deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-0959
Published: 2005-05-02
Description: Buffer overflow in the mt_do_dir function in YepYep mtftpd 0.0.3 may allow attackers to execute arbitrary code via a long path.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/12947; http://www.tripbit.org/advisories/TA-040305.txt; http://www.securityfocus.com/bid/12947
CVE: CVE-2005-0960
Published: 2005-05-02
Description: Multiple vulnerabilities in the SACK functionality in (1) tcp_input.c and (2) tcp_usrreq.c OpenBSD 3.5 and 3.6 allow remote attackers to cause a denial of service (memory exhaustion or system crash).
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1013611; http://www.openbsd.org/errata.html#sack; http://www.openbsd.org/errata35.html#sack
CVE: CVE-2005-0961
Published: 2005-05-02
Description: Cross-site scripting (XSS) vulnerability in Horde 3.0.4 before 3.0.4-RC2 allows remote attackers to inject arbitrary web script or HTML via the parent frame title.
CVSS Score: 4.3 (MEDIUM)
References: http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.49&r2=1.515.2.93&ty=h; http://lists.horde.org/archives/announce/2005/000176.html; http://secunia.com/advisories/14730
CVE: CVE-2005-0962
Published: 2005-05-02
Description: SQL injection vulnerability in index.php for Lighthouse Squirrelcart allows remote attackers to execute arbitrary SQL commands via the (1) crn parameter in a show action or (2) rn parameter in a show_detail action.
CVSS Score: 7.5 (HIGH)
References: http://digitalparadox.org/advisories/sqc.txt; http://secunia.com/advisories/14770; http://www.securityfocus.com/bid/12944
CVE: CVE-2005-0963
Published: 2005-05-02
Description: An error in the Toshiba ACPI BIOS 1.6 causes the BIOS to only examine the first slot in the Master Boot Record (MBR) table for an active partition, which prevents the system from booting even though the MBR is not malformed.  NOTE: it has been debated as to whether or not this issue poses a security vulnerability, since administrative privileges would be required, and other DoS attacks are possible with such privileges.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4810&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8629&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2643&w=2
CVE: CVE-2005-0964
Published: 2005-05-02
Description: Unknown vulnerability in Kerio Personal Firewall 4.1.2 and earlier allows local users to bypass firewall rules via a malicious process that impersonates a legitimate process that has fewer restrictions.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/14717; http://securitytracker.com/id?1013607; http://www.kerio.com/security_advisory.html#0503
CVE: CVE-2005-0965
Published: 2005-05-02
Description: The gaim_markup_strip_html function in Gaim 1.2.0, and possibly earlier versions, allows remote attackers to cause a denial of service (application crash) via a string that contains malformed HTML, which causes an out-of-bounds read.
CVSS Score: 5.0 (MEDIUM)
References: http://gaim.sourceforge.net/security/index.php?id=13; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7356&w=2; http://secunia.com/advisories/14815
CVE: CVE-2005-0966
Published: 2005-05-02
Description: The IRC protocol plugin in Gaim 1.2.0, and possibly earlier versions, allows (1) remote attackers to inject arbitrary Gaim markup via irc_msg_kick, irc_msg_mode, irc_msg_part, irc_msg_quit, (2) remote attackers to inject arbitrary Pango markup and pop up empty dialog boxes via irc_msg_invite, or (3) malicious IRC servers to cause a denial of service (application crash) by injecting certain Pango markup into irc_msg_badmode, irc_msg_banned, irc_msg_unknown, irc_msg_nochan functions.
CVSS Score: 6.4 (MEDIUM)
References: http://gaim.sourceforge.net/security/index.php?id=14; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7356&w=2; http://secunia.com/advisories/14815
CVE: CVE-2005-0967
Published: 2005-05-02
Description: Gaim 1.2.0 allows remote attackers to cause a denial of service (application crash) via a malformed file transfer request to a Jabber user, which leads to an out-of-bounds read.
CVSS Score: 5.0 (MEDIUM)
References: http://gaim.sourceforge.net/security/?id=15; http://secunia.com/advisories/14815; http://securitytracker.com/id?1013645
CVE: CVE-2005-0968
Published: 2005-05-02
Description: Computer Associates (CA) eTrust Intrusion Detection 3.0 allows remote attackers to cause a denial of service via large size values that are not properly validated before calling the CPImportKey function in the Crypto API.
CVSS Score: 5.0 (MEDIUM)
References: http://www.idefense.com/application/poi/display?id=223&type=vulnerabilities; http://www.idefense.com/application/poi/display?id=223&type=vulnerabilities
CVE: CVE-2005-0970
Published: 2005-05-02
Description: Mac OS X 10.3.9 and earlier allows users to install, create, and execute setuid/setgid scripts, contrary to the intended design, which may allow attackers to conduct unauthorized activities with escalated privileges via vulnerable scripts.
CVSS Score: 7.6 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2005/Apr/msg00000.html; http://lists.apple.com/archives/security-announce/2005/Apr/msg00000.html
CVE: CVE-2005-0975
Published: 2005-05-02
Description: Integer signedness error in the parse_machfile function in the mach-o loader (mach_loader.c) for the Darwin Kernel as used in Mac OS X 10.3.7, and other versions before 10.3.9, allows local users to cause a denial of service (CPU consumption) via a crafted mach-o header.
CVSS Score: 2.1 (LOW)
References: http://felinemenace.org/advisories/macosx.txt; http://lists.apple.com/archives/security-announce/2005/Apr/msg00000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3671&w=2
CVE: CVE-2005-0976
Published: 2005-05-02
Description: AppleWebKit (WebCore and WebKit), as used in multiple products such as Safari 1.2 and OmniGroup OmniWeb 5.1, allows remote attackers to read arbitrary files via the XMLHttpRequest Javascript component, as demonstrated using automatically mounted disk images and file:// URLs.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2005/Apr/msg00000.html; http://remahl.se/david/vuln/001/; http://lists.apple.com/archives/security-announce/2005/Apr/msg00000.html
CVE: CVE-2005-0977
Published: 2005-05-02
Description: The shmem_nopage function in shmem.c for the tmpfs driver in Linux kernel 2.6 does not properly verify the address argument, which allows local users to cause a denial of service (kernel crash) via an invalid address.
CVSS Score: 2.1 (LOW)
References: http://linux.bkbits.net:8080/linux-2.6/cset%40420551fbRlv9-QG6Gw9Lw_bKVfPSsg; http://lkml.org/lkml/2005/2/5/111; http://www.redhat.com/support/errata/RHSA-2005-366.html
CVE: CVE-2005-0978
Published: 2005-05-02
Description: Directory traversal vulnerability in the Object Push service in IVT BlueSoleil 1.4 allows remote attackers to upload arbitrary files via a .. (dot dot) in a PUSH command.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6503&w=2; http://secunia.com/advisories/14790/; http://www.digitalmunition.com/DMA%5B2005-0401a%5D.txt
CVE: CVE-2005-0979
Published: 2005-05-02
Description: Multiple buffer overflows in RUMBA 7.3 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via crafted values in a profile file, as demonstrated using a long SysName field.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6500&w=2; http://www.securityfocus.com/bid/12965; https://exchange.xforce.ibmcloud.com/vulnerabilities/19934
CVE: CVE-2005-0980
Published: 2005-05-02
Description: PHP remote file inclusion vulnerability in index.php in AlstraSoft EPay Pro 2.0 allows remote attackers to execute arbitrary PHP code by modifying the view parameter to reference a URL on a remote web server that contains the code.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1626&w=2; http://secunia.com/advisories/14802; http://www.securityfocus.com/bid/12973
CVE: CVE-2005-0981
Published: 2005-05-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft EPay Pro 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) payment or (2) send parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1626&w=2; http://secunia.com/advisories/14802; http://www.securityfocus.com/bid/12974
CVE: CVE-2005-0982
Published: 2005-05-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Yet Another Forum.net 0.9.9 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) location, or (3) Subject field.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1262&w=2; http://securitytracker.com/id?1013632; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1262&w=2
CVE: CVE-2005-0983
Published: 2005-05-02
Description: Quake 3 engine, as used in multiple games, allows remote attackers to cause a denial of service (client disconnect) via a long message, which is not properly truncated and causes the engine to process the remaining data as if it were network data.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/q3msgboom-adv.txt; http://bani.anime.net/banimod/forums/viewtopic.php?p=27322; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8067&w=2
CVE: CVE-2005-0984
Published: 2005-05-02
Description: Buffer overflow in the G_Printf function in Star Wars Jedi Knight: Jedi Academy 1.011 and earlier allows remote attackers to execute arbitrary code via a long message using commands such as (1) say and (2) tell.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/jamsgbof-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3653&w=2; http://secunia.com/advisories/14809
CVE: CVE-2005-0986
Published: 2005-05-02
Description: NLSCCSTR.DLL in the web service in IBM Lotus Domino Server 6.5.1, 6.0.3, and possibly other versions allows remote attackers to cause a denial of service (deep recursion and nHTTP.exe process crash) via a long GET request containing UNICODE decimal value 430 characters, which causes the stack to be exhausted.  NOTE: IBM has reported that it is unable to replicate this issue.
CVSS Score: 5.0 (MEDIUM)
References: http://news.zdnet.co.uk/software/applications/0%2C39020384%2C39194293%2C00.htm; http://secunia.com/advisories/14858; http://www-1.ibm.com/support/docview.wss?uid=swg21202446
CVE: CVE-2005-0987
Published: 2005-05-02
Description: Unknown vulnerability in IRC Services NickServ LISTLINKS before 5.0.50 allows remote attackers to obtain the links of a nick.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1013622; http://www.ircservices.esper.net/Changes.txt; http://securitytracker.com/id?1013622
CVE: CVE-2005-0988
Published: 2005-05-02
Description: Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete.
CVSS Score: 3.7 (LOW)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.58/SCOSA-2005.58.txt; http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html; http://rhn.redhat.com/errata/RHSA-2005-357.html
CVE: CVE-2005-0989
Published: 2005-05-02
Description: The find_replen function in jsstr.c in the Javascript engine for Mozilla Suite 1.7.6, Firefox 1.0.1 and 1.0.2, and Netscape 7.2 allows remote attackers to read portions of heap memory in a Javascript string via the lambda replace method.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt; http://secunia.com/advisories/14820; http://secunia.com/advisories/14821
CVE: CVE-2005-0990
Published: 2005-05-02
Description: unshar (unshar.c) in sharutils 4.2.1 allows local users to overwrite arbitrary files via a symlink attack on the unsh.X temporary file.
CVSS Score: 2.1 (LOW)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=302412; http://www.redhat.com/support/errata/RHSA-2005-377.html; http://www.securityfocus.com/bid/12981
CVE: CVE-2005-0991
Published: 2005-05-02
Description: RC.BOOT in IBM AIX 5.1, 5.2, and 5.3 does not "use a secure location for temporary files," which allows local users to have an unknown impact, probably by overwriting files.
CVSS Score: 2.1 (LOW)
References: http://www-1.ibm.com/support/search.wss?rs=0&q=IY59205&apar=only; http://www-1.ibm.com/support/search.wss?rs=0&q=IY59206&apar=only; http://www-1.ibm.com/support/search.wss?rs=0&q=IY59207&apar=only
CVE: CVE-2005-0992
Published: 2005-05-02
Description: Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin before 2.6.2-rc1 allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2660&w=2; http://secunia.com/advisories/14799; http://www.arrelnet.com/advisories/adv20050403.html
CVE: CVE-2005-0993
Published: 2005-05-02
Description: Buffer overflow in nwprint in SCO OpenServer 5.0.7 allows local users to execute arbitrary code via a long command line argument.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8491&w=2; http://www.securityfocus.com/bid/12986; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8491&w=2
CVE: CVE-2005-0994
Published: 2005-05-02
Description: Multiple SQL injection vulnerabilities in ProductCart 2.7 allow remote attackers to execute arbitrary SQL commands via (1) the Category or resultCnt parameters to advSearch_h.asp, and possibly (2) the offset parameter to tarinasworld_butterflyjournal.asp. NOTE: it is possible that item (2) is the result of a typo or editing error from the original research report.
CVSS Score: 7.5 (HIGH)
References: http://digitalparadox.org/advisories/prodcart.txt; http://secunia.com/advisories/14833; http://www.osvdb.org/15263
CVE: CVE-2005-0995
Published: 2005-05-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in ProductCart 2.7 allow remote attackers to inject arbitrary web script or HTML via (1) the keyword parameter to advSearch_h.asp, (2) the redirectUrl parameter to NewCust.asp, (3) the country parameter to storelocator_submit.asp, or (4) the error parameter to techErr.asp. NOTE: it has been reported that storelocator_submit.asp does not exist in ProductCart.
CVSS Score: 4.3 (MEDIUM)
References: http://digitalparadox.org/advisories/prodcart.txt; http://secunia.com/advisories/14833; http://www.osvdb.org/15264
CVE: CVE-2005-0996
Published: 2005-05-02
Description: Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the email or url parameters in the Add function, (2) the min parameter in the viewsdownload function, or (3) the min parameter in the search function.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4764&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4764&w=2
CVE: CVE-2005-0997
Published: 2005-05-02
Description: Multiple SQL injection vulnerabilities in the Web_Links module for PHP-Nuke 7.6 allow remote attackers to execute arbitrary SQL commands via (1) the email or url parameters in the Add function, (2) the url parameter in the modifylinkrequestS function, (3) the orderby or min parameters in the viewlink function, (4) the orderby, min, or show parameters in the search function, or (5) the ratenum parameter in the MostPopular function.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4764&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4764&w=2
CVE: CVE-2005-0998
Published: 2005-05-02
Description: The Web_Links module for PHP-Nuke 7.6 allows remote attackers to obtain sensitive information via an invalid show parameter, which triggers a division by zero PHP error that leaks the full pathname of the server.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4764&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4764&w=2
CVE: CVE-2005-0999
Published: 2005-05-02
Description: SQL injection vulnerability in the Top module for PHP-Nuke 6.x through 7.6 allows remote attackers to execute arbitrary SQL commands via the querylang parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6901&w=2; http://www.waraxe.us/advisory-41.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6901&w=2
CVE: CVE-2005-1000
Published: 2005-05-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the bid parameter to the EmailStats op in banners.pgp, (2) the ratenum parameter in the TopRated and MostPopular actions in the Web_Links module, (3) the ttitle parameter in the viewlinkdetails, viewlinkeditorial, viewlinkcomments, and ratelink actions in the Web_Links module, or (4) the username parameter in the Your_Account module.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2005-04/0037.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8478&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/19952
CVE: CVE-2005-1001
Published: 2005-05-02
Description: PHP-Nuke 7.6 allows remote attackers to obtain sensitive information via direct requests to (1) the Surveys module with the file parameter set to comments or (2) 3D-Fantasy/theme.php, which leaks the full pathname of the web server in a PHP error message.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2005-04/0037.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/19953; http://archives.neohapsis.com/archives/bugtraq/2005-04/0037.html
CVE: CVE-2005-1002
Published: 2005-05-02
Description: logwebftbs2000.exe in Logics Software File Transfer (LOG-FT) allows remote attackers to read arbitrary files via modified (1) VAR_FT_LANG and (2) VAR_FT_TMPL parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6436&w=2; http://secunia.com/advisories/14851; http://www.securityfocus.com/bid/12998
CVE: CVE-2005-1003
Published: 2005-05-02
Description: Directory traversal vulnerability in index.php for ProfitCode PayProCart 3.0 allows remote attackers to include arbitrary PHP files via .. (dot dot) sequences in the modID parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6090&w=2; http://secunia.com/advisories/14832; http://securitytracker.com/id?1013640
CVE: CVE-2005-1004
Published: 2005-05-02
Description: Cross-site scripting (XSS) vulnerability in usrdetails.php in ProfitCode PayProCart 3.0 allows remote attackers to inject arbitrary web script or HTML via the sgnuptype parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6090&w=2; http://secunia.com/advisories/14832; http://securitytracker.com/id?1013640
CVE: CVE-2005-1005
Published: 2005-05-02
Description: ProfitCode PayProCart 3.0 allows remote attackers to bypass authentication and gain administrative privileges to the admin control panel, as demonstrated via a direct request to adminshop/index.php with hex-encoded .. sequences in the ftoedit parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6090&w=2; http://secunia.com/advisories/14832; http://securitytracker.com/id?1013640
CVE: CVE-2005-1006
Published: 2005-05-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in SonicWALL SOHO 5.1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the URL or (2) the user login name, which is not filtered when the administrator views the log file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2005-04/0041.html; http://secunia.com/advisories/14823; http://securitytracker.com/id?1013638
CVE: CVE-2005-1007
Published: 2005-05-02
Description: Unknown vulnerability in the LIST functionality in CommuniGate Pro before 4.3c3 allows remote attackers to cause a denial of service (server crash) via certain multipart messages.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/14604; http://www.osvdb.org/15257; http://www.stalker.com/CommuniGatePro/History.html
CVE: CVE-2005-1008
Published: 2005-05-02
Description: Cross-site scripting (XSS) vulnerability in posts.asp for ASP-DEv XM Forum RC3 allows remote attackers to inject arbitrary web script or HTML via a "javascript:" URL in an IMG tag.
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1013614; http://www.securityfocus.com/bid/12958; http://securitytracker.com/id?1013614
CVE: CVE-2005-1009
Published: 2005-05-02
Description: Multiple buffer overflows in BakBone NetVault 6.x and 7.x allow (1) remote attackers to execute arbitrary code via a modified computer name and length that leads to a heap-based buffer overflow, or (2) local users to execute arbitrary code via a long Name entry in the configure.cfg file.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/14814; http://securitytracker.com/id?1013625; http://www.class101.org/netv-locsbof.pdf
CVE: CVE-2005-1010
Published: 2005-05-02
Description: Cross-site scripting (XSS) vulnerability in Comersus Cart 6 allows remote attackers to inject arbitrary web script or HTML via the account username.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/14825; http://securitytracker.com/id?1013634; http://www.securityfocus.com/bid/13000
CVE: CVE-2005-1011
Published: 2005-05-02
Description: SQL injection vulnerability in content.asp in SiteEnable allows remote attackers to execute arbitrary SQL commands via the sortby parameter.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1013631; http://www.securityfocus.com/bid/12985; http://www.zone-h.com/en/advisories/read/id=7367/
CVE: CVE-2005-1012
Published: 2005-05-02
Description: Cross-site scripting (XSS) vulnerability in Iatek SiteEnable allows remote attackers to inject arbitrary web script or HTML via (1) the contenttype parameter to content.asp, (2) the title, or (3) the description.
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1013631; http://www.zone-h.com/en/advisories/read/id=7367/; https://exchange.xforce.ibmcloud.com/vulnerabilities/19891
CVE: CVE-2005-1013
Published: 2005-05-02
Description: The SMTP service in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to cause a denial of service (server crash) via an EHLO command with a Unicode string.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8494&w=2; http://secunia.com/advisories/14812; http://securitytracker.com/id?1013637
CVE: CVE-2005-1014
Published: 2005-05-02
Description: Buffer overflow in the IMAP service for MailEnable Enterprise 1.04 and earlier and Professional 1.54 allows remote attackers to execute arbitrary code via a long AUTHENTICATE command.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-April/033123.html; http://secunia.com/advisories/14812; http://securitytracker.com/id?1013637
CVE: CVE-2005-1015
Published: 2005-05-02
Description: Buffer overflow in MailEnable Imapd (MEIMAP.exe) allows remote attackers to execute arbitrary code via a long LOGIN command.
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-April/033144.html; http://lists.grok.org.uk/pipermail/full-disclosure/2005-April/033144.html
CVE: CVE-2005-1016
Published: 2005-05-02
Description: Cross-site scripting (XSS) vulnerability in links_add_form.asp for MaxWebPortal 1.33 and earlier allows remote attackers to inject arbitrary web script or HTML via a Javascript URL in a banner URL.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/14752; http://securitytracker.com/id?1013617; http://www.hackerscenter.com/archive/view.asp?id=1807