deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-1921
Published: 2005-07-05
Description: Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0145&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0867&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7335&w=2
CVE: CVE-2005-1922
Published: 2005-07-05
Description: The MS-Expand file handling in Clam AntiVirus (ClamAV) before 0.86 allows remote attackers to cause a denial of service (file descriptor and memory consumption) via a crafted file that causes repeated errors in the cli_msexpand function.
CVSS Score: 5.0 (MEDIUM)
References: http://sourceforge.net/project/shownotes.php?release_id=336462; http://www.debian.org/security/2005/dsa-737; http://www.idefense.com/application/poi/display?id=276&type=vulnerabilities&flashstatus=true
CVE: CVE-2005-1923
Published: 2005-07-05
Description: The ENSURE_BITS macro in mszipd.c for Clam AntiVirus (ClamAV) 0.83, and other versions vefore 0.86, allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a cabinet (CAB) file with the cffile_FolderOffset field set to 0xff, which causes a zero-length read.
CVSS Score: 2.6 (LOW)
References: http://www.debian.org/security/2005/dsa-737; http://www.idefense.com/application/poi/display?id=275&type=vulnerabilities; http://www.debian.org/security/2005/dsa-737
CVE: CVE-2005-1931
Published: 2005-07-05
Description: GoodTech SMTP Server 5.14 allows remote attackers to cause a denial of service (application crash) via a RCPT TO command with an invalid argument, as demonstrated using an "A" character.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3776&w=2; http://secunia.com/advisories/15623; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3776&w=2
CVE: CVE-2005-1932
Published: 2005-07-05
Description: Lpanel 1.59 and earlier, and other versions before 1.597, allows remote authenticated users to modify certain critical variables and (1) modify DNS settings for arbitrary domains via the domain parameter to diagnose.php, (2) close, open, or respond to arbitrary support tickets via the close, open, or pid parameter to view_ticket.php, (3) obtain sensitive information on arbitrary invoices via the inv parameter to viewreceipt.php, or (4) modify domain information for arbitrary domains via the editdomain parameter to domains.php.
CVSS Score: 2.1 (LOW)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034414.html; http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034415.html; http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034416.html
CVE: CVE-2005-2019
Published: 2005-07-05
Description: ipfw in FreeBSD 5.4, when running on Symmetric Multi-Processor (SMP) or Uni Processor (UP) systems with the PREEMPTION kernel option enabled, does not sufficiently lock certain resources while performing table lookups, which can cause the cache results to be corrupted during multiple concurrent lookups, allowing remote attackers to bypass intended access restrictions.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:13.ipfw.asc; ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:13.ipfw.asc
CVE: CVE-2005-2068
Published: 2005-07-05
Description: FreeBSD 4.x through 4.11 and 5.x through 5.4 allows remote attackers to modify certain TCP options via a TCP packet with the SYN flag set for an already established session.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:15.tcp.asc; ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:15.tcp.asc
CVE: CVE-2005-2081
Published: 2005-07-05
Description: Stack-based buffer overflow in the function that parses commands in Asterisk 1.0.7, when the 'write = command' option is enabled, allows remote attackers to execute arbitrary code via a command that has two double quotes followed by a tab character.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1080&w=2; http://www.portcullis-security.com/advisory/advisory-05-013.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/21115
CVE: CVE-2005-2082
Published: 2005-07-05
Description: im_trbbs.cgi in imTRSET 1.02 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the df parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6261&w=2; http://www.cgi-club.com/imTRBBS/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6261&w=2
CVE: CVE-2005-2083
Published: 2005-07-05
Description: Format string vulnerability in IMAP4 in IA eMailServer Corporate Edition 5.2.2 build 1051 allows remote attackers to cause a denial of service (application crash) via a LIST command with format string specifiers as the second argument.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9448&w=2; http://securitytracker.com/alerts/2005/Jun/1014301.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/21169
CVE: CVE-2005-2084
Published: 2005-07-05
Description: Cross-site scripting (XSS) vulnerability in SearchResults.aspx in Community Forum allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9469&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9469&w=2
CVE: CVE-2005-2085
Published: 2005-07-05
Description: Buffer overflow in Inframail Advantage Server Edition 6.0 through 6.7 allows remote attackers to cause a denial of service (process crash) via a long (1) SMTP FROM field or possibly (2) FTP NLST command.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6731&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6731&w=2
CVE: CVE-2005-2086
Published: 2005-07-05
Description: PHP remote file inclusion vulnerability in viewtopic.php in phpBB 2.0.15 and earlier allows remote attackers to execute arbitrary PHP code.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7019&w=2; http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=302011; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7019&w=2
CVE: CVE-2005-2087
Published: 2005-07-05
Description: Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, as demonstrated using the JVIEW Profiler (Javaprxy.dll).  NOTE: the researcher says that the vendor could not reproduce this problem.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4946&w=2; http://secunia.com/advisories/15891; http://securitytracker.com/id?1014329
CVE: CVE-2005-2088
Published: 2005-07-05
Description: The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-444
References: http://docs.info.apple.com/article.html?artnum=302847; http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html; http://marc.info/?l=apache-httpd-announce&m=[PII_REDACTED]7329&w=3
CVE: CVE-2005-2089
Published: 2005-07-05
Description: Microsoft IIS 5.0 and 6.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes IIS to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-444
References: http://seclists.org/lists/bugtraq/2005/Jun/0025.html; http://www.securiteam.com/securityreviews/5GP0220G0U.html; http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf
CVE: CVE-2005-2090
Published: 2005-07-05
Description: Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
CVSS Score: 4.3 (MEDIUM)
References: http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx; http://docs.info.apple.com/article.html?artnum=306172; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
CVE: CVE-2005-2091
Published: 2005-07-05
Description: IBM WebSphere 5.1 and WebSphere 5.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes WebSphere to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
CVSS Score: 4.3 (MEDIUM)
References: http://seclists.org/lists/bugtraq/2005/Jun/0025.html; http://securitytracker.com/id?1014367; http://www.securiteam.com/securityreviews/5GP0220G0U.html
CVE: CVE-2005-2092
Published: 2005-07-05
Description: BEA Systems WebLogic 8.1 SP1 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes WebLogic to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
CVSS Score: 4.3 (MEDIUM)
References: http://seclists.org/lists/bugtraq/2005/Jun/0025.html; http://securitytracker.com/id?1014366; http://www.securiteam.com/securityreviews/5GP0220G0U.html
CVE: CVE-2005-2093
Published: 2005-07-05
Description: Oracle 9i Application Server (Oracle9iAS) 9.0.2 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Application Server to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
CVSS Score: 4.3 (MEDIUM)
References: http://seclists.org/lists/bugtraq/2005/Jun/0025.html; http://www.securiteam.com/securityreviews/5GP0220G0U.html; http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf
CVE: CVE-2005-2094
Published: 2005-07-05
Description: Sun SunONE web server 6.1 SP1 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes SunONE to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
CVSS Score: 4.3 (MEDIUM)
References: http://seclists.org/lists/bugtraq/2005/Jun/0025.html; http://securitytracker.com/id?1014369; http://www.securiteam.com/securityreviews/5GP0220G0U.html
CVE: CVE-2005-2105
Published: 2005-07-05
Description: Cisco IOS 12.2T through 12.4 allows remote attackers to bypass Authentication, Authorization, and Accounting (AAA) RADIUS authentication, if the fallback method is set to none, via a long username.
CVSS Score: 7.5 (HIGH)
References: http://www.cisco.com/warp/public/707/cisco-sa-20050629-aaa.shtml; http://www.securitytracker.com/alerts/2005/Jun/1014330.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/21190
CVE: CVE-2005-2106
Published: 2005-07-05
Description: Unknown vulnerability in Drupal 4.5.0 through 4.5.3, 4.6.0, and 4.6.1 allows remote attackers to execute arbitrary PHP code via a public comment or posting.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7452&w=2; http://secunia.com/advisories/15872; http://www.debian.org/security/2005/dsa-745
CVE: CVE-2005-2107
Published: 2005-07-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in post.php in WordPress 1.5.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) p or (2) comment parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1438&w=2; http://secunia.com/advisories/15831; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5
CVE: CVE-2005-2108
Published: 2005-07-05
Description: SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the HTTP_RAW_POST_DATA variable, which stores the data in an XML file.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1438&w=2; http://secunia.com/advisories/15831; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5
CVE: CVE-2005-2109
Published: 2005-07-05
Description: wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change the content of the forgotten password e-mail message via the message variable, which is not initialized before use.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1438&w=2; http://secunia.com/advisories/15831; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5
CVE: CVE-2005-2110
Published: 2005-07-05
Description: WordPress 1.5.1.2 and earlier allows remote attackers to obtain sensitive information via (1) a direct request to menu-header.php or a "1" value in the feed parameter to (2) wp-atom.php, (3) wp-rss.php, or (4) wp-rss2.php, which reveal the path in an error message.  NOTE: vector [1] was later reported to also affect WordPress 2.0.1.
CVSS Score: 5.0 (MEDIUM)
References: http://NeoSecurityTeam.net/advisories/Advisory-17.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1438&w=2; http://secunia.com/advisories/15831
CVE: CVE-2005-2111
Published: 2005-07-05
Description: login.cgi in Community Link Pro Web Editor allows remote attackers to execute arbitrary commands via the file parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5309&w=2; http://secunia.com/advisories/15880; http://securitytracker.com/id?1014345
CVE: CVE-2005-2112
Published: 2005-07-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) order parameter to edit.php or (2) cid parameter to comment_edit.php.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2991&w=2; http://secunia.com/advisories/15843; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5
CVE: CVE-2005-2113
Published: 2005-07-05
Description: SQL injection vulnerability in the loginUser function in the XMLRPC server in XOOPS 2.0.11 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via crafted values in an XML file, as demonstrated using the blogger.getPost method.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2991&w=2; http://secunia.com/advisories/15843; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5
CVE: CVE-2005-2114
Published: 2005-07-05
Description: Mozilla 1.7.8, Firefox 1.0.4, Camino 0.8.4, Netscape 8.0.2, and K-Meleon 0.9, and possibly other products that use the Gecko engine, allow remote attackers to cause a denial of service (application crash) via JavaScript that repeatedly calls an empty function.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0033&w=2; http://securitytracker.com/id?1014292; http://securitytracker.com/id?1014293
CVE: CVE-2005-2115
Published: 2005-07-05
Description: Soldier of Fortune II 1.02x and 1.03 allows remote attackers to cause a denial of service (server crash) via a large ID value in the ignore command, which is used as an array index and causes an out-of-bounds operation.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/sof2ignore-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6593&w=2; http://secunia.com/advisories/15868
CVE: CVE-2005-2116
Published: 2005-07-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-1921.  Reason: This candidate is a duplicate of CVE-2005-1921.  Notes: All CVE users should reference CVE-2005-1921 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-2133
Published: 2005-07-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-1915.  Reason: This candidate is a duplicate of CVE-2005-1915.  Notes: All CVE users should reference CVE-2005-1915 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-2134
Published: 2005-07-05
Description: The (1) clcs and (2) emuxki drivers in NetBSD 1.6 through 2.0.2 allow local users to cause a denial of service (kernel crash) by using the set-parameters ioctl on an audio device to change the block size and set the pause state to "unpaused" in the same ioctl, which causes a divide-by-zero error.
CVSS Score: 2.1 (LOW)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2005-002.txt.asc; ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2005-002.txt.asc
CVE: CVE-2005-2135
Published: 2005-07-05
Description: SQL injection vulnerability in verify.asp in EtoShop Dynamic Biz Website Builder (QuickWeb) 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) T1 or (2) T2 parameters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15818; http://secunia.com/advisories/15818
CVE: CVE-2005-2136
Published: 2005-07-05
Description: Raritan Dominion SX (DSX) Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 set (1) world-readable permissions for /etc/shadow and (2) world-writable permissions for /bin/busybox, which allows local users to obtain hashed passwords or execute arbitrary code as other users.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-863
References: http://seclists.org/lists/bugtraq/2005/Jun/0251.html; http://secunia.com/advisories/15853; http://www.securityfocus.com/bid/14084
CVE: CVE-2005-2137
Published: 2005-07-05
Description: Unknown vulnerability in NateOn Messenger 3.0 allows remote attackers to list arbitrary directories via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/15819; http://www.osvdb.org/17619; http://www.securityfocus.com/bid/14100
CVE: CVE-2005-2138
Published: 2005-07-05
Description: Cross-site scripting (XSS) vulnerability in index.php in Comdev eCommerce 3.0 and 3.1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the onMouseOver event of an "A" tag in a review message.
CVSS Score: 4.3 (MEDIUM)
References: http://k.domaindlx.com/shellcore/advisories.asp?bug_report=display&infamous_group=64; http://secunia.com/advisories/15865; http://k.domaindlx.com/shellcore/advisories.asp?bug_report=display&infamous_group=64
CVE: CVE-2005-2139
Published: 2005-07-05
Description: PHP remote file inclusion vulnerability in user_check.php for Pavsta Auto Site allows remote attackers to execute arbitrary PHP code via the sitepath parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/15873; http://securitytracker.com/id?1014321; http://www.osvdb.org/17631
CVE: CVE-2005-2140
Published: 2005-07-05
Description: Directory traversal vulnerability in default.asp for FSboard 2.0 allows remote attackers to read arbitrary files via ".." sequences in the filename parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://www.securityfocus.com/bid/14111; http://www.securityfocus.com/bid/14111
CVE: CVE-2005-2141
Published: 2005-07-05
Description: TCP Chat 1.0 allows remote attackers to cause a denial of service (crash) via a long string to the chat service, possibly triggering a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://addict3d.org/index.php?page=viewarticle&type=security&ID=4377; http://k.domaindlx.com/shellcore/advisories.asp?bug_report=display&infamous_group=65; http://securitytracker.com/id?1014371
CVE: CVE-2005-2142
Published: 2005-07-05
Description: Directory traversal vulnerability in Golden FTP Server 2.60 allows remote authenticated attackers to list arbitrary directories via a "\.."  (backslash dot dot) in an LS (LIST) command.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/15840; http://secunia.com/advisories/15840
CVE: CVE-2005-2143
Published: 2005-07-05
Description: Microsoft Front Page allows attackers to cause a denial of service (crash) via a crafted style tag in a web page.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1014352; http://www.freewebs.com/xxosfilexx/HungFPage.html; http://securitytracker.com/id?1014352
CVE: CVE-2005-2144
Published: 2005-07-05
Description: Prevx Pro 2005 1.0 allows local users to bypass file protection and modify files by using MapViewOfFile to perform memory mapping on the file.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/15885; http://securitytracker.com/id?1014346; http://secunia.com/advisories/15885
CVE: CVE-2005-2145
Published: 2005-07-05
Description: The kernel driver in Prevx Pro 2005 1.0 does not verify the source of certain messages, which allows local users to bypass protection by sending certain messages to the driver, as demonstrated by sending an "allow" message to bypass a warning message.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/15885; http://securitytracker.com/id?1014346; http://secunia.com/advisories/15885
CVE: CVE-2005-2146
Published: 2005-07-05
Description: SSH Tectia Server 4.3.1 and earlier, and SSH Secure Shell for Windows Servers, uses insecure permissions when generating the Secure Shell host identification key, which allows local users to access the key and spoof the server.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/15894; http://www.ssh.com/company/newsroom/article/653/; http://secunia.com/advisories/15894
CVE: CVE-2005-1916
Published: 2005-07-06
Description: linki.py in ekg 2005-06-05 and earlier allows local users to overwrite or create arbitrary files via a symlink attack on temporary files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1122&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7250&w=2; http://www.debian.org/security/2005/dsa-760
CVE: CVE-2005-2096
Published: 2005-07-06
Description: zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:16.zlib.asc; ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.6/SCOSA-2006.6.txt; http://lists.apple.com/archives/security-announce//2008/Nov/msg00001.html