deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-0640
Published: 2005-03-02
Description: Computer Associates (CA) Unicenter Asset Management (UAM) 4.0 does not properly initialize the "Change Credentials for Database" window, which allows local users to recover the SQL Admin password via certain methods.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/14454; http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=Qo64323; http://secunia.com/advisories/14454
CVE: CVE-2005-0641
Published: 2005-03-02
Description: Cross-site scripting (XSS) vulnerability in the Reporter for Computer Associates (CA) Unicenter Asset Management (UAM) 4.0 allows remote attackers to inject arbitrary HTML or web script via the (1) name or (2) description in a report template.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/14454; http://supportconnect.ca.com/sc/solcenter/solresults.jsp?aparno=Qo64323; http://secunia.com/advisories/14454
CVE: CVE-2005-0671
Published: 2005-03-03
Description: Format string vulnerability in Carsten's 3D Engine (Ca3DE), March 2004 version and earlier, allows remote attackers to execute arbitrary code via format string specifiers in a command.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/ca3dex-adv.txt; http://secunia.com/advisories/14483; http://securitytracker.com/id?1013361
CVE: CVE-2005-0674
Published: 2005-03-03
Description: Cross-site scripting (XSS) vulnerability in the News module for paBox 1.6 allows remote attackers to inject arbitrary web script or HTML via the text hidden parameter in an HTTP POST request.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1541&w=2; http://secunia.com/advisories/14474; http://securitytracker.com/id?1013363
CVE: CVE-2005-0593
Published: 2005-03-04
Description: Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote attackers to spoof the SSL "secure site" lock icon via (1) a web site that does not finish loading, which shows the lock of the previous site, (2) a non-HTTP server that uses SSL, which causes the lock to be displayed when the SSL handshake is completed, or (3) a URL that generates an HTTP 204 error, which updates the icon and location information but does not change the display of the original site.
CVSS Score: 2.6 (LOW)
References: http://www.gentoo.org/security/en/glsa/glsa-200503-10.xml; http://www.gentoo.org/security/en/glsa/glsa-200503-30.xml; http://www.mozilla.org/security/announce/mfsa2005-14.html
CVE: CVE-2005-0668
Published: 2005-03-04
Description: Unknown vulnerability in HTTP Anti Virus Proxy (HAVP) before 0.51 prevents viruses from being properly detected in certain files such as (1) .CAB or (2) .ZIP files.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1013370; http://www.bemberg.de/server-side/index.htm; http://securitytracker.com/id?1013370
CVE: CVE-2005-0109
Published: 2005-03-05
Description: Hyper-Threading technology, as used in FreeBSD and other operating systems that are run on Intel Pentium and other processors, allows local users to use a malicious thread to create covert channels, monitor the execution of other threads, and obtain sensitive information such as cryptographic keys, via a timing attack on memory cache misses.
CVSS Score: 5.6 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.24/SCOSA-2005.24.txt; http://marc.info/?l=freebsd-hackers&m=[PII_REDACTED]1858&w=2; http://marc.info/?l=freebsd-security&m=[PII_REDACTED]9609&w=2
CVE: CVE-2005-0688
Published: 2005-03-05
Description: Windows Server 2003 and XP SP2, with Windows Firewall turned off, allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the SYN flag set and the same destination and source address and port, aka a reoccurrence of the "Land" vulnerability (CVE-1999-0016).
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4081&w=2; http://secunia.com/advisories/22341; http://www.securityfocus.com/archive/1/449179/100/0/threaded
CVE: CVE-2005-0681
Published: 2005-03-06
Description: Nokia Symbian 60 allows remote attackers to cause a denial of service (phone restart) via a Bluetooth nickname.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1013380; http://www.osvdb.org/14574; http://www.securiteam.com/securitynews/5PP0V00G1S.html
CVE: CVE-2005-0687
Published: 2005-03-06
Description: Format string vulnerability in Hashcash 1.16 allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via format string specifiers in a reply address, which is not properly handled when printing the header.
CVSS Score: 7.5 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=83541; http://secunia.com/advisories/14487; http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml
CVE: CVE-2005-0691
Published: 2005-03-06
Description: PHP remote file inclusion vulnerability in article mode for modules.php in SocialMPN allows remote attackers to execute arbitrary PHP code by modifying the name parameter to reference a URL on a remote web server that contains the code.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3239&w=2; http://waraxe.us/ftopic-542-0-days0-orderasc-.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3239&w=2
CVE: CVE-2005-0692
Published: 2005-03-06
Description: Cross-site scripting (XSS) vulnerability in fusion_core.php for PHP-Fusion 5.x allows remote attackers to inject arbitrary web script or HTML via a message with IMG bbcode containing character-encoded Javascript.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0028&w=2; http://secunia.com/advisories/14492; http://www.php-fusion.co.uk/news.php?readmore=183
CVE: CVE-2005-0177
Published: 2005-03-07
Description: nls_ascii.c in Linux before 2.6.8.1 uses an incorrect table size, which allows attackers to cause a denial of service (kernel crash) via a buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000930; http://linux.bkbits.net:8080/linux-2.6/cset%4041e2bfbeOiXFga62XrBhzm7Kv9QDmQ; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1365&w=2
CVE: CVE-2005-0178
Published: 2005-03-07
Description: Race condition in the setsid function in Linux before 2.6.8.1 allows local users to cause a denial of service (crash) and possibly access portions of kernel memory, related to TTY changes, locking, and semaphores.
CVSS Score: 6.2 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000930; http://linux.bkbits.net:8080/linux-2.6/cset%4041ddda70CWJb5nNL71T4MOlG2sMG8A; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1365&w=2
CVE: CVE-2005-0179
Published: 2005-03-07
Description: Linux kernel 2.4.x and 2.6.x allows local users to cause a denial of service (CPU and memory consumption) and bypass RLIM_MEMLOCK limits via the mlockall call.
CVSS Score: 2.1 (LOW)
References: http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000930; http://lists.grok.org.uk/pipermail/full-disclosure/2005-January/030660.html; http://secunia.com/advisories/17002
CVE: CVE-2005-0180
Published: 2005-03-07
Description: Multiple integer signedness errors in the sg_scsi_ioctl function in scsi_ioctl.c for Linux 2.6.x allow local users to read or modify kernel memory via negative integers in arguments to the scsi ioctl, which bypass a maximum length check before calling the copy_from_user and copy_to_user functions.
CVSS Score: 3.6 (LOW)
References: http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000930; http://lists.grok.org.uk/pipermail/full-disclosure/2005-January/030660.html; http://secunia.com/advisories/17826
CVE: CVE-2005-0548
Published: 2005-03-07
Description: Cross-site scripting (XSS) vulnerability in Solaris AnswerBook2 Documentation 1.4.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the Search function.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1628&w=2; http://sunsolve.sun.com/search/document.do?assetkey=1-26-57737-1; http://sunsolve.sun.com/search/document.do?assetkey=1-77-1000230.1-1
CVE: CVE-2005-0667
Published: 2005-03-07
Description: Buffer overflow in Sylpheed before 1.0.3 and other versions before 1.9.5 allows remote attackers to execute arbitrary code via an e-mail message with certain headers containing non-ASCII characters that are not properly handled when the user replies to the message.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/14491; http://securitytracker.com/id?1013376; http://sylpheed.good-day.net/changelog-devel.html.en
CVE: CVE-2005-0680
Published: 2005-03-07
Description: PHP remote file inclusion vulnerability in download_center_lite.inc.php for Download Center Lite 1.6 allows remote attackers to execute arbitrary PHP code by modifying the script_root parameter to reference a URL on a remote web server that contains the code.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1719&w=2; http://secunia.com/advisories/14513; http://www.stadtaus.com/forum/p-5895.html
CVE: CVE-2005-0686
Published: 2005-03-07
Description: Integer overflow in mlterm 2.5.0 through 2.9.1, with gdk-pixbuf support enabled, allows remote attackers to execute arbitrary code via a large image file that is used as a background.
CVSS Score: 7.5 (HIGH)
References: http://www.gentoo.org/security/en/glsa/glsa-200503-13.xml; https://sourceforge.net/project/shownotes.php?release_id=310416; http://www.gentoo.org/security/en/glsa/glsa-200503-13.xml
CVE: CVE-2005-0689
Published: 2005-03-07
Description: includer.cgi in The Includer allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the URL or (2) the template parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0779&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3411&w=2; http://www.securityfocus.com/bid/12738
CVE: CVE-2005-0690
Published: 2005-03-07
Description: Gene6 FTP Server does not properly restrict access to the control console, which allows local users to modify the server configuration and gain privileges, as demonstrated by defining a SITE command.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6680&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1080&w=2; http://secunia.com/advisories/14436
CVE: CVE-2005-0693
Published: 2005-03-07
Description: Buffer overflow in JoWood Chaser 1.50 and earlier allows remote attackers to cause a denial of service (client or server crash) and execute arbitrary code via a long nickname.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/chasercool-adv.txt; http://www.securityfocus.com/bid/12733; http://aluigi.altervista.org/adv/chasercool-adv.txt
CVE: CVE-2005-0694
Published: 2005-03-07
Description: Hosting Controller 6.1 Hotfix 1.7 and earlier stores log files under the web root, which allows remote attackers to obtain sensitive information via a direct request to HCDiskQuotaService.csv.
CVSS Score: 5.0 (MEDIUM)
References: http://isun.shabgard.org/hc2.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4947&w=2; http://secunia.com/advisories/14522
CVE: CVE-2005-0695
Published: 2005-03-07
Description: The password recovery feature (forgotpassword.asp) in Hosting Controller 6.1 Hotfix 1.7 and earlier allows remote attackers to determine the owner's e-mail address by providing a portion of the domain name to the "login ID" field.
CVSS Score: 5.0 (MEDIUM)
References: http://isun.shabgard.org/hc2.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4947&w=2; http://secunia.com/advisories/14522
CVE: CVE-2005-0697
Published: 2005-03-07
Description: SQL injection vulnerability in the process_picture function xp_publish.php in CopperExport 0.2.1 allows remote attackers to execute arbitrary SQL commands, possibly via the (1) title, (2) caption, or (3) keywords parameters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/14401; http://www.zzamboni.org/copperexport/; http://secunia.com/advisories/14401
CVE: CVE-2005-0698
Published: 2005-03-07
Description: PHP remote file inclusion vulnerability in PHPWebLog 0.5.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the (1) G_PATH parameter to init.inc.php or the (2) PATH parameter to index.php to reference a URL on a remote web server that contains the code.
CVSS Score: 4.6 (MEDIUM)
References: http://www.securityfocus.com/archive/1/392552; http://www.securityfocus.com/bid/12747; http://www.securityfocus.com/archive/1/392552
CVE: CVE-2005-0700
Published: 2005-03-07
Description: The export_index action in myadmin.php for Aztek Forum 4.0 allows remote attackers to obtain database files, possibly by setting the ATK_ADMIN cookie.
CVSS Score: 5.0 (MEDIUM)
References: http://www.frsirt.com/exploits/20050307.aztek.c.php; http://www.securityfocus.com/bid/12745; http://www.frsirt.com/exploits/20050307.aztek.c.php
CVE: CVE-2005-0701
Published: 2005-03-07
Description: Directory traversal vulnerability in Oracle Database Server 8i and 9i allows remote attackers to read or rename arbitrary files via "\\.\\.."  (modified dot dot backslash) sequences to UTL_FILE functions such as (1) UTL_FILE.FOPEN or (2) UTL_FILE.frename.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-March/032273.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8211&w=2; http://www.argeniss.com/research/ARGENISS-ADV-030501.txt
CVE: CVE-2005-0702
Published: 2005-03-07
Description: SQL injection vulnerability in phpMyFAQ 1.4 and 1.5 allows remote attackers to add FAQ records to the database via the username field in forum messages.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/14516; http://www.phpmyfaq.de/advisory_2005-03-06.php; http://secunia.com/advisories/14516
CVE: CVE-2005-0703
Published: 2005-03-07
Description: Xerox MicroServer Web Server for various WorkCentre products including M35/M45/M55 2.028.11.000 through 2.97.20.032 and 4.84.16.000 through 4.97.20.032, Pro 35/45/55 3.028.11.000 through 3.97.20.032, Pro 65/75/90 1.001.00.060 through 1.001.02.084, and others, has an "unauthenticated account," which allows remote attackers to modify system configuration, a different vulnerability than CVE-2005-1179.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/14507; http://www.xerox.com/downloads/usa/en/c/cert_XRX05_005.pdf; http://secunia.com/advisories/14507
CVE: CVE-2005-0722
Published: 2005-03-07
Description: eXPerience2 allows remote attackers to obtain the full path for the web root via a direct request to modules.php without any parameters, which leaks the path in a PHP error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4600&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4600&w=2
CVE: CVE-2005-0098
Published: 2005-03-08
Description: Multiple buffer overflows in the SDL port of abuse (abuse-SDL) before 2.00 allow local users to execute arbitrary code via the command line.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/14495; http://www.debian.org/security/2005/dsa-691; http://secunia.com/advisories/14495
CVE: CVE-2005-0099
Published: 2005-03-08
Description: The SDL port of abuse (abuse-SDL) before 2.00 does not properly drop privileges before creating certain files, which allows local users to create or overwrite arbitrary files.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/14495; http://www.debian.org/security/2005/dsa-691; http://www.osvdb.org/14610
CVE: CVE-2005-0626
Published: 2005-03-08
Description: Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
CVSS Score: 2.6 (LOW)
References: http://fedoranews.org/updates/FEDORA--.shtml; http://www.redhat.com/support/errata/RHSA-2005-415.html; http://www.securityfocus.com/bid/12716
CVE: CVE-2005-0685
Published: 2005-03-08
Description: Multiple access validation errors in OutStart Participate Enterprise (PE) allow remote attackers to (1) browse arbitrary directory trees by modifying the rootFolder parameter to displaynavigator.jsp, (2) rename arbitrary directory objects by modifying the selectedObject parameter to renamepopup.jsp, (3) delete arbitrary directory objects by modifying the selectedObjectsCSV parameter to displaydeletenavigator.jsp, and conduct other unauthorized activities via the (4) showDeleteView, (5) showWebFolderView, (6) showLibraryView, (7) showMyLibraryView, (8) singleSelectObject, (9) processRadioSelection, (10) processCheckboxSelection, (11) singleSelectObject, (12) addToSelectedObjects, or (13) removeFromSelectedObjects commands.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/14542; http://security.honour.ca/outstartpsi.txt; http://www.securityfocus.com/archive/1/392623
CVE: CVE-2005-0696
Published: 2005-03-08
Description: Buffer overflow in ArGoSoft FTP Server 1.4.2.8 allows remote authenticated users to execute arbitrary code via a long DELE command. NOTE: this issue was later reported to also affect 1.4.3.5.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/042523.html; http://secunia.com/advisories/14526; http://securityreason.com/securityalert/494
CVE: CVE-2005-0699
Published: 2005-03-08
Description: Multiple buffer overflows in the dissect_a11_radius function in the CDMA A11 (3G-A11) dissector (packet-3g-a11.c) for Ethereal 0.10.9 and earlier allow remote attackers to execute arbitrary code via RADIUS authentication packets with large length values.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2400&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1813&w=2; http://security.gentoo.org/glsa/glsa-200503-16.xml
CVE: CVE-2005-0720
Published: 2005-03-08
Description: PHP remote file inclusion vulnerability in admin/header.php in PHP mcNews 1.3 allows remote attackers to execute arbitrary PHP code by modifying the skinfile parameter to reference a URL on a remote web server that contains the code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4892&w=2; http://secunia.com/advisories/14528; http://www.securityfocus.com/archive/1/476277/100/0/threaded
CVE: CVE-2005-0723
Published: 2005-03-08
Description: Cross-site scripting (XSS) vulnerability in the jumpmenu function in functions.php for paFileDB 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL parameters, which is not properly cleansed in the $pageurl variable, as demonstrated using pafiledb.php.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2851&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2851&w=2
CVE: CVE-2005-0725
Published: 2005-03-08
Description: SQL injection vulnerability in the getAllbyArticle function in wfsfiles.php for WF-Sections (wfsections) 1.07 allows remote attackers to execute arbitrary SQL commands via the articleid parameter to article.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9821&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/19660; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9821&w=2
CVE: CVE-2005-0741
Published: 2005-03-08
Description: Cross-site scripting (XSS) vulnerability in YaBB.pl for YaBB 2.0 RC1 allows remote attackers to inject arbitrary web script or HTML via the username parameter in a usersrecentposts action.
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1013420; http://www.securityfocus.com/bid/12756; http://securitytracker.com/id?1013420
CVE: CVE-2005-0747
Published: 2005-03-08
Description: ApplyYourself i-Class allows remote attackers to obtain sensitive information about their own applications by reusing the hidden ID field, as demonstrated using the id parameter to ApplicantDecision.asp.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1013400; http://securitytracker.com/id?1013400
CVE: CVE-2005-0719
Published: 2005-03-09
Description: Unknown vulnerability in the systems message queue in HP Tru64 Unix 4.0F PK8 through 5.1B-2/PK4 allows local users to cause a denial of service (process crash) for processes such as nfsstat, pfstat, arp, ogated, rarpd, route, sendmail, srconfig, strsetup, trpt, netstat, and xntpd.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7482&w=2; http://secunia.com/advisories/14549/; http://www.securityfocus.com/bid/12768
CVE: CVE-2005-0736
Published: 2005-03-09
Description: Integer overflow in sys_epoll_wait in eventpoll.c for Linux kernel 2.6 to 2.6.11 allows local users to overwrite kernel memory via a large number of events.
CVSS Score: 2.1 (LOW)
References: http://linux.bkbits.net:8080/linux-2.6/cset%40422dd06a1p5PsyFhoGAJseinjEq3ew?nav=index.html%7CChangeSet%40-1d; http://lists.grok.org.uk/pipermail/full-disclosure/2005-March/032314.html; http://www.novell.com/linux/security/advisories/2005_18_kernel.html
CVE: CVE-2005-0745
Published: 2005-03-09
Description: UTStarcom iAN-02EX VoIP Analog Terminal Adaptor (ATA) allows local users to bypass ATA access restrictions by dialing "*#26845#" and causing a device reset.
CVSS Score: 4.6 (MEDIUM)
References: http://seclists.org/lists/bugtraq/2005/Mar/0168.html; http://secunia.com/advisories/14544; http://seclists.org/lists/bugtraq/2005/Mar/0168.html
CVE: CVE-2005-0731
Published: 2005-03-10
Description: PY Software Active Webcam WebServer (webcam.exe) 5.5 allows remote attackers to cause a denial of service (CPU consumption) via a direct request to Filelist.html.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-03/0216.html; http://secunia.com/advisories/14553; http://secway.org/advisory/ad20050104.txt
CVE: CVE-2005-0748
Published: 2005-03-10
Description: PHP remote file inclusion vulnerability in initdb.php for WEBInsta Mailing list manager 1.3d allows remote attackers to execute arbitrary PHP code by modifying the absolute_path parameter to reference a URL on a remote web server that contains the code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/14550; http://securitytracker.com/id?1013409; http://www.securityfocus.com/bid/12773
CVE: CVE-2005-0774
Published: 2005-03-10
Description: SQL injection vulnerability in member.php and possibly other scripts in PhotoPost PHP 5.0 RC3 allows remote attackers to execute arbitrary SQL commands via the uid parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2859&w=2; http://secunia.com/advisories/14576; http://www.securityfocus.com/bid/12779
CVE: CVE-2005-0765
Published: 2005-03-12
Description: Unknown vulnerability in the JXTA dissector in Ethereal 0.10.9 allows remote attackers to cause a denial of service (application crash).
CVSS Score: 5.0 (MEDIUM)
References: http://www.ethereal.com/appnotes/enpa-sa-00018.html; http://www.gentoo.org/security/en/glsa/glsa-200503-16.xml; http://www.mandriva.com/security/advisories?name=MDKSA-2005:053
CVE: CVE-2005-0780
Published: 2005-03-12
Description: paFileDB 3.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) auth.php, (2) login.php, (3) category.php, (4) file.php, (5) team.php, (6) license.php, (7) custom.php, (8) admins.php, or (9) backupdb.php, which reveal the path in a PHP error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4977&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4977&w=2
CVE: CVE-2005-0258
Published: 2005-03-14
Description: Directory traversal vulnerability in (1) usercp_register.php and (2) usercp_avatar.php for phpBB 2.0.11, and possibly other versions, with gallery avatars enabled, allows remote attackers to delete (unlink) arbitrary files via "/../" sequences in the avatarselect parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://www.gentoo.org/security/en/glsa/glsa-200503-02.xml; http://www.idefense.com/application/poi/display?id=205&type=vulnerabilities; http://www.phpbb.com/support/documents.php?mode=changelog