deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-3278
Published: 2005-10-23
Description: Integer overflow in the openpsfile function in gsinterf.c for Jan Kybic BitMap Viewer (BMV) 1.2 allows local users to execute arbitrary code via a PostScript (PS) file containing a large number of pages value, which leads to a resultant buffer overflow.
CVSS Score: 7.2 (HIGH)
References: http://felinemenace.org/advisories/bmv_advisory.txt; http://secunia.com/advisories/17266; http://secunia.com/advisories/19029
CVE: CVE-2005-3279
Published: 2005-10-23
Description: Stack-based buffer overflow in the vgasco_printf function in Jan Kybic BitMap Viewer (BMV) 1.2, when compiled with the M_UNIX flag and running setuid, allows local users to gain privileges via a long filename in the -b command line option.
CVSS Score: 7.2 (HIGH)
References: http://felinemenace.org/advisories/bmv_advisory.txt; http://felinemenace.org/advisories/bmv_advisory.txt
CVE: CVE-2005-3280
Published: 2005-10-23
Description: Paros 3.2.5 uses a default password for the "sa" account in the underlying HSQLDB database and does not restrict access to the local machine, which allows remote attackers to gain privileges.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17089; http://secunia.com/advisories/18626; http://www.gentoo.org/security/en/glsa/glsa-200601-15.xml
CVE: CVE-2005-3281
Published: 2005-10-23
Description: Directory traversal vulnerability in NukeFixes 3.1 for PHP-Nuke 7.8 allows remote attackers to include arbitrary files via the file parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17218; http://secunia.com/advisories/17218
CVE: CVE-2005-3282
Published: 2005-10-23
Description: Splatt Forum 3.0 to 3.2 allows remote attackers to bypass authentication via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/15152; http://www.securityfocus.com/bid/15152
CVE: CVE-2005-3283
Published: 2005-10-23
Description: Cross-site scripting (XSS) vulnerability in TikiWiki before 1.9.1.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.gentoo.org/show_bug.cgi?id=109858; http://secunia.com/advisories/17279; http://secunia.com/advisories/17363
CVE: CVE-2005-3284
Published: 2005-10-23
Description: Multiple buffer overflows in AhnLab V3 AntiVirus V3Pro 2004 before 6.0.0.488, V3Net for Windows Server 6.0 before 6.0.0.488, and MyV3, with compressed file scanning enabled, allow remote attackers to execute arbitrary code via crafted (1) ALZ, (2) UUE, or (3) XXE archives.
CVSS Score: 7.5 (HIGH)
References: http://global.ahnlab.com/security/security_advisory002.html; http://secunia.com/advisories/16851; http://secunia.com/secunia_research/2005-48/advisory/
CVE: CVE-2005-3285
Published: 2005-10-23
Description: Cross-site scripting (XSS) vulnerability in comersus_backoffice_searchItemForm.asp in Comersus BackOffice Plus allows remote attackers to inject arbitrary web script or HTML via the (1) forwardTo1, (2) forwardTo2, (3) nameFT1, or (4) nameFT2 parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://lostmon.blogspot.com/2005/10/comersus-backoffice-plus-cross-site.html; http://secunia.com/advisories/17219; http://securitytracker.com/id?1015064
CVE: CVE-2005-3286
Published: 2005-10-23
Description: The FWDRV driver in Kerio Personal Firewall 4.2 and Server Firewall 1.1.1 allows local users to cause a denial of service (crash) by setting the PAGE_NOACCESS or PAGE_GUARD protection on the Page Environment Block (PEB), which triggers an exception, aka the "PEB lockout vulnerability."
CVSS Score: 2.1 (LOW)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/037958.html; http://pb.specialised.info/all/adv/kerio-fwdrv-dos-adv.txt; http://seclists.org/bugtraq/2005/Oct/166
CVE: CVE-2005-3287
Published: 2005-10-23
Description: Incomplete blacklist vulnerability in Mailsite Express allows remote attackers to upload and possibly execute files via attachments with executable extensions such as ASPX, which are not converted to .TXT like other dangerous extensions, and which can be directly requested from the cache directory.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1015063; http://securitytracker.com/id?1015063
CVE: CVE-2005-3288
Published: 2005-10-23
Description: Mailsite Express allows remote attackers to upload and execute files with executable extensions such as ASP by attaching the file using the "compose page" feature, then accessing the file from the cache directory before saving or sending the message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-434
References: http://securitytracker.com/id?1015063; http://securitytracker.com/id?1015063
CVE: CVE-2005-3289
Published: 2005-10-23
Description: LSCFG in IBM AIX 5.2 and 5.3 does not create temporary files securely, which allows local users to corrupt /etc/passwd and possibly other system files via the trace file.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/17202; http://securitytracker.com/id?1015061; http://www-1.ibm.com/support/docview.wss?uid=isg1IY77624
CVE: CVE-2005-3290
Published: 2005-10-23
Description: SQL injection vulnerability in Accelerated Mortgage Manager allows remote attackers to execute arbitrary SQL commands via the password field.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/21581; http://www.securityfocus.com/bid/15097; http://www.osvdb.org/21581
CVE: CVE-2005-3291
Published: 2005-10-23
Description: Stani's Python Editor (SPE) 0.7.5 is installed with world-writable permissions, which allows local users to gain privileges by modifying executable files.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/17224; http://secunia.com/advisories/17241; http://www.gentoo.org/security/en/glsa/glsa-200510-13.xml
CVE: CVE-2005-3292
Published: 2005-10-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in Xeobook 0.93 allow remote attackers to inject arbitrary web script or HTML via Javascript events in tages such as <b>.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/17159; http://www.securityfocus.com/bid/15086; http://secunia.com/advisories/17159
CVE: CVE-2005-3293
Published: 2005-10-23
Description: Xerver 4.17 allows remote attackers to (1) obtain source code of scripts via a request with a trailing "." (dot) or (2) list directory contents via a trailing null character.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17243; http://securitytracker.com/id?1015079; http://www.osvdb.org/20075
CVE: CVE-2005-3266
Published: 2005-10-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-3265.  Reason: this candidate is a duplicate of CVE-2005-3265; after initial reservation, the requester discovered that they had the same cause. Notes: All CVE users should reference CVE-2005-3265 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-3294
Published: 2005-10-23
Description: Typsoft FTP Server 1.11, with "Sub Directory Include" enabled, allows remote attackers to cause a denial of service (crash) by sending multiple RETR commands.  NOTE: it was later reported that 1.10 is also affected.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/17196; http://www.exploit-db.com/exploits/15860; http://www.exploitlabs.com/files/advisories/EXPL-A-2005-016-typsoft-ftpd.txt
CVE: CVE-2005-3295
Published: 2005-10-23
Description: Unspecified vulnerability in HP-UX B.11.23 on Itanium platforms allows local users to cause a denial of service due to a "specific stack size."
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/17195; http://securitytracker.com/id?1015050; http://www.auscert.org.au/render.html?it=5613
CVE: CVE-2005-3296
Published: 2005-10-23
Description: The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in.
CVSS Score: 10.0 (HIGH)
References: http://cert.uni-stuttgart.de/archive/bugtraq/2005/11/msg00126.html; http://securitytracker.com/id?1015158; http://www.frsirt.com/exploits/20051019.hpux_ftpd_preauth_list.pm.php
CVE: CVE-2005-3297
Published: 2005-10-23
Description: Multiple integer overflows in OpenWBEM on SuSE Linux 9 allow remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17176; http://secunia.com/advisories/17244; http://www.novell.com/linux/security/advisories/2005_60_OpenWBEM.html
CVE: CVE-2005-3298
Published: 2005-10-23
Description: Multiple buffer overflows in OpenWBEM on SuSE Linux 9 allow remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17176; http://secunia.com/advisories/17244; http://www.novell.com/linux/security/advisories/2005_60_OpenWBEM.html
CVE: CVE-2005-3299
Published: 2005-10-23
Description: PHP file inclusion vulnerability in grab_globals.lib.php in phpMyAdmin 2.6.4 and 2.6.4-pl1 allows remote attackers to include local files via the $__redirect parameter, possibly involving the subform array.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17137; http://securityreason.com/securityalert/69; http://www.gentoo.org/security/en/glsa/glsa-200510-16.xml
CVE: CVE-2005-3300
Published: 2005-10-23
Description: The register_globals emulation layer in grab_globals.php for phpMyAdmin before 2.6.4-pl3 does not perform safety checks on values in the _FILES array for uploaded files, which allows remote attackers to include arbitrary files by using direct requests to library scripts that do not use grab_globals.php, then modifying certain configuration values for the theme.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0478.; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4699&w=2; http://secunia.com/advisories/17289/
CVE: CVE-2005-3301
Published: 2005-10-24
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-pl3 allow remote attackers to inject arbitrary web script or HTML via certain arguments to (1) left.php, (2) queryframe.php, or (3) server_databases.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/17337; http://secunia.com/advisories/17559; http://secunia.com/advisories/17607
CVE: CVE-2005-3302
Published: 2005-10-24
Description: Eval injection vulnerability in bvh_import.py in Blender 2.36 allows attackers to execute arbitrary Python code via a hierarchy element in a .bvh file, which is supplied to an eval function call.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94, CWE-94
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=330895; http://secunia.com/advisories/19754; http://www.debian.org/security/2006/dsa-1039
CVE: CVE-2005-2926
Published: 2005-10-25
Description: Stack-based buffer overflow in (1) backupsh and (2) authsh in SCO Openserver 5.0.7 allows local users to execute arbitrary code via a long HOME environment variable.
CVSS Score: 4.6 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.40/SCOSA-2005.40.txt; http://secunia.com/advisories/17274; http://securitytracker.com/id?1015099
CVE: CVE-2005-2927
Published: 2005-10-25
Description: Stack-based buffer overflow in ppp in SCO Unixware 7.1.3 and 7.1.4, and possibly earlier versions, allows local users to execute arbitrary code via a long argument to the (1) prompt or (2) defprompt command.
CVSS Score: 7.2 (HIGH)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.41/SCOSA-2005.41.txt; http://secunia.com/advisories/17275; http://securityreason.com/securityalert/101
CVE: CVE-2005-2958
Published: 2005-10-25
Description: Multiple format string vulnerabilities in the GNOME Data Access library for GNOME2 (libgda2) 1.2.1 and earlier allow attackers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17323; http://secunia.com/advisories/17339; http://secunia.com/advisories/17391
CVE: CVE-2005-2959
Published: 2005-10-25
Description: Incomplete blacklist vulnerability in sudo 1.6.8 and earlier allows local users to gain privileges via the (1) SHELLOPTS and (2) PS4 environment variables before executing a bash script on behalf of another user, which are not cleared even though other variables are.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://docs.info.apple.com/article.html?artnum=305214; http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html; http://secunia.com/advisories/17318
CVE: CVE-2005-2100
Published: 2005-10-25
Description: The rw_vm function in usercopy.c in the 4GB split patch for the Linux kernel in Red Hat Enterprise Linux 4 does not perform proper bounds checking, which allows local users to cause a denial of service (crash).
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/17073; http://www.redhat.com/support/errata/RHSA-2005-514.html; https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=165547
CVE: CVE-2005-2970
Published: 2005-10-25
Description: Memory leak in the worker MPM (worker.c) for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service (memory consumption) via aborted connections, which prevents the memory for the transaction pool from being reused for other connections.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-770
References: http://mail-archives.apache.org/mod_mbox/httpd-cvs/200509.mbox/%3C[PII_REDACTED]0218.40692.qmail%40minotaur.apache.org%3E; http://rhn.redhat.com/errata/RHSA-2006-0159.html; http://secunia.com/advisories/16559
CVE: CVE-2005-2708
Published: 2005-10-25
Description: The search_binary_handler function in exec.c in Linux 2.4 kernel on 64-bit x86 architectures does not check a return code for a particular function call when virtual memory is low, which allows local users to cause a denial of service (panic), as demonstrated by running a process using the bash ulimit -v command.
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: http://secunia.com/advisories/18523; http://secunia.com/advisories/18562; http://secunia.com/advisories/18684
CVE: CVE-2005-2744
Published: 2005-10-25
Description: Buffer overflow in QuickDraw Manager for Apple OS X 10.3.9 and 10.4.2, as used by applications such as Safari, Mail, and Finder, allows remote attackers to execute arbitrary code via a crafted PICT file.
CVSS Score: 5.1 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2005/Sep/msg00002.html; http://secunia.com/advisories/16920/; http://securitytracker.com/alerts/2005/Sep/1014961.html
CVE: CVE-2005-2747
Published: 2005-10-25
Description: Buffer overflow in ImageIO for Apple Mac OS X 10.4.2, as used by applications such as WebCore and Safari, allows remote attackers to execute arbitrary code via a crafted GIF file.
CVSS Score: 7.5 (HIGH)
References: http://lists.apple.com/archives/security-announce/2005/Sep/msg00002.html; http://secunia.com/advisories/16920/; http://securitytracker.com/alerts/2005/Sep/1014958.html
CVE: CVE-2005-2748
Published: 2005-10-25
Description: The malloc function in the libSystem library in Apple Mac OS X 10.3.9 and 10.4.2 allows local users to overwrite arbitrary files by setting the MallocLogFile environment variable to the target file before running a setuid application.
CVSS Score: 2.1 (LOW)
References: http://lists.apple.com/archives/security-announce/2005/Sep/msg00002.html; http://secunia.com/advisories/16920/; http://www.auscert.org.au/5509
CVE: CVE-2005-2524
Published: 2005-10-26
Description: Safari after 2.0 in Apple Mac OS X 10.3.9 allows remote attackers to bypass domain restrictions via crafted web archives that cause Safari to render them as if they came from a different site.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2005/Sep/msg00002.html; http://secunia.com/advisories/16920/; http://www.auscert.org.au/5509
CVE: CVE-2005-2741
Published: 2005-10-26
Description: Authorization Services in securityd for Apple Mac OS X 10.3.9 allows local users to gain privileges by granting themselves certain rights that should be restricted to administrators.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2005/Sep/msg00002.html; http://secunia.com/advisories/16920/; http://www.auscert.org.au/5509
CVE: CVE-2005-2742
Published: 2005-10-26
Description: SecurityAgent in Apple Mac OS X 10.4.2, under certain circumstances, can cause the "Switch User..." button to appear even though the "Enable fast user switching" setting is disabled, which can allow attackers with physical access to gain access to the desktop and bypass the "Require password to wake this computer from sleep or screen saver" setting.
CVSS Score: 4.6 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2005/Sep/msg00002.html; http://secunia.com/advisories/16920/; http://www.auscert.org.au/5509
CVE: CVE-2005-2743
Published: 2005-10-26
Description: The Java extensions for QuickTime 6.52 and earlier in Apple Mac OS X 10.3.9 allow untrusted applets to call arbitrary functions in system libraries, which allows remote attackers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://lists.apple.com/archives/security-announce/2005/Sep/msg00002.html; http://secunia.com/advisories/16920/; http://www.auscert.org.au/5509
CVE: CVE-2005-2745
Published: 2005-10-26
Description: Mail.app in Mail for Apple Mac OS X 10.3.9, when using Kerberos 5 for SMTP authentication, can include uninitialized memory in a message, which might allow remote attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2005/Sep/msg00002.html; http://secunia.com/advisories/16920/; http://www.auscert.org.au/5509
CVE: CVE-2005-2746
Published: 2005-10-26
Description: Mail.app in Mail for Apple Mac OS X 10.3.9 and 10.4.2 includes message contents when using auto-reply rules, which could cause Mail.app to include decrypted message contents for encrypted messages.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2005/Sep/msg00002.html; http://secunia.com/advisories/16920/; http://www.auscert.org.au/5509
CVE: CVE-2005-3304
Published: 2005-10-26
Description: Multiple SQL injection vulnerabilities in PHP-Nuke 7.8 allow remote attackers to modify SQL queries and execute arbitrary PHP code via (1) the username parameter in the Your Account page, (2) the url parameter in the Downloads module, and (3) the description parameter in the Web_Links module.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2436&w=2; http://rgod.altervista.org/phpnuke78sql.html; http://secunia.com/advisories/17315/
CVE: CVE-2005-3305
Published: 2005-10-26
Description: Multiple SQL injection vulnerabilities in Nuked Klan 1.7 allow remote attackers to execute arbitrary SQL commands via the (1) forum_id or (2) thread_id parameter in the Forum file, (3) the link_id in the Links file, (4) the artid parameter in the Sections file, and (5) the dl_id parameter in the Download file.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0427&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6710&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3796&w=2
CVE: CVE-2005-3306
Published: 2005-10-26
Description: Cross-site scripting (XSS) vulnerability in index.php for FlatNuke 2.5.6 allows remote attackers to inject arbitrary web script or HTML via the user parameter in a profile operation, a different vulnerability than CVE-2005-2814.  NOTE: it is possible that this XSS is a resultant vulnerability of CVE-2005-3307.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9407&w=2; http://secunia.com/advisories/17291/; http://www.osvdb.org/20246
CVE: CVE-2005-3307
Published: 2005-10-26
Description: Directory traversal vulnerability in index.php for FlatNuke 2.5.6 allows remote attackers to read arbitrary files via ".." sequences in the (1) user parameter in a profile operation or (2) quale parameter in a newtopic operation.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9407&w=2; http://secunia.com/advisories/17291/; http://www.osvdb.org/20245
CVE: CVE-2005-3308
Published: 2005-10-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Zomplog 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) comment parameter in detail.php, (3) the username parameter in get.php, and (4) the search parameter in index.php.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1123&w=2; http://secunia.com/advisories/17306/; http://securitytracker.com/alerts/2005/Oct/1015088.html
CVE: CVE-2005-3309
Published: 2005-10-26
Description: Multiple SQL injection vulnerabilities in Zomplog 3.4 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in detail.php and the catid parameter in (2) get.php and (3) index.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17306/; http://securitytracker.com/alerts/2005/Oct/1015088.html; http://www.osvdb.org/20250
CVE: CVE-2005-3310
Published: 2005-10-26
Description: Interpretation conflict in phpBB 2.0.17, with remote avatars and avatar uploading enabled, allows remote authenticated users to inject arbitrary web script or HTML via an HTML file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer, which renders malformed image types as HTML, enabling cross-site scripting (XSS) attacks.  NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer (CVE-2005-3312) and the proper fix should be in that browser; if so, then this should not be treated as a vulnerability in phpBB.
CVSS Score: 3.5 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0479.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7987&w=2; http://secunia.com/advisories/17295/
CVE: CVE-2005-3311
Published: 2005-10-26
Description: BMC Software Control-M 6.1.03 for Solaris, and possibly other platforms, allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5811&w=2; http://secunia.com/advisories/17294; http://securitytracker.com/id?1015096
CVE: CVE-2005-3312
Published: 2005-10-26
Description: The HTML rendering engine in Microsoft Internet Explorer 6.0 allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML in corrupted images and other files such as .GIF, JPG, and WAV, which is rendered as HTML when the user clicks on the link, even though the web server response and file extension indicate that it should be treated as a different file type.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7987&w=2; http://securityreason.com/securityalert/18; http://www.computec.ch/download.php?view.683
CVE: CVE-2005-2338
Published: 2005-10-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.12 JP and earlier, XOOPS 2.0.13.1 and earlier, and 2.2.x up to 2.2.3 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) modules that use "XOOPS Code" and (2) newbb in the forum module.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2024&w=2; http://secunia.com/advisories/17300
CVE: CVE-2005-3088
Published: 2005-10-27
Description: fetchmailconf before 1.49 in fetchmail 6.2.0, 6.2.5 and 6.2.5.2 creates configuration files with insecure world-readable permissions, which allows local users to obtain sensitive information such as passwords.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://fetchmail.berlios.de/fetchmail-SA-2005-02.txt; http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2031&w=2