deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-4023
Published: 2005-12-05
Description: Unspecified vulnerability in the zipcart module in Gallery 2.0 before 2.0.2 allows remote attackers to read arbitrary files via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17747; http://www.securityfocus.com/archive/1/418200/100/0/threaded; http://www.securityfocus.com/bid/15614
CVE: CVE-2005-4024
Published: 2005-12-05
Description: Cross-site scripting (XSS) vulnerability in Interspire FastFind 2004 and 2005 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/interspire-fastfind-2005-xss-vuln.html; http://www.vupen.com/english/advisories/2005/2692; http://pridels0.blogspot.com/2005/12/interspire-fastfind-2005-xss-vuln.html
CVE: CVE-2005-4025
Published: 2005-12-05
Description: Help Desk Reloaded Free Help Desk does not remove or protect install.php once installation is complete, which allows remote attackers to gain privileges via a direct request to install.php, then navigating to accountsetup.php and creating a new user.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1015307; http://securitytracker.com/id?1015307
CVE: CVE-2005-4026
Published: 2005-12-05
Description: search.php in Geeklog 1.4.x before 1.4.0rc1, and 1.3.x before 1.3.11sr3, allows remote attackers to obtain sensitive information via invalid (1) datestart and (2) dateend parameters, which leaks the web server path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2005/11/geeklog-14x-full-path-disclosure-vuln.html; http://www.geeklog.net/article.php/geeklog-1.3.11sr3; http://www.osvdb.org/21398
CVE: CVE-2005-4027
Published: 2005-12-05
Description: SQL injection vulnerability in SimpleBBS 1.1 allows remote attackers to execute arbitrary SQL commands via unspecified search module parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://pridels0.blogspot.com/2005/11/simplebbs-v11-sql-inj-vuln.html; http://www.osvdb.org/21399; http://www.securityfocus.com/bid/15594
CVE: CVE-2005-4028
Published: 2005-12-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in aMember allow remote attackers to inject arbitrary web script or HTML via the (1) lamember_login parameter to sendpass.php and (2) login parameter to member.php.
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1015208; http://www.osvdb.org/21012; http://www.osvdb.org/21013
CVE: CVE-2005-4029
Published: 2005-12-05
Description: WebEOC before 6.0.2 allows remote attackers to obtain valid usernames via the HTML source of the WebEOC login webpage, which could be useful in other attacks such as locking out valid users via brute force methods.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/170394; http://www.kb.cert.org/vuls/id/170394
CVE: CVE-2005-4030
Published: 2005-12-06
Description: SQL injection vulnerability in Quicksilver Forums before 1.5.1 allows remote attackers to execute arbitrary SQL commands via the HTTP_USER_AGENT header.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/17861; http://sourceforge.net/project/shownotes.php?release_id=375970&group_id=154354; http://www.osvdb.org/21443
CVE: CVE-2005-4031
Published: 2005-12-06
Description: Eval injection vulnerability in MediaWiki 1.5.x before 1.5.3 allows remote attackers to execute arbitrary PHP code via the "user language option," which is used as part of a dynamic class name that is processed using the eval function.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17866; http://sourceforge.net/project/shownotes.php?group_id=34373&release_id=375755; http://www.kb.cert.org/vuls/id/392156
CVE: CVE-2005-4032
Published: 2005-12-06
Description: Cross-site scripting (XSS) vulnerability in search.cgi in Easy Search System 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/easy-search-system-v11-xss-vuln.html; http://secunia.com/advisories/17823; http://www.securityfocus.com/bid/15705
CVE: CVE-2005-4033
Published: 2005-12-06
Description: Nodezilla 0.4.13-corno-fulgure does not properly protect the evl_data directory, which could allow them to be shared when they are not protected by PRIVATEDATADIR in nodezilla.ini, which allows remote attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17867; http://www.nodezilla.net/history.txt; http://www.securityfocus.com/bid/15704
CVE: CVE-2005-4034
Published: 2005-12-06
Description: Multiple SQL injection vulnerabilities in Web4Future eDating Professional 5 allow remote attackers to execute arbitrary SQL commands via the (1) s, (2) pg, and (3) sortb parameters to (a) index.php; (4) cid parameter to (b) gift.php and (c) fq.php; and (5) cat parameter to (d) articles.php.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/web4future-edating-professional-v5-sql.html; http://secunia.com/advisories/17879; http://www.osvdb.org/21418
CVE: CVE-2005-4035
Published: 2005-12-06
Description: Multiple SQL injection vulnerabilities in Web4Future eCommerce Enterprise Edition 2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) prod, and (2) brid parameters to (a) view.php; the (3) the bid parameter to (b) viewbrands.php; and the (4) grp and (5) cat parameters to index.php.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/ecommerce-enterprise-edition-sql-inj.html; http://secunia.com/advisories/17881; http://www.osvdb.org/21466
CVE: CVE-2005-4036
Published: 2005-12-06
Description: Cross-site scripting (XSS) vulnerability in index.cgi in Web4Future KeyWord Frequency Counter 1.0 allows remote attackers to inject arbitrary web script or HTML via the "remote URL."
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/keyword-frequency-counter-v10-xss-vuln.html; http://secunia.com/advisories/17876; http://www.securityfocus.com/bid/15702
CVE: CVE-2005-4037
Published: 2005-12-06
Description: SQL injection vulnerability in functions.php in Web4Future Affiliate Manager PRO 4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/web4future-affiliate-manager-pro-sql.html; http://secunia.com/advisories/17883; http://www.osvdb.org/21457
CVE: CVE-2005-4038
Published: 2005-12-06
Description: SQL injection vulnerability in comentarii.php in Web4Future Portal Solutions News Portal allows remote attackers to execute arbitrary SQL commands via the idp parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/web4future-portal-solutions-news.html; http://secunia.com/advisories/17880; http://www.osvdb.org/21422
CVE: CVE-2005-4039
Published: 2005-12-06
Description: Directory traversal vulnerability in arhiva.php in Web4Future Portal Solutions News Portal allows remote attackers to read arbitrary files via the dir parameter.
CVSS Score: 7.8 (HIGH)
References: http://pridels0.blogspot.com/2005/12/web4future-portal-solutions-news.html; http://secunia.com/advisories/17880; http://www.osvdb.org/21423
CVE: CVE-2005-4040
Published: 2005-12-06
Description: SQL injection vulnerability in FileLister 0.51 and earlier allows remote attackers to execute arbitrary SQL commands via the search parameters, possibly the searchwhat parameter to definesearch.jsp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://pridels0.blogspot.com/2005/12/filelister-sql-inj-vuln.html; http://secunia.com/advisories/17821; http://www.osvdb.org/21416
CVE: CVE-2005-4041
Published: 2005-12-06
Description: Cross-site scripting (XSS) vulnerability in search.cgi in MR CGI Guy Hot Links SQL 3.1.x and Hot Links Pro 3.1.x allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/hot-links-pro-3x-xss-vuln.html; http://pridels0.blogspot.com/2005/12/hot-links-sql-3x-xss-vuln.html; http://secunia.com/advisories/17868
CVE: CVE-2005-4042
Published: 2005-12-06
Description: Cross-site scripting (XSS) vulnerability in Warm Links 1.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to search.cgi.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/warm-links-xss-vuln.html; http://secunia.com/advisories/17864; http://www.osvdb.org/21439
CVE: CVE-2005-4043
Published: 2005-12-06
Description: SQL injection vulnerability in view.php in Hobosworld HobSR 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) arrange and (2) p parameters.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/hobsr-sql-inj-vuln.html; http://secunia.com/advisories/17884; http://www.osvdb.org/21417
CVE: CVE-2005-4044
Published: 2005-12-06
Description: Cross-site scripting (XSS) vulnerability in search.cgi in Amazon Search Directory 1.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly the search parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/amazon-search-directory-xss-vuln.html; http://secunia.com/advisories/17875; http://www.osvdb.org/21438
CVE: CVE-2005-3193
Published: 2005-12-07
Description: Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code (JPXStream.c) for xpdf 3.01 and earlier, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, (4) CUPS, and (5) libextractor allows user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with large size values that cause insufficient memory to be allocated.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt; ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.20/SCOSA-2006.20.txt; ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.21/SCOSA-2006.21.txt
CVE: CVE-2005-2923
Published: 2005-12-07
Description: The IMAP server in IMail Server 8.20 in Ipswitch Collaboration Suite (ICS) before 2.02 allows remote attackers to cause a denial of service (crash) via a long argument to the LIST command, which causes IMail Server to reference invalid memory.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/17863; http://securitytracker.com/id?1015318; http://www.idefense.com/application/poi/display?id=347&type=vulnerabilities
CVE: CVE-2005-2931
Published: 2005-12-07
Description: Format string vulnerability in the SMTP service in IMail Server 8.20 in Ipswitch Collaboration Suite (ICS) before 2.02 allows remote attackers to execute arbitrary code via format string specifiers to the (1) EXPN, (2) MAIL, (3) MAIL FROM, and (4) RCPT TO commands.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17863; http://securitytracker.com/id?1015317; http://www.idefense.com/application/poi/display?id=346&type=vulnerabilities
CVE: CVE-2005-3191
Published: 2005-12-07
Description: Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineSOF functions in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier, as used in products such as (a) Poppler, (b) teTeX, (c) KDE kpdf, (d) pdftohtml, (e) KOffice KWord, (f) CUPS, and (g) libextractor allow user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with an out-of-range number of components (numComps), which is used as an array index.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt; ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.20/SCOSA-2006.20.txt; ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.21/SCOSA-2006.21.txt
CVE: CVE-2005-4045
Published: 2005-12-07
Description: Unspecified vulnerability in System Communications Services 6 Delegated Administrator 2005Q1 in Sun Java System Messaging Server 2005Q1 allows remote attackers to obtain the Top-Level Administrator (TLA) default password via unknown vectors, possibly involving configure_toplevel_admin.ldif.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17889; http://securitytracker.com/id?1015313; http://sunsolve.sun.com/search/document.do?assetkey=1-77-1000831.1-1
CVE: CVE-2005-4046
Published: 2005-12-07
Description: Unspecified vulnerability in Reverse SSL Proxy Plug-in for Sun Java System Application Server Standard Edition 7 2004Q2, Application Server Enterprise Edition 8.1 2005Q1, and Sun ONE Application Server 7 Standard Edition, as used in multiple web servers, allows remote attackers to conduct man-in-the-middle (MITM) attacks and "compromise data privacy."
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/17873; http://securitytracker.com/id?1015312; http://sunsolve.sun.com/searchproxy/document.do?assetkey=1-26-102012-1
CVE: CVE-2005-4047
Published: 2005-12-07
Description: Cross-site scripting (XSS) vulnerability in kb.asp in IISWorks ASPKnowledgeBase 2.0 allows remote attackers to inject arbitrary web script or HTML via the a parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/iisworks-asp-knowledgebase-2x-xss-vuln.html; http://secunia.com/advisories/17901; http://www.securityfocus.com/bid/15734
CVE: CVE-2005-4048
Published: 2005-12-07
Description: Heap-based buffer overflow in the avcodec_default_get_buffer function (utils.c) in FFmpeg libavcodec 0.4.9-pre1 and earlier, as used in products such as (1) mplayer, (2) xine-lib, (3) Xmovie, and (4) GStreamer, allows remote attackers to execute arbitrary commands via small PNG images with palettes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://article.gmane.org/gmane.comp.video.ffmpeg.devel/26558; http://cvs.freedesktop.org/gstreamer/gst-ffmpeg/ChangeLog?rev=1.239&view=markup; http://secunia.com/advisories/17892
CVE: CVE-2005-4049
Published: 2005-12-07
Description: Multiple SQL injection vulnerabilities in Blog System 1.2 allow remote attackers to execute arbitrary SQL commands via (1) the cat parameter in index.php and (2) the note parameter in blog.php.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/blog-system-v12-sql-inj-vuln.html; http://secunia.com/advisories/17893/; http://securityreason.com/securityalert/230
CVE: CVE-2005-4050
Published: 2005-12-07
Description: Buffer overflow in multiple Multi-Tech Systems MultiVOIP devices with firmware before x.08 allows remote attackers to execute arbitrary code via a long INVITE field in a Session Initiation Protocol (SIP) packet.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17852; http://securityreason.com/securityalert/231; http://securitytracker.com/id?1015314
CVE: CVE-2005-4051
Published: 2005-12-07
Description: e107 0.6174 allows remote attackers to vote multiple times for a download via repeated requests to rate.php.
CVSS Score: 5.0 (MEDIUM)
References: http://e107.org/e107_plugins/bugtrack/bugtrack.php?1625.show; http://secunia.com/advisories/17890/; http://www.securityfocus.com/archive/1/418577/100/0/threaded
CVE: CVE-2005-4052
Published: 2005-12-07
Description: e107 0.6174 allows remote attackers to redirect users to other web sites via the download parameter in rate.php, which is used after a user submits a file download rating.  NOTE: in the default installation, the e_BASE variable restricts the redirection to the same web site.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17890/; http://securityreason.com/securityalert/229; http://www.securityfocus.com/archive/1/418577/100/0/threaded
CVE: CVE-2005-4053
Published: 2005-12-07
Description: Cross-site scripting (XSS) vulnerability in coWiki 0.3.4 allows remote attackers to inject arbitrary web script or HTML via the q parameter, as demonstrated using 26.html.
CVSS Score: 4.3 (MEDIUM)
References: http://cowiki.tigris.org/issues/show_bug.cgi?id=234; http://pridels0.blogspot.com/2005/12/cowiki-034-xss-vuln.html; http://secunia.com/advisories/17913
CVE: CVE-2005-4054
Published: 2005-12-07
Description: SQL injection vulnerability in index.php in PluggedOut Blog 1.9.5 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) categoryid, (2) entryid, (3) year, (4) month, and (5) day parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/pluggedout-blog-sql-vuln.html; http://secunia.com/advisories/17911; http://www.osvdb.org/21480
CVE: CVE-2005-4055
Published: 2005-12-07
Description: SQL injection vulnerability in index.php in Cars Portal 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) page and (2) car parameters.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/cars-portal-v1x-sql-injection.html; http://secunia.com/advisories/17914; http://www.osvdb.org/21482
CVE: CVE-2005-4056
Published: 2005-12-07
Description: SQL injection vulnerability in search.php in PluggedOut Nexus 0.1 allows remote attackers to execute arbitrary SQL commands via the (1) Location, (2) Last Name, and (3) First Name parameters.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/pluggedout-nexus-sqlxss-vuln_06.html; http://secunia.com/advisories/17909; http://www.osvdb.org/21478
CVE: CVE-2005-4057
Published: 2005-12-07
Description: Cross-site scripting (XSS) vulnerability in search.php in PluggedOut Nexus 0.1 allows remote attackers to inject arbitrary web script or HTML via the (1) Location, (2) Last Name, and (3) First Name parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/pluggedout-nexus-sqlxss-vuln_06.html; http://secunia.com/advisories/17909; http://www.osvdb.org/21479
CVE: CVE-2005-4058
Published: 2005-12-07
Description: SQL injection vulnerability in saralblog 1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to viewprofile.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://evuln.com/vulns/40/summary.html; http://pridels0.blogspot.com/2005/12/saralblog-v1-sql-inj-vuln.html; http://www.osvdb.org/21520
CVE: CVE-2005-4059
Published: 2005-12-07
Description: SQL injection vulnerability in searchdb.asp in LocazoList 1.03c and earlier allows remote attackers to execute arbitrary SQL commands via the q parameter.
CVSS Score: 7.5 (HIGH)
References: http://locazo.net:81/applications/; http://pridels0.blogspot.com/2005/12/locazolist-classifieds-v103c-vuln.html; http://www.osvdb.org/21531
CVE: CVE-2005-4060
Published: 2005-12-07
Description: Cross-site scripting (XSS) vulnerability in search.asp in rwAuction Pro 4.0 and 5.0 allows remote attackers to inject arbitrary web script or HTML via the searchtxt parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://pridels-team.blogspot.com/2007/06/rwauction-pro-xss-vuln.html; http://pridels0.blogspot.com/2005/12/rwauction-pro-v40-xss-vuln.html; http://secunia.com/advisories/17905
CVE: CVE-2005-4061
Published: 2005-12-07
Description: Cross-site scripting (XSS) vulnerability in PASearch.asp in XcPhotoAlbum 1.x allows remote attackers to inject arbitrary web script or HTML via the search parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/xcphotoalbum-v1x-xss-vuln.html; http://secunia.com/advisories/17904; http://www.osvdb.org/21477
CVE: CVE-2005-4062
Published: 2005-12-07
Description: Cross-site scripting (XSS) vulnerability in CPSearch.asp in XcClassified 3.x allows remote attackers to inject arbitrary web script or HTML via the search parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/xcclassified-v3x-xss-vuln.html; http://secunia.com/advisories/17903; http://www.osvdb.org/21470
CVE: CVE-2005-4063
Published: 2005-12-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in NetAuctionHelp 3.0 and earlier allow remote attackers to inject arbitrary HTML and web script via the (1) L, (2) sort, (3) category, (4) categoryname parameters to search.asp.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/netauctionhelp-v30-xss-vuln.html; http://secunia.com/advisories/17902; http://www.osvdb.org/21474
CVE: CVE-2005-4064
Published: 2005-12-07
Description: Multiple SQL injection vulnerabilities in A-FAQ 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) faqid parameter to faqDspItem.asp and (2) catcode parameter to faqDsp.asp.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/faq-sql-inj-vuln.html; http://secunia.com/advisories/17900; http://www.osvdb.org/21472
CVE: CVE-2005-4065
Published: 2005-12-07
Description: SQL injection vulnerability in the search module in Edgewall Trac before 0.9.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://lists.edgewall.com/archive/trac/2005-December/005777.html; http://projects.edgewall.com/trac/wiki/ChangeLog; http://secunia.com/advisories/17894
CVE: CVE-2005-4066
Published: 2005-12-07
Description: Total Commander 6.53 uses weak encryption to store FTP usernames and passwords in WCX_FTP.INI, which allows local users to decrypt the passwords and gain access to FTP servers, as possibly demonstrated by the W32.Gudeb worm.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-310
References: http://securitytracker.com/id?1015311; http://www.networksecurity.fi/advisories/total-commander.html; http://www.vupen.com/english/advisories/2005/2780
CVE: CVE-2005-4067
Published: 2005-12-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-4031.  Reason: This candidate is a reservation duplicate of CVE-2005-4031.  Notes: All CVE users should reference CVE-2005-4031 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-3192
Published: 2005-12-08
Description: Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, and (4) pdftohtml, (5) KOffice KWord, (6) CUPS, and (7) libextractor allows remote attackers to execute arbitrary code via a PDF file with an out-of-range numComps (number of components) field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.01pl1.patch; ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt; ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.20/SCOSA-2006.20.txt
CVE: CVE-2005-4068
Published: 2005-12-08
Description: Unspecified "absolute path vulnerability" in umountall in IBM AIX 5.1 through 5.3 allows local users to cause unknown impact via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/17924; http://securitytracker.com/id?1015321; http://www-1.ibm.com/support/docview.wss?uid=isg1IY75283
CVE: CVE-2005-4069
Published: 2005-12-08
Description: SunnComm MediaMax DRM 5.0.21.0, as used by Sony BMG, assigns insecure Everyone/Full Control permissions to the "SunnComm Shared" directory, which allows local users to gain privileges by modifying programs installed in that directory, such as MMX.exe.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/17933; http://securitytracker.com/id?1015327; http://www.eff.org/IP/DRM/Sony-BMG/MediaMaxVulnerabilityReport.pdf
CVE: CVE-2005-4070
Published: 2005-12-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-3665.  Reason: This candidate is a reservation duplicate of CVE-2005-3665.  Notes: All CVE users should reference CVE-2005-3665 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage