deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-1582
Published: 2005-05-14
Description: Cross-site scripting (XSS) vulnerability in index.php for 1Two News 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) nom, (2) email, (3) siteweb, or (4) commentaire variables.
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1013960; http://securitytracker.com/id?1013960
CVE: CVE-2005-1583
Published: 2005-05-14
Description: 1Two News 1.0 allows remote attackers to (1) delete images for new stories via a direct request to admin/delete.php or (2) upload arbitrary images via a direct request to admin/upload.php.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1013960; http://securitytracker.com/id?1013960
CVE: CVE-2005-1584
Published: 2005-05-14
Description: Cross-site scripting (XSS) vulnerability in index.php for Quick.Forum 2.1.6 allows remote attackers to inject arbitrary web script or HTML via the topic field in a NewTopic action.
CVSS Score: 4.3 (MEDIUM)
References: http://lostmon.blogspot.com/2005/05/quickforum-topic-field-xss-and-page.html; http://secunia.com/advisories/15200; http://www.osvdb.org/16327
CVE: CVE-2005-1586
Published: 2005-05-14
Description: Quick.Forum 2.1.6 stores potentially sensitive information such as usernames, banned IP addresses, censored words, and backups under the web document root, which allows remote attackers to obtain that information via a direct request to (1) db/users.txt, (2) db/banList.txt, (3) db/censureWords.txt, or (4) backup files.
CVSS Score: 5.0 (MEDIUM)
References: http://lostmon.blogspot.com/2005/05/quickforum-topic-field-xss-and-page.html; http://secunia.com/advisories/15200; http://www.osvdb.org/16328
CVE: CVE-2005-1587
Published: 2005-05-14
Description: Cross-site scripting (XSS) vulnerability in index.php for Quick.cart 0.3.0 allows remote attackers to inject arbitrary web script or HTML via the sWord parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://lostmon.blogspot.com/2005/05/quickcart-sword-variable-xss-and.html; http://opensolution.org/forum/?p=readTopic&nr=948; http://secunia.com/advisories/15297
CVE: CVE-2005-1193
Published: 2005-05-16
Description: The bbencode_second_pass and make_clickable functions in bbcode.php for phpBB before 2.0.15, as used in viewtopic.php, privmsg.php, and other scripts, allow remote attackers to execute arbitrary script via a BBcode tag with a (1) javascript:, (2) applet:, (3) about:, (4) activex:, (5) chrome:, or (6) script: URI scheme, as demonstrated using the URL tag.
CVSS Score: 7.5 (HIGH)
References: http://castlecops.com/t123194-.html; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]0088&w=2; http://seclists.org/lists/bugtraq/2005/May/0098.html
CVE: CVE-2005-1248
Published: 2005-05-16
Description: Buffer overflow in Apple iTunes before 4.8 allows remote attackers to execute arbitrary code via a crafted MPEG4 file.
CVSS Score: 7.5 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=301596; http://lists.apple.com/archives/security-announce/2005/May/msg00003.html; http://secunia.com/advisories/15310
CVE: CVE-2005-1365
Published: 2005-05-16
Description: Pico Server (pServ) 3.2 and earlier allows remote attackers to execute arbitrary commands via a URL with multiple leading "/" (slash) characters and ".." sequences.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6712&w=2; http://sourceforge.net/project/shownotes.php?release_id=327708; http://www.redteam-pentesting.de/advisories/rt-sa-2005-010.txt
CVE: CVE-2005-1366
Published: 2005-05-16
Description: Pico Server (pServ) 3.2 and earlier allows remote attackers to obtain the source code for CGI scripts via "dirname/../cgi-bin" in a URL.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9003&w=2; http://sourceforge.net/project/shownotes.php?release_id=327708; http://www.redteam-pentesting.de/advisories/rt-sa-2005-011.txt
CVE: CVE-2005-1367
Published: 2005-05-16
Description: Pico Server (pServ) 3.2 and earlier allows local users to read arbitrary files as the pServ user via a symlink to a file outside of the web document root.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9003&w=2; http://www.redteam-pentesting.de/advisories/rt-sa-2005-012.txt; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9003&w=2
CVE: CVE-2005-1590
Published: 2005-05-16
Description: The Altiris Client Service for Windows (ACLIENT.EXE) 6.0.88 allows local users to disable password protection and access the administrative interface by finding and showing the "Altiris Client Service" hidden window, disabling the password protection, disabling the "Hide client tray icon box" option, then opening the AClient tray icon and using the View Log File option, a different vulnerability than CVE-2004-2070.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-04/0614.html; http://secunia.com/advisories/15159; http://www.osvdb.org/15897
CVE: CVE-2005-1591
Published: 2005-05-16
Description: Unknown vulnerability in NIS+ on Solaris 7, 8, and 9 allows remote attackers to cause a denial of service (rpc.nisd disabled and NIS+ unavailable) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-57780-1; http://www.vupen.com/english/advisories/2005/0492; http://sunsolve.sun.com/search/document.do?assetkey=1-26-57780-1
CVE: CVE-2005-1592
Published: 2005-05-16
Description: Multiple "javascript vulerabilities in BB code" in BirdBlog before 1.3.1 allow remote attackers to inject arbitrary Javascript.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15206; http://sourceforge.net/project/shownotes.php?release_id=324788; http://secunia.com/advisories/15206
CVE: CVE-2005-1593
Published: 2005-05-16
Description: Cross-site scripting (XSS) vulnerability in catalog.php for CodeThat ShoppingCart 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://lostmon.blogspot.com/2005/05/codethat-shoppingcart-critical.html; http://secunia.com/advisories/15251; http://securitytracker.com/id?1013924
CVE: CVE-2005-1594
Published: 2005-05-16
Description: SQL injection vulnerability in catalog.php for CodeThat ShoppingCart 1.3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://lostmon.blogspot.com/2005/05/codethat-shoppingcart-critical.html; http://secunia.com/advisories/15251; http://securitytracker.com/id?1013924
CVE: CVE-2005-1595
Published: 2005-05-16
Description: CodeThat ShoppingCart 1.3.1 stores config.ini under the web root, which allows remote attackers to obtain sensitive information via a direct request.
CVSS Score: 5.0 (MEDIUM)
References: http://lostmon.blogspot.com/2005/05/codethat-shoppingcart-critical.html; http://secunia.com/advisories/15251; http://securitytracker.com/id?1013924
CVE: CVE-2005-1596
Published: 2005-05-16
Description: index.php in Fusion SBX 1.2 and earlier does not properly use the extract function, which allows remote attackers to bypass authentication by setting the is_logged parameter or execute arbitrary code via the maxname2 parameter.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/15257; http://www.exploits.co.in/Article1134.html; http://www.osvdb.org/16216
CVE: CVE-2005-1597
Published: 2005-05-16
Description: Cross-site scripting (XSS) vulnerability in (1) search.php and (2) topics.php for Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the highlite parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://forums.invisionpower.com/index.php?showtopic=168016; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5851&w=2; http://secunia.com/advisories/15265
CVE: CVE-2005-1598
Published: 2005-05-16
Description: SQL injection vulnerability in Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via a crafted cookie password hash (pass_hash) that modifies the internal $pid variable.
CVSS Score: 7.5 (HIGH)
References: http://forums.invisionpower.com/index.php?showtopic=168016; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5851&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6834&w=2
CVE: CVE-2005-1599
Published: 2005-05-16
Description: Cross-site scripting (XSS) vulnerability in Kryloff Technologies Subject Search Server (SSServer) 1.1 allows remote attackers to inject arbitrary web script or HTML via the "Search For" field.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/15288; http://securitytracker.com/id?1013938; http://www.securityfocus.com/bid/13574
CVE: CVE-2005-1600
Published: 2005-05-16
Description: A "mathematical flaw" in the implementation of the El Gamal signature algorithm for LibTomCrypt 1.0 to 1.0.2 allows attackers to generate valid signatures without having the private key.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15233; http://www.osvdb.org/16188; http://www.securiteam.com/unixfocus/5JP092AFPG.html
CVE: CVE-2005-1601
Published: 2005-05-16
Description: MRO Maximo Self Service 4 and 5 stores certain information under the web document root using file extensions that are not processed by Tomcat, which allows remote attackers to obtain sensitive information via a direct request for the file, such as MXServer.properties.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/15176; http://www.osvdb.org/16161; http://www.securityfocus.com/archive/1/397522
CVE: CVE-2005-1602
Published: 2005-05-16
Description: SQL injection vulnerability in login.asp for Net56 Browser Based File Manager 1.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the password field.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-05/0134.html; http://www.osvdb.org/16544; http://www.securityfocus.com/bid/13547
CVE: CVE-2005-1603
Published: 2005-05-16
Description: NiteEnterprises Remote File Manager 1.0 allows remote attackers to cause a denial of service (crash) via a crafted string to TCP port 7080.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-05/0129.html; http://secunia.com/advisories/15299; http://www.osvdb.org/16158
CVE: CVE-2005-1604
Published: 2005-05-16
Description: PHP Advanced Transfer Manager (phpATM) 1.21 allows remote attackers to upload arbitrary files via filenames containing multiple file extensions, as demonstrated using a filename ending in "php.ns", which allows execution of arbitrary PHP code.
CVSS Score: 7.5 (HIGH)
References: http://seclists.org/lists/bugtraq/2005/May/0075.html; http://secunia.com/advisories/15279; http://www.osvdb.org/16160
CVE: CVE-2005-1605
Published: 2005-05-16
Description: Cross-site scripting (XSS) vulnerability in the guestbook for SiteStudio 1.6 allows remote attackers to inject arbitrary web script or HTML via the name field to (1) psoft.guestbook.GuestBookServ in Standalone Site Studio or (2) E-Guest_sign.pl in Integrated Site Studio with H-Sphere.
CVSS Score: 6.8 (MEDIUM)
References: http://exploitlabs.com/files/advisories/EXPL-A-2005-008-sitestudio.txt; http://secunia.com/advisories/15286; http://www.derkeiler.com/Mailing-Lists/Full-Disclosure/2005-05/0154.html
CVE: CVE-2005-1606
Published: 2005-05-16
Description: H-Sphere Winbox 2.4.2 and 2.4.3 RC1 stores sensitive information such as username and password in plaintext in world-readable log files, which allows local users to gain privileges.
CVSS Score: 4.6 (MEDIUM)
References: http://exploitlabs.com/files/advisories/EXPL-A-2005-007-hsphere.txt; http://secunia.com/advisories/15287; http://www.osvdb.org/16239
CVE: CVE-2005-1607
Published: 2005-05-16
Description: Cross-site scripting (XSS) vulnerability in shop.cgi in Remote Cart allows remote attackers to inject arbitrary web script or HTML via the (1) merchant or (2) demo parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://securitytracker.com/id?1013903; http://www.governmentsecurity.org/forum/lofiversion/index.php/t14715.html; http://www.osvdb.org/16454
CVE: CVE-2005-1608
Published: 2005-05-16
Description: Multiple unknown vulnerabilities in the Blocks module in Spidean AutoTheme 1.7 and AT-Lite for PostNuke have unknown impact.
CVSS Score: 5.0 (MEDIUM)
References: http://news.postnuke.com/Article2687.html; http://secunia.com/advisories/15289; http://securitytracker.com/id?1013908
CVE: CVE-2005-1609
Published: 2005-05-16
Description: Unknown vulnerability in Sun StorEdge 6130 Arrays (SE6130) with serial numbers between 0451AWF00G and 0513AWF00J allows local users and remote attackers to delete data.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15306; http://securitytracker.com/id?1013921; http://sunsolve.sun.com/search/document.do?assetkey=1-26-57771-1
CVE: CVE-2005-1610
Published: 2005-05-16
Description: Cross-site scripting (XSS) vulnerability in security.php for Tru-Zone NukeET 3.0 and 3.1 allows remote attackers to inject arbitrary web script or HTML via a base64 encoded Codigo parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://lostmon.blogspot.com/2005/05/nukeet-codigo-variable-cross-site.html; http://secunia.com/advisories/15332; http://securitytracker.com/id?1013936
CVE: CVE-2005-1611
Published: 2005-05-16
Description: Cross-site scripting (XSS) vulnerability in WebX in Web Crossing 5.x allows remote attackers to inject arbitrary web script or HTML via a URL with an "@" followed by the desired script.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/ref/16/16070-webcrossing.txt; http://secunia.com/advisories/15218; http://www.osvdb.org/16070
CVE: CVE-2005-1612
Published: 2005-05-16
Description: SQL injection vulnerability in read.php in Open Bulletin Board (OpenBB) 1.0.8 allows remote attackers to execute arbitrary SQL commands via the TID parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2632&w=2; http://www.securityfocus.com/bid/13624; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2632&w=2
CVE: CVE-2005-1613
Published: 2005-05-16
Description: Cross-site scripting (XSS) vulnerability in member.php in Open Bulletin Board (OpenBB) 1.0.8 allows remote attackers to inject arbitrary web script or HTML via the reverse parameter in a list action.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2632&w=2; http://www.securityfocus.com/bid/13625; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2632&w=2
CVE: CVE-2005-1614
Published: 2005-05-16
Description: Cross-site scripting (XSS) vulnerability in viewforum.php in Ultimate PHP Board (UPB) 1.8 through 1.9.6 allows remote attackers to inject arbitrary web script or HTML via the postorder parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4876&w=2; http://www.securityfocus.com/bid/13621; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4876&w=2
CVE: CVE-2005-1615
Published: 2005-05-16
Description: viewforum.php in Ultimate PHP Board (UPB) 1.8 through 1.9.6 may allow remote attackers to read sensitive data via the postorder parameter, which is not properly handled by textdb.inc.php, possibly due to a SQL injection vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4876&w=2; http://www.securityfocus.com/bid/13622; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4876&w=2
CVE: CVE-2005-1616
Published: 2005-05-16
Description: viewforum.php in Ultimate PHP Board (UPB) 1.8 through 1.9.6 allows remote attackers to obtain sensitive information via an invalid (1) id or possibly (2) postorder parameter, which reveals the path in an error message when a file can not be opened.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4876&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4876&w=2
CVE: CVE-2005-1617
Published: 2005-05-16
Description: Willings WebCam and WebCam Lite 2.8 and earlier stores the password in memory in plaintext, which allows local users to gain sensitive information.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1137&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1137&w=2
CVE: CVE-2005-1618
Published: 2005-05-16
Description: The YMSGR URL handler in Yahoo! Messenger 5.x through 6.0 allows remote attackers to cause a denial of service (disconnect) via a room login or a room join request packet with a third : (colon) and an & (ampersand), which causes Messenger to send a corrupted packet to the server, which triggers a disconnect from the server.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4055&w=2; http://www.osvdb.org/16816; http://www.securityfocus.com/bid/13626
CVE: CVE-2005-1619
Published: 2005-05-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in (1) start_page.css.php3 (aka start-page.css.php3) or (2) style.css.php3 in PHPMyChat 0.14.5 allow remote attackers to inject arbitrary web script or HTML commands via the FontName parameter.  NOTE: it was later reported that 0.14.5 is also affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0031&w=2; http://www.securityfocus.com/archive/1/484575/100/0/threaded; http://www.securityfocus.com/bid/13627
CVE: CVE-2005-1620
Published: 2005-05-16
Description: Cross-site scripting (XSS) vulnerability in Skull-Splitter Guestbook 1.0, 2.0 and 2.2 allows remote attackers to inject arbitrary web script or HTML via the (1) title or (2) content of a message.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7070&w=2; http://www.m0r1n3x.com/Skull-splitter_adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7070&w=2
CVE: CVE-2005-1621
Published: 2005-05-16
Description: Directory traversal vulnerability in the pnModFunc function in pnMod.php for PostNuke 0.750 through 0.760rc4 allows remote attackers to read arbitrary files via a .. (dot dot) in the func parameter to index.php.
CVSS Score: 5.0 (MEDIUM)
References: http://cvs.postnuke.com/viewcvs.cgi/Historic_PostNuke_Library/postnuke-devel/html/includes/pnMod.php.diff?r1=1.47&r2=1.48; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1526&w=2; http://news.postnuke.com/Article2690.html
CVE: CVE-2005-1622
Published: 2005-05-16
Description: Cross-site scripting (XSS) vulnerability in productsByCategory.asp in MetaCart e-Shop allows remote attackers to inject arbitrary web script or HTML via the strCatalog_NAME parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://echo.or.id/adv/adv13-theday-2005.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3176&w=2; http://echo.or.id/adv/adv13-theday-2005.txt
CVE: CVE-2005-1264
Published: 2005-05-17
Description: Raw character devices (raw.c) in the Linux kernel 2.6.x call the wrong function before passing an ioctl to the block device, which crosses security boundaries by making kernel address space accessible from user space, a similar vulnerability to CVE-2005-1589.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0045.html; http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0046.html; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.11.10
CVE: CVE-2005-1307
Published: 2005-05-17
Description: The (1) stopserver.sh and (2) startserver.sh scripts in Adobe Version Cue on Mac OS X uses the current working directory to find and execute the productname.sh script, which allows local users to execute arbitrary code by copying and calling the scripts from a user-controlled directory.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2004-12/0040.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3544&w=2; http://secunia.com/advisories/13399
CVE: CVE-2005-1589
Published: 2005-05-17
Description: The pkt_ioctl function in the pktcdvd block device ioctl handler (pktcdvd.c) in Linux kernel 2.6.12-rc4 and earlier calls the wrong function before passing an ioctl to the block device, which crosses security boundaries by making kernel address space accessible from user space and allows local users to cause a denial of service and possibly execute arbitrary code, a similar vulnerability to CVE-2005-1264.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0045.html; http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0046.html; http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0047.html
CVE: CVE-2005-1626
Published: 2005-05-17
Description: Multiple buffer overflows in handlers.c for Pico Server (pServ) before 3.3 may allow attackers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://sourceforge.net/project/shownotes.php?release_id=327708; http://www.securityfocus.com/bid/13648; http://sourceforge.net/project/shownotes.php?release_id=327708
CVE: CVE-2005-1627
Published: 2005-05-17
Description: Unknown vulnerability in Viewglob before 2.0.1, related to "a potential security issue with the Viewglob display and ssh X forwarding," has unknown impact.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/15293; http://securitytracker.com/id?1013937; http://sourceforge.net/project/shownotes.php?release_id=325574
CVE: CVE-2005-1628
Published: 2005-05-17
Description: apage.cgi in WebAPP 0.9.9.2.1, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the f parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.defacers.com.mx/advisories/3.txt; http://www.securityfocus.com/archive/1/449517/100/200/threaded; http://www.securityfocus.com/archive/1/449573/100/200/threaded
CVE: CVE-2005-1629
Published: 2005-05-17
Description: SQL injection vulnerability in member.php for Photopost PHP Pro allows remote attackers to execute arbitrary SQL commands via the verifykey parameter.
CVSS Score: 7.5 (HIGH)
References: http://seclists.org/lists/fulldisclosure/2005/May/0311.html; http://www.securityfocus.com/bid/13620; http://seclists.org/lists/fulldisclosure/2005/May/0311.html
CVE: CVE-2005-1630
Published: 2005-05-17
Description: Unknown vulnerability in Attachment Mod before 2.3.13, related to a "serious issue with realnames," has unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15327; http://sourceforge.net/project/shownotes.php?release_id=326408; http://secunia.com/advisories/15327
CVE: CVE-2005-1631
Published: 2005-05-17
Description: booby.php in Booby 1.0.0 and earlier allows remote attackers to view private bookmarks by guessing item IDs.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/15305; http://sourceforge.net/project/shownotes.php?release_id=326826; http://www.securityfocus.com/bid/13623
CVE: CVE-2005-1632
Published: 2005-05-17
Description: Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitrary code via a malicious module in /tmp/.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/15386; http://sourceforge.net/mailarchive/forum.php?thread_id=7070332&forum_id=1542; http://www.osvdb.org/16622
CVE: CVE-2005-1633
Published: 2005-05-17
Description: Multiple SQL injection vulnerabilities in JGS-XA JGS-Portal 3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) anzahl_beitraege parameter to jgs_portal.php, 2) year parameter to (jgs_portal_statistik.php, 3) year parameter to (jgs_portal_beitraggraf.php, 4) tag parameter to (jgs_portal_viewsgraf.php, 5) year parameter to (jgs_portal_themengraf.php, 6) year parameter to (jgs_portal_mitgraf.php, 7) id parameter to jgs_portal_sponsor.php, or (8) the Accept-Language header to jgs_portal_log.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8415&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8415&w=2