deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-4342
Published: 2005-12-19
Description: ColdFusion Sandbox on Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 does not throw an exception if the SecurityManager is disabled, which might allow remote attackers to "bypass security controls," aka "JRun Clustered Sandbox Security Vulnerability."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18078; http://securitytracker.com/id?1015369; http://www.macromedia.com/devnet/security/security_zone/mpsb05-12.html
CVE: CVE-2005-4343
Published: 2005-12-19
Description: Adobe (formerly Macromedia) ColdFusion MX 6.0, 6.1, 6.1 with JRun, and 7.0 allows remote attackers to attach arbitrary files and send mail via a crafted Subject field, which is not properly handled by the CFMAIL tag in applications that use ColdFusion, aka "CFMAIL injection Vulnerability".
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18078; http://securitytracker.com/id?1015369; http://www.macromedia.com/devnet/security/security_zone/mpsb05-12.html
CVE: CVE-2005-4344
Published: 2005-12-19
Description: Adobe (formerly Macromedia) ColdFusion MX 7.0 does not honor when the CFOBJECT /CreateObject(Java) setting is disabled, which allows local users to create an object despite the specified configuration.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/18078; http://securitytracker.com/id?1015371; http://www.macromedia.com/devnet/security/security_zone/mpsb05-14.html
CVE: CVE-2005-4345
Published: 2005-12-19
Description: Adobe (formerly Macromedia) ColdFusion MX 7.0 exposes the password hash of the Administrator in an API call, which allows local developers to obtain the hash and gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/18078; http://securitytracker.com/id?1015371; http://www.macromedia.com/devnet/security/security_zone/mpsb05-14.html
CVE: CVE-2005-4346
Published: 2005-12-19
Description: Invalid SQL syntax error in blog.php in phpBB Blog 2.2.2 and earlier allows remote attackers to obtain the full path of the application via an invalid permalink parameter to index.php, which produces an invalid SQL query that leaks the full pathname in a SQL syntax error message. NOTE: this was originally claimed to be SQL injection, but a cleansing step strips all non-digit characters and leaves an empty permalink argument, which leads to the syntax error.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/phpbb-blog-222-sql-inj-vuln.html; http://www.osvdb.org/21565; http://www.outshine.com/forums/viewtopic.php?t=308
CVE: CVE-2005-4349
Published: 2005-12-19
Description: SQL injection vulnerability in server_privileges.php in phpMyAdmin 2.7.0 allows remote authenticated users to execute arbitrary SQL commands via the (1) dbname and (2) checkprivs parameters.  NOTE: the vendor and a third party have disputed this issue, saying that the main task of the program is to support query execution by authenticated users, and no external attack scenario exists without an auto-login configuration.  Thus it is likely that this issue will be REJECTED.  However, a closely related CSRF issue has been assigned CVE-2005-4450
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2821&w=2; http://secunia.com/advisories/18113; http://securityreason.com/securityalert/270
CVE: CVE-2005-4350
Published: 2005-12-20
Description: Unspecified vulnerability in WBEM Services A.01.x before A.01.05.12 and A.02.x before A.02.00.08 on HP-UX B.11.00 through B.11.23 allows remote attackers to cause an unspecified denial of service via unknown attack vectors.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/18160; http://securitytracker.com/alerts/2005/Dec/1015377.html; http://www.securityfocus.com/bid/15930
CVE: CVE-2005-4353
Published: 2005-12-20
Description: SQL injection vulnerability in index.php in toendaCMS 0.6.2.1, when configured to use a SQL database, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18058; http://www.osvdb.org/21768; http://www.vupen.com/english/advisories/2005/2926
CVE: CVE-2005-4354
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in webglimpse.cgi in Webglimpse 2.14.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18076; http://www.vupen.com/english/advisories/2005/2966; http://secunia.com/advisories/18076
CVE: CVE-2005-4355
Published: 2005-12-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in UStore allow remote attackers to inject arbitrary web script or HTML via the (1) Cat parameter in default.asp and the (2) accessdenied parameter in admin/default.asp.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18026; http://www.osvdb.org/21979; http://www.osvdb.org/21980
CVE: CVE-2005-4356
Published: 2005-12-20
Description: SQL injection vulnerability in UStore allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18026; http://www.osvdb.org/21981; http://www.vupen.com/english/advisories/2005/2990
CVE: CVE-2005-4357
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in phpBB 2.0.18, when "Allowed HTML tags" is enabled, allows remote attackers to inject arbitrary Javascript via a permitted HTML tag with " (quote) characters and active attributes such as onmouseover.
CVSS Score: 2.6 (LOW)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2679&w=2; http://secunia.com/advisories/18125; http://secunia.com/advisories/18252
CVE: CVE-2005-4358
Published: 2005-12-20
Description: admin/admin_disallow.php in phpBB 2.0.18 allows remote attackers to obtain the installation path via a direct request with a non-empty setmodules parameter, which causes an invalid append_sid function call that leaks the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2679&w=2; http://secunia.com/advisories/18125; http://secunia.com/advisories/18252
CVE: CVE-2005-4359
Published: 2005-12-20
Description: SQL injection vulnerability in includes/core.inc.php in ODFaq 2.1.0 allows remote attackers to execute arbitrary SQL commands via the (1) cat and (2) srcText parameters to faq.php.
CVSS Score: 6.4 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/odfaq-sql-inj-vuln.html; http://secunia.com/advisories/18121; http://www.osvdb.org/21790
CVE: CVE-2005-4360
Published: 2005-12-20
Description: The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" followed by arguments such as "~0" through "~9", which causes ntdll.dll to produce a return value that is not correctly handled by IIS, as demonstrated using "/_vti_bin/.dll/*/~0".  NOTE: the consequence was originally believed to be only a denial of service (application crash and reboot).
CVSS Score: 7.8 (HIGH)
CWE: CWE-252
References: http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html; http://ingehenriksen.blogspot.com/2005/12/microsoft-iis-remote-dos-dll-url.html; http://secunia.com/advisories/18106
CVE: CVE-2005-4361
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in search.html in Magnolia Content Management Suite 2.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/magnolia-xss-vuln.html; http://secunia.com/advisories/18104; http://www.osvdb.org/21795
CVE: CVE-2005-4362
Published: 2005-12-20
Description: SQL injection vulnerability in page.php in Komodo CMS 2.1 allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/komodo-cms-vuln.html; http://secunia.com/advisories/18120; http://www.securityfocus.com/bid/15966
CVE: CVE-2005-4363
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in the search engine in Komodo CMS 2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.
CVSS Score: 5.8 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/komodo-cms-vuln.html; http://secunia.com/advisories/18120; http://www.osvdb.org/21792
CVE: CVE-2005-4364
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in index.cfm in Hot Banana Web Content Management Suite 5.3 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.
CVSS Score: 5.8 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/hot-banana-xss-vuln.html; http://secunia.com/advisories/18126; http://www.osvdb.org/21786
CVE: CVE-2005-4365
Published: 2005-12-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in FLIP 0.9.0.1029 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter in text.php and (2) frame parameter in forum.php.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/flip-xss-vuln.html; http://secunia.com/advisories/18128; http://www.osvdb.org/21788
CVE: CVE-2005-4366
Published: 2005-12-20
Description: Multiple SQL injection vulnerabilities in DRZES HMS 3.2 allow remote attackers to execute arbitrary SQL commands via the (1) plan_id parameter to (a) domains.php, (b) viewusage.php, (c) pop_accounts.php, (d) databases.php, (e) ftp_users.php, (f) crons.php, (g) pass_dirs.php, (h) zone_files.php, (i) htaccess.php, and (j) software.php; (2) the customerPlanID parameter to viewplan.php; (3) the ref_id parameter to referred_plans.php; (4) customerPlanID parameter to listcharges.php; and (5) the domain parameter to (k) pop_accounts.php, (d) databases.php, (e) ftp_users.php, (f) crons.php, (g) pass_dirs.php, (h) zone_files.php, (i) htaccess.php, and (j) software.php.  NOTE: the viewinvoice.php invoiceID vector is already covered by CVE-2005-4137.
CVSS Score: 6.4 (MEDIUM)
References: http://pridels0.blogspot.com/2005/11/drzes-hms-32-multiple-vuln.html; http://www.osvdb.org/21179; http://www.osvdb.org/21180
CVE: CVE-2005-4367
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in register_domain.php in DRZES HMS 3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the "Domain Availability" field.  NOTE: this issue was later reported to affect CONTROLzx (renamed from DRZES) 3.3.4.
CVSS Score: 5.8 (MEDIUM)
References: http://pridels0.blogspot.com/2005/11/drzes-hms-32-multiple-vuln.html; http://pridels0.blogspot.com/2006/03/controlzx-hms-hosting-management.html; http://www.osvdb.org/21193
CVE: CVE-2005-4368
Published: 2005-12-20
Description: roundcube webmail Alpha, with a default high verbose level ($rcmail_config['debug_level'] = 1), allows remote attackers to obtain the full path of the application via an invalid_task parameter, which leaks the path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/archive/1/418851/100/0/threaded; http://www.securityfocus.com/archive/1/419710/100/0/threaded; http://www.securityfocus.com/archive/1/422168/100/0/threaded
CVE: CVE-2005-4369
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in Acuity CMS 2.6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly strSearchKeywords to browse.asp.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/acuity-cms-26x-asp-xss-vuln.html; http://secunia.com/advisories/18070; http://www.osvdb.org/21794
CVE: CVE-2005-4370
Published: 2005-12-20
Description: SQL injection vulnerability in main_content.asp in Acidcat 2.1.13 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter to default.asp.
CVSS Score: 7.5 (HIGH)
References: http://hamid.ir/security/acidcat.txt; http://secunia.com/advisories/18097; http://www.osvdb.org/21845
CVE: CVE-2005-4371
Published: 2005-12-20
Description: Acidcat 2.1.13 and earlier stores the database under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a request to databases/acidcat.mdb.
CVSS Score: 5.0 (MEDIUM)
References: http://hamid.ir/security/acidcat.txt; http://secunia.com/advisories/18097; http://www.osvdb.org/22491
CVE: CVE-2005-4372
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in account.html in Adaptive Website Framework (AWF) 2.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/awf-adaptive-website-framework-vuln.html; http://www.awf-cms.org/news.html; http://www.osvdb.org/21914
CVE: CVE-2005-4373
Published: 2005-12-20
Description: Adaptive Website Framework (AWF) 2.10 and earlier allows remote attackers to obtain the full path of the application via an invalid mode parameter to community.html, which leaks the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/awf-adaptive-website-framework-vuln.html; http://www.awf-cms.org/news.html; http://www.osvdb.org/21915
CVE: CVE-2005-4374
Published: 2005-12-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Allinta 2.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to faq.asp and (2) searchQuery parameter to search.asp.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/allinta-23x-xss-vuln.html; http://secunia.com/advisories/18060; http://www.osvdb.org/21784
CVE: CVE-2005-4375
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in Amaxus 3 and earlier allows remote attackers to inject arbitrary web script or HTML via the change parameter.  NOTE: it is possible that this is resultant from CVE-2005-4376.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/amaxus-vuln.html; http://secunia.com/advisories/18004; http://www.osvdb.org/21821
CVE: CVE-2005-4376
Published: 2005-12-20
Description: Directory traversal vulnerability in Amaxus 3 and earlier allows remote attackers to access arbitrary files via ".." sequences in the change parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/amaxus-vuln.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/40002; http://pridels0.blogspot.com/2005/12/amaxus-vuln.html
CVE: CVE-2005-4377
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in Page.asp in Baseline CMS 1.95 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) PageID and (2) SiteNodeID parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/baseline-cms-vuln.html; http://www.osvdb.org/21938; http://www.vupen.com/english/advisories/2005/2974
CVE: CVE-2005-4378
Published: 2005-12-20
Description: SQL injection vulnerability in Page.asp in Baseline CMS 1.95 and earlier allows remote attackers to execute arbitrary SQL commands via the SiteNodeID parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/baseline-cms-vuln.html; http://www.osvdb.org/21939; http://www.securityfocus.com/bid/15961
CVE: CVE-2005-4379
Published: 2005-12-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to inject arbitrary web script or HTML via the (1) sort_mode parameter to (a) fisheye/list_galleries.php, (b) messages/message_box.php, and (c) users/my.php; the (2) post_id parameter to (d) blogs/view_post.php; the (3) blog_id parameter to (e) blogs/view.php; and the (4) search field to (f) users/my_groups.php.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/bitweaver-multiple-vuln.html; http://www.bitweaver.org/forums/viewtopic.php?t=1299; http://www.osvdb.org/21924
CVE: CVE-2005-4380
Published: 2005-12-20
Description: Multiple SQL injection vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to execute arbitrary SQL commands via the (1) sort_mode parameter to (a) fisheye/list_galleries.php, (b) messages/message_box.php, and (c) users/my.php; the (2) post_id parameter to (d) blogs/view_post.php; and the (3) blog_id parameter to (e) blogs/view.php, which are not properly cleansed by the convert_sortmode function in kernel/BitDb.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://pridels0.blogspot.com/2005/12/bitweaver-multiple-vuln.html; http://www.bitweaver.org/forums/viewtopic.php?t=1299; http://www.osvdb.org/21919
CVE: CVE-2005-4381
Published: 2005-12-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Caravel CMS 3.0 Beta 1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) fileDN and (2) folderviewer_attrs parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/caravel-cms-xss.html; http://secunia.com/advisories/18151; http://www.osvdb.org/21833
CVE: CVE-2005-4382
Published: 2005-12-20
Description: SQL injection vulnerability in CitySoft Community Enterprise 4.x allows remote attackers to execute arbitrary SQL commands via the (1) nodeID, (2) pageID, (3) ID, and (4) parentid parameter to index.cfm; and (5) documentFormatId parameter to document/docWindow.cfm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://pridels0.blogspot.com/2005/12/community-enterprise-4x-multiple-vuln.html; http://secunia.com/advisories/18145/; http://www.osvdb.org/21855
CVE: CVE-2005-4383
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in index.cfm in CitySoft Community Enterprise 4.x allows remote attackers to inject arbitrary web script or HTML via the (1) presentationSite, (2) docPublishYear, (3) docDescription, (4) publishState, (5) docAuthor, (6) docTitle, (7) subTopic, (8) topic, (9) topicRadio, (10) topicOnly, (11) startrow, and (12) sortby parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/community-enterprise-4x-multiple-vuln.html; http://secunia.com/advisories/18145; http://www.osvdb.org/21856
CVE: CVE-2005-4384
Published: 2005-12-20
Description: CitySoft Community Enterprise 4.x allows remote attackers to obtain the full path of the server via an invalid (1) fuseaction parameter to index.cfm and (2) documentid parameter to document/docWindow.cfm.
CVSS Score: 6.4 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/community-enterprise-4x-multiple-vuln.html; http://secunia.com/advisories/18145; http://www.osvdb.org/21857
CVE: CVE-2005-4385
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in search.htm in Cofax 2.0 RC3 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/cofax-xss-vuln.html; http://www.osvdb.org/21850; http://www.securityfocus.com/bid/15940
CVE: CVE-2005-4386
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in Colony CMS 2.75 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://pridels0.blogspot.com/2005/12/colony-cms-xss-vuln.html; http://www.osvdb.org/21853; http://www.securityfocus.com/bid/15941
CVE: CVE-2005-4387
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in home.php in contenite 0.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/contenite-xss-vuln.html; http://secunia.com/advisories/18144; http://www.osvdb.org/21832
CVE: CVE-2005-4388
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in search.cfm in CONTENS 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the near parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/contens-searchcfm-multiple-input.html; http://secunia.com/advisories/18143; http://www.osvdb.org/21824
CVE: CVE-2005-4389
Published: 2005-12-20
Description: search.cfm in CONTENS 3.0 and earlier allows remote attackers to obtain the full server path via invalid (1) submit.y, (2) bool, (3) itemsperpage, (4) submit, (5) submit.x, (6) criteria, (7) advanced, and (8) intern parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/contens-searchcfm-multiple-input.html; http://secunia.com/advisories/18143; http://www.osvdb.org/21825
CVE: CVE-2005-4390
Published: 2005-12-20
Description: SQL injection vulnerability in index.php in ContentServ 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the StoryID parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/contentserv-31-sql-inj.html; http://www.osvdb.org/21851; http://www.securityfocus.com/bid/15956
CVE: CVE-2005-4391
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in damoon allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the q parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/damoon-xss-vuln.html; http://secunia.com/advisories/18118; http://www.osvdb.org/21817
CVE: CVE-2005-4392
Published: 2005-12-20
Description: SQL injection vulnerability in printer_friendly.cfm in e-publish CMS 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/e-publish-cms-vuln.html; http://secunia.com/advisories/18140; http://www.osvdb.org/21881
CVE: CVE-2005-4393
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in show.cfm in e-publish CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) obcatid and (2) comid parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/e-publish-cms-vuln.html; http://secunia.com/advisories/18140; http://www.osvdb.org/21882
CVE: CVE-2005-4394
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in EPiX 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search query parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/epix-search-query-xss-vuln.html; http://secunia.com/advisories/18234; http://www.osvdb.org/21849
CVE: CVE-2005-4395
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in FarCry 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the criteria parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/farcry-xss-vuln.html; http://secunia.com/advisories/18129; http://www.osvdb.org/21826
CVE: CVE-2005-4396
Published: 2005-12-20
Description: Cross-site scripting (XSS) vulnerability in admin/Default.asp in iCMS allows remote attackers to inject arbitrary web script or HTML via the LoginMSG parameter.  NOTE: the provenance of this issue is unknown; the details were obtained solely from third party sources.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18085; http://www.osvdb.org/21809; http://secunia.com/advisories/18085
CVE: CVE-2005-4397
Published: 2005-12-20
Description: SQL injection vulnerability in RunScript.asp iCMS allows remote attackers to execute arbitrary SQL commands via the Event_ID parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18085; http://www.osvdb.org/21810; http://secunia.com/advisories/18085