.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17383; http://www.osvdb.org/20422; http://www.procheckup.com/Vulner_PR0413.php
CVE: CVE-2005-3481
Published: 2005-11-03
Description: Cisco IOS 12.0 to 12.4 might allow remote attackers to execute arbitrary code via a heap-based buffer overflow in system timers. NOTE: this issue does not correspond to a specific vulnerability, rather a general weakness that only increases the feasibility of exploitation of any vulnerabilities that might exist.  Such design-level weaknesses normally are not included in CVE, so perhaps this issue should be REJECTed.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/17413; http://securitytracker.com/id?1015139; http://www.cisco.com/warp/public/707/cisco-sa-20051102-timers.shtml
CVE: CVE-2005-3482
Published: 2005-11-03
Description: Cisco 1200, 1131, and 1240 series Access Points, when operating in Lightweight Access Point Protocol (LWAPP) mode and controlled by 2000 and 4400 series Airespace WLAN controllers running 3.1.59.24, allow remote attackers to send unencrypted traffic to a secure network using frames with the MAC address of an authenticated end host.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17406; http://securityreason.com/securityalert/139; http://securitytracker.com/id?1015140
CVE: CVE-2005-3483
Published: 2005-11-03
Description: Buffer overflow in GO-Global for Windows 3.1.0.3270 and earlier allows remote attackers to execute arbitrary code via a data block that is longer than the specified data block size.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/ggwbof-adv.txt; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]0489&w=2; http://secunia.com/advisories/17424
CVE: CVE-2005-3484
Published: 2005-11-03
Description: Directory traversal vulnerability in NeroNET 1.2.0.2 and earlier allows remote attackers to read arbitrary files with certain file extensions (such as ZIP, AVI, JPG, TXT, and HTML) via ".." and hex-encoded (1) slash "/" ("%2f") or (2) backslash "\" ("%5c") sequences.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/neronet-adv.txt; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]0152&w=2; http://secunia.com/advisories/17421
CVE: CVE-2005-3485
Published: 2005-11-03
Description: Buffer overflow in Glider Collect'n kill 1.0.0.0 allows remote attackers to execute arbitrary code via a gl_playerEnter command with a long player name.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/gliderbof-adv.txt; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1571&w=2; http://secunia.com/advisories/17422
CVE: CVE-2005-3486
Published: 2005-11-03
Description: Multiple format string vulnerabilities in Scorched 3D 39.1 (bf) and earlier allow remote attackers to execute arbitrary code via various (1) GLConsole::addLine, (2) ServerCommon::sendString, (3) ServerCommon::serverLog functions, and possibly other unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/scorchbugs-adv.txt; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1946&w=2; http://secunia.com/advisories/17423
CVE: CVE-2005-3487
Published: 2005-11-03
Description: Multiple buffer overflows in Scorched 3D 39.1 (bf) and earlier allow remote attackers to execute arbitrary code via various (1) GLConsole::addLine, (2) ServerCommon::sendString, (3) ServerCommon::serverLog functions, (4) a long command that is not properly handled in ComsMessageHandler.cpp when generating an error message, (5) a long UniqueID value in Logger.cpp, and possibly other unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/scorchbugs-adv.txt; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1946&w=2; http://secunia.com/advisories/17423
CVE: CVE-2005-3488
Published: 2005-11-03
Description: Scorched 3D 39.1 (bf) and earlier allows remote attackers to cause a denial of service (long loop and server hang) via a negative numplayers value that bypasses a signed check in ServerConnectHandler.cpp.
CVSS Score: 7.8 (HIGH)
References: http://aluigi.altervista.org/adv/scorchbugs-adv.txt; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1946&w=2; http://secunia.com/advisories/17423
CVE: CVE-2005-2974
Published: 2005-11-04
Description: libungif library before 4.1.0 allows attackers to cause a denial of service via a crafted GIF file that triggers a null dereference.
CVSS Score: 2.6 (LOW)
References: http://bugs.gentoo.org/show_bug.cgi?id=109997; http://scary.beasts.org/security/CESA-2005-007.txt; http://secunia.com/advisories/17436
CVE: CVE-2005-3350
Published: 2005-11-04
Description: libungif library before 4.1.0 allows attackers to corrupt memory and possibly execute arbitrary code via a crafted GIF file that leads to an out-of-bounds write.
CVSS Score: 7.5 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=109997; http://scary.beasts.org/security/CESA-2005-007.txt; http://secunia.com/advisories/17436
CVE: CVE-2005-3489
Published: 2005-11-04
Description: Buffer overflow in Asus Video Security 3.5.0.0 and earlier, when using authorization, allows remote attackers to execute arbitrary code via a long username/password string.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/asusvsbugs-adv.txt; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2614&w=2; http://secunia.com/advisories/17419
CVE: CVE-2005-3490
Published: 2005-11-04
Description: Directory traversal vulnerability in the web server in Asus Video Security 3.5.0.0 and earlier allows remote attackers to read arbitrary files via "../" or "..\" sequences in the URL.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/asusvsbugs-adv.txt; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2614&w=2; http://secunia.com/advisories/17419
CVE: CVE-2005-3491
Published: 2005-11-04
Description: Multiple buffer overflows in the receiver function in loop.c in FlatFrag 0.3 and earlier allow remote attackers to execute arbitrary code via the (1) version, (2) name, and (3) model fields.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/flatfragz-adv.txt; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6274&w=2; http://www.osvdb.org/20769
CVE: CVE-2005-3492
Published: 2005-11-04
Description: FlatFrag 0.3 and earlier allows remote attackers to cause a denial of service (crash) by sending an NT_CONN_OK command from a client that is not connected, which triggers a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/flatfragz-adv.txt; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6274&w=2; http://www.osvdb.org/20770
CVE: CVE-2005-3493
Published: 2005-11-04
Description: Battle Carry .005 and earlier allows remote attackers to cause a denial of service (inaccessible port) via a large packet, which triggers a socket error and terminates the socket that is listening on the server's UDP port.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/bcarrydos-adv.txt; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]0102&w=2; http://secunia.com/advisories/17417
CVE: CVE-2005-3494
Published: 2005-11-04
Description: Cross-site scripting (XSS) vulnerability in Ar-blog 5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a blog comment.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038133.html; http://secunia.com/advisories/17307; http://securitytracker.com/id?1015100
CVE: CVE-2005-3495
Published: 2005-11-04
Description: Ar-blog 5.2 and earlier allows remote attackers to bypass authentication by modifying cookies.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038133.html; http://secunia.com/advisories/17307; http://securitytracker.com/id?1015100
CVE: CVE-2005-3496
Published: 2005-11-04
Description: Cross-site scripting (XSS) vulnerability in PHP Handicapper allows remote attackers to inject arbitrary web script or HTML via the msg parameter to msg.php.  NOTE: some sources identify a second vector in the login parameter to process_signup.php, but the original source says that it is for CRLF injection (CVE-2005-4712).  Also note: the vendor has disputed CVE-2005-3497, and it is possible that the dispute was intended to include this issue as well.  If so, followup investigation strongly suggests that the original report is correct.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/17412; http://www.osvdb.org/20479; http://www.osvdb.org/20480
CVE: CVE-2005-3497
Published: 2005-11-04
Description: SQL injection vulnerability in process_signup.php in PHP Handicapper allows remote attackers to execute arbitrary SQL commands via the serviceid parameter.  NOTE: on 20060210, the vendor disputed this issue, saying "this is 100% false reporting, this is a slander campaign from a customer who had a vulnerability in his SERVER not the software."  However, followup investigation strongly suggests that the original report is correct
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/17412; http://www.osvdb.org/20481; http://www.securityfocus.com/bid/15298
CVE: CVE-2005-3498
Published: 2005-11-04
Description: IBM WebSphere Application Server 5.0.x before 5.02.15, 5.1.x before 5.1.1.8, and 6.x before fixpack V6.0.2.5, when session trace is enabled, records a full URL including the queryString in the trace logs when an application encodes a URL, which could allow attackers to obtain sensitive information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://securitytracker.com/id?1015134; http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27004980; http://www-1.ibm.com/support/docview.wss?uid=swg24010781
CVE: CVE-2005-3499
Published: 2005-11-04
Description: Frisk F-Prot Antivirus allows remote attackers to bypass protection via a ZIP file with a version header greater than 15, which prevents F-Prot from decompressing and analyzing the file.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0073.html; http://securitytracker.com/id?1015148; http://thierry.sniff-em.com/research/fprot.html
CVE: CVE-2005-2628
Published: 2005-11-05
Description: Macromedia Flash 6 and 7 (Flash.ocx) allows remote attackers to execute arbitrary code via a SWF file with a modified frame type identifier that is used as an out-of-bounds array index to a function pointer.
CVSS Score: 5.1 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006/May/msg00003.html; http://secunia.com/advisories/17430; http://secunia.com/advisories/17437/
CVE: CVE-2005-2753
Published: 2005-11-05
Description: Integer overflow in Apple QuickTime before 7.0.3 allows user-assisted attackers to execute arbitrary code via a crafted MOV file that causes a sign extension of the length element in a Pascal style string.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-189
References: http://docs.info.apple.com/article.html?artnum=302772; http://pb.specialised.info/all/adv/quicktime-mov-io1-adv.txt; http://secunia.com/advisories/17428
CVE: CVE-2005-2754
Published: 2005-11-05
Description: Integer overflow in Apple QuickTime before 7.0.3 allows user-assisted attackers to execute arbitrary code via a crafted MOV file with "Improper movie attributes."
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-189
References: http://docs.info.apple.com/article.html?artnum=302772; http://pb.specialised.info/all/adv/quicktime-mov-io2-adv.txt; http://secunia.com/advisories/17428
CVE: CVE-2005-2755
Published: 2005-11-05
Description: Apple QuickTime Player before 7.0.3 allows user-assisted attackers to cause a denial of service (crash) via a crafted file with a missing movie attribute, which leads to a null dereference.
CVSS Score: 2.6 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0102.html; http://docs.info.apple.com/article.html?artnum=302772; http://pb.specialised.info/all/adv/quicktime-mov-dos-adv.txt
CVE: CVE-2005-2756
Published: 2005-11-05
Description: Apple QuickTime before 7.0.3 allows user-assisted attackers to overwrite memory and execute arbitrary code via a crafted PICT file that triggers an overflow during expansion.
CVSS Score: 5.1 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=302772; http://pb.specialised.info/all/adv/quicktime-pict-adv.txt; http://secunia.com/advisories/17428
CVE: CVE-2005-3303
Published: 2005-11-05
Description: The FSG unpacker (fsg.c) in Clam AntiVirus (ClamAV) 0.80 through 0.87 allows remote attackers to cause "memory corruption" and execute arbitrary code via a crafted FSG 1.33 file.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2005-11/0041.html; http://secunia.com/advisories/17184; http://secunia.com/advisories/17434
CVE: CVE-2005-3500
Published: 2005-11-05
Description: The tnef_attachment function in tnef.c for Clam AntiVirus (ClamAV) before 0.87.1 allows remote attackers to cause a denial of service (infinite loop and memory exhaustion) via a crafted value in a CAB file that causes ClamAV to repeatedly scan the same block.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17184; http://secunia.com/advisories/17434; http://secunia.com/advisories/17451
CVE: CVE-2005-3501
Published: 2005-11-05
Description: The cabd_find function in cabd.c of the libmspack library (mspack) for Clam AntiVirus (ClamAV) before 0.87.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted CAB file that causes cabd_find to be called with a zero length.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/17184; http://secunia.com/advisories/17434; http://secunia.com/advisories/17451
CVE: CVE-2005-3502
Published: 2005-11-05
Description: attachment_send.php in Cerberus Helpdesk allows remote attackers to view attachments and tickets of other users via a modified file_id parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]3298&w=2; http://secunia.com/advisories/17431; http://securitytracker.com/id?1015153
CVE: CVE-2005-3503
Published: 2005-11-05
Description: chfn in pwdutils 3.0.4 and earlier on SuSE Linux, and possibly other operating systems, does not properly check arguments for the GECOS field, which allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/17469; http://www.osvdb.org/20525; http://www.securityfocus.com/archive/1/415725/30/0/threaded
CVE: CVE-2005-3504
Published: 2005-11-05
Description: Buffer overflow in swcons in IBM AIX 5.2, when debug malloc is enabled, allows remote attackers to cause a core dump and possibly execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17439; http://www-1.ibm.com/support/docview.wss?uid=isg1IY78467; http://www.securityfocus.com/bid/15323
CVE: CVE-2005-3505
Published: 2005-11-05
Description: Cross-site scripting (XSS) vulnerability in the Entropy Chat script in cPanel 10.2.0-R82 and 10.6.0-R137 allows remote attackers to inject arbitrary web script or HTML via a chat message containing Javascript in style attributes in tags such as <b>, which are processed by Internet Explorer.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0124.html; http://secunia.com/advisories/16609; http://secunia.com/secunia_research/2005-56/advisory/
CVE: CVE-2005-3506
Published: 2005-11-05
Description: Cross-site scripting (XSS) vulnerability in proxy.asp in Sambar Server 6.3 BETA 2 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via the (1) Remote Proxy Server or (2) Proxy Filter IPs field.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0038.html; http://secunia.com/advisories/17329; http://www.osvdb.org/20434
CVE: CVE-2005-3124
Published: 2005-11-06
Description: syslogtocern in Acme thttpd before 2.23 allows local users to write arbitrary files via a symlink attack on a temporary file.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/17454; http://secunia.com/advisories/17472; http://www.debian.org/security/2005/dsa-883
CVE: CVE-2005-3507
Published: 2005-11-06
Description: Directory traversal vulnerability in CuteNews 1.4.1 allows remote attackers to include arbitrary files, execute code, and gain privileges via "../" sequences in the template parameter to (1) show_archives.php and (2) show_news.php.
CVSS Score: 5.0 (MEDIUM)
References: http://rgod.altervista.org/cute141.html; http://secunia.com/advisories/17435; http://www.osvdb.org/20472
CVE: CVE-2005-3508
Published: 2005-11-06
Description: SQL injection vulnerability in showGallery.php in Gallery (Galerie) 2.4 allows remote attackers to execute arbitrary SQL commands via the galid parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17453; http://securitytracker.com/id?1015162; http://www.osvdb.org/20523
CVE: CVE-2005-3509
Published: 2005-11-06
Description: Multiple SQL injection vulnerabilities in JPortal allow remote attackers to execute arbitrary SQL commands via (1) banner.php or the id parameter to (2) print.php, (3) comment.php, and (4) news.php.
CVSS Score: 7.5 (HIGH)
References: http://foro.elhacker.net/index.php?topic=93436.0; http://www.security.nnov.ru/Kdocument105.html; http://www.securityfocus.com/bid/15324
CVE: CVE-2005-3510
Published: 2005-11-06
Description: Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.
CVSS Score: 5.0 (MEDIUM)
References: http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx; http://secunia.com/advisories/17416; http://secunia.com/advisories/30899