deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-1368
Published: 2005-05-02
Description: The key_user_lookup function in security/keys/key.c in Linux kernel 2.6.10 to 2.6.11.8 may allow attackers to cause a denial of service (oops) via SMP.
CVSS Score: 1.2 (LOW)
References: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.11.8; http://linux.bkbits.net:8080/linux-2.6/cset%40423078fafVa6mAyny23YZ87hDipmTw; http://www.securityfocus.com/archive/1/427980/100/0/threaded
CVE: CVE-2005-1369
Published: 2005-05-02
Description: The (1) it87 and (2) via686a drivers in I2C for Linux 2.6.x before 2.6.11.8, and 2.6.12 before 2.6.12-rc2, create the sysfs "alarms" file with write permissions, which allows local users to cause a denial of service (CPU consumption) by attempting to write to the file, which does not have an associated store function.
CVSS Score: 2.1 (LOW)
References: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.11.8; http://lkml.org/lkml/2005/4/20/159; http://www.securityfocus.com/archive/1/427980/100/0/threaded
CVE: CVE-2005-0106
Published: 2005-05-03
Description: SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGD_PATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/18639; http://www.mandriva.com/security/advisories?name=MDKSA-2006:023; http://www.securityfocus.com/bid/13471
CVE: CVE-2005-0157
Published: 2005-05-03
Description: The confirm add-on in SmartList 3.15 and earlier allows attackers to subscribe arbitrary e-mail addresses by using a valid cookie that specifies an address other than the address for which the cookie was assigned.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2005/dsa-720; http://www.debian.org/security/2005/dsa-720
CVE: CVE-2005-1343
Published: 2005-05-03
Description: Stack-based buffer overflow in the VPN daemon (vpnd) for Mac OS X before 10.3.9 allows local users to execute arbitrary code via a long -i (Server_id) argument.
CVSS Score: 7.2 (HIGH)
References: http://lists.apple.com/archives/security-announce/2005/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2005/May/msg00001.html; http://www.kb.cert.org/vuls/id/706838
CVE: CVE-2005-1370
Published: 2005-05-03
Description: Unknown vulnerability in Radia Management Agent (RMA) in HP OpenView Radia Management Portal (RMP) 1.x and 2.x allows remote attackers to execute arbitrary commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2005-04/0490.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1909&w=2; http://secunia.com/advisories/15089
CVE: CVE-2005-1371
Published: 2005-05-03
Description: BPFTPServer service in BulletProof FTP Server 2.4.0.31 does not properly drop privileges before opening files through the Help menu, which allows local users to gain privileges.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8477&w=2; http://secunia.com/advisories/15152; http://www.osvdb.org/15898
CVE: CVE-2005-1372
Published: 2005-05-03
Description: nvstatsmngr.exe process in BakBone NetVault 7.1 does not properly drop privileges before opening files, which allows local users to gain privileges via the Help menu.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4243&w=2; http://secunia.com/advisories/15158/; http://www.osvdb.org/15900
CVE: CVE-2005-1373
Published: 2005-05-03
Description: Multiple SQL injection vulnerabilities in index.php in Dream4 Koobi CMS 4.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) q or (2) p parameters.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3703&w=2; http://secunia.com/advisories/14696; http://www.osvdb.org/15997
CVE: CVE-2005-1374
Published: 2005-05-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to inject arbitrary web script or HTML via (1) exercise_result.php, (2) exercice_submit.php, (3) agenda.php, (4) learningPathList.php, (5) learningPathAdmin.php, (6) learningPath.php, (7) userLog.php, (8) tool parameter to toolaccess_details.php, (9) data parameter to user_access_details.php, or (10) coursePath parameter to myagenda.php.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3407&w=2; http://secunia.com/advisories/15161; http://secunia.com/advisories/15725
CVE: CVE-2005-1375
Published: 2005-05-03
Description: Multiple SQL injection vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to execute arbitrary SQL commands via (1) learningPath.php, (2) learningPathAdmin.php, (3) learnPath_details.php, (4) modules_pool.php, (5) module.php, (6) uInfo parameter in userInfo.php, or (7) exo_id parameter to exercises_details.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3407&w=2; http://secunia.com/advisories/15161; http://secunia.com/advisories/15725
CVE: CVE-2005-1376
Published: 2005-05-03
Description: Multiple directory traversal vulnerabilities in (1) document.php or (2) insertMyDoc.php in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote project administrators to upload arbitrary files.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3407&w=2; http://secunia.com/advisories/15161; http://secunia.com/advisories/15725
CVE: CVE-2005-1377
Published: 2005-05-03
Description: Multiple PHP remote file inclusion vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to execute arbitrary PHP code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3407&w=2; http://secunia.com/advisories/15161; http://secunia.com/advisories/15725
CVE: CVE-2005-1378
Published: 2005-05-03
Description: SQL injection vulnerability in posting_notes.php in the notes module for phpBB allows remote attackers to execute arbitrary SQL commands via the p parameter, which is used in the $post_id variable, and other attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8372&w=2; http://secunia.com/advisories/15154/; http://securitytracker.com/id?1013827
CVE: CVE-2005-1379
Published: 2005-05-03
Description: The LAM runtime environment package (lam-runtime-7.0.6-2mdk) on Mandrake Linux installs the mpi user without a password, which allows local users to gain privileges.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1060&w=2; http://www.securityfocus.com/bid/13431; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1060&w=2
CVE: CVE-2005-1380
Published: 2005-05-03
Description: Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server parameter to a JndiFramesetAction action.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3010&w=2; http://secunia.com/advisories/15128; http://securitytracker.com/alerts/2005/Apr/1013817.html
CVE: CVE-2005-1381
Published: 2005-05-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in Oracle Webcache 9i allow remote attackers to inject arbitrary web script or HTML via the (1) cache_dump_file or (2) PartialPageErrorPage parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9560&w=2; http://secunia.com/advisories/15143; http://www.osvdb.org/15910
CVE: CVE-2005-1382
Published: 2005-05-03
Description: The webcacheadmin module in Oracle Webcache 9i allows remote attackers to corrupt arbitrary files via a full pathname in the cache_dump_file parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9295&w=2; http://secunia.com/advisories/15143; http://www.osvdb.org/15909
CVE: CVE-2005-1383
Published: 2005-05-03
Description: The OHS component 1.0.2 through 10.x, when UseWebcacheIP is disabled, in Oracle Application Server allows remote attackers to bypass HTTP Server mod_access restrictions via a request to the webcache TCP port 7778.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3952&w=2; http://secunia.com/advisories/15143; http://www.osvdb.org/15908
CVE: CVE-2005-1384
Published: 2005-05-03
Description: Multiple SQL injection vulnerabilities in phpCoin 1.2.2 allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to index.php, (2) phpcoinsessid parameter to login.php, (3) id, (4) dtopic_id, or (5) dcat_id to mod.php.
CVSS Score: 7.5 (HIGH)
References: http://digitalparadox.org/viewadvisories.ah?view=36; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4665&w=2; http://pridels0.blogspot.com/2006/03/phpcoin-poc.html
CVE: CVE-2005-1385
Published: 2005-05-03
Description: Safari 1.3 allows remote attackers to cause a denial of service (application crash) via a long https URL that triggers a NULL pointer dereference.
CVSS Score: 2.6 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4498&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0011&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9272&w=2
CVE: CVE-2005-1386
Published: 2005-05-03
Description: PHP-Nuke 7.6 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) ipban.php, (2) db.php, (3) lang-norwegian.php, (4) lang-indonesian.php, (5) lang-greek.php, (6) a request to Web_Links with the portuguese language (lang-portuguese.php), (7) a request to Web_Links with the indonesian language (lang-indonesian.php), (8) a request to the survey module with the indonesian language (lang-indonesian.php), (9) a request to the Reviews module with the portuguese language, or (10) a request to the Journal module with the portuguese language, which reveal the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9035&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9035&w=2
CVE: CVE-2005-1387
Published: 2005-05-03
Description: Cocktail 3.5.4 and possibly earlier in Mac OS X passes the administrative password on the command line to sudo in cleartext, which allows local users to gain sensitive information by running listing processes.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0362&w=2; http://secunia.com/advisories/15201; http://www.osvdb.org/16046
CVE: CVE-2005-1388
Published: 2005-05-03
Description: Cross-site scripting (XSS) vulnerability in SURVIVOR before 0.9.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://www.columbia.edu/acis/dev/projects/survivor/doc/todo.html#changelog; http://www.osvdb.org/15905; http://www.securityfocus.com/bid/13415
CVE: CVE-2005-1389
Published: 2005-05-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-0175.  Reason: This candidate is a duplicate of CVE-2005-0175.  Notes: All CVE users should reference CVE-2005-0175 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-1390
Published: 2005-05-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-0174.  Reason: This candidate is a duplicate of CVE-2005-0174.  Notes: All CVE users should reference CVE-2005-0174 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-1391
Published: 2005-05-03
Description: Buffer overflow in the add_port function in APSIS Pound 1.8.2 and earlier allows remote attackers to execute arbitrary code via a long Host HTTP header.
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=307852; http://secunia.com/advisories/15142; http://secunia.com/advisories/15202
CVE: CVE-2005-1392
Published: 2005-05-03
Description: The SQL install script in phpMyAdmin 2.6.2 is created with world-readable permissions, which allows local users to obtain the initial database password by reading the script.
CVSS Score: 4.6 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=88831; http://security.gentoo.org/glsa/glsa-200504-30.xml; http://www.osvdb.org/16053
CVE: CVE-2005-1393
Published: 2005-05-03
Description: Multiple buffer overflows in ArcGIS for ESRI ArcInfo Workstation 9.0 allow local users to execute arbitrary code via long command line arguments to (1) asmaster, (2) asuser, (3) asutility, (4) se, or (5) asrecovery.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]4630&w=2; http://secunia.com/advisories/15196; http://securitytracker.com/id?1013852
CVE: CVE-2005-1394
Published: 2005-05-03
Description: Format string vulnerability in ArcGIS for ESRI ArcInfo Workstation 9.0 allows local users to gain privileges via format string specifiers in the ARCHOME environment variable to (1) wservice or (2) lockmgr.
CVSS Score: 7.2 (HIGH)
CWE: CWE-134
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]4630&w=2; http://secunia.com/advisories/15196; http://securitytracker.com/id?1013852
CVE: CVE-2005-1395
Published: 2005-05-03
Description: Buffer overflow in Ce/Ceterm (aka ARPUS/Ce) 2.5.4 and earlier may allow local users to gain privileges via a long (1) XAPPLRESLANGPATH or (2) XAPPLRESDIR environment variable, or (3) command line argument.
CVSS Score: 7.2 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-May/033705.html; http://secunia.com/advisories/15197; http://securitytracker.com/id?1013855
CVE: CVE-2005-1396
Published: 2005-05-03
Description: Race condition in Ce/Ceterm (aka ARPUS/Ce) 2.5.4 and earlier allows local users to write to arbitrary files via a symlink attack on the ce_edit_log temporary file.
CVSS Score: 1.2 (LOW)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-May/033705.html; http://secunia.com/advisories/15197; http://securitytracker.com/id?1013855
CVE: CVE-2005-1397
Published: 2005-05-03
Description: SQL injection vulnerability in search.php for PHP-Calendar before 0.10.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15116; http://sourceforge.net/project/shownotes.php?release_id=323483; http://www.osvdb.org/15866
CVE: CVE-2005-1398
Published: 2005-05-03
Description: phpcart.php in PHPCart 3.2 allows remote attackers to change product price information by modifying the (1) price or (2) postage parameters.  NOTE: it was later reported that 3.4 through 4.6.4 are also affected.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lostmon.blogspot.com/2005/04/phpcart-price-manipulation.html; http://secunia.com/advisories/15147; http://www.osvdb.org/15859
CVE: CVE-2005-1401
Published: 2005-05-03
Description: Format string vulnerability in the client for Mtp-Target 1.2.2 and earlier allows remote attackers to execute arbitrary code via game messages or other text.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/mtpbugs-adv.txt; http://www.security-focus.com/archive/1/397304; http://aluigi.altervista.org/adv/mtpbugs-adv.txt
CVE: CVE-2005-1402
Published: 2005-05-03
Description: Integer signedness error in certain older versions of the NeL library, as used in Mtp-Target 1.2.2 and earlier, and possibly other products, allows remote attackers to cause a denial of service (memory consumption or server crash) via a negative value in a STLport call, which is not caught by a signed comparison.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/mtpbugs-adv.txt; http://www.security-focus.com/archive/1/397304; http://aluigi.altervista.org/adv/mtpbugs-adv.txt
CVE: CVE-2005-1403
Published: 2005-05-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in JustWilliam's Amazon Webstore 04050100 allow remote attackers to inject arbitrary web script or HTML via the (1) image parameter to closeup.php, the (2) currentIsExpanded or (3) searchFor parameters to index.php, (4) the currentNumber parameter to software_CAD_Technical_60002_uk.htm, or (5) a cookie.
CVSS Score: 6.8 (MEDIUM)
References: http://lostmon.blogspot.com/2005/04/amazon-webstore-script-injection-and.html; http://secunia.com/advisories/15155; http://securitytracker.com/id?1013836
CVE: CVE-2005-1404
Published: 2005-05-03
Description: MyPHP Forum 1.0 allows remote attackers to spoof the username by modifying the (1) nbuser parameter to post.php or (2) sender parameter to privmsg.php.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/15166; http://www.osvdb.org/15902; http://www.osvdb.org/15903
CVE: CVE-2005-1405
Published: 2005-05-03
Description: HTTP response splitting vulnerability in the @SetHTTPHeader function in Lotus Domino 6.5.x before 6.5.4 and 6.0.x before 6.0.5 allows attackers to poison the web cache via malicious applications.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/14879; http://securitytracker.com/id?1013839; http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21202437
CVE: CVE-2005-1407
Published: 2005-05-03
Description: Skype for Windows 1.2.0.0 to 1.2.0.46 allows local users to bypass the identity check for an authorized application, then call arbitrary Skype API functions by modifying or replacing that application.
CVSS Score: 4.6 (MEDIUM)
References: http://www.skype.com/security/ssa-2005-01.html; http://www.skype.com/security/ssa-2005-01.html
CVE: CVE-2005-1409
Published: 2005-05-03
Description: PostgreSQL 7.3.x through 8.0.x gives public EXECUTE access to certain character conversion functions, which allows unprivileged users to call those functions with malicious values, with unknown impact, aka the "Character conversion vulnerability."
CVSS Score: 7.5 (HIGH)
References: http://archives.postgresql.org/pgsql-announce/2005-05/msg00001.php; http://www.novell.com/linux/security/advisories/2005_36_sudo.html; http://www.postgresql.org/about/news.315
CVE: CVE-2005-1410
Published: 2005-05-03
Description: The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex_init, (2) snb_en_init, (3) snb_ru_init, (4) spell_init, and (5) syn_init functions as "internal" even when they do not take an internal argument, which allows attackers to cause a denial of service (application crash) and possibly have other impacts via SQL commands that call other functions that accept internal arguments.
CVSS Score: 2.1 (LOW)
References: http://archives.postgresql.org/pgsql-announce/2005-05/msg00001.php; http://www.novell.com/linux/security/advisories/2005_36_sudo.html; http://www.postgresql.org/about/news.315
CVE: CVE-2005-1411
Published: 2005-05-03
Description: Cybration ICUII 7.0 stores passwords in plaintext in the world-readable icuii.ini file, which allows local users to gain privileges.
CVSS Score: 4.6 (MEDIUM)
References: http://osvdb.org/ref/14/14688-icuii.txt; http://secunia.com/advisories/15171; http://securitytracker.com/id?1013828
CVE: CVE-2005-1412
Published: 2005-05-03
Description: SQL injection vulnerability in verify.asp for Ecomm Professional Guestbook 3.x allows remote attackers to execute arbitrary SQL commands via the AdminPWD parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15190; http://www.osvdb.org/15967; http://secunia.com/advisories/15190
CVE: CVE-2005-1413
Published: 2005-05-03
Description: Multiple SQL injection vulnerabilities in enVivo!CMS allow remote attackers to execute arbitrary SQL commands and gain privileges via the (1) username or (2) password parameters to admin_login.asp, or the (3) searchstring and possibly (4) ID parameters to default.asp.
CVSS Score: 7.5 (HIGH)
References: http://digitalparadox.org/viewadvisories.ah?view=37; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2945&w=2; http://secunia.com/advisories/15173
CVE: CVE-2005-1414
Published: 2005-05-03
Description: ExoticSoft FilePocket 1.2 stores sensitive proxy information, including proxy passwords, in plaintext in the registry, which allows local users to gain privileges.
CVSS Score: 4.6 (MEDIUM)
References: http://securitytracker.com/id?1013823; http://www.osvdb.org/14685; http://www.securityfocus.com/bid/13445
CVE: CVE-2005-1415
Published: 2005-05-03
Description: Buffer overflow in GlobalSCAPE Secure FTP Server 3.0.2 allows remote authenticated users to execute arbitrary code via a long FTP command.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-04/0674.html; http://www.cuteftp.com/gsftps/history.asp; http://www.securityfocus.com/bid/13454
CVE: CVE-2005-1416
Published: 2005-05-03
Description: Directory traversal vulnerability in 04WebServer 1.81 allows remote attackers to read files outside of the web root but within the installation folder.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/ref/16/16067-04webserver.txt; http://secunia.com/advisories/15230; http://www.osvdb.org/16067
CVE: CVE-2005-1417
Published: 2005-05-03
Description: Multiple SQL injection vulnerabilities in MaxWebPortal 2.x, 1.35, and other versions allow remote attackers to execute arbitrary SQL commands via (1) article_popular.asp, (2) arguments to dl_popular.asp, (3) arguments to links_popular.asp, (4) arguments to pic_popular.asp, (5) article_rate.asp, (6) dl_rate.asp, (7) links_rate.asp, (8) pic_rates.asp, (9) article_toprated.asp, (10) dl_toprated.asp, (11) links_toprated.asp, (12) arguments to pic_toprated.asp, or (13) the TOPIC_ID or Forum_ID parameters to custom_link.asp.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15214; http://securitytracker.com/id?1013845; http://www.maxwebportal.info/downloads/mwp_security_fixes.zip
CVE: CVE-2005-1418
Published: 2005-05-03
Description: NetLeaf Limited NotJustBrowsing 1.0.3 stores the View Lock Password in plaintext in the notjustbrowsing.prf file, which allows local users to gain privileges.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/15184; http://securitytracker.com/id?1013826; http://www.osvdb.org/14687
CVE: CVE-2005-1419
Published: 2005-05-03
Description: SQL injection vulnerability in the admin login panel for Ocean12 Mailing List Manager 1.06 allows remote attackers to execute arbitrary SQL commands via the Admin_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2005-04/0491.html; http://secunia.com/advisories/15178; http://securitytracker.com/id?1013833
CVE: CVE-2005-1420
Published: 2005-05-03
Description: Raysoft/Raybase Video Cam Server 1.0.0 beta allows remote attackers to determine the full pathname of the server via a request for an invalid page, as demonstrated using "%20" (hex-encoded space).
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1013860; http://www.autistici.org/fdonato/advisory/VideoCamServer1.0.0-adv.txt; http://securitytracker.com/id?1013860
CVE: CVE-2005-1421
Published: 2005-05-03
Description: Directory traversal vulnerability in Raysoft/Raybase Video Cam Server 1.0.0 beta allows remote attackers to read arbitrary files via ".." (dot dot) sequences in an HTTP request.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1013860; http://www.autistici.org/fdonato/advisory/VideoCamServer1.0.0-adv.txt; http://securitytracker.com/id?1013860
CVE: CVE-2005-1422
Published: 2005-05-03
Description: Raysoft/Raybase Video Cam Server 1.0.0 beta allows remote attackers to conduct administrator operations and cause a denial of service (server or camera shutdown) via a direct request to admin.html.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1013860; http://www.autistici.org/fdonato/advisory/VideoCamServer1.0.0-adv.txt; http://securitytracker.com/id?1013860
CVE: CVE-2005-1423
Published: 2005-05-03
Description: Directory traversal vulnerability in the mail program in 602LAN SUITE 2004.0.05.0413 allows remote attackers to cause a denial of service and determine the presence of arbitrary files via .. sequences in the A parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/15231; http://www.osvdb.org/16069; http://secunia.com/advisories/15231