deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-2256
Published: 2005-07-13
Description: Encoded directory traversal vulnerability in phpPgAdmin 3.1 to 3.5.3 allows remote attackers to access arbitrary files via "%2e%2e%2f" (encoded dot dot) sequences in the formLanguage parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/dailydave/2005-q3/0010.html; http://secunia.com/advisories/15941; http://secunia.com/advisories/16116
CVE: CVE-2005-2257
Published: 2005-07-13
Description: The saveProfile function in PhpSlash 0.8.0 allows remote attackers to modify arbitrary profiles and gain privileges by modifying the author_id parameter.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8139&w=2; http://secunia.com/advisories/15936; http://securitytracker.com/id?1014415
CVE: CVE-2005-2258
Published: 2005-07-13
Description: PHP remote file inclusion vulnerability in photolist.inc.php in Squito Gallery 1.33 allows remote attackers to execute arbitrary code via the photoroot parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16009; http://securitytracker.com/id?1014447; http://www.securityfocus.com/bid/14219
CVE: CVE-2005-2259
Published: 2005-07-13
Description: The dispallclosed2 function in dispallclosed.pl for multiple USANet Creations products, including (1) USANet Shopping Mall Software, (2) Domain Name Auction Software, (3) Standard Classified Ads Software, and (4) MakeBid Reverse Auction allows remote attackers to execute arbitrary code via shell metacharacters in the DISPCLOSED parameter.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/15985; http://securitytracker.com/id?1014411; http://www.securityfocus.com/bid/14179
CVE: CVE-2005-2260
Published: 2005-07-13
Description: The browser user interface in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 does not properly distinguish between user-generated events and untrusted synthetic events, which makes it easier for remote attackers to perform dangerous actions that normally could only be performed manually by the user.
CVSS Score: 7.5 (HIGH)
References: http://bugzilla.mozilla.org/show_bug.cgi?id=289940; http://secunia.com/advisories/16043; http://secunia.com/advisories/16044
CVE: CVE-2005-2261
Published: 2005-07-13
Description: Firefox before 1.0.5, Thunderbird before 1.0.5, Mozilla before 1.7.9, Netscape 8.0.2, and K-Meleon 0.9 runs XBL scripts even when Javascript has been disabled, which makes it easier for remote attackers to bypass such protection.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16043; http://secunia.com/advisories/16044; http://secunia.com/advisories/16059
CVE: CVE-2005-2262
Published: 2005-07-13
Description: Firefox 1.0.3 and 1.0.4, and Netscape 8.0.2, allows remote attackers to execute arbitrary code by tricking the user into using the "Set As Wallpaper" (in Firefox) or "Set as Background" (in Netscape) context menu on an image URL that is really a javascript: URL with an eval statement, aka "Firewalling."
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/16043; http://secunia.com/advisories/16044; http://www.ciac.org/ciac/bulletins/p-252.shtml
CVE: CVE-2005-2263
Published: 2005-07-13
Description: The InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by forcing a page navigation after the install method has been called, which causes the callback to be run in the context of the new page and results in a same origin violation.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16043; http://secunia.com/advisories/16059; http://www.ciac.org/ciac/bulletins/p-252.shtml
CVE: CVE-2005-2264
Published: 2005-07-13
Description: Firefox before 1.0.5 allows remote attackers to steal sensitive information by opening a malicious link in the Firefox sidebar using the _search target, then injecting script into other pages via a data: URL.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16043; http://www.ciac.org/ciac/bulletins/p-252.shtml; http://www.mozilla.org/security/announce/mfsa2005-49.html
CVE: CVE-2005-2265
Published: 2005-07-13
Description: Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 allows remote attackers to cause a denial of service (access violation and crash), and possibly execute arbitrary code, by calling InstallVersion.compareTo with an object instead of a string.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16043; http://secunia.com/advisories/16044; http://secunia.com/advisories/16059
CVE: CVE-2005-2266
Published: 2005-07-13
Description: Firefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the parent is in a different domain, which violates the same origin policy and allows remote attackers to steal sensitive information such as cookies and passwords from web sites whose child frames do not verify that they are in the same domain as their parents.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/15549; http://secunia.com/advisories/15551; http://secunia.com/advisories/15553
CVE: CVE-2005-2267
Published: 2005-07-13
Description: Firefox before 1.0.5 allows remote attackers to steal information and possibly execute arbitrary code by using standalone applications such as Flash and QuickTime to open a javascript: URL, which is run in the context of the previous page, and may lead to code execution if the standalone application loads a privileged chrome: URL.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16043; http://securitytracker.com/id?1014469; http://www.ciac.org/ciac/bulletins/p-252.shtml
CVE: CVE-2005-2268
Published: 2005-07-13
Description: Firefox before 1.0.5 and Mozilla before 1.7.9 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability."
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/15489; http://secunia.com/multiple_browsers_dialog_origin_vulnerability_test/; http://www.debian.org/security/2005/dsa-810
CVE: CVE-2005-2269
Published: 2005-07-13
Description: Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 does not properly verify the associated types of DOM node names within the context of their namespaces, which allows remote attackers to modify certain tag properties, possibly leading to execution of arbitrary script or code, as demonstrated using an XHTML document with IMG tags with custom properties ("XHTML node spoofing").
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16043; http://secunia.com/advisories/16044; http://secunia.com/advisories/16059
CVE: CVE-2005-2270
Published: 2005-07-13
Description: Firefox before 1.0.5 and Mozilla before 1.7.9 does not properly clone base objects, which allows remote attackers to execute arbitrary code by navigating the prototype chain to reach a privileged object.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16043; http://secunia.com/advisories/16059; http://secunia.com/advisories/19823
CVE: CVE-2005-2271
Published: 2005-07-13
Description: iCab 2.9.8 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability."
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/15477; http://secunia.com/multiple_browsers_dialog_origin_vulnerability_test/; http://secunia.com/advisories/15477
CVE: CVE-2005-2272
Published: 2005-07-13
Description: Safari version 2.0 (412) does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability."
CVSS Score: 2.6 (LOW)
References: http://docs.info.apple.com/article.html?artnum=302847; http://secunia.com/advisories/15474; http://secunia.com/advisories/17813
CVE: CVE-2005-2273
Published: 2005-07-13
Description: Opera 7.x and 8 before 8.01 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability."
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/15488; http://secunia.com/multiple_browsers_dialog_origin_vulnerability_test/; http://secunia.com/secunia_research/2005-8/
CVE: CVE-2005-2274
Published: 2005-07-13
Description: Microsoft Internet Explorer 6.0 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability."
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/15491; http://secunia.com/advisories/15492; http://secunia.com/multiple_browsers_dialog_origin_vulnerability_test/
CVE: CVE-2005-2277
Published: 2005-07-15
Description: Bluetooth FTP client (BTFTP) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename argument of a PUT command.
CVSS Score: 10.0 (HIGH)
References: http://affix.sourceforge.net/affix_212_sec.patch; http://affix.sourceforge.net/affix_320_sec.patch; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4397&w=2
CVE: CVE-2005-1174
Published: 2005-07-18
Description: MIT Kerberos 5 (krb5) 1.3 through 1.4.1 Key Distribution Center (KDC) allows remote attackers to cause a denial of service (application crash) via a certain valid TCP connection that causes a free of unallocated memory.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20050703-01-U.asc; http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html; http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html
CVE: CVE-2005-1175
Published: 2005-07-18
Description: Heap-based buffer overflow in the Key Distribution Center (KDC) in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a certain valid TCP or UDP request.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20050703-01-U.asc; http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html; http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html
CVE: CVE-2005-1689
Published: 2005-07-18
Description: Double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: ftp://patches.sgi.com/support/free/security/advisories/20050703-01-U.asc; http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000993; http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html
CVE: CVE-2005-1914
Published: 2005-07-18
Description: CenterICQ 4.20.0 and earlier creates temporary files with predictable file names, which allows local users to overwrite arbitrary files via a symlink attack on the gg.token.PID temporary file.
CVSS Score: 2.1 (LOW)
References: http://www.debian.org/security/2005/dsa-754; http://www.securityfocus.com/bid/14144; http://www.zataz.net/adviso/centericq-06152005.txt
CVE: CVE-2005-2195
Published: 2005-07-18
Description: Apple Darwin Streaming Server 5.5 and earlier allows remote attackers to cause a denial of service (application crash) via a URL with a filename containing a .cgi extension and an MS-DOS device name such as AUX, CON, PRN, COM1, or LPT1, a different vulnerability than CVE-2003-0421 and CVE-2003-0502.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4361&w=2; http://secunia.com/advisories/16056; http://securitytracker.com/id?1014474
CVE: CVE-2005-2278
Published: 2005-07-18
Description: Stack-based buffer overflow in the IMAP daemon (imapd) in MailEnable Professional 1.54 allows remote authenticated users to execute arbitrary code via the status command with a long mailbox name.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9993&w=2; http://www.coresecurity.com/common/showdoc.php?idx=467&idxseccion=10; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9993&w=2
CVE: CVE-2005-2279
Published: 2005-07-18
Description: Cisco ONS 15216 Optical Add/Drop Multiplexer (OADM) running firmware 2.2.2 and earlier allows remote attackers to cause a denial of service (management plane session loss) via crafted telnet data.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16073; http://securitytracker.com/id?1014475; http://www.cisco.com/warp/public/707/cisco-sa-20050713-ons.shtml
CVE: CVE-2005-2280
Published: 2005-07-18
Description: Cisco Security Agent (CSA) 4.5 allows remote attackers to cause a denial of service (system crash) via a crafted IP packet.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/cisco-sa-20050713-csa.shtml; https://exchange.xforce.ibmcloud.com/vulnerabilities/21344; http://www.cisco.com/warp/public/707/cisco-sa-20050713-csa.shtml
CVE: CVE-2005-2281
Published: 2005-07-18
Description: WebEOC before 6.0.2 uses a weak encryption scheme for passwords, which makes it easier for attackers to crack passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: http://www.kb.cert.org/vuls/id/491770; http://www.kb.cert.org/vuls/id/JGEI-6BWQDQ; http://www.kb.cert.org/vuls/id/491770
CVE: CVE-2005-2282
Published: 2005-07-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in WebEOC before 6.0.2 allow remote attackers to inject arbitrary web script and HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/138538; http://www.kb.cert.org/vuls/id/JGEI-6BVST4; http://www.kb.cert.org/vuls/id/138538
CVE: CVE-2005-2283
Published: 2005-07-18
Description: WebEOC before 6.0.2 does not properly restrict the size of an uploaded file, which allows remote authenticated users to cause a denial of service (system and database resource consumption) via a large file.
CVSS Score: 2.1 (LOW)
References: http://www.kb.cert.org/vuls/id/956762; http://www.kb.cert.org/vuls/id/JGEI-6BWLER; http://www.kb.cert.org/vuls/id/956762
CVE: CVE-2005-2284
Published: 2005-07-18
Description: Multiple SQL injection vulnerabilities in WebEOC before 6.0.2 allow remote attackers to modify SQL statements via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.kb.cert.org/vuls/id/372797; http://www.kb.cert.org/vuls/id/JGEI-6C8Q27; http://www.kb.cert.org/vuls/id/372797
CVE: CVE-2005-2285
Published: 2005-07-18
Description: WebEOC before 6.0.2 stores sensitive information in locations such as URIs, web pages, and configuration files, which allows remote attackers to obtain information such as Usernames, Passwords, Emergency information, medical information, and system configuration.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/165290; http://www.kb.cert.org/vuls/id/JGEI-6BWPXL; http://www.kb.cert.org/vuls/id/165290
CVE: CVE-2005-2286
Published: 2005-07-18
Description: WebEOC before 6.0.2 does not properly check user authorization, which allows remote attackers to gain privileges via a direct request to a resource.
CVSS Score: 10.0 (HIGH)
References: http://www.kb.cert.org/vuls/id/258834; http://www.kb.cert.org/vuls/id/JGEI-6BWLWG; http://www.kb.cert.org/vuls/id/258834
CVE: CVE-2005-2287
Published: 2005-07-18
Description: SoftiaCom wMailServer 1.0 and 2.0 allows remote attackers to cause a denial of service (application crash) via a large TCP packet with a leading space, possibly triggering a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8722&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8722&w=2
CVE: CVE-2005-2288
Published: 2005-07-18
Description: Cross-site scripting (XSS) vulnerability in PHPCounter 7.2 allows remote attackers to inject arbitrary web script or HTML via the EpochPrefix parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8834&w=2; http://secunia.com/advisories/15816; http://securitytracker.com/id?1014478
CVE: CVE-2005-2289
Published: 2005-07-18
Description: PHPCounter 7.2 allows remote attackers to obtain sensitive information via a direct request to prelims.php, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8834&w=2; http://secunia.com/advisories/15816; http://securitytracker.com/id?1014478
CVE: CVE-2005-2290
Published: 2005-07-18
Description: wps_shop.cgi in WPS Web Portal System 0.7.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) art and (2) cat variables.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0418&w=2; http://secunia.com/advisories/15780; http://securitytracker.com/id?1014480
CVE: CVE-2005-2291
Published: 2005-07-18
Description: Oracle JDeveloper 9.0.4, 9.0.5, and 10.1.2 passes the cleartext password as a parameter when starting sqlplus, which allows local users to gain sensitive information.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3341&w=2; http://www.red-database-security.com/advisory/oracle_jdeveloper_passes_plaintext_password.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3341&w=2
CVE: CVE-2005-2292
Published: 2005-07-18
Description: Oracle JDeveloper 9.0.4, 9.0.5, and 10.1.2 stores cleartext passwords in (1) IDEConnections.xml, (2) XSQLConfig.xml and (3) settings.xml, which allows local users to obtain sensitive information.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7502&w=2; http://secunia.com/advisories/15991/; http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.html
CVE: CVE-2005-2293
Published: 2005-07-18
Description: Oracle Formsbuilder 9.0.4 stores database usernames and passwords in a temporary file, which is not deleted after it is used, which allows local users to obtain sensitive information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-459
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2307&w=2; http://secunia.com/advisories/15991/; http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.html
CVE: CVE-2005-2294
Published: 2005-07-18
Description: Oracle Forms 4.5, 6.0, 6i, and 9i on Unix, when a large number of records are retrieved by an Oracle form, stores a copy of the database tables in a world-readable temporary file, which allows local users to gain sensitive information such as credit card numbers.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1846&w=2; http://secunia.com/advisories/15991/; http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.html
CVE: CVE-2005-2295
Published: 2005-07-18
Description: NetPanzer 0.8 and earlier allows remote attackers to cause a denial of service (infinite loop) via a packet with a zero datablock size.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/panzone-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1823&w=2; http://secunia.com/advisories/16055
CVE: CVE-2005-2296
Published: 2005-07-18
Description: YabbSE 1.5.5c allows remote attackers to obtain sensitive information via a direct request to ssi_examples.php, which reveals the path.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4760&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4760&w=2
CVE: CVE-2005-1530
Published: 2005-07-19
Description: Sophos Anti-Virus 5.0.1, with "Scan inside archive files" enabled, allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a Bzip2 archive with a large 'Extra field length' value.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1014488; http://www.idefense.com/application/poi/display?id=283&type=vulnerabilities&flashstatus=true; http://www.securityfocus.com/bid/14270
CVE: CVE-2005-1850
Published: 2005-07-19
Description: Certain contributed scripts for ekg Gadu Gadu client 1.5 and earlier create temporary files insecurely, with unknown impact and attack vectors, a different vulnerability than CVE-2005-1916.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7250&w=2; http://www.debian.org/security/2005/dsa-760; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7250&w=2
CVE: CVE-2005-1851
Published: 2005-07-19
Description: A certain contributed script for ekg Gadu Gadu client 1.5 and earlier allows attackers to execute shell commands via unknown attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7250&w=2; http://www.debian.org/security/2005/dsa-760; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7250&w=2
CVE: CVE-2005-2196
Published: 2005-07-19
Description: The Apple AirPort card uses a default WEP key when not connected to a known or trusted network, which can cause it to automatically connect to a malicious network.
CVSS Score: 2.1 (LOW)
References: http://securitytracker.com/id?1014522; http://www.securityfocus.com/bid/14321; http://securitytracker.com/id?1014522
CVE: CVE-2005-2297
Published: 2005-07-19
Description: Stack-based buffer overflow in TreeAction.do in Sybase EAServer 4.2.5 through 5.2 allows remote authenticated users to execute arbitrary code via a large javascript parameter.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2313&w=2; http://secunia.com/advisories/16108; http://securitytracker.com/id?1014497
CVE: CVE-2005-2298
Published: 2005-07-19
Description: BitDefender Engine 1.6.1 and earlier does not properly scan all attachments, which allows remote attackers to bypass virus scanning via begin and end commands in the body of the e-mail, which BitDefender treats as a uuencoded attachment and stops scanning afterwards.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2322&w=2; http://securitytracker.com/id?1014495; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2322&w=2
CVE: CVE-2005-2299
Published: 2005-07-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Simple Message Board Version 2.0 Beta 1 allow remote attackers to inject arbitrary web script or HTML via the (1) FID parameter to forum.cfm, (2) UID parameter to user.cfm, (3) TID parameter to thread.cfm, or (4) PostDate parameter to search.cfm.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1087&w=2; http://securitytracker.com/id?1014494; http://www.securityfocus.com/bid/14266
CVE: CVE-2005-2300
Published: 2005-07-19
Description: Skype 1.1.0.20 and earlier allows local users to overwrite arbitrary files via a symlink attack on the skype_profile.jpg temporary file.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3818&w=2; http://secunia.com/advisories/16105; http://www.zone-h.org/advisories/read/id=7808
CVE: CVE-2005-2301
Published: 2005-07-19
Description: PowerDNS before 2.9.18, when running with an LDAP backend, does not properly escape LDAP queries, which allows remote attackers to cause a denial of service (failure to answer ldap questions) and possibly conduct an LDAP injection attack.
CVSS Score: 5.0 (MEDIUM)
References: http://doc.powerdns.com/changelog.html#CHANGELOG-2-9-18; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0297&w=2; http://securitytracker.com/id?1014504
CVE: CVE-2005-2302
Published: 2005-07-19
Description: PowerDNS before 2.9.18, when allowing recursion to a restricted range of IP addresses, does not properly handle questions from clients that are denied recursion, which could cause a "blank out" of answers to those clients that are allowed to use recursion.
CVSS Score: 2.1 (LOW)
References: http://doc.powerdns.com/changelog.html#CHANGELOG-2-9-18; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0297&w=2; http://securitytracker.com/id?1014504