deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-4643
Published: 2005-12-31
Description: SQL injection vulnerability in index.php in Antharia OnContent // CMS allows remote attackers to execute arbitrary SQL commands via the pid parameter.  NOTE: it is not clear, but this might be an application service provider, in which case it might be excluded from CVE.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/ref/20/20888-oncontent-sql.txt; http://secunia.com/advisories/17596; http://www.osvdb.org/20888
CVE: CVE-2005-4644
Published: 2005-12-31
Description: Cross-site scripting (XSS) vulnerability in the HTML WikiProcessor in Edgewall Trac 0.9.2 allows remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag.
CVSS Score: 4.3 (MEDIUM)
References: http://projects.edgewall.com/trac/ticket/2473; http://secunia.com/advisories/18465; http://secunia.com/advisories/18555
CVE: CVE-2005-4645
Published: 2005-12-31
Description: SQL injection vulnerability in index.php in 3CFR allows remote attackers to execute arbitrary SQL commands via the LangueID parameter.
CVSS Score: 7.5 (HIGH)
References: http://hackers.by.lv/showthread.php?p=408; http://osvdb.org/ref/20/20832-3CFR-sql.txt; http://www.osvdb.org/20832
CVE: CVE-2005-4646
Published: 2005-12-31
Description: Unspecified vulnerability in index.php in PEARLINGER Pearl Forums 2.4 allows remote attackers to include arbitrary files via the mode parameter, possibly due to a directory traversal vulnerability.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17533; http://www.osvdb.org/20849; http://www.securityfocus.com/bid/15433
CVE: CVE-2005-4647
Published: 2005-12-31
Description: Multiple SQL injection vulnerabilities in PEARLINGER Pearl Forums 2.4 allow remote attackers to execute arbitrary SQL commands via the (1) forumsId and (2) topicId parameters in index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17533; http://www.osvdb.org/20848; http://www.securityfocus.com/bid/15425
CVE: CVE-2005-4648
Published: 2005-12-31
Description: Buffer overflow in Illustrate dBpowerAMP Music Converter 11.5 and earlier, possibly including (1) MusicConverter.exe, (2) playlist.exe, and (3) amp.exe, allows user-assisted attackers to cause a denial of service or execute arbitrary code via a .m3u playlist with a long entry, possibly involving large field names, as demonstrated by SecuBox.Labs.m3u.  NOTE: this issue might be the same as the .m3u vulnerability in CVE-2004-1569, but if so, then CD:SF-LOC suggests creating a different identifier since the .m3u issue would affect different versions than the .pls issue.
CVSS Score: 5.1 (MEDIUM)
References: http://secubox.shadock.net/dBpowerAMP_Music_Converter_v11.5_Local_Buffer_Overflow_Issue.html; http://securitytracker.com/id?1015415; http://secubox.shadock.net/dBpowerAMP_Music_Converter_v11.5_Local_Buffer_Overflow_Issue.html
CVE: CVE-2005-4649
Published: 2005-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Advanced Guestbook 2.2 and 2.3.1 allow remote attackers to inject arbitrary web script or HTML via (1) the entry parameter in index.php and (2) the gb_id parameter in comment.php.  NOTE: The index.php/entry vector might be resultant from CVE-2005-1548.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-12/1230.html; http://www.morx.org/guestbook.txt; http://www.osvdb.org/22188
CVE: CVE-2005-4650
Published: 2005-12-31
Description: Joomla! 1.03 does not restrict the number of "Search" Mambots, which allows remote attackers to cause a denial of service (resource consumption) via a large number of Search Mambots.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770, CWE-770
References: http://secunia.com/advisories/17675; http://www.joomla.org/content/view/499/66/; http://www.osvdb.org/21041
CVE: CVE-2005-4651
Published: 2005-12-31
Description: SQL injection vulnerability in index.php in AlstraSoft EPay Pro 2.0 allows remote attackers to execute arbitrary SQL commands via the pmodule parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://pridels0.blogspot.com/2005/11/epay-pro-pmodule-sql-injection.html; http://www.osvdb.org/21291; http://pridels0.blogspot.com/2005/11/epay-pro-pmodule-sql-injection.html
CVE: CVE-2005-4652
Published: 2005-12-31
Description: SQL injection vulnerability in PHlyMail 3.02.01 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://phlymail.de/forum/viewtopic.php?t=842; http://secunia.com/advisories/18536; http://www.osvdb.org/20976
CVE: CVE-2005-4653
Published: 2005-12-31
Description: Unspecified vulnerability in ss.php in AL-Caricatier 2.5 and earlier allows remote attackers to bypass login authentication by requesting view_caricatier.php, and then requesting any file in the admin directory with a cookie_username=admin argument.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0483.html; http://secunia.com/advisories/17292; http://www.securityfocus.com/bid/15162
CVE: CVE-2005-4654
Published: 2005-12-31
Description: Multiple unspecified vulnerabilities in Oracle for OpenView (OfO) 8.1.7, 9.1.01, and 9.2, and OfO for Linux, allow remote attackers to have an unknown impact via unknown attack vectors.  NOTE: because of the lack of details in the vendor advisory, it is unclear which set of existing CVEs this advisory might refer to.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/17313; http://www.vupen.com/english/advisories/2005/2196; http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBMA01235
CVE: CVE-2005-4655
Published: 2005-12-31
Description: Cross-site scripting (XSS) vulnerability in submit.php in PHP-Fusion 6.0.204 allows remote attackers to inject arbitrary web script or HTML via nested tags in the news_body parameter, as demonstrated by elements such as "<me<meta>ta" and "<sc<script>ript>".
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2005-10/0272.html; http://secunia.com/advisories/17312; http://securityreason.com/securityalert/106
CVE: CVE-2005-4656
Published: 2005-12-31
Description: SQL injection vulnerability in index.php in TClanPortal 1.1.3 and earlier allows remote attackers to execute arbitrary SQL commands, and retrieve all usernames and passwords, via the id parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/TClanPortal_sql_inj.pl; http://secunia.com/advisories/17324; http://www.osvdb.org/20305
CVE: CVE-2005-4657
Published: 2005-12-31
Description: Ocean12 Calendar Manager Pro 1.01 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to /admin/view.asp.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/15329; http://www.securityfocus.com/bid/15329
CVE: CVE-2005-4658
Published: 2005-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in ASP-Programmers.com ASPKnowledgebase allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in the administrative interface.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/lists/bugtraq/2005/Nov/0122.html; http://secunia.com/advisories/17517; http://www.osvdb.org/20713
CVE: CVE-2005-4659
Published: 2005-12-31
Description: IPCop (aka IPCop Firewall) before 1.4.10 has world-readable permissions for the backup.key file, which might allow local users to overwrite system configuration files and gain privileges by creating a malicious encrypted backup archive owned by "nobody", then executing ipcoprscfg to restore from this backup.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/17513/; http://sourceforge.net/project/shownotes.php?release_id=369759; http://sourceforge.net/tracker/index.php?func=detail&aid=1344032&group_id=40604&atid=428516
CVE: CVE-2005-4660
Published: 2005-12-31
Description: Race condition in IPCop (aka IPCop Firewall) before 1.4.10 might allow local users to overwrite system configuration files and gain privileges by replacing a backup archive during the time window when the archive is owned by "nobody" but not yet encrypted, then executing ipcoprscfg to restore from this backup.
CVSS Score: 1.2 (LOW)
References: http://secunia.com/advisories/17513/; http://sourceforge.net/tracker/index.php?func=detail&aid=1344047&group_id=40604&atid=428516; http://www.securityfocus.com/bid/15378
CVE: CVE-2005-4661
Published: 2005-12-31
Description: The notifyendsubs cron job in Campsite before 2.3.3 sends an e-mail message containing a certain unencrypted MySQL password, which allows remote attackers to sniff the password.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17528; http://sourceforge.net/project/shownotes.php?release_id=367403&group_id=66936; http://www.osvdb.org/20698
CVE: CVE-2005-4662
Published: 2005-12-31
Description: Multiple SQL injection vulnerabilities in OcoMon 1.20, and possibly earlier versions, allow remote attackers to execute arbitrary SQL commands via unknown attack vectors in an unspecified input form, a different vulnerability than CVE-2005-4664.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17470; http://sourceforge.net/project/showfiles.php?group_id=45554; http://sourceforge.net/project/shownotes.php?release_id=369163
CVE: CVE-2005-4663
Published: 2005-12-31
Description: Cross-site scripting (XSS) vulnerability in OcoMon 1.20, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/17470; http://sourceforge.net/project/showfiles.php?group_id=45554; http://sourceforge.net/project/shownotes.php?release_id=369163
CVE: CVE-2005-4664
Published: 2005-12-31
Description: SQL injection vulnerability in OcoMon 1.21, and possibly other versions, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the logon page, a different vulnerability than CVE-2005-4662.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17470; http://sourceforge.net/project/showfiles.php?group_id=45554; http://www.osvdb.org/20751
CVE: CVE-2005-4665
Published: 2005-12-31
Description: Cross-site scripting (XSS) vulnerability in PunBB 1.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via Javascript contained in nested, malformed BBcode url tags.
CVSS Score: 4.3 (MEDIUM)
References: http://punbb.org/changelogs/1.2.6_to_1.2.7.txt; http://secunia.com/advisories/16775; http://www.osvdb.org/19382
CVE: CVE-2005-4666
Published: 2005-12-31
Description: Cross-site scripting (XSS) vulnerability in PHlyMail before 3.3 Beta1 allows remote attackers to inject arbitrary Javascript via unknown attack vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://phlymail.de/forum/viewtopic.php?t=842; http://secunia.com/advisories/18536; http://www.osvdb.org/20975
CVE: CVE-2005-4667
Published: 2005-12-31
Description: Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument.  NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.
CVSS Score: 3.7 (LOW)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0930.html; http://secunia.com/advisories/25098; http://www.debian.org/security/2006/dsa-1012
CVE: CVE-2005-4668
Published: 2005-12-31
Description: The embedded HSQLDB in ParosProxy before 3.2.7, when running with JDK 1.4.2 before 1.4.2_08, allows local users to execute arbitrary comands via crafted SQL commands that interact with HSQLDB through JDBC, a similar vulnerability to CVE-2003-0845.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2005-11/0042.html; http://archives.neohapsis.com/archives/sf/pentest/2005-11/0048.html; http://securityreason.com/securityalert/147
CVE: CVE-2005-4669
Published: 2005-12-31
Description: SQL injection vulnerability in RT Internet Solutions (RTIS) WebAdmin allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2005-10/0170.html; http://www.osvdb.org/20327; http://archives.neohapsis.com/archives/bugtraq/2005-10/0170.html
CVE: CVE-2005-4670
Published: 2005-12-31
Description: Cross-site scripting (XSS) vulnerability in message.php in CityPost Automated Link Exchange (LNKX) allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/15009; http://securitytracker.com/id?1013752; http://www.osvdb.org/15676
CVE: CVE-2005-4671
Published: 2005-12-31
Description: Cross-site scripting (XSS) vulnerability in simple-upload-53.php in CityPost Simple PHP Upload 5.3 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1013749; http://www.securityfocus.com/bid/13261; https://exchange.xforce.ibmcloud.com/vulnerabilities/20164
CVE: CVE-2005-4672
Published: 2005-12-31
Description: Cross-site scripting (XSS) vulnerability in image-editor-52/index.php in CityPost Simple Image-Editor 0.52 allows remote attackers to inject arbitrary web script or HTML via the (1) m1, (2) m2, (3) m3, (4) imgsrc, and (5) m4 parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/15010; http://securitytracker.com/id?1013751; http://www.securityfocus.com/bid/13260
CVE: CVE-2005-4673
Published: 2005-12-31
Description: ioFTPD 0.5.84 u responds with different messages depending on whether or not a username exists, which allows remote attackers to enumerate valid usernames.
CVSS Score: 5.0 (MEDIUM)
References: http://www.critical.lt/?vulnerabilities/119; http://www.osvdb.org/22709; http://www.security.nnov.ru/Kdocument79.html
CVE: CVE-2005-4674
Published: 2005-12-31
Description: Multiple SQL injection vulnerabilities in list.php in Complete PHP Counter allow remote attackers to execute arbitrary SQL commands via the (1) c or (2) s parameter.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1015054; http://www.osvdb.org/20084; http://www.osvdb.org/20085
CVE: CVE-2005-4675
Published: 2005-12-31
Description: Cross-site scripting (XSS) vulnerability in list.php in Complete PHP Counter allows remote attackers to inject arbitrary web script or HTML via the c parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1015054; http://www.securityfocus.com/bid/15112; https://exchange.xforce.ibmcloud.com/vulnerabilities/22759
CVE: CVE-2005-4676
Published: 2005-12-31
Description: Buffer overflow in Andreas Huggel Exiv2 before 0.9 does not null terminate strings before calling the sscanf function, which allows remote attackers to cause a denial of service (application crash) via images with crafted IPTC metadata.
CVSS Score: 5.0 (MEDIUM)
References: http://dev.robotbattle.com/mantis/bug_view_advanced_page.php?bug_id=447; http://home.arcor.de/ahuggel/exiv2/changelog.html; http://secunia.com/advisories/18619
CVE: CVE-2005-4677
Published: 2005-12-31
Description: SQL injection vulnerability in additional_images.php (aka the Additional Images module) before 1.14 in osCommerce allows remote attackers to execute arbitrary SQL commands via the products_id parameter to product_info.php.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0124.html; http://secunia.com/advisories/17082; http://www.oscommerce.com/community/contributions%2C1032
CVE: CVE-2005-4678
Published: 2005-12-31
Description: Apple Safari 2.0.2 (aka 416.12) allows remote attackers to spoof the URL in the status bar via the title in an image in a link to a trusted site within a form to the malicious site.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17618; http://secunia.com/advisories/17618
CVE: CVE-2005-4679
Published: 2005-12-31
Description: Internet Explorer 6 for Windows XP Service Pack 2 allows remote attackers to spoof the URL in the status bar via the title in an image in a link to a trusted site within a form to the malicious site.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17565; http://secunia.com/advisories/17565
CVE: CVE-2005-4680
Published: 2005-12-31
Description: Sophos Anti-Virus before 4.02, 4.5.x before 4.5.9, 4.6.x before 4.6.9, and 5.x before 5.1.4 allow remote attackers to hide arbitrary files and data via crafted ARJ archives, which are not properly scanned.
CVSS Score: 5.0 (MEDIUM)
References: http://www.sophos.com/support/knowledgebase/article/3803.html; http://www.vupen.com/english/advisories/2006/0347; https://exchange.xforce.ibmcloud.com/vulnerabilities/24345
CVE: CVE-2005-4681
Published: 2005-12-31
Description: Buffer overflow in mIRC 5.91, 6.03, 6.12, and 6.16 allows local users to execute arbitrary code via a long string that is entered after reaching the DCC Get Folder Dialog.  NOTE: this issue has been disputed by the vendor, saying "as far as I can tell, this is neither an exploit nor a vulnerability. The above report describes a local bug in mIRC."  It could be that this is only exploitable by the user of the application, and thus would not cross privilege boundaries unless under an otherwise restrictive environment such as a kiosk
CVSS Score: 4.6 (MEDIUM)
References: http://seclists.org/lists/bugtraq/2005/Dec/0263.html; http://securityreason.com/securityalert/285; http://trout.snt.utwente.nl/ubbthreads/showflat.php?Cat=0&Number=146129&an=0&page=0#146129
CVE: CVE-2005-4682
Published: 2005-12-31
Description: Cross-site scripting (XSS) vulnerability in error.asp in AudienceView allows remote attackers to inject arbitrary web script or HTML via the TSerrorMessage parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/17582; http://www.osvdb.org/20880; http://www.vupen.com/english/advisories/2005/2449
CVE: CVE-2005-4683
Published: 2005-12-31
Description: PADL MigrationTools 46, when a failure occurs, stores contents of /etc/shadow in a world-readable /tmp/nis.$$.ldif file, and possibly other sensitive information in other temporary files, which are not properly managed by (1) migrate_all_online.sh, (2) migrate_all_offline.sh, (3) migrate_all_netinfo_online.sh, (4) migrate_all_netinfo_offline.sh, (5) migrate_all_nis_online.sh, (6) migrate_all_nis_offline.sh, (7) migrate_all_nisplus_online.sh, and (8) migrate_all_nisplus_offline.sh.
CVSS Score: 2.1 (LOW)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=338920; http://secunia.com/advisories/17530; http://www.osvdb.org/20839
CVE: CVE-2005-4684
Published: 2005-12-31
Description: Konqueror can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers to trick a user into accepting a cookie for a hostname formed via search-list expansion of the hostname entered by the user, or steal a cookie for an expanded hostname, as demonstrated by an attacker who operates an ap1.com Internet web site to steal cookies associated with an ap1.com.example.com intranet web site.
CVSS Score: 6.4 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0123.html; http://www.securityfocus.com/bid/15331; https://exchange.xforce.ibmcloud.com/vulnerabilities/25291
CVE: CVE-2005-4685
Published: 2005-12-31
Description: Firefox and Mozilla can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers to trick a user into accepting a cookie for a hostname formed via search-list expansion of the hostname entered by the user, or steal a cookie for an expanded hostname, as demonstrated by an attacker who operates an ap1.com Internet web site to steal cookies associated with an ap1.com.example.com intranet web site.
CVSS Score: 6.4 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0123.html; http://www.securityfocus.com/bid/15331; https://exchange.xforce.ibmcloud.com/vulnerabilities/25291
CVE: CVE-2005-4686
Published: 2005-12-31
Description: PunBB 1.2.9, when used alone or with F-ART BLOG:CMS, includes config.php before calling the unregister_globals function, which allows attackers to obtain unspecified sensitive information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17425; http://secunia.com/advisories/17433; http://www.punbb.org/changelogs/1.2.9_to_1.2.10.txt
CVE: CVE-2005-4687
Published: 2005-12-31
Description: PunBB 1.2.9, used alone or with F-ART BLOG:CMS, may trust a client's IP address as specified in the X-Forwarded-For HTTP header rather than the TCP/IP stack, which allows remote attackers to misrepresent their IP address by sending a modified header.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17425; http://secunia.com/advisories/17433; http://www.punbb.org/changelogs/1.2.9_to_1.2.10.txt
CVE: CVE-2005-4688
Published: 2005-12-31
Description: PunBB 1.2.9 does not require password entry when changing the e-mail address in an account's profile, which might allow an attacker to make an address change via a hijacked login session.
CVSS Score: 5.0 (MEDIUM)
References: http://www.punbb.org/changelogs/1.2.9_to_1.2.10.txt; http://www.punbb.org/changelogs/1.2.9_to_1.2.10.txt
CVE: CVE-2005-4689
Published: 2005-12-31
Description: Six Apart Movable Type 3.16 stores account names and password hashes in a cookie, which allows remote attackers to login to an account by sniffing the cookie.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0091.html; http://www.sixapart.com/movabletype/docs/3.2/h_changelog/3_2.html; http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0091.html
CVE: CVE-2005-4690
Published: 2005-12-31
Description: Six Apart Movable Type 3.16 allows local users with blog-creation privileges to create or overwrite arbitrary files of certain types (such as HTML and image files) by selecting an arbitrary directory as a blog's top-level directory.  NOTE: this issue can be used in conjunction with CVE-2005-3102 to create or overwrite arbitrary files of all types.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0091.html; http://secunia.com/advisories/16899; http://www.securityfocus.com/bid/15302
CVE: CVE-2005-4691
Published: 2005-12-31
Description: imake in NetBSD before 2.0.3, NetBSD-current before 12 September 2005, certain versions of X.Org, and certain versions of XFree86 allows local users to overwrite arbitrary files via a symlink attack on the temporary file for the file.0 target, which is used for a pre-formatted manual page.
CVSS Score: 2.1 (LOW)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2005-009.txt.asc; http://mail-index.netbsd.org/netbsd-announce/2005/10/31/0000.html; http://mail-index.netbsd.org/source-changes/2005/09/12/0043.html
CVE: CVE-2005-4692
Published: 2005-12-31
Description: Unspecified vulnerability in mroovca stats (mroovcastats) before 0.4.5b has unknown attack vectors and impact, related to cookies.
CVSS Score: 7.5 (HIGH)
References: http://sourceforge.net/project/shownotes.php?group_id=113650&release_id=381543; http://www.osvdb.org/22123; http://sourceforge.net/project/shownotes.php?group_id=113650&release_id=381543