deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-4071
Published: 2005-12-08
Description: Multiple SQL injection vulnerabilities in CFMagic Magic Forum Personal 2.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ForumID parameter in view_forum.cfm, and (2) ForumID, (3) Thread, and (4) ThreadID parameters in view_thread.cfm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://pridels0.blogspot.com/2005/12/magic-forum-personal-sqlxss-vuln.html; http://secunia.com/advisories/17935; http://www.osvdb.org/21501
CVE: CVE-2005-4072
Published: 2005-12-08
Description: Cross-site scripting (XSS) vulnerability in CFMagic Magic Forum Personal 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the Words parameter in search_forums.cfm, as used in the "Search For:" field.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/magic-forum-personal-sqlxss-vuln.html; http://secunia.com/advisories/17935; http://www.securityfocus.com/bid/15774
CVE: CVE-2005-4073
Published: 2005-12-08
Description: SQL injection vulnerability in view_archive.cfm in CFMagic Magic List Pro 2.5 allows remote attackers to execute arbitrary SQL commands via the ListID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://pridels0.blogspot.com/2005/12/magic-list-pro-25-sql-inj-vuln.html; http://secunia.com/advisories/17937; http://www.osvdb.org/21504
CVE: CVE-2005-4074
Published: 2005-12-08
Description: Directory traversal vulnerability in index.cfm in CF_Nuke 4.6 and earlier, when Sandbox Security is disabled, allows remote attackers to include arbitrary local .cfm files via a .. (dot dot) in the (1) sector or (2) page parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/cfnuke-v46-multiple-vuln.html; http://secunia.com/advisories/17939; http://www.osvdb.org/21505
CVE: CVE-2005-4075
Published: 2005-12-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.cfm in CF_Nuke 4.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) topic and (2) newsid parameter in the news sector, and (3) cat parameter in the links sector.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/cfnuke-v46-multiple-vuln.html; http://secunia.com/advisories/17939; http://www.osvdb.org/21507
CVE: CVE-2005-4076
Published: 2005-12-08
Description: Buffer overflow in Appfluent Technology Database IDS 2.0 allows local users to execute arbitrary code via a long APPFLUENT_HOME environment variable.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0253.html; http://mantis.pulltheplug.org/display.php?offset=8; http://open-security.org/advisories/14
CVE: CVE-2005-4077
Published: 2005-12-08
Description: Multiple off-by-one errors in the cURL library (libcurl) 7.11.2 through 7.15.0 allow local users to trigger a buffer overflow and cause a denial of service or bypass PHP security restrictions via certain URLs that (1) are malformed in a way that prevents a terminating null byte from being added to either a hostname or path buffer, or (2) contain a "?"  separator in the hostname portion, which causes a "/" to be prepended to the resulting string.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-189
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.16/SCOSA-2006.16.txt; http://curl.haxx.se/docs/adv_20051207.html; http://docs.info.apple.com/article.html?artnum=307562
CVE: CVE-2005-4078
Published: 2005-12-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in Ideal BB.NET 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) forumID, (2) boardID, and (3) topicRepeater1-p parameters in topics.aspx, (4) boardID parameter in categoryindex.aspx, (5) postID parameter in posts.aspx, (6) catID parameter in forums.aspx, and (7) memberID parameter in member.aspx.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/ideal-bbnet-13-xss-vuln.html; http://secunia.com/advisories/17906; http://www.osvdb.org/21511
CVE: CVE-2005-4079
Published: 2005-12-08
Description: The register_globals emulation in phpMyAdmin 2.7.0 rc1 allows remote attackers to exploit other vulnerabilities in phpMyAdmin by modifying the import_blacklist variable in grab_globals.php, which can then be used to overwrite other variables.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17925/; http://secunia.com/advisories/17957; http://secunia.com/advisories/18618
CVE: CVE-2005-4080
Published: 2005-12-08
Description: Horde IMP 4.0.4 and earlier does not sanitize strings containing UTF16 null characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via UTF16 encoded attachments and strings that will be executed when viewed using Internet Explorer, which ignores the characters.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/17910; http://securityreason.com/securityalert/232; http://securitytracker.com/id?1015315
CVE: CVE-2005-4081
Published: 2005-12-08
Description: Multiple SQL injection vulnerabilities in Alisveristr E-commerce allow remote attackers to bypass authentication and possibly execute arbitrary SQL commands via the username and password parameters in (1) the user login and (2) administrator login pages.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/228; http://www.osvdb.org/21622; http://www.securityfocus.com/archive/1/418510/100/0/threaded
CVE: CVE-2005-4082
Published: 2005-12-08
Description: The dhcp.client program for QNX 4.25 vmware is setuid, possibly by default, which allows local users to modify the NIC configuration and conduct other attacks.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/17870; http://www.securityfocus.com/archive/1/418513/100/0/threaded; http://www.securityfocus.com/bid/15785
CVE: CVE-2005-4083
Published: 2005-12-08
Description: Directory traversal vulnerability in xs_edit.php in the eXtreme Styles phpBB module 2.2.1 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the edit parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/418518/100/0/threaded; http://www.securityfocus.com/archive/1/418518/100/0/threaded
CVE: CVE-2005-4084
Published: 2005-12-08
Description: xs_edit.php in the phpBB eXtreme Styles module 2.2.1 and earlier allows remote attackers to obtain the installation path of the application via an invalid viewbackup parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/418518/100/0/threaded; http://www.securityfocus.com/archive/1/418518/100/0/threaded
CVE: CVE-2005-3661
Published: 2005-12-08
Description: Dell TrueMobile 2300 Wireless Broadband Router running firmware 3.0.0.8 and 5.1.1.6, and possibly other versions, allows remote attackers to reset authentication credentials, then change configuration or firmware, via a direct request to apply.cgi with the Page parameter set to adv_password.asp.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17936; http://securityreason.com/securityalert/242; http://securitytracker.com/id?1015325
CVE: CVE-2005-3665
Published: 2005-12-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_HOST variable and (2) various scripts in the libraries directory that handle header generation.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/17895; http://secunia.com/advisories/17957; http://secunia.com/advisories/18618
CVE: CVE-2005-4086
Published: 2005-12-08
Description: Directory traversal vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management (SugarCRM) 4.0 beta and earlier allows remote attackers to include arbitrary local files via ".." sequences in the beanFiles array parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://rgod.altervista.org/sugar_suite_40beta.html; http://secunia.com/advisories/17948; http://securitytracker.com/id?1015322
CVE: CVE-2005-4087
Published: 2005-12-08
Description: PHP remote file include vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management (SugarCRM) 4.0 beta and earlier allows remote attackers to execute arbitrary PHP code via a URL in the beanFiles array parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/239; http://www.securityfocus.com/archive/1/418840; http://www.securityfocus.com/bid/15760
CVE: CVE-2005-4088
Published: 2005-12-08
Description: SQL injection vulnerability in index.php in phpForumPro 2.2 allows remote attackers to execute arbitrary SQL commands via the (1) parent and (2) day parameters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17915; http://www.osvdb.org/21484; http://www.securityfocus.com/bid/15736
CVE: CVE-2005-4089
Published: 2005-12-08
Description: Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability."
CVSS Score: 7.1 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/17564; http://securitytracker.com/id?1016291; http://www.hacker.co.il/security/ie/css_import.html
CVE: CVE-2005-4090
Published: 2005-12-08
Description: Unspecified vulnerability in HP-UX B.11.00 to B.11.23, when IPSEC is running, allows remote attackers to have unknown impact.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/17593; http://securitytracker.com/id?1015319; http://www.securityfocus.com/advisories/9812
CVE: CVE-2005-4091
Published: 2005-12-08
Description: Cross-site scripting (XSS) vulnerability in 1search.cgi in 1-Script 1-Search 1.8 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/1-search-xss-vuln.html; http://secunia.com/advisories/17862; http://www.securityfocus.com/bid/15712
CVE: CVE-2005-4092
Published: 2005-12-08
Description: Multiple heap-based buffer overflows in QuickTime.qts in Apple QuickTime Player 7.0.3 and iTunes 6.0.1 (3) and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a .mov file with (1) a Movie Resource atom with a large size value, or (2) an stsd atom with a modified Sample Description Table size value, and possibly other vectors involving media files.  NOTE: item 1 was originally identified by CVE-2005-4127 for a pre-patch announcement, and item 2 was originally identified by CVE-2005-4128 for a pre-patch announcement.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=303101; http://secunia.com/advisories/18149; http://secunia.com/advisories/18370
CVE: CVE-2005-4093
Published: 2005-12-08
Description: Check Point VPN-1 SecureClient NG with Application Intelligence R56, NG FP1, 4.0, and 4.1 allows remote attackers to bypass security policies by modifying the local copy of the local.scv policy file after it has been downloaded from the VPN Endpoint.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/039634.html; http://secunia.com/advisories/17837; http://secunia.com/advisories/23395
CVE: CVE-2005-4094
Published: 2005-12-08
Description: connector.php in the fckeditor2rc2 addon in DoceboLMS 2.0.4 allows remote attackers to execute arbitrary PHP by using the FileUpload command to upload a file that appears to be an image but contains PHP script.
CVSS Score: 7.5 (HIGH)
References: http://rgod.altervista.org/docebo204_xpl.html; http://secunia.com/advisories/1015308; http://secunia.com/advisories/17896
CVE: CVE-2005-4095
Published: 2005-12-08
Description: Directory traversal vulnerability in connector.php in the fckeditor2rc2 addon in DoceboLMS 2.0.4 allows remote attackers to list arbitrary files and directories via ".." sequences in the Type parameter in a GetFoldersAndFiles command.
CVSS Score: 5.0 (MEDIUM)
References: http://rgod.altervista.org/docebo204_xpl.html; http://secunia.com/advisories/1015308; http://secunia.com/advisories/17896
CVE: CVE-2005-4126
Published: 2005-12-09
Description: ** UNVERIFIABLE, PRERELEASE **  NOTE: this issue describes a problem that can not be independently verified as of 20051208.  Unspecified vulnerability in unspecified versions of Real Networks RealPlayer allows attackers to execute arbitrary code.  NOTE: the information regarding this issue is extremely vague and does not provide any verifiable information.  It has been posted by a reliable reporter with a prerelease disclosure policy.  This item has only been assigned a CVE identifier for tracking purposes, and to serve as a concrete example for discussion of the newly emerging UNVERIFIABLE and PRERELEASE content decisions in CVE, which must be discussed by the Editorial Board.  Without additional details or independent verification by reliable sources, it is possible that this item might be RECAST or REJECTED.
CVSS Score: 7.5 (HIGH)
References: http://www.eeye.com/html/research/upcoming/20051130.html; http://www.securityfocus.com/bid/15691; http://www.eeye.com/html/research/upcoming/20051130.html
CVE: CVE-2005-4127
Published: 2005-12-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-4092.  Reason: This candidate is a duplicate of CVE-2005-4092.  This candidate was originally published to handle a pre-patch vague announcement, but multiple simultaneous pre-patch announcements resulted in duplicate CVEs that could not be identified until a full patch was released. Notes: All CVE users should reference CVE-2005-4092 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-4128
Published: 2005-12-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-4092.  Reason: This candidate is a duplicate of CVE-2005-4092.  This candidate was originally published to handle a pre-patch vague announcement, but multiple simultaneous pre-patch announcements resulted in duplicate CVEs that could not be identified until a full patch was released. Notes: All CVE users should reference CVE-2005-4092 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-4129
Published: 2005-12-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-4092.  Reason: This candidate is a reservation duplicate of CVE-2005-4092.  Notes: All CVE users should reference CVE-2005-4092 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-4130
Published: 2005-12-09
Description: ** UNVERIFIABLE, PRERELEASE **  NOTE: this issue describes a problem that can not be independently verified as of 20051208.  Unspecified vulnerability in unspecified versions of Real Networks RealPlayer allows remote attackers to execute arbitrary code.  NOTE: it is not known whether this issue should be MERGED with CVE-2005-4126.  The information regarding this issue is extremely vague and does not provide any verifiable information.  It has been posted by a reliable reporter with a prerelease disclosure policy.  This item has only been assigned a CVE identifier for tracking purposes, and to serve as a concrete example for discussion of the newly emerging UNVERIFIABLE and PRERELEASE content decisions in CVE, which must be discussed by the Editorial Board.  Without additional details or independent verification by reliable sources, it is possible that this item might be RECAST or REJECTED.
CVSS Score: 7.5 (HIGH)
References: http://www.eeye.com/html/research/upcoming/20051116.html; http://www.eeye.com/html/research/upcoming/20051116.html
CVE: CVE-2005-4131
Published: 2005-12-09
Description: Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed range, which could lead to memory corruption involving an argument to the msvcrt.memmove function, aka "Brand new Microsoft Excel Vulnerability," as originally placed for sale on eBay as item number[PII_REDACTED].
CVSS Score: 6.8 (MEDIUM)
References: http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=[PII_REDACTED]; http://informationweek.com/story/showArticle.jhtml?articleID=174910198; http://news.com.com/2061-10789_3-5988086.html
CVE: CVE-2005-4132
Published: 2005-12-09
Description: Unspecified "security leak" vulnerability in Contenido before 4.6.4, when register_globals is on and allow_url_fopen is true, has unspecified impact and attack vectors.  NOTE: it is likely that this is a PHP remote file include vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/apps/freshmeat/2005-12/0008.html; http://www.contenido.org/opensourcecms/en/index-b-21-1616.html; http://www.osvdb.org/21566
CVE: CVE-2005-4133
Published: 2005-12-09
Description: Sun Update Connection in Sun Solaris 10, when configured to use a web proxy, allows local users to obtain the proxy authentication password via (1) an unspecified vector and (2) proxy log files.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/17931; http://securitytracker.com/id?1015331; http://sunsolve.sun.com/searchproxy/document.do?assetkey=1-26-102090-1
CVE: CVE-2005-4134
Published: 2005-12-09
Description: Mozilla Firefox 1.5, Netscape 8.0.4 and 7.2, and K-Meleon before 0.9.12 allows remote attackers to cause a denial of service (CPU consumption and delayed application startup) via a web site with a large title, which is recorded in history.dat but not processed efficiently during startup.  NOTE: despite initial reports, the Mozilla vendor does not believe that this issue can be used to trigger a crash or buffer overflow in Firefox.  Also, it has been independently reported that Netscape 8.1 does not have this issue.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt; ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9629&w=2
CVE: CVE-2005-4135
Published: 2005-12-09
Description: Direct static code injection vulnerability in includes/newtopic.php in SimpleBBS 1.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the Host header (possibly the name parameter or variable), which is then written to data/topics.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17949; http://securitytracker.com/id?1015323; http://www.securityfocus.com/archive/1/418838/100/0/threaded
CVE: CVE-2005-4136
Published: 2005-12-09
Description: Cross-site scripting (XSS) vulnerability in login.php in DRZES HMS 3.2 allows remote attackers to inject arbitrary web script or HTML via the customerEmailAddress parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1015334; http://www.osvdb.org/21743; http://www.securityfocus.com/archive/1/418851/100/0/threaded
CVE: CVE-2005-4137
Published: 2005-12-09
Description: SQL injection vulnerability in viewinvoice.php in DRZES HMS 3.2 allows remote attackers to execute arbitrary SQL commands via the invoiceID parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17755; http://securitytracker.com/id?1015334; http://www.osvdb.org/21180
CVE: CVE-2005-4138
Published: 2005-12-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in ThWboard before 3 Beta 2.84 allow remote attackers to inject arbitrary web script or HTML via the (1) Wohnort and (2) Beruf fields in editprofile.php, (3) user parameter array in v_profile.php, and (4) the action parameter in misc.php.
CVSS Score: 4.3 (MEDIUM)
References: http://kapda.ir/advisory-149.html; http://www.securityfocus.com/archive/1/418837/100/0/threaded; http://www.securityfocus.com/bid/15763
CVE: CVE-2005-4139
Published: 2005-12-09
Description: Multiple SQL injection vulnerabilities in ThWboard before 3 Beta 2.84 allow remote attackers to execute arbitrary SQL commands via the (1) year parameter in calendar.php, (2) user parameter array in v_profile.php, and (3) the userid parameter in misc.php.
CVSS Score: 7.5 (HIGH)
References: http://kapda.ir/advisory-149.html; http://securityreason.com/securityalert/238; http://www.osvdb.org/21737
CVE: CVE-2005-4140
Published: 2005-12-09
Description: SQL injection vulnerability in admin/login/index.php in Website Baker 2.6.0 allows remote attackers to execute arbitrary SQL commands via the username parameter, as used by the user field.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2005-12/0085.html; http://rgod.altervista.org/wbaker_260_xpl.html; http://secunia.com/advisories/17945
CVE: CVE-2005-4141
Published: 2005-12-09
Description: Multiple SQL injection vulnerabilities in ASPMForum allow remote attackers to execute arbitrary SQL commands via the (1) harf parameter in kullanicilistesi.asp and (2) baslik parameter in forum.asp.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17954; http://www.osvdb.org/21538; http://www.osvdb.org/21539
CVE: CVE-2005-3651
Published: 2005-12-10
Description: Stack-based buffer overflow in the dissect_ospf_v3_address_prefix function in the OSPF protocol dissector in Ethereal 0.10.12, and possibly other versions, allows remote attackers to execute arbitrary code via crafted packets.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U; http://anonsvn.ethereal.com/viewcvs/viewcvs.py/trunk/epan/dissectors/packet-ospf.c; http://lists.suse.de/archive/suse-security-announce/2006-Feb/0008.html
CVE: CVE-2005-4142
Published: 2005-12-10
Description: The web interface for subscribing new users in Lyris ListManager 5.0 through 8.8b, in combination with a line wrap feature, allows remote attackers to execute arbitrary list administration commands via LFCR (%0A%0D) sequences in the pw parameter.  NOTE: it is not clear whether this is a variant of a CRLF injection vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0349.html; http://metasploit.com/research/vulns/lyris_listmanager/; http://secunia.com/advisories/17943
CVE: CVE-2005-4143
Published: 2005-12-10
Description: SQL injection vulnerability in Lyris ListManager 5.0 through 8.9a allows remote attackers to execute arbitrary SQL commands via SQL code after a numeric argument to a /read/attachment URL.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0349.html; http://metasploit.com/research/vulns/lyris_listmanager/; http://secunia.com/advisories/17943
CVE: CVE-2005-4144
Published: 2005-12-10
Description: Lyris ListManager 5.0 through 8.9a allows remote attackers to add "ORDER BY" columns to SQL queries via unusual whitespace characters in the orderby parameter, such as (1) newlines and (2) 0xFF (ASCII 255) characters, which are interpreted as whitespace.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0349.html; http://metasploit.com/research/vulns/lyris_listmanager/; http://secunia.com/advisories/17943
CVE: CVE-2005-4145
Published: 2005-12-10
Description: The MSDE version of Lyris ListManager 5.0 through 8.9b configures the sa account in the database to use a password with a small search space ("lyris" and up to 5 digits, possibly from the process ID), which allows remote attackers to gain access via a brute force attack.
CVSS Score: 6.5 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0349.html; http://metasploit.com/research/vulns/lyris_listmanager/; http://secunia.com/advisories/17943