deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-4743
Published: 2005-12-31
Description: Multiple SQL injection vulnerabilities in index.php in NeLogic Nephp Publisher 4.5.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) nnet_catid parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2005/11/nephp-publisher-v45x-sql-inj-vuln.html; http://secunia.com/advisories/17772; http://www.osvdb.org/21196
CVE: CVE-2005-4744
Published: 2005-12-31
Description: Off-by-one error in the sql_error function in sql_unixodbc.c in FreeRADIUS 1.0.2.5-5, and possibly other versions including 1.0.4, might allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing the external database query to fail.  NOTE: this single issue is part of a larger-scale disclosure, originally by SUSE, which reported multiple issues that were disputed by FreeRADIUS.  Disputed issues included file descriptor leaks, memory disclosure, LDAP injection, and other issues.  Without additional information, the most recent FreeRADIUS report is being regarded as the authoritative source for this CVE identifier.
CVSS Score: 6.4 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc; http://rhn.redhat.com/errata/RHSA-2006-0271.html; http://secunia.com/advisories/16712
CVE: CVE-2005-4745
Published: 2005-12-31
Description: SQL injection vulnerability in the rlm_sqlcounter module in FreeRADIUS 1.0.3 and 1.0.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2006/dsa-1145; http://www.freeradius.org/security.html; http://www.mandriva.com/security/advisories?name=MDKSA-2007:092
CVE: CVE-2005-4746
Published: 2005-12-31
Description: Multiple buffer overflows in FreeRADIUS 1.0.3 and 1.0.4 allow remote attackers to cause denial of service (crash) via (1) the rlm_sqlcounter module or (2) unknown vectors "while expanding %t".
CVSS Score: 7.8 (HIGH)
References: http://www.debian.org/security/2006/dsa-1145; http://www.freeradius.org/security.html; http://www.mandriva.com/security/advisories?name=MDKSA-2006:066
CVE: CVE-2005-4747
Published: 2005-12-31
Description: Cross-site scripting (XSS) vulnerability in WebHost Automation Ltd Helm before 3.2.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors involving the default page.
CVSS Score: 4.3 (MEDIUM)
References: http://attrition.org/pipermail/vim/2006-March/000653.html; http://attrition.org/pipermail/vim/2006-March/000654.html; http://www.webhostautomation.com/webhost-301
CVE: CVE-2005-4748
Published: 2005-12-31
Description: PHP remote file include vulnerability in functions_admin.php in Virtual War (VWar) 1.5.0 R10 allows remote attackers to include and execute arbitrary PHP code via unspecified attack vectors.  NOTE: this issue has been referred to as XSS, but it is clear from the vendor description that it is a file inclusion problem.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/17315; http://www.vwar.de/; http://www.securityfocus.com/bid/17315
CVE: CVE-2005-4749
Published: 2005-12-31
Description: HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allows remote attackers to inject arbitrary HTTP headers via unspecified attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/159; http://dev2dev.bea.com/pub/advisory/177; http://secunia.com/advisories/17138
CVE: CVE-2005-4750
Published: 2005-12-31
Description: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service (server thread hang) via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://dev2dev.bea.com/pub/advisory/138; http://secunia.com/advisories/17138; http://www.securityfocus.com/bid/15052
CVE: CVE-2005-4751
Published: 2005-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allow remote attackers to inject arbitrary web script or HTML and gain administrative privileges via unknown attack vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/139; http://secunia.com/advisories/17138; http://www.securityfocus.com/bid/15052
CVE: CVE-2005-4752
Published: 2005-12-31
Description: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, might allow local users to gain privileges by using the run-as deployment descriptor element to change the privileges of a web application or EJB from the Deployer security role to the Admin security role.
CVSS Score: 4.6 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/142; http://secunia.com/advisories/17138; http://www.securityfocus.com/bid/15052
CVE: CVE-2005-4753
Published: 2005-12-31
Description: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain "heavy usage" scenarios, report incorrect severity levels for an audit event, which might allow attackers to perform unauthorized actions and avoid detection.
CVSS Score: 5.0 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/143; http://secunia.com/advisories/17138; http://www.securityfocus.com/bid/15052
CVE: CVE-2005-4754
Published: 2005-12-31
Description: BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allow remote attackers to obtain sensitive information (intranet IP addresses) via unknown attack vectors involving "network address translation."
CVSS Score: 5.0 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/144; http://secunia.com/advisories/17138; http://www.securityfocus.com/bid/15052
CVE: CVE-2005-4755
Published: 2005-12-31
Description: BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private key passphrase in cleartext (2) on a terminal or (3) in a log file, which might allow local users to obtain cryptographic keys.
CVSS Score: 2.1 (LOW)
References: http://dev2dev.bea.com/pub/advisory/145; http://dev2dev.bea.com/pub/advisory/150; http://secunia.com/advisories/17138
CVE: CVE-2005-4756
Published: 2005-12-31
Description: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not properly validate derived Principals with multiple PrincipalValidators, which might allow attackers to gain privileges.
CVSS Score: 7.5 (HIGH)
References: http://dev2dev.bea.com/pub/advisory/146; http://secunia.com/advisories/17138; http://www.securityfocus.com/bid/15052
CVE: CVE-2005-4757
Published: 2005-12-31
Description: BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly "constrain" a "/" (slash) servlet root URL pattern, which might allow remote attackers to bypass intended servlet protections.
CVSS Score: 7.5 (HIGH)
References: http://dev2dev.bea.com/pub/advisory/147; http://secunia.com/advisories/17138; http://www.securityfocus.com/bid/15052
CVE: CVE-2005-4758
Published: 2005-12-31
Description: Unspecified vulnerability in the Administration server in BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allows remote authenticated Admin users to read arbitrary files via unknown attack vectors related to an "internal servlet" accessed through HTTP.
CVSS Score: 4.0 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/148; http://secunia.com/advisories/17138; http://www.securityfocus.com/bid/15052
CVE: CVE-2005-4759
Published: 2005-12-31
Description: BEA WebLogic Server and WebLogic Express 8.1 and 7.0, during a migration across operating system platforms, do not warn the administrative user about platform differences in URLResource case sensitivity, which might cause local users to inadvertently lose protection of Web Application pages.
CVSS Score: 5.0 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/149; http://secunia.com/advisories/17138; http://www.securityfocus.com/bid/15052
CVE: CVE-2005-4760
Published: 2005-12-31
Description: BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, when fullyDelegatedAuthorization is enabled for a servlet, does not cause servlet deployment to fail when failures occur in authorization or role providers, which might prevent the servlet from being "fully protected."
CVSS Score: 5.1 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/151; http://secunia.com/advisories/17138; http://www.securityfocus.com/bid/15052
CVE: CVE-2005-4761
Published: 2005-12-31
Description: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which might include sensitive information (passwords or keyphrases) in the server log file when the -D option is used.
CVSS Score: 1.2 (LOW)
References: http://dev2dev.bea.com/pub/advisory/152; http://secunia.com/advisories/17138; http://www.securityfocus.com/bid/15052
CVE: CVE-2005-4762
Published: 2005-12-31
Description: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier sometimes stores the boot password in the registry in cleartext, which might allow local users to gain administrative privileges.
CVSS Score: 7.2 (HIGH)
References: http://dev2dev.bea.com/pub/advisory/153; http://secunia.com/advisories/17138; http://www.securityfocus.com/bid/15052
CVE: CVE-2005-4763
Published: 2005-12-31
Description: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier, when Internet Inter-ORB Protocol (IIOP) is used, sometimes include a password in an exception message that is sent to a client or stored in a log file, which might allow remote attackers to perform unauthorized actions.
CVSS Score: 7.5 (HIGH)
References: http://dev2dev.bea.com/pub/advisory/154; http://secunia.com/advisories/17138; http://www.securityfocus.com/bid/15052
CVE: CVE-2005-4764
Published: 2005-12-31
Description: BEA WebLogic Server and WebLogic Express 9.0, 8.1, and 7.0 lock out the admin user account after multiple incorrect password guesses, which allows remote attackers who know or guess the admin account name to cause a denial of service (blocked admin logins).
CVSS Score: 7.8 (HIGH)
References: http://dev2dev.bea.com/pub/advisory/155; http://secunia.com/advisories/17138; http://www.securityfocus.com/bid/15052
CVE: CVE-2005-4765
Published: 2005-12-31
Description: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier and 7.0 SP6 and earlier, when using the weblogic.Deployer command with the t3 protocol, does not use the secure t3s protocol even when an Administration port is enabled on the Administration server, which might allow remote attackers to sniff the connection.
CVSS Score: 7.6 (HIGH)
References: http://dev2dev.bea.com/pub/advisory/156; http://secunia.com/advisories/17138; http://www.securityfocus.com/bid/15052
CVE: CVE-2005-4766
Published: 2005-12-31
Description: BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not encrypt multicast traffic, which might allow remote attackers to read sensitive cluster synchronization messages by sniffing the multicast traffic.
CVSS Score: 5.4 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/157; http://secunia.com/advisories/17138; http://www.securityfocus.com/bid/15052
CVE: CVE-2005-4767
Published: 2005-12-31
Description: BEA WebLogic Server and WebLogic Express 8.1 SP5 and earlier, and 7.0 SP6 and earlier, when using username/password authentication, does not lock out a username after the maximum number of invalid login attempts, which makes it easier for remote attackers to guess the password.
CVSS Score: 5.1 (MEDIUM)
References: http://dev2dev.bea.com/pub/advisory/161; http://dev2dev.bea.com/pub/advisory/178; http://secunia.com/advisories/17138
CVE: CVE-2005-4768
Published: 2005-12-31
Description: SQL injection vulnerability in manage_account.php in Tux Racer TuxBank 0.7x and 0.8 allows remote attackers to execute arbitrary SQL commands via the id parameter in a manageaccount action to index.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/ref/24/24052-tuxbank.txt; http://www.osvdb.org/24052; http://www.securityfocus.com/bid/17376
CVE: CVE-2005-4769
Published: 2005-12-31
Description: SQL injection vulnerability in addrbook.php in Belchior Foundry vCard PRO 3.1 allows remote attackers to execute arbitrary SQL commands via the addr_id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/15254; http://www.securityfocus.com/bid/15254
CVE: CVE-2005-4770
Published: 2005-12-31
Description: SQL injection vulnerability in an unspecified Accelerated Enterprise Solutions product, possibly Accelerated E Solutions, allows remote attackers to execute arbitrary SQL commands via the password parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/26548; http://www.securityfocus.com/bid/15077; http://www.osvdb.org/26548
CVE: CVE-2005-4771
Published: 2005-12-31
Description: Trusted Mobility Agent PC Policy in Trust Digital Trusted Mobility Suite provides a cancel button that bypasses the domain-authentication prompt, which allows local users to sync a handheld (PDA) device despite a policy setting that sync is unauthorized.
CVSS Score: 4.6 (MEDIUM)
References: http://www.securityfocus.com/archive/1/413417; http://www.securityfocus.com/bid/15109; http://www.securityfocus.com/archive/1/413417
CVE: CVE-2005-4772
Published: 2005-12-31
Description: liby2util in Yet another Setup Tool (YaST) in SUSE Linux before 20051007 preserves permissions and ownerships when copying a remote repository, which might allow local users to read or modify sensitive files, possibly giving local users the ability to exploit CVE-2005-3013.
CVSS Score: 6.4 (MEDIUM)
References: http://www.novell.com/linux/security/advisories/2005_22_sr.html; http://www.securityfocus.com/bid/15026; http://www.novell.com/linux/security/advisories/2005_22_sr.html
CVE: CVE-2005-4773
Published: 2005-12-31
Description: The configuration of VMware ESX Server 2.x, 2.0.x, 2.1.x, and 2.5.x allows local users to cause a denial of service (shutdown) via the (1) halt, (2) poweroff, and (3) reboot scripts executed at the service console.
CVSS Score: 4.9 (MEDIUM)
References: http://www.osvdb.org/21584; http://www.vmware.com/support/kb/enduser/std_adp.php?p_sid=dsxk%2ABWh&p_lva=&p_faqid=1817; http://www.osvdb.org/21584
CVE: CVE-2005-4774
Published: 2005-12-31
Description: Cross-site scripting (XSS) vulnerability in Xerver 4.17 allows remote attackers to inject arbitrary web script or HTML after a /%00/ sequence at the end of the URI.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/17243; http://securitytracker.com/id?1015079; http://www.osvdb.org/20077
CVE: CVE-2005-4775
Published: 2005-12-31
Description: Michael Scholz and Sebastian Stein Contineo 2.0, when the admin account lacks an e-mail address attribute, displays the password hash in a warning upon page reload, which might allow remote attackers to view the hash.
CVSS Score: 5.0 (MEDIUM)
References: http://sourceforge.net/tracker/index.php?func=detail&aid=1350700&group_id=88385&atid=586478; http://www.osvdb.org/20704; http://sourceforge.net/tracker/index.php?func=detail&aid=1350700&group_id=88385&atid=586478
CVE: CVE-2005-4776
Published: 2005-12-31
Description: Integer overflow in the FreeBSD compatibility code (freebsd_misc.c) in NetBSD-current, NetBSD-3, NetBSD-2.0, and NetBSD-2 before 20050913; and NetBSD-1.6 before 20050914; allows local users to cause a denial of service (heap corruption or system crash) and possibly gain root privileges.
CVSS Score: 7.2 (HIGH)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2005-008.txt.asc; http://mail-index.netbsd.org/source-changes/2005/09/13/0024.html; http://www.osvdb.org/20757
CVE: CVE-2005-4777
Published: 2005-12-31
Description: Tashcom ASPEdit 2.9 stores the administration password (aka the FTP password) in cleartext in the registry, which might allow local users to view the password.
CVSS Score: 4.9 (MEDIUM)
References: http://k.domaindlx.com/shellcore/advisories.asp?bug_report=display&infamous_group=94; http://securityreason.com/securityalert/37; http://securitytracker.com/id?1014989
CVE: CVE-2005-4778
Published: 2005-12-31
Description: The powersave daemon in SUSE Linux 10.0 before 20051007 has an unspecified "configuration problem," which allows local users to suspend the computer and possibly perform certain other unauthorized actions.
CVSS Score: 2.1 (LOW)
References: http://lists.suse.com/archive/suse-security-announce/2005-Oct/0002.html; http://www.securityfocus.com/bid/15042; http://lists.suse.com/archive/suse-security-announce/2005-Oct/0002.html
CVE: CVE-2005-4779
Published: 2005-12-31
Description: verifiedexecioctl in verified_exec.c in NetBSD 2.0.2 calls NDINIT with UIO_USERSPACE rather than UID_SYSSPACE, which removes the functionality of the verified exec kernel subsystem and might allow local users to execute Trojan horse programs.
CVSS Score: 3.6 (LOW)
References: http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/verified_exec.c.diff?r1=1.4&r2=1.4.2.1&f=h; http://mail-index.netbsd.org/netbsd-announce/2005/10/31/0000.html; http://releng.netbsd.org/cgi-bin/req-2-0.cgi?show=1988
CVE: CVE-2005-4780
Published: 2005-12-31
Description: Cross-site scripting (XSS) vulnerability in Fidra Lighthouse CMS 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in a query_string to the home page. NOTE: The vendor disputes this issue, saying "Lighthouse does not in any way make use of the PHP technology.  [It] is an application server ... A technology like this cannot be susceptible to client-side cross-site-scripting-attacks on its own, but only applications created based on such a technology. This does not only apply to Lighthouse, but also to Perl, PHP or web applications based on Java Servlet technology."  Since the original researcher is known to test demo pages and is sometimes inaccurate, it is likely that this issue will be REJECTED
CVSS Score: 3.7 (LOW)
References: http://pridels0.blogspot.com/2005/12/lighthouse-cms-xss-vuln.html; http://www.lighthouse-cms.de/en/news/; http://www.osvdb.org/21852
CVE: CVE-2005-4781
Published: 2005-12-31
Description: Multiple SQL injection vulnerabilities in SergiDs Top Music module 3.0 PR3 and earlier for PHP-Nuke allow remote attackers to execute arbitrary SQL commands via the (1) idartist, (2) idsong, and (3) idalbum parameters to modules.php.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2005_11_27_pridels_archive.html; http://www.osvdb.org/21397; http://www.securityfocus.com/bid/15581
CVE: CVE-2005-4782
Published: 2005-12-31
Description: NetBSD 2.0 before 2.0.4, 2.1 before 2.1.1, and 3, when the kernel is compiled with "options DIAGNOSTIC," allows local users to cause a denial of service (kernel assertion panic) via a negative linger time in the SO_LINGER socket option.
CVSS Score: 4.9 (MEDIUM)
References: http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/kern/uipc_socket.c.diff?r1=1.111&r2=1.112; http://mail-index.netbsd.org/netbsd-announce/2005/11/08/0010.html; http://mail-index.netbsd.org/source-changes/2005/10/21/0038.html
CVE: CVE-2005-4783
Published: 2005-12-31
Description: kernfs_xread in kernfs_vnops.c in NetBSD before 20050831 does not check for a negative offset when reading the message buffer, which allows local users to read arbitrary kernel memory.
CVSS Score: 2.1 (LOW)
References: http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/miscfs/kernfs/kernfs_vnops.c; http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/miscfs/kernfs/kernfs_vnops.c.diff?r1=1.110&r2=1.111&f=h; http://mail-index.netbsd.org/netbsd-announce/2005/10/31/0000.html
CVE: CVE-2005-4784
Published: 2005-12-31
Description: Multiple buffer overflows in the POSIX readdir_r function, as used in multiple packages, allow local users to cause a denial of service and possibly execute arbitrary code via (1) a symlink attack that exploits a race condition between opendir and pathcon calls and changes the filesystem to one with a larger maximum directory-entry name length, or (2) possibly via programmer-introduced errors on operating systems with a small struct dirent, such as Solaris or BeOS, as demonstrated in packages including (a) gcj, (b) KDE, (c) libwww, (d) the Rudiments library, (e) teTeX, (f) xmail, (g) bfbtester, (h) ncftp, (i) netwib, (j) OpenOffice.org, (k) Pike, (l) reprepro, (m) Tcl, and (n) xgsmlib.
CVSS Score: 5.6 (MEDIUM)
References: http://womble.decadentplace.org.uk/readdir_r-advisory.html; http://www.securityfocus.com/archive/1/415781; http://www.securityfocus.com/archive/1/415790/30/0/threaded
CVE: CVE-2005-4785
Published: 2005-12-31
Description: Cross-site scripting (XSS) vulnerability in QuickBlogger 1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) author ("your name") and (2) "comment" section.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-07/0090.html; http://exploitlabs.com/files/advisories/EXPL-A-2005-011-quickblogger.txt; http://secunia.com/advisories/15942
CVE: CVE-2005-4786
Published: 2005-12-31
Description: Buffer overflow in the archive decompression library (vrAZMain.dll 5.8.22.137), as used in HAURI anti-virus products including (1) ViRobot Expert 4.0, (2) ViRobot Advanced Server, and (3) HAURI LiveCall, allows user-assisted attackers to execute arbitrary code via an ALZ archive containing a file with a long filename.
CVSS Score: 4.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0150.html; http://secunia.com/advisories/16852; http://secunia.com/secunia_research/2005-47/advisory/
CVE: CVE-2005-4787
Published: 2005-12-31
Description: Turnkey Web Tools SunShop Shopping Cart allows remote attackers to obtain sensitive information via a phpinfo action to (1) index.php, (2) admin/index.php, and (3) admin/adminindex.php, which executes the PHP phpinfo function.  NOTE: The vendor has disputed this issue, saying that "Having this in the code makes it easier for us to troubleshoot when issues arise on individual carts. For someone to have a script to do this type of search would require that they know where your shop is actually located. I dont think it really can be construde [sic] as a security issue.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17832; http://www.turnkeywebtools.com/forum/showpost.php?p=9874&postcount=6; http://www.turnkeywebtools.com/forum/showthread.php?t=2384
CVE: CVE-2005-4788
Published: 2005-12-31
Description: resmgr in SUSE Linux 9.2 and 9.3, and possibly other distributions, allows local users to bypass access control rules for USB devices via "alternate syntax for specifying USB devices."
CVSS Score: 2.1 (LOW)
References: http://www.novell.com/linux/security/advisories/2005_22_sr.html; http://www.securityfocus.com/bid/15037; http://www.novell.com/linux/security/advisories/2005_22_sr.html
CVE: CVE-2005-4789
Published: 2005-12-31
Description: resmgr in SUSE Linux 9.2 and 9.3, and possibly other distributions, does not properly enforce class-specific exclude rules in some situations, which allows local users to bypass intended access restrictions for USB devices that set their class ID at the interface level.
CVSS Score: 2.1 (LOW)
References: http://www.novell.com/linux/security/advisories/2005_22_sr.html; http://www.securityfocus.com/bid/15037; http://www.novell.com/linux/security/advisories/2005_22_sr.html