deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-1634
Published: 2005-05-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in JGS-XA JGS-Portal 3.0.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) anzahl_beitraege parameter to jgs_portal.php, (2) year parameter to jgs_portal_statistik.php, (3) year parameter to jgs_portal_beitraggraf.php, (4) tag parameter to jgs_portal_viewsgraf.php, (5) year parameter to jgs_portal_themengraf.php, (6) year parameter to jgs_portal_mitgraf.php, (7) id parameter to jgs_portal_sponsor.php, or (8) the Accept-Language header to jgs_portal_log.php.  NOTE: this issue may stem from the same core problem as CVE-2005-1633.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8415&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8415&w=2
CVE: CVE-2005-1635
Published: 2005-05-17
Description: JGS-XA JGS-Portal 3.0.2 and earlier allows remote attackers to obtain the full server path via direct requests to (1) jgs_portal_ref.php, (2) jgs_portal_land.php, (3) jgs_portal_log.php, (4) jgs_portal_global_sponsor.php, (5) jgs_portal_global.php, (6) jgs_portal_system.php, (7) jgs_portal_views.php; or multiple files in the jgs_portal_include directory, including (8) jgs_portal_boardmenue.php, (9) jgs_portal_forenliste.php, (10) jgs_portal_geburtstag.php, (11) jgs_portal_guckloch.php, (12) jgs_portal_kalender.php, (13) jgs_portal_letztethemen.php, (14) jgs_portal_links.php, (15) jgs_portal_neustemember.php, (16) jgs_portal_newsboard.php, (17) jgs_portal_online.php, (18) jgs_portal_pn.php, (19) jgs_portal_portalmenue.php, (20) jgs_portal_styles.php, (21) jgs_portal_suchen.php, (22) jgs_portal_team.php, (23) jgs_portal_topforen.php, (24) jgs_portal_topposter.php, (25) jgs_portal_umfrage.php, (26) jgs_portal_useravatar.php, (27) jgs_portal_waronline.php, (28) jgs_portal_woonline.php, or (29) jgs_portal_zufallsavatar.php.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8415&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8415&w=2
CVE: CVE-2005-1636
Published: 2005-05-17
Description: mysql_install_db in MySQL 4.1.x before 4.1.12 and 5.x up to 5.0.4 creates the mysql_install_db.X file with a predictable filename and insecure permissions, which allows local users to execute arbitrary SQL commands by modifying the file's contents.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]5498&w=2; http://secunia.com/advisories/15369; http://secunia.com/advisories/17080
CVE: CVE-2005-1637
Published: 2005-05-17
Description: Multiple SQL injection vulnerabilities in NPDS 4.8 and 5.0 allow remote attackers to execute arbitrary SQL commands via the thold parameter to (1) comments.php or (2) pollcomments.php.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1013973; http://www.npds.org/article.php?sid=1258; http://securitytracker.com/id?1013973
CVE: CVE-2005-1638
Published: 2005-05-17
Description: The _writeAttrs function in SafeHTML before 1.3.2 does not properly handle quotes in attribute values, which could allow remote attackers to exploit cross-site scripting (XSS) vulnerabilities in applications that rely on SafeHTML for protection.
CVSS Score: 4.3 (MEDIUM)
References: http://pixel-apes.com/safehtml/feed; http://secunia.com/advisories/15371; http://www.osvdb.org/16612
CVE: CVE-2005-1639
Published: 2005-05-17
Description: SQL injection vulnerability in Sigmaweb.DLL in Sigma ISP Manager 6.6 allows remote attackers to execute arbitrary SQL commands via the (1) username, (2) password, or (3) domain fields.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15379; http://www.osvdb.org/16620; http://www.under9round.com/sigma.txt
CVE: CVE-2005-1640
Published: 2005-05-17
Description: mod_channel.bas in The Ignition Project ignitionServer 0.3.0 to 0.3.6, and possibly earlier versions, does not properly verify whether a host has the owner privileges required to delete IRC channel access entries, which allows remote attackers to bypass intended restrictions.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15388; http://www.ignition-project.com/security/20050414-hosts-delete-owner-access-entries; http://secunia.com/advisories/15388
CVE: CVE-2005-1641
Published: 2005-05-17
Description: mod_channel in The Ignition Project ignitionServer 0.3.0 to 0.3.6, and possibly earlier versions, does not allow protected operators to access channels that have been locked out by a key, which allows IRC users to cause a denial of service.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/15388; http://www.ignition-project.com/security/20050515-protected-opers-cannot-join-channel-with-key; http://secunia.com/advisories/15388
CVE: CVE-2005-1642
Published: 2005-05-17
Description: SQL injection vulnerability in the verify_email function in Woltlab Burning Board 2.x and earlier allows remote attackers to execute arbitrary SQL commands via the $email variable.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2005-05/0199.html; http://secunia.com/advisories/15395; http://www.attrition.org/pipermail/vim/2005-May/000047.html
CVE: CVE-2005-1643
Published: 2005-05-17
Description: The ZCom_BitStream::Deserialize function in Zoidcom 1.0 beta 4 and earlier allows remote attackers to cause a denial of service via a crafted UDP packet with a large size value, which causes a memory allocation error or an out-of-bounds read.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/zoidboom-adv.txt; http://archives.neohapsis.com/archives/bugtraq/2005-05/0107.html; http://securitytracker.com/id?1013939
CVE: CVE-2005-0134
Published: 2005-05-18
Description: The X server in SCO UnixWare 7.1.1, 7.1.3, and 7.1.4 does not properly create socket directories in /tmp, which could allow attackers to hijack local sockets.
CVSS Score: 4.6 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.8/SCOSA-2005.8.txt; http://www.vupen.com/english/advisories/2005/0077; ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.8/SCOSA-2005.8.txt
CVE: CVE-2005-0515
Published: 2005-05-18
Description: Smc.exe in My Firewall Plus 5.0 build 1117, and possibly other versions, does not drop privileges before launching the Log Viewer export functionality, which allows local users to corrupt arbitrary files by saving log files.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/13577; http://secunia.com/secunia_research/2004-20/advisory/; http://www.securityfocus.com/bid/12842
CVE: CVE-2005-0757
Published: 2005-05-18
Description: The xattr file system code, as backported in Red Hat Enterprise Linux 3 on 64-bit systems, does not properly handle certain offsets, which allows local users to cause a denial of service (system crash) via certain actions on an ext3 file system with extended attributes enabled.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/18056; http://secunia.com/advisories/18059; http://www.debian.org/security/2005/dsa-921
CVE: CVE-2005-1644
Published: 2005-05-18
Description: Cross-site scripting (XSS) vulnerability in guestbook.php for 1Two Livre d'Or 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) livreornom, (2) livreoremail, or (3) livreormessage parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://securitytracker.com/id?1013971; http://www.osvdb.org/16717; http://www.securityfocus.com/bid/13631
CVE: CVE-2005-1645
Published: 2005-05-18
Description: Keyvan1 ImageGallery stores the image.mdb database under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/15362; http://securitytracker.com/id?1013970; http://www.osvdb.org/16618
CVE: CVE-2005-1646
Published: 2005-05-18
Description: The default installation of Fastream NETFile FTP/Web Server 7.4.6, which supports FXP, does not require that the IP address in a PORT command be the same as the IP of the logged in user, which allows remote attackers to conduct FTP Bounce attacks to bypass firewall rules or cause a denial of service.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15394; http://www.osvdb.org/16621; http://www.security.org.sg/vuln/netfileftp746port.html
CVE: CVE-2005-1647
Published: 2005-05-18
Description: Gurgens (GASoft) Guest Book 2.1 stores the db/Genid.dat database file under the web document root with insufficient access control, which allows remote attackers to obtain and decrypt usernames and passwords.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-05/0351.html; http://secunia.com/advisories/15373; http://securitytracker.com/id?1013976
CVE: CVE-2005-1648
Published: 2005-05-18
Description: Gurgens (GASoft) Ultimate Forum 1.0 stores the db/Genid.dat database file under the web document root with insufficient access control, which allows remote attackers to obtain and decrypt usernames and passwords.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-05/0350.html; http://secunia.com/advisories/15374; http://securitytracker.com/id?1013974
CVE: CVE-2005-1649
Published: 2005-05-18
Description: The IPv6 support in Windows XP SP2, 2003 Server SP1, and Longhorn, with Windows Firewall turned off, allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the SYN flag set and the same destination and source address and port, a variant of CVE-2005-0688 and a reoccurrence of the "Land" vulnerability (CVE-1999-0016).
CVSS Score: 5.0 (MEDIUM)
References: http://www.ntbugtraq.com/default.aspx?pid=36&sid=1&A2=ind0505&L=NTBUGTRAQ&P=R409&D=0&F=N&H=0&O=D&T=0; http://www.securityfocus.com/bid/13658; http://www.vupen.com/english/advisories/2005/0559
CVE: CVE-2005-1650
Published: 2005-05-18
Description: The web mail service in Woppoware PostMaster 4.2.2 (build 3.2.5) generates different error messages depending on whether a user exists or not, which allows remote attackers to determine valid usernames.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-203
References: http://secunia.com/advisories/15268; http://www.securityfocus.com/bid/13597; http://secunia.com/advisories/15268
CVE: CVE-2005-1651
Published: 2005-05-18
Description: Directory traversal vulnerability in message.htm for Woppoware PostMaster 4.2.2 (build 3.2.5) allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in the wmm parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15268; http://www.securityfocus.com/bid/13597; http://secunia.com/advisories/15268
CVE: CVE-2005-1652
Published: 2005-05-18
Description: message.htm for Woppoware PostMaster 4.2.2 (build 3.2.5) allows remote attackers to bypass authentication by modifying the email parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15268; http://www.securityfocus.com/bid/13597; http://secunia.com/advisories/15268
CVE: CVE-2005-1653
Published: 2005-05-18
Description: Cross-site scripting (XSS) vulnerability in message.htm for Woppoware PostMaster 4.2.2 (build 3.2.5) allows remote attackers to inject arbitrary web script or HTML via the email parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/15268; http://www.securityfocus.com/bid/13597; http://secunia.com/advisories/15268
CVE: CVE-2005-1654
Published: 2005-05-18
Description: Hosting Controller 6.1 Hotfix 1.9 and earlier allows remote attackers to register arbitrary users via a direct request to addsubsite.asp with the loginname and password parameters set.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: http://isun.shabgard.org/hc3.txt; http://secunia.com/advisories/15271; http://isun.shabgard.org/hc3.txt
CVE: CVE-2005-1655
Published: 2005-05-18
Description: AOL Instant Messenger 5.5.x and earlier allows remote attackers to cause a denial of service (client crash) via an invalid smiley icon location in the sml parameter of a font tag.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/bid/13553; http://www.securityfocus.com/bid/13553
CVE: CVE-2005-1656
Published: 2005-05-18
Description: Mercur Messaging 2005 SP2 allows remote attackers to read the source code of .ctml files via a URL with a trailing hex-encoded space ("%20").
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/15234; http://www.osvdb.org/16218; http://secunia.com/advisories/15234
CVE: CVE-2005-1657
Published: 2005-05-18
Description: Multiple directory traversal vulnerabilities in Mercur Messaging 2005 SP2 allow remote attackers to perform unauthorized file operations via the Folder.Id parameter to (1) deletefolder.ctml, (2) deletemessage.ctml, (3) origmessage.ctml, or (4) readmessage.ctml, the Message.Id parameter to editmessage.ctml, or the (5) Message.Command parameter to messages.ctml.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15234; http://www.osvdb.org/16220; http://www.osvdb.org/16221
CVE: CVE-2005-1658
Published: 2005-05-18
Description: Directory traversal vulnerability in filemanager.cpp in MyServer 0.8 allows remote attackers to list the parent directory of the web root via a URL with a "..."  (triple dot).
CVSS Score: 5.0 (MEDIUM)
References: http://cvs.sourceforge.net/viewcvs.py/myserverweb/myserverweb/source/filemanager.cpp?rev=1.116&view=log; http://secunia.com/advisories/15274; http://cvs.sourceforge.net/viewcvs.py/myserverweb/myserverweb/source/filemanager.cpp?rev=1.116&view=log
CVE: CVE-2005-1659
Published: 2005-05-18
Description: Cross-site scripting (XSS) vulnerability in filemanager.cpp in MyServer 0.8 allows remote attackers to inject arbitrary Javascript via a URL with a "..."  (triple dot) followed by an onmouseover event.
CVSS Score: 4.3 (MEDIUM)
References: http://cvs.sourceforge.net/viewcvs.py/myserverweb/myserverweb/source/filemanager.cpp?rev=1.116&view=log; http://secunia.com/advisories/15274; http://cvs.sourceforge.net/viewcvs.py/myserverweb/myserverweb/source/filemanager.cpp?rev=1.116&view=log
CVE: CVE-2005-1660
Published: 2005-05-18
Description: HTMLJunction EZGuestbook stores the guestbook.mdb file under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as the administrative password.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1013912; http://www.osvdb.org/16444; https://exchange.xforce.ibmcloud.com/vulnerabilities/20487
CVE: CVE-2005-1661
Published: 2005-05-18
Description: Jeuce Personal Webserver 2.13 allows remote attackers to cause a denial of service (server crash) via a long GET request, possibly triggering a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/13732; http://securitytracker.com/id?1013902; http://users.pandora.be/bratax/advisories/b005.html
CVE: CVE-2005-1662
Published: 2005-05-18
Description: Directory traversal vulnerability in Jeuce Personal Web Server 2.13 allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/13732; http://securitytracker.com/id?1012791; http://www.osvdb.org/12718
CVE: CVE-2005-1663
Published: 2005-05-18
Description: Jeuce Personal Web Server 2.13 allows remote attackers to cause a denial of service (server crash) via a GET request beginning with "://".
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/13732; http://securitytracker.com/id?1012791; http://www.osvdb.org/12719
CVE: CVE-2005-1664
Published: 2005-05-18
Description: The __VIEWSTATE functionality in Microsoft ASP.NET 1.x allows remote attackers to conduct replay attacks to (1) apply a ViewState generated from one view to a different view, (2) reuse ViewState information after the application's state has changed, or (3) use the ViewState to conduct attacks or expose content to third parties.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4270&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2517&w=2; http://scottonwriting.net/sowblog/posts/3747.aspx
CVE: CVE-2005-1665
Published: 2005-05-18
Description: The __VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not cryptographically signed, allows remote attackers to cause a denial of service (CPU consumption) via deeply nested markup.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4270&w=2; http://scottonwriting.net/sowblog/posts/3747.aspx; http://secunia.com/advisories/15241
CVE: CVE-2005-1666
Published: 2005-05-18
Description: Multiple buffer overflows in Orenosv HTTP/FTP Server 0.8.1 allow remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via long arguments to FTP commands such as MKD, RMD, or DELE, which are processed by the (1) ftp_xlate_path, (2) ftp_is_canonical, or (3) os_fn_nativize functions, or (4) a long SSI command that is processed by the parse_cmd function in cgissi.exe.
CVSS Score: 7.5 (HIGH)
References: http://hp.vector.co.jp/authors/VA027031/orenosv/index_en.html; http://secunia.com/advisories/15302; http://securitytracker.com/id?1013923
CVE: CVE-2005-1667
Published: 2005-05-18
Description: DataTrac Activity Console 1.1 allows remote attackers to cause a denial of service via a long HTTP GET request.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/15291; http://www.osvdb.org/16168; http://www.securiteam.com/windowsntfocus/5FP052AFPA.html
CVE: CVE-2005-1668
Published: 2005-05-18
Description: YusASP Web Asset Manager 1.0 allows remote attackers to gain privileges via a direct request to assetmanager.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: http://www.osvdb.org/16198; http://www.securiteam.com/windowsntfocus/5OP0115FPQ.html; http://www.securityfocus.com/bid/13501
CVE: CVE-2005-0040
Published: 2005-05-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in DotNetNuke before 3.0.12 allow remote attackers to inject arbitrary web script or HTML via the (1) register a new user page, (2) User-Agent, or (3) Username, which is not properly quoted before sending to the error log.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8591&w=2; http://secunia.com/advisories/15397; http://www.securityfocus.com/bid/13644
CVE: CVE-2005-0392
Published: 2005-05-19
Description: ppxp does not drop root privileges before opening log files, which allows local users to execute arbitrary commands.
CVSS Score: 7.2 (HIGH)
References: http://www.debian.org/security/2005/dsa-725; http://www.securityfocus.com/bid/13681; http://www.debian.org/security/2005/dsa-725
CVE: CVE-2005-1260
Published: 2005-05-19
Description: bzip2 allows remote attackers to cause a denial of service (hard drive consumption) via a crafted bzip2 file that causes an infinite loop (a.k.a "decompression bomb").
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-400
References: ftp://patches.sgi.com/support/free/security/advisories/20060301-01.U.asc; http://docs.info.apple.com/article.html?artnum=307041; http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html
CVE: CVE-2005-1454
Published: 2005-05-19
Description: SQL injection vulnerability in the radius_xlat function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via (1) group_membership_query, (2) simul_count_query, or (3) simul_verify_query configuration entries.
CVSS Score: 7.5 (HIGH)
References: http://www.derkeiler.com/Mailing-Lists/Full-Disclosure/2005-05/0492.html; http://www.freeradius.org/security.html; http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml
CVE: CVE-2005-1455
Published: 2005-05-19
Description: Buffer overflow in the sql_escape_func function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote attackers to cause a denial of service (crash).
CVSS Score: 7.5 (HIGH)
References: http://www.derkeiler.com/Mailing-Lists/Full-Disclosure/2005-05/0492.html; http://www.freeradius.org/security.html; http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml
CVE: CVE-2005-1472
Published: 2005-05-19
Description: Certain system calls in Apple Mac OS X 10.4.1 do not properly enforce the permissions of certain directories without the POSIX read bit set, but with the execute bits set for group or other, which allows local users to list files in otherwise restricted directories.
CVSS Score: 2.1 (LOW)
References: http://lists.apple.com/archives/security-announce/2005/May/msg00004.html; http://lists.apple.com/archives/security-announce/2005/May/msg00004.html
CVE: CVE-2005-1670
Published: 2005-05-19
Description: Unknown vulnerability in Extreme BlackDiamond 10808 and 8800 switches running ExtremeWare XOS 11.1 before 11.1.3.3, 11.0 before 11.0.2.4, and 10.x allows remote authenticated users to execute arbitrary commands.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/15438; http://www.extremenetworks.com/services/documentation/FieldNotices_FN0215-Security_Alert_EXOS.asp; http://www.kb.cert.org/vuls/id/937838
CVE: CVE-2005-1671
Published: 2005-05-19
Description: The Logfile feature in Yahoo! Messenger 5.x through 6.0 can be activated by a YMSGR: URL and writes all output to a single ypager.log file, even when there are multiple users, and does not properly warn later users that the feature has been enabled, which allows local users to obtain sensitive information from other users.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0982&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0982&w=2
CVE: CVE-2005-1672
Published: 2005-05-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Help Center Live allow remote attackers to inject arbitrary web script or HTML via the (1) find parameter to index.php, (2) name or (3) message field of a chat request, or (4) the message body when opening a trouble ticket.
CVSS Score: 4.3 (MEDIUM)
References: http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5; http://www.securityfocus.com/archive/1/398457; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5
CVE: CVE-2005-1673
Published: 2005-05-19
Description: Multiple SQL injection vulnerabilities in Help Center Live allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to index.php, (2) tid parameter to view.php, fid parameter to (3) download.php or (4) chat_download.php, (5) status parameter to icon.php, TICKET_tid parameter to (6) index.php or (7) view.php.
CVSS Score: 7.5 (HIGH)
References: http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5; http://www.securityfocus.com/archive/1/398457/2005-05-15/2005-05-21/0; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5
CVE: CVE-2005-1674
Published: 2005-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in Help Center Live allows remote attackers to perform actions as the administrator via a link or IMG tag to view.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5; http://www.securityfocus.com/archive/1/398457/2005-05-15/2005-05-21/0; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5
CVE: CVE-2005-1934
Published: 2005-05-19
Description: Gaim before 1.3.1 allows remote attackers to cause a denial of service (crash) via a malformed MSN message that leads to a memory allocation of a large size, possibly due to an integer signedness error.
CVSS Score: 5.0 (MEDIUM)
References: http://security.gentoo.org/glsa/glsa-200506-11.xml; http://sourceforge.net/tracker/index.php?func=detail&aid=1205290&group_id=235&atid=100235; http://www.debian.org/security/2005/dsa-734
CVE: CVE-2005-1675
Published: 2005-05-20
Description: Groove Virtual Office before 3.1 build 2338, before 3.1a build 2364, and Groove Workspace before 2.5n build 1871 installs the client installation directories with insecure EVERYBODY permissions, which allows local users to gain sensitive information.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/15421; http://www.kb.cert.org/vuls/id/443370; http://www.kb.cert.org/vuls/id/JGEI-6BCRBX