deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-1169
Published: 2005-05-02
Description: Mafia Blog .4 BETA does not properly protect the admin directory, which allows remote attackers to execute arbitrary PHP code by using writeinfo.php to inject the code into info.php.
CVSS Score: 7.5 (HIGH)
References: http://chrisnowak.org/projects/mafia/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6958&w=2; http://www.securityfocus.com/bid/13194
CVE: CVE-2005-1170
Published: 2005-05-02
Description: SQL injection vulnerability in mod.php in the datenbank module for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9726&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9726&w=2
CVE: CVE-2005-1171
Published: 2005-05-02
Description: Cross-site scripting (XSS) vulnerability in mod.php in the datenbank module for phpBB allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9726&w=2; http://www.osvdb.org/15812; http://www.securityfocus.com/bid/13210
CVE: CVE-2005-1172
Published: 2005-05-02
Description: Cross-site scripting (XSS) vulnerability in init.inc.php in Coppermine Photo Gallery 1.3.x allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://coppermine.sourceforge.net/board/index.php?topic=17134; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7880&w=2; http://secunia.com/advisories/15004
CVE: CVE-2005-1173
Published: 2005-05-02
Description: Buffer overflow in PMSoftware Simple Web Server 1.0 allows remote attackers to execute arbitrary code via a long GET request.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2021&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2021&w=2
CVE: CVE-2005-1176
Published: 2005-05-02
Description: Race condition in JFS2 on AIX 5.2 and 5.3, when deleting a file while I/O is still occurring for that file, may write data to a different file, which could leak sensitive information.
CVSS Score: 1.2 (LOW)
References: http://www-1.ibm.com/support/search.wss?rs=0&q=IY70032&apar=only; http://www-1.ibm.com/support/search.wss?rs=0&q=IY70034&apar=only; https://exchange.xforce.ibmcloud.com/vulnerabilities/20604
CVE: CVE-2005-1177
Published: 2005-05-02
Description: Unknown vulnerability in (1) Webmin and (2) Usermin before 1.200 causes Webmin to change permissions and ownership of configuration files, with unknown impact.
CVSS Score: 10.0 (HIGH)
References: http://securitytracker.com/id?1013723; http://www.webmin.com/changes.html; http://www.webmin.com/uchanges.html
CVE: CVE-2005-1178
Published: 2005-05-02
Description: SQL injection vulnerability in Oracle Forms 10g allows remote attackers to execute arbitrary SQL commands via the Query/Where feature.
CVSS Score: 7.5 (HIGH)
References: http://www.red-database-security.com/wp/sql_injection_forms_us.pdf; http://www.securiteam.com/securitynews/5HP0I0UFFI.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/20080
CVE: CVE-2005-1179
Published: 2005-05-02
Description: Unknown vulnerability in Xerox MicroServer Web Server for various WorkCentre products including M35/M45/M55 2.028.11.000 through 2.97.20.032 and 4.84.16.000 through 4.97.20.032, Pro 35/45/55 3.028.11.000 through 3.97.20.032, Pro 65/75/90 1.001.00.060 through 1.001.02.084, and others, related to SNMP authentication, allows remote attackers to modify system configuration, a different vulnerability than CVE-2005-0703.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/14507; http://www.securityfocus.com/bid/13196; http://www.xerox.com/downloads/usa/en/c/cert_XRX05_005.pdf
CVE: CVE-2005-1180
Published: 2005-05-02
Description: HTTP Response Splitting vulnerability in the Surveys module in PHP-Nuke 7.6 allows remote attackers to spoof web content and poison web caches via hex-encoded CRLF ("%0d%0a") sequences in the forwarder parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3536&w=2; http://secunia.com/advisories/14965; http://www.digitalparadox.org/advisories/pnuke.txt
CVE: CVE-2005-1181
Published: 2005-05-02
Description: NOTE: this issue has been disputed by the vendor.  PHP remote code injection vulnerability in loader.php for Ariadne CMS 2.4 allows remote attackers to execute arbitrary PHP code by modifying the ariadne parameter to reference a URL on a remote web server that contains the code.  NOTE: the vendor has disputed this issue, saying that loader.php first requires the "ariadne.inc" file, which defines the $ariadne variable, and thus it cannot be modified by an attacker. In addition, CVE personnel have partially verified the dispute via source code inspection of Ariadne 2.4 as available on July 5, 2005
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1013721; http://www.osvdb.org/15549; https://exchange.xforce.ibmcloud.com/vulnerabilities/20611
CVE: CVE-2005-1182
Published: 2005-05-02
Description: Unknown vulnerability in Incoming Remote Command (iSeries Access for Windows Remote Command service) in IBM OS/400 R510, R520, and R530 allows attackers to cause a denial of service (IRC shutdown) via certain inputs.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/14970; http://www-1.ibm.com/support/docview.wss?uid=nas29afd3991f5f290b086256fdb0053b293; https://exchange.xforce.ibmcloud.com/vulnerabilities/20612
CVE: CVE-2005-1183
Published: 2005-05-02
Description: Cross-site scripting (XSS) vulnerability in mvnForum 1.0 RC4 allows remote attackers to inject arbitrary web script or HTML via the Search parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://www.osvdb.org/15760; http://www.securityfocus.com/bid/13213; https://exchange.xforce.ibmcloud.com/vulnerabilities/20613
CVE: CVE-2005-1184
Published: 2005-05-02
Description: The TCP/IP stack in multiple operating systems allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the correct sequence number but the wrong Acknowledgement number, which generates a large number of "keep alive" packets.  NOTE: some followups indicate that this issue could not be replicated.
CVSS Score: 5.0 (MEDIUM)
References: http://seclists.org/lists/fulldisclosure/2005/Apr/0358.html; http://seclists.org/lists/fulldisclosure/2005/Apr/0383.html; http://seclists.org/lists/fulldisclosure/2005/Apr/0385.html
CVE: CVE-2005-1185
Published: 2005-05-02
Description: Unquoted Windows search path vulnerability in Musicmatch Jukebox 10.00.2047 and earlier allows local users to gain privileges via a malicious C:\program.exe file, which is run by MMFWLaunch.exe when it attempts to execute launch.exe.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1509&w=2; http://securitytracker.com/id?1013718; http://www.hyperdose.com/advisories/H2005-05.txt
CVE: CVE-2005-1186
Published: 2005-05-02
Description: Musicmatch Jukebox 10.00.2047 and earlier adds the musicmatch.com domain to the Trusted Sites zone in Internet Explorer, which allows systems in the domain to conduct unauthorized activities, as demonstrated using cross-site scripting (XSS) attacks.
CVSS Score: 6.8 (MEDIUM)
References: http://seclists.org/lists/bugtraq/2005/Apr/0212.html; http://securitytracker.com/id?1013718; http://www.hyperdose.com/advisories/H2005-04.txt
CVE: CVE-2005-1187
Published: 2005-05-02
Description: Heap-based buffer overflow in WinHex 12.05 SR-14, and possibly other versions, may allow attackers to execute arbitrary code via a long file name argument.  NOTE: since this overflow is in the command line of an unprivileged program, it is highly likely that this is not a vulnerability.
CVSS Score: 5.1 (MEDIUM)
References: http://securitytracker.com/id?1013727; http://www.unl0ck.org/files/papers/winhex.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/20139
CVE: CVE-2005-1188
Published: 2005-05-02
Description: Cross-site scripting (XSS) vulnerability in comersus_searchItem.asp in Comersus 3.90 to 4.51 allows remote attackers to inject arbitrary web script or HTML via the curPage parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://lostmon.blogspot.com/2005/04/comersus-asp-shopping-cart-variable.html; http://securitytracker.com/id?1013747; http://www.osvdb.org/15539
CVE: CVE-2005-1189
Published: 2005-05-02
Description: Cross-site scripting (XSS) vulnerability in WebcamXP PRO v2.16.468 and earlier allows remote attackers to inject arbitrary web script or HTML via the chat name, as demonstrated by using an IFRAME to redirect users to other sites.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/14999; http://securitytracker.com/id?1013753; https://exchange.xforce.ibmcloud.com/vulnerabilities/20166
CVE: CVE-2005-1190
Published: 2005-05-02
Description: WebcamXP PRO v2.16.468 and earlier allows remote attackers to cause a denial of service via a long chat name, which takes up too much display space and prevents the chat frame from being properly rendered.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1013753; https://exchange.xforce.ibmcloud.com/vulnerabilities/20615; http://securitytracker.com/id?1013753
CVE: CVE-2005-1191
Published: 2005-05-02
Description: The Web View DLL (webvw.dll), as used in Windows Explorer on Windows 2000 systems, does not properly filter an apostrophe ("'") in the author name in a document, which allows attackers to execute arbitrary script via extra attributes when Web View constructs a mailto: link for the preview pane when the user selects the file.
CVSS Score: 5.0 (MEDIUM)
References: http://security.greymagic.com/security/advisories/gm015-ie; http://www.securityfocus.com/archive/1/396224; http://www.securityfocus.com/bid/13248
CVE: CVE-2005-1192
Published: 2005-05-02
Description: Unknown vulnerability in HP-UX B.11.00, B.11.04, B.11.11, B.11.22, and B.11.23, when running TCP/IP on IPv4, allows remote attackers to cause a denial of service via certain packets, related to the PMTU, a different vulnerability than CVE-2004-1060.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/262; http://www.securityfocus.com/bid/13367; http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX01137
CVE: CVE-2005-1195
Published: 2005-05-02
Description: Multiple heap-based buffer overflows in the code used to handle (1) MMS over TCP (MMST) streams or (2) RealMedia RTSP streams in xine-lib before 1.0, and other products that use xine-lib such as MPlayer 1.0pre6 and earlier, allow remote malicious servers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://cvs.sourceforge.net/viewcvs.py/xine/xine-lib/src/input/librtsp/rtsp.c?r1=1.18&r2=1.19&diff_format=u; http://cvs.sourceforge.net/viewcvs.py/xine/xine-lib/src/input/mms.c?r1=1.55&r2=1.56&diff_format=u; http://seclists.org/lists/bugtraq/2005/Apr/0337.html
CVE: CVE-2005-1196
Published: 2005-05-02
Description: SQL injection vulnerability in kb.php in the Knowledge Base module for phpBB allows remote attackers to obtain sensitive information and execute SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6335&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6335&w=2
CVE: CVE-2005-1197
Published: 2005-05-02
Description: SQL injection vulnerability in the SYS.DBMS_CDC_IPUBLISH.CREATE_SCN_CHANGE_SET procedure in Oracle Database Server 10g allows remote attackers to execute arbitrary SQL commands via the CHANGE_SET_NAME parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9118&w=2; http://www.kb.cert.org/vuls/id/948486; http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf
CVE: CVE-2005-1198
Published: 2005-05-02
Description: Directory traversal vulnerability in apexec.pl for Anaconda Foundation Directory allows remote attackers to read arbitrary files via hex-encoded null characters (%00) in the middle of ".." sequences in the template parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6656&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6656&w=2
CVE: CVE-2005-1199
Published: 2005-05-02
Description: SQL injection vulnerability in printthread.php in UBB.Threads allows remote attackers to execute arbitrary SQL commands via the main parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1575&w=2; http://secunia.com/advisories/15024; http://www.osvdb.org/15698
CVE: CVE-2005-1200
Published: 2005-05-02
Description: PHP remote file inclusion vulnerability in main_index.php in AZ Bulletin Board (AZbb) 1.0.07a through 1.0.07c allows remote attackers to execute arbitrary PHP code by modifying the (1) dir_src or (2) abs_layer parameter to reference a URL on a remote web server that contains the code.
CVSS Score: 7.5 (HIGH)
References: http://azbb.cyaccess.com/azbb.php?[PII_REDACTED]; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1857&w=2; http://secunia.com/advisories/15013
CVE: CVE-2005-1201
Published: 2005-05-02
Description: Multiple directory traversal vulnerabilities in AZ Bulletin board (AZbb) before 1.0.08 allow (1) remote authenticated users with administrative privileges to delete arbitrary files via a .. (dot dot) in the URL to admin_avatar.php or admin_attachment.php or (2) remote attackers to enumerate files via a .. (dot dot) in the attachment parameter to attachment.php, which displays a different message when a file exists or does not exist.
CVSS Score: 6.4 (MEDIUM)
References: http://azbb.cyaccess.com/azbb.php?[PII_REDACTED]; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1857&w=2; http://secunia.com/advisories/15013
CVE: CVE-2005-1202
Published: 2005-05-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in eGroupware before 1.0.0.007 allow remote attackers to inject arbitrary web script or HTML via the (1) ab_id, (2) page, (3) type, or (4) lang parameter to index.php or (5) category_id parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5555&w=2; http://secunia.com/advisories/14982; http://security.gentoo.org/glsa/glsa-200504-24.xml
CVE: CVE-2005-1203
Published: 2005-05-02
Description: Multiple SQL injection vulnerabilities in index.php in eGroupware before 1.0.0.007 allow remote attackers to execute arbitrary SQL commands via the (1) filter or (2) cats_app parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5555&w=2; http://secunia.com/advisories/14982; http://security.gentoo.org/glsa/glsa-200504-24.xml
CVE: CVE-2005-1204
Published: 2005-05-02
Description: Desktop Rover 3.0, and possibly earlier versions, allows remote attackers to cause a denial of service (application crash) via a crafted packet to TCP port 61427, which causes an invalid memory access.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6915&w=2; http://secunia.com/advisories/15032; http://www.evilpacket.net/advisories/EP-000-0003.html
CVE: CVE-2005-1220
Published: 2005-05-02
Description: Shoutbox SCRIPT 3.0.2 and earlier allows remote attackers to obtain sensitive information via a direct request to db/settings.dat, which displays usernames and password hashes.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8991&w=2; http://secunia.com/advisories/15015; http://www.osvdb.org/15695
CVE: CVE-2005-1221
Published: 2005-05-02
Description: SQL injection vulnerability in login.asp for Ecommerce-Carts EcommPro 3.0 allows remote attackers to execute arbitrary SQL commands via the password field.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5925&w=2; http://www.ihssecurity.com/download/advisory/ecomerce-cart.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/20200
CVE: CVE-2005-1222
Published: 2005-05-02
Description: cat_for_gen.php in Annuaire Netref 4.2 allows remote attackers to execute arbitrary PHP code by setting the ad_direct parameter to reference cat_for_gen.php, then including the code in the m_for_racine parameter, which is then written to cat_for_gen.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5600&w=2; http://secunia.com/advisories/15040; http://www.osvdb.org/15717
CVE: CVE-2005-1223
Published: 2005-05-02
Description: Multiple SQL injection vulnerabilities in Ocean12 Calendar manager 1.01 allow remote attackers to execute arbitrary SQL commands via the Admin_id field.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7772&w=2; http://secunia.com/advisories/15026; http://www.securitytracker.com/alerts/2005/Apr/1013762.html
CVE: CVE-2005-1224
Published: 2005-05-02
Description: Multiple SQL injection vulnerabilities in DUware DUportal Pro 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) nChannel parameter to default.asp, cat.asp, or detail.asp, (2) the iChannel parameter to search.asp, default.asp, result.asp, cat.asp, or detail.asp (3) the iCat parameter to cat.asp or detail.asp, (4) the iData parameter to detail.asp or result.asp, the (5) POL_ID, (6) POL_PARENT, (7) POL_CATEGORY, (8) CHA_NAME, or (9) CHA_ID parameters to inc_vote.asp, or the (10) tfm_order or (11) tfm_orderby parameters to toppages.asp, a different set of vulnerabilities than CVE-2005-1236.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1705&w=2; http://secunia.com/advisories/15031; http://www.digitalparadox.org/advisories/duppro.txt
CVE: CVE-2005-1225
Published: 2005-05-02
Description: SQL injection vulnerability in Coppermine Photo Gallery 1.3.2 allows remote attackers to execute arbitrary SQL commands via the favs parameter to (1) init.inc.php or (2) zipdownload.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4179&w=2; http://secunia.com/advisories/15004; http://www.waraxe.us/advisory-42.html
CVE: CVE-2005-1226
Published: 2005-05-02
Description: Coppermine Photo Gallery 1.3.2 stores passwords in plaintext, which allows remote attackers to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4179&w=2; http://www.waraxe.us/advisory-42.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/20206
CVE: CVE-2005-1228
Published: 2005-05-02
Description: Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. (dot dot) in the original filename within a compressed file.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.58/SCOSA-2005.58.txt; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=305255; http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html
CVE: CVE-2005-1229
Published: 2005-05-02
Description: Directory traversal vulnerability in cpio 2.6 and earlier allows remote attackers to write to arbitrary directories via a .. (dot dot) in a cpio file.
CVSS Score: 4.6 (MEDIUM)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:03.cpio.asc; ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.2/SCOSA-2006.2.txt; ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.32/SCOSA-2005.32.txt
CVE: CVE-2005-1230
Published: 2005-05-02
Description: Directory traversal vulnerability in Yawcam 0.2.5 allows remote attackers to read arbitrary files via "..\" (dot dot backslash) sequences in a GET request.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5961&w=2; http://secunia.com/advisories/15052; http://www.autistici.org/fdonato/advisory/Yawcam0.2.5-adv.txt
CVE: CVE-2005-1231
Published: 2005-05-02
Description: Cross-site scripting (XSS) vulnerability in the NewTerm function in GlossaryModel.php in JAWS 0.4 allows remote attackers to inject arbitrary web script or HTML via the (1) term or (2) description.
CVSS Score: 4.3 (MEDIUM)
References: http://seclists.org/lists/fulldisclosure/2005/Apr/0416.html; http://www.securiteam.com/unixfocus/5RP0M0AFFS.html; http://www.securityfocus.com/bid/13254
CVE: CVE-2005-1232
Published: 2005-05-02
Description: Buffer overflow in Sun Java System Web Proxy Server (aka Sun ONE Proxy Server) 3.6 SP6 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-57763-1; http://www.securityfocus.com/bid/82356; http://sunsolve.sun.com/search/document.do?assetkey=1-26-57763-1
CVE: CVE-2005-1234
Published: 2005-05-02
Description: Multiple SQL injection vulnerabilities in phpbb-Auction allow remote attackers to execute arbitrary SQL commands via the (1) u parameter to auction_rating.php or (2) ar parameter to action_offer.php.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/15029; http://securitytracker.com/id?1013779; http://www.aria-security.net/advisory/phpauction.txt
CVE: CVE-2005-1235
Published: 2005-05-02
Description: auction_my_auctions.php in phpbb-Auction 1.2m and earlier allows remote attackers to obtain sensitive information via an invalid mode parameter, which leaks the full path in a PHP error message.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/15029; http://securitytracker.com/id?1013779; http://www.osvdb.org/15706
CVE: CVE-2005-1236
Published: 2005-05-02
Description: Multiple SQL injection vulnerabilities in DUware DUportal 3.1.2 and 3.1.2 SQL allow remote attackers to execute arbitrary SQL commands via the (1) iChannel parameter to channel.asp or search.asp, (2) iData parameter to detail.asp or inc_rating.asp, (3) iCat parameter to detail.asp or type.asp, (4) DAT_PARENT parameter to inc_poll_voting.asp, or (5) iRate parameter to inc_rating.asp, a different set of vulnerabilities than CVE-2005-1224.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15044; http://www.digitalparadox.org/advisories/dup.txt; http://www.securityfocus.com/bid/13288
CVE: CVE-2005-1237
Published: 2005-05-02
Description: SQL injection vulnerability in news.php in FlexPHPNews 0.0.3 allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/14905; http://www.attrition.org/pipermail/vim/2007-April/001506.html; http://www.osvdb.org/15715
CVE: CVE-2005-1238
Published: 2005-05-02
Description: By design, the built-in FTP server for iSeries AS/400 systems does not support a restricted document root, which allows attackers to read or write arbitrary files, including sensitive QSYS databases, via a full pathname in a GET or PUT request.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/396628; http://www.venera.com/downloads/Canonicalization_problems_in_iSeries_FTP_security.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/20260
CVE: CVE-2005-1239
Published: 2005-05-02
Description: Directory traversal vulnerability in the third party tool from Raz-Lee, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitrary files, including those from qsys.lib, via ".." sequences in a GET request.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/396628; http://www.securityfocus.com/bid/13310; http://www.venera.com/downloads/Canonicalization_problems_in_iSeries_FTP_security.pdf
CVE: CVE-2005-1242
Published: 2005-05-02
Description: Directory traversal vulnerability in the third party tool from Bsafe, as used to secure the iSeries AS/400 FTP server, allows remote attackers to access arbitrary files, including those from qsys.lib, via ".." sequences in a GET request.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/archive/1/396628; http://www.venera.com/downloads/Canonicalization_problems_in_iSeries_FTP_security.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/20260