deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-2778
Published: 2005-09-02
Description: SQL injection vulnerability in member.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL statements via the fid parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0050&w=2; http://www.securityfocus.com/bid/14684; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0050&w=2
CVE: CVE-2005-2779
Published: 2005-09-02
Description: The iTAN Online-Banking Security System allows remote attackers to obtain TAN numbers via a man-in-the-middle (MITM) attack while the transaction is taking place, which facilitates a "phishing" attack.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1687&w=2; http://www.redteam-pentesting.de/advisories/rt-sa-2005-014.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1687&w=2
CVE: CVE-2005-2780
Published: 2005-09-02
Description: Cross-site scripting (XSS) vulnerability in Land Down Under (LDU) allows remote attackers to inject arbitrary web script or HTML via a signature.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5818&w=2; http://www.securityfocus.com/bid/14677; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5818&w=2
CVE: CVE-2005-2781
Published: 2005-09-02
Description: The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitrary PHP code via a file with a .php extension that contains image data followed by PHP code.
CVSS Score: 7.5 (HIGH)
References: http://fudforum.org/forum/index.php?t=msg&th=5470&start=0&; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3406&w=2; http://secunia.com/advisories/16627/
CVE: CVE-2005-2782
Published: 2005-09-02
Description: PHP remote file inclusion vulnerability in al_initialize.php for AutoLinks Pro 2.1 allows remote attackers to execute arbitrary PHP code via an "ftp://" URL in the alpath parameter, which bypasses the incomplete blacklist that only checks for "http" and "https" URLs.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6486&w=2; http://secunia.com/advisories/16620/; http://www.securityfocus.com/bid/14686
CVE: CVE-2005-2783
Published: 2005-09-02
Description: Cross-site scripting (XSS) vulnerability in PHP-Fusion 6.00.107 and earlier allows remote attackers to inject arbitrary web script or HTML via nested, malformed URL BBCode tags.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3267&w=2; http://secunia.com/advisories/16632/; http://www.securityfocus.com/bid/14688
CVE: CVE-2005-2784
Published: 2005-09-02
Description: SQL injection vulnerability in the login function for the administration login panel in cosmoshop 8.10.78 allows remote attackers to execute arbitrary SQL commands and bypass authentication via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0093&w=2; http://secunia.com/advisories/16625/; http://www.securityfocus.com/bid/14689
CVE: CVE-2005-2785
Published: 2005-09-02
Description: cosmoshop 8.10.78 and earlier stores passwords in plaintext in the database, which allows local users to obtain sensitive information.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0093&w=2; http://secunia.com/advisories/16625/; https://exchange.xforce.ibmcloud.com/vulnerabilities/22081
CVE: CVE-2005-2786
Published: 2005-09-02
Description: Directory traversal vulnerability in bestmail_edit.cgi in cosmoshop 8.10.78 and earlier allows remote administrators to read arbitrary files via ".." sequences in the file parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0093&w=2; http://secunia.com/advisories/16625/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0093&w=2
CVE: CVE-2005-2787
Published: 2005-09-02
Description: comment_delete_cgi.php in Simple PHP Blog allows remote attackers to delete arbitrary files via the comment parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0762&w=2; http://secunia.com/advisories/16616/; http://www.ftusecurity.com/pub/sphpblog_vulns
CVE: CVE-2005-2788
Published: 2005-09-02
Description: Multiple SQL injection vulnerabilities in Land Down Under (LDU) 801 and earlier allow remote attackers to execute arbitrary SQL commands via the c parameter to (1) events.php, (2) index.php, or (3) list.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5945&w=2; http://www.securityfocus.com/bid/14685; https://exchange.xforce.ibmcloud.com/vulnerabilities/22047
CVE: CVE-2005-2789
Published: 2005-09-02
Description: BFCommand & Control Server Manager BFCC 1.22_A and earlier, and BFVCC 2.14_B and earlier, allows remote attackers to bypass authentication via (1) an unknown attack vector or (2) a NULL (0x00) as a username.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/bfccown-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8828&w=2; http://secunia.com/advisories/16629/
CVE: CVE-2005-2790
Published: 2005-09-02
Description: BFCommand & Control Server Manager BFCC 1.22_A and earlier, and BFVCC 2.14_B and earlier, relies on the client to enforce permissions and perform actions such as disconnections, which allows remote attackers to bypass administrative restrictions via a modified client.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/bfccown-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8828&w=2; http://secunia.com/advisories/16629/
CVE: CVE-2005-2791
Published: 2005-09-02
Description: BFCommand & Control Server Manager BFCC 1.22_A and earlier, and BFVCC 2.14_B and earlier, allows remote attackers to cause a denial of service (refused new connections) via a series of connections and disconnections without sending the login command.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/bfccown-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8828&w=2; http://secunia.com/advisories/16629/
CVE: CVE-2005-2792
Published: 2005-09-02
Description: Directory traversal vulnerability in welcome.php in phpLDAPadmin 0.9.6 and 0.9.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the custom_welcome_page parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9235&w=2; http://secunia.com/advisories/16617/; http://www.rgod.altervista.org/phpldap.html
CVE: CVE-2005-2793
Published: 2005-09-02
Description: PHP remote file inclusion vulnerability in welcome.php in phpLDAPadmin 0.9.6 and 0.9.7 allows remote attackers to execute arbitrary PHP code via the custom_welcome_page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9235&w=2; http://secunia.com/advisories/16617/; http://www.rgod.altervista.org/phpldap.html
CVE: CVE-2005-2797
Published: 2005-09-06
Description: OpenSSH 4.0, and other versions before 4.2, does not properly handle dynamic port forwarding ("-D" option) when a listen address is not provided, which may cause OpenSSH to enable the GatewayPorts functionality.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.11/SCOSA-2006.11.txt; ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.53/SCOSA-2005.53.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4049&w=2
CVE: CVE-2005-2798
Published: 2005-09-06
Description: sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, allows GSSAPI credentials to be delegated to clients who log in using non-GSSAPI methods, which could cause those credentials to be exposed to untrusted users or hosts.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.53/SCOSA-2005.53.txt; http://lists.suse.com/archive/suse-security-announce/2006-Feb/0001.html; http://secunia.com/advisories/16686
CVE: CVE-2005-2800
Published: 2005-09-06
Description: Memory leak in the seq_file implementation in the SCSI procfs interface (sg.c) in Linux kernel 2.6.13 and earlier allows local users to cause a denial of service (memory consumption) via certain repeated reads from the /proc/scsi/sg/devices file, which is not properly handled when the next() iterator returns NULL or an error.
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: http://secunia.com/advisories/17826; http://secunia.com/advisories/17918; http://secunia.com/advisories/18510
CVE: CVE-2005-2801
Published: 2005-09-06
Description: xattr.c in the ext2 and ext3 file system code for Linux kernel 2.6 does not properly compare the name_index fields when sharing xattr blocks, which could prevent default ACLs from being applied.
CVSS Score: 7.5 (HIGH)
CWE: CWE-697
References: http://acl.bestbits.at/pipermail/acl-devel/2005-February/001848.html; http://lists.debian.org/debian-kernel/2005/08/msg00238.html; http://secunia.com/advisories/17073
CVE: CVE-2005-2802
Published: 2005-09-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-2872, CVE-2005-2873.  Reason: this candidate's description originally combined two separate issues.  Notes: All CVE users should consult CVE-2005-2872 and CVE-2005-2873 to determine the appropriate identifier for the issue
CVE: CVE-2005-2336
Published: 2005-09-06
Description: Cross-site scripting (XSS) vulnerability in Hiki 0.8.0 to 0.8.2 allows remote attackers to inject arbitrary web script or HTML via "missing pages" in which the page name is not properly escaped, a different vulnerability than CVE-2005-2803.
CVSS Score: 4.3 (MEDIUM)
References: http://hikiwiki.org/en/advisory20050804.html; http://jvn.jp/en/jp/JVN38138980/index.html; http://secunia.com/advisories/17075
CVE: CVE-2005-2803
Published: 2005-09-06
Description: Cross-site scripting (XSS) vulnerability in Hiki 0.8.1 to 0.8.2 allows remote attackers to inject arbitrary web script or HTML via a page name in a Login link, a different vulnerability than CVE-2005-2336.
CVSS Score: 4.3 (MEDIUM)
References: http://hikiwiki.org/en/advisory20050804.html; http://jvn.jp/jp/JVN%[PII_REDACTED]; http://secunia.com/advisories/17075
CVE: CVE-2005-2805
Published: 2005-09-06
Description: forum_post.php in e107 0.6 allows remote attackers to post to non-existent forums by modifying the forum number.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7131&w=2; http://www.securityfocus.com/bid/14699; https://exchange.xforce.ibmcloud.com/vulnerabilities/22059
CVE: CVE-2005-2806
Published: 2005-09-06
Description: client.cpp in BNBT EasyTracker 7.7r3.2004.10.27 and earlier allows remote attackers to cause a denial of service (application hang) via an HTTP header containing only a ":" (colon), possibly leading to an integer signedness error due to a missing field name or value.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7451&w=2; http://secunia.com/advisories/16613/; http://secway.org/advisory/AD20050830.txt
CVE: CVE-2005-2494
Published: 2005-09-06
Description: kcheckpass in KDE 3.2.0 up to 3.4.2 allows local users to gain root access via a symlink attack on lock files.
CVSS Score: 7.2 (HIGH)
References: ftp://ftp.kde.org/pub/kde/security_patches/post-3.4.2-kdebase-kcheckpass.diff; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5453&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8169&w=2
CVE: CVE-2005-2656
Published: 2005-09-06
Description: Polygen before 1.0.6 generates precompiled grammar objects with world-writable permissions, which allows local users to cause a denial of service (disk consumption) and possibly perform other unauthorized activities.
CVSS Score: 2.1 (LOW)
References: http://www.debian.org/security/2005/dsa-794; http://www.securityfocus.com/bid/14722; http://www.debian.org/security/2005/dsa-794
CVE: CVE-2005-2700
Published: 2005-09-06
Description: ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
CVSS Score: 10.0 (HIGH)
References: http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html; http://marc.info/?l=apache-modssl&m=[PII_REDACTED]3897&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8607&w=2
CVE: CVE-2005-2763
Published: 2005-09-06
Description: Multiple format string vulnerabilities in OpenTTD before 0.4.0.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=102631; http://www.gentoo.org/security/en/glsa/glsa-200509-03.xml; http://www.vupen.com/english/advisories/2005/1640
CVE: CVE-2005-2794
Published: 2005-09-07
Description: store.c in Squid 2.5.STABLE10 and earlier allows remote attackers to cause a denial of service (crash) via certain aborted requests that trigger an assert error related to STORE_PENDING.
CVSS Score: 5.0 (MEDIUM)
References: http://fedoranews.org/updates/FEDORA--.shtml; http://secunia.com/advisories/16977; http://secunia.com/advisories/17027
CVE: CVE-2005-2796
Published: 2005-09-07
Description: The sslConnectTimeout function in ssl.c for Squid 2.5.STABLE10 and earlier allows remote attackers to cause a denial of service (segmentation fault) via certain crafted requests.
CVSS Score: 5.0 (MEDIUM)
References: http://fedoranews.org/updates/FEDORA--.shtml; http://secunia.com/advisories/16977; http://secunia.com/advisories/17027
CVE: CVE-2005-2807
Published: 2005-09-07
Description: frox 0.7.18, when running setuid root, does not properly drop privileges when reading a configuration file, which allows local users to read portions of arbitrary files via the -f command line option.
CVSS Score: 7.2 (HIGH)
References: http://www.securityfocus.com/archive/1/409667; http://www.securityfocus.com/bid/14711; http://www.securityfocus.com/archive/1/409667
CVE: CVE-2005-2808
Published: 2005-09-07
Description: frox 0.7.16 and 0.7.17 does not properly parse certain Deny ACLs, which might allow attackers to bypass intended restrictions and access blocked hosts.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/14182; http://securitytracker.com/id?1013089; http://sourceforge.net/mailarchive/forum.php?thread_id=6492850&forum_id=1822
CVE: CVE-2005-2809
Published: 2005-09-07
Description: silc daemon (silcd.c) in Secure Internet Live Conferencing (SILC) 1.0 and earlier allows local users to overwrite arbitrary files via a symlink attack on the silcd.[PID].stats temporary file.
CVSS Score: 2.1 (LOW)
References: http://bugs.gentoo.org/show_bug.cgi?id=94587; http://secunia.com/advisories/16659/; http://www.securityfocus.com/archive/1/409672
CVE: CVE-2005-2810
Published: 2005-09-07
Description: Multiple stack-based buffer overflows in urban before 1.5.3 allow local users to gain privileges via a long HOME environment variable to (1) config.cc, (2) game.cc, (3) highscor.cc, or (4) meny.cc.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9036&w=2; http://securitytracker.com/id?1014848; http://www.freebsd.org/cgi/cvsweb.cgi/ports/games/urban/files/
CVE: CVE-2005-2811
Published: 2005-09-07
Description: Untrusted search path vulnerability in Net-SNMP 5.2.1.2 and earlier, on Gentoo Linux, installs certain Perl modules with an insecure DT_RPATH, which could allow local users to gain privileges.
CVSS Score: 4.6 (MEDIUM)
References: http://www.gentoo.org/security/en/glsa/glsa-200509-05.xml; http://www.gentoo.org/security/en/glsa/glsa-200509-05.xml
CVE: CVE-2005-2812
Published: 2005-09-07
Description: man2web allows remote attackers to execute arbitrary commands via -P arguments.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/14747; http://www.securityfocus.com/bid/14747
CVE: CVE-2005-2813
Published: 2005-09-07
Description: Directory traversal vulnerability in FlatNuke 2.5.6 and possibly earlier allows remote attackers to read arbitrary files via ".." sequences and "%00" (trailing null byte) characters in the id parameter to the read mod in index.php.
CVSS Score: 5.0 (MEDIUM)
References: http://seclists.org/lists/bugtraq/2005/Aug/0440.html; http://secunia.com/advisories/16650/; http://securitytracker.com/id?1014824
CVE: CVE-2005-2814
Published: 2005-09-07
Description: Cross-site scripting (XSS) vulnerability in FlatNuke 2.5.6 allows remote attackers to inject arbitrary web script or HTML via the usr parameter in a vis_reg operation to index.php.
CVSS Score: 4.3 (MEDIUM)
References: http://seclists.org/lists/bugtraq/2005/Aug/0440.html; http://securitytracker.com/id?1014824; http://www.securityfocus.com/bid/14704
CVE: CVE-2005-2815
Published: 2005-09-07
Description: print.php in FlatNuke 2.5.6 allows remote attackers to obtain sensitive information (path disclosure on error) or cause a denial of service (resource consumption) via an MS-DOS device name in the news parameter to print.php, such as (1) AUX, (2) CON, (3) PRN, (4) COM1, or (5) LPT1.
CVSS Score: 6.4 (MEDIUM)
References: http://seclists.org/lists/bugtraq/2005/Aug/0440.html; http://securitytracker.com/id?1014824; https://exchange.xforce.ibmcloud.com/vulnerabilities/22153
CVE: CVE-2005-2816
Published: 2005-09-07
Description: Cross-site scripting (XSS) vulnerability in Greymatter allows remote attackers to inject arbitrary web script or HTML via a post comment, which is recorded in a log file but not properly handled when the administrator uses "View Control Panel Log" to read the log file.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8929&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8929&w=2
CVE: CVE-2005-2817
Published: 2005-09-07
Description: Simple Machines Forum (SMF) 1-0-5 and earlier supports the use of URLs for avatar images, which allows remote attackers to monitor sensitive information of forum visitors such as IP address and user agent, as demonstrated using a PHP script on a malicious server.
CVSS Score: 5.0 (MEDIUM)
References: http://rgod.altervista.org/smf105.html; http://seclists.org/lists/bugtraq/2005/Aug/0438.html; http://secunia.com/advisories/16646
CVE: CVE-2005-2818
Published: 2005-09-07
Description: Cross-site scripting (XSS) vulnerability in DownFile 1.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter to (1) email.php,(2) index.php, (3) del.php, or (4) add_form.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/16630; http://securitytracker.com/id?1014827; http://www.securityfocus.com/bid/14713
CVE: CVE-2005-2819
Published: 2005-09-07
Description: DownFile 1.3 allows remote attackers to gain administrator privileges via a direct request to (1) update.php, (2) del.php, and (3) add_form.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/16630; http://securitytracker.com/id?1014827; http://www.securityfocus.com/bid/14714
CVE: CVE-2005-2820
Published: 2005-09-07
Description: Cross-site scripting (XSS) vulnerability in SqWebMail 5.0.4 allows remote attackers to inject arbitrary web script or HTML via an e-mail message containing Internet Explorer "Conditional Comments" such as "[if]" and "[endif]".
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0475&w=2; http://secunia.com/advisories/16704/; http://secunia.com/advisories/17156
CVE: CVE-2005-2836
Published: 2005-09-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to register.php or (2) a signature of a logged-in user in "My Control Center," which is not properly handled by control.php.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0018.html; http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0048.html; http://secunia.com/advisories/16667
CVE: CVE-2005-2837
Published: 2005-09-07
Description: Multiple eval injection vulnerabilities in PlainBlack Software WebGUI before 6.7.3 allow remote attackers to execute arbitrary Perl code via (1) Help.pm, (2) International.pm, or (3) WebGUI.pm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.plainblack.com/getwebgui/advisories/security-exploit-found-in-6.x-versions; http://www.securityfocus.com/bid/14732; http://www.plainblack.com/getwebgui/advisories/security-exploit-found-in-6.x-versions
CVE: CVE-2005-2838
Published: 2005-09-07
Description: SQL injection vulnerability in login.php in myBloggie 2.1.3-beta and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
References: http://glide.stanford.edu/yichen/research/sec.pdf; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1963&w=2; http://mywebland.com/forums/showtopic.php?t=399
CVE: CVE-2005-2839
Published: 2005-09-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in MAXdev MD-Pro 1.0.72 allow remote attackers to inject arbitrary web script or HTML via (1) dl-search.php or (2) wl-search.php.
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1014847; http://securitytracker.com/id?1014847
CVE: CVE-2005-2840
Published: 2005-09-07
Description: Multiple unknown vulnerabilities in MAXdev MD-Pro 1.0.72 and earlier have unknown impact and unspecified attack vectors, in one or more of the (1) Download, (2) Search, (3) Web links, (4) Blocks, (5) Messages, (6) News, (7) Comments, (8) Settings, (9) Stats or (10) subjects modules.
CVSS Score: 10.0 (HIGH)
References: http://www.maxdev.com/index.php?module=News&catid=&topic=2; http://www.maxdev.com/index.php?module=News&catid=&topic=2
CVE: CVE-2005-2020
Published: 2005-09-08
Description: Directory traversal vulnerability in the web server for 3Com Network Supervisor 5.0.2 allows remote attackers to read arbitrary files via ".." sequences in the URL to TCP port 21700.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16639; http://securitytracker.com/id?1014836; http://www.idefense.com/application/poi/display?id=300&type=vulnerabilities&flashstatus=true
CVE: CVE-2005-2841
Published: 2005-09-08
Description: Buffer overflow in Firewall Authentication Proxy for FTP and/or Telnet Sessions for Cisco IOS 12.2ZH and 12.2ZL, 12.3 and 12.3T, and 12.4 and 12.4T allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted user authentication credentials.
CVSS Score: 7.5 (HIGH)
References: http://www.cisco.com/warp/public/707/cisco-sa-20050907-auth_proxy.shtml; http://www.kb.cert.org/vuls/id/236045; http://www.vupen.com/english/advisories/2005/1669
CVE: CVE-2005-2842
Published: 2005-09-08
Description: Buffer overflow in dwrcs.exe in DameWare Mini Remote Control before 4.9.0 allows remote attackers to execute arbitrary code via the username.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-08/1074.html; http://secunia.com/advisories/16655; http://securitytracker.com/id?1014830
CVE: CVE-2005-2843
Published: 2005-09-08
Description: Helpdesk software Hesk 0.92 does not properly verify usernames and passwords, which allows remote attackers to bypass authentication via a direct request to admin_main.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3213&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7124&w=2; http://secunia.com/advisories/16623/
CVE: CVE-2005-2844
Published: 2005-09-08
Description: Buffer overflow in MMClient.exe in Indiatimes Messenger 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long group name argument to the RenameGroup function in the MMClient.MunduMessenger.1 ActiveX object.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6169&w=2; http://secunia.com/advisories/16633/; http://securitytracker.com/id?1014842
CVE: CVE-2005-2845
Published: 2005-09-08
Description: Ariba Spend Management System sends the username and password to the server in plaintext in a POST request, which allows remote attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9473&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3287&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/22116