deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-3094
Published: 2005-09-28
Description: Avi Alkalay man-cgi script allows remote attackers to execute arbitrary code via shell metacharacters in the topic parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16887; http://www.alkalay.net/software; http://www.cirt.net/advisories/alkalay.shtml
CVE: CVE-2005-3095
Published: 2005-09-28
Description: Avi Alkalay notify program, dated 19 Aug 2001, allows remote attackers to execute arbitrary commands via shell metacharacters in the from parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16886/; http://www.alkalay.net/software; http://www.cirt.net/advisories/alkalay.shtml
CVE: CVE-2005-3096
Published: 2005-09-28
Description: Avi Alkalay nslookup.cgi program, dated 16 June 2002, allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16880; http://www.alkalay.net/software; http://www.cirt.net/advisories/alkalay.shtml
CVE: CVE-2005-3097
Published: 2005-09-28
Description: Directory traversal vulnerability in Avi Alkalay contribute.cgi (aka contribute.pl), dated 16 Jun 2002, allows remote attackers to overwrite arbitrary files via ".." sequences in the contribdir variable.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cirt.net/advisories/alkalay.shtml; http://www.osvdb.org/19522; http://www.cirt.net/advisories/alkalay.shtml
CVE: CVE-2005-3098
Published: 2005-09-28
Description: poppassd in Qualcomm qpopper 4.0.8 allows local users to modify arbitrary files and gain privileges via the -t (trace file) command line argument.
CVSS Score: 4.6 (MEDIUM)
References: http://seclists.org/lists/fulldisclosure/2005/Sep/0652.html; http://secunia.com/advisories/16935; http://www.securityfocus.com/bid/14944
CVE: CVE-2005-3099
Published: 2005-09-28
Description: Unspecified vulnerability in the (1) Xsun and (2) Xprt commands in Solaris 7, 8, 9, and 10 allows local users to execute arbitrary code.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/16955; http://secunia.com/advisories/17246; http://sunsolve.sun.com/search/document.do?assetkey=1-26-101800-1
CVE: CVE-2005-3100
Published: 2005-09-28
Description: Unspecified "PPTP Remote DoS Vulnerability" in Astaro Security Linux 4.027 allows attackers to cause a denial of service.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16967; http://www.astaro.org/showflat.php?Cat=&Number=62289&Main=62289; http://www.osvdb.org/20971
CVE: CVE-2005-3101
Published: 2005-09-28
Description: The password reset feature in Movable Type before 3.2 generates different error messages depending on whether a user exists or not, which allows remote attackers to determine valid usernames.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0091.html; http://secunia.com/advisories/16899; http://www.securityfocus.com/bid/14911
CVE: CVE-2005-3102
Published: 2005-09-28
Description: The administrative interface in Movable Type allows attackers to upload files with arbitrary extensions under the web root.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0091.html; http://secunia.com/advisories/16899; http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0091.html
CVE: CVE-2005-3103
Published: 2005-09-28
Description: Cross-site scripting (XSS) vulnerability in Movable Type before 3.2 allows remote attackers to inject arbitrary web script or HTML via the (1) title, (2) category, (3) body, (4) extended body, and (5) excerpt form fields in new blog entries.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0091.html; http://secunia.com/advisories/16899; http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0091.html
CVE: CVE-2005-3104
Published: 2005-09-28
Description: mt-comments.cgi in Movable Type before 3.2 allows attackers to redirect users to other web sites via URLs in comments.
CVSS Score: 2.6 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0091.html; http://secunia.com/advisories/16899; http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0091.html
CVE: CVE-2005-3105
Published: 2005-09-30
Description: The mprotect code (mprotect.c) in Linux 2.6 on Itanium IA64 Montecito processors does not properly maintain cache coherency as required by the architecture, which allows local users to cause a denial of service and possibly corrupt data by modifying PTE protections.
CVSS Score: 2.1 (LOW)
References: http://cache-www.intel.com/cd/00/00/21/57/215792_215792.pdf; http://linux.bkbits.net:8080/linux-2.6/cset%404248d4019z8HvgrPAji51TKrWiV2uw?nav=index.html%7Csrc/%7Csrc/mm%7Crelated/mm/mprotect.c; http://secunia.com/advisories/18056
CVE: CVE-2005-3106
Published: 2005-09-30
Description: Race condition in Linux 2.6, when threads are sharing memory mapping via CLONE_VM (such as linuxthreads and vfork), might allow local users to cause a denial of service (deadlock) by triggering a core dump while waiting for a thread that has just performed an exec.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-667, CWE-667
References: http://linux.bkbits.net:8080/linux-2.6/diffs/fs/exec.c%401.156?nav=index.html%7Csrc/%7Csrc/fs%7Chist/fs/exec.c; http://secunia.com/advisories/17141; http://secunia.com/advisories/18056
CVE: CVE-2005-3107
Published: 2005-09-30
Description: fs/exec.c in Linux 2.6, when one thread is tracing another thread that shares the same memory map, might allow local users to cause a denial of service (deadlock) by forcing a core dump when the traced thread is in the TASK_TRACED state.
CVSS Score: 2.1 (LOW)
References: http://linux.bkbits.net:8080/linux-2.6/diffs/fs/exec.c%401.155?nav=index.html%7Csrc/%7Csrc/fs%7Chist/fs/exec.c; http://secunia.com/advisories/17141; http://secunia.com/advisories/18056
CVE: CVE-2005-3108
Published: 2005-09-30
Description: mm/ioremap.c in Linux 2.6 on 64-bit x86 systems allows local users to cause a denial of service or an information leak via an ioremap on a certain memory map that causes the iounmap to perform a lookup of a page that does not exist.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/17141; http://secunia.com/advisories/17364; http://secunia.com/advisories/18056
CVE: CVE-2005-3109
Published: 2005-09-30
Description: The HFS and HFS+ (hfsplus) modules in Linux 2.6 allow attackers to cause a denial of service (oops) by using hfsplus to mount a filesystem that is not hfsplus.
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: http://secunia.com/advisories/17141; http://secunia.com/advisories/18056; http://secunia.com/advisories/18510
CVE: CVE-2005-3110
Published: 2005-09-30
Description: Race condition in ebtables netfilter module (ebtables.c) in Linux 2.6, when running on an SMP system that is operating under a heavy load, might allow remote attackers to cause a denial of service (crash) via a series of packets that cause a value to be modified after it has been read but before it has been locked.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/17141; http://secunia.com/advisories/17364; http://secunia.com/advisories/17918
CVE: CVE-2005-3111
Published: 2005-09-30
Description: The handler code for backupninja 0.8 and earlier creates temporary files with predictable filenames, which allows local users to modify arbitrary files via a symlink attack.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/16995/; http://secunia.com/advisories/17018; http://www.debian.org/security/2005/dsa-827
CVE: CVE-2005-3112
Published: 2005-09-30
Description: The "reset password" feature in Macromedia Breeze 5.0 stores passwords in plaintext in the database instead of the hash, which allows attackers with access to the database to obtain the passwords.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/17009; http://securitytracker.com/id?1014990; http://www.macromedia.com/go/mpsb05-06
CVE: CVE-2005-3113
Published: 2005-09-30
Description: The ActiveX control for NateOn Messenger (NateonDownloadManager.ocx) allows remote attackers to download and execute arbitrary programs by setting the arguments to the GotNate.Excute method.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9343&w=2; http://secunia.com/advisories/16983; http://securitytracker.com/id?1014987
CVE: CVE-2005-3114
Published: 2005-09-30
Description: Buffer overflow in the ActiveX control for NateOn Messenger (NateonDownloadManager.ocx) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long third argument to the GotNate.Excute method.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]9343&w=2; http://secunia.com/advisories/16983; http://securitytracker.com/id?1014987
CVE: CVE-2005-2917
Published: 2005-09-30
Description: Squid 2.5.STABLE10 and earlier, while performing NTLM authentication, does not properly handle certain request sequences, which allows attackers to cause a denial of service (daemon restart).
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt; ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U; http://fedoranews.org/updates/FEDORA--.shtml
CVE: CVE-2005-2962
Published: 2005-09-30
Description: The post-installation script for ntlmaps before 0.9.9 sets world-readable permissions for the configuration file, which allows local users to obtain the username and password.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/17017; http://www.debian.org/security/2005/dsa-830; http://www.securityfocus.com/bid/16700
CVE: CVE-2005-3115
Published: 2005-09-30
Description: mpeg-tools before 1.5b-r2 creates multiple temporary files insecurely, which allows local users to overwrite arbitrary files via (1) ts.stat, (2) ts.mpg, (3) foobar, (4) blockbar, or (5) foobar[NNN].
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/17008; http://secunia.com/advisories/17051; http://www.gentoo.org/security/en/glsa/glsa-200510-02.xml
CVE: CVE-2005-2660
Published: 2005-09-30
Description: apachetop 0.12.5 and earlier, when running in debug mode, allows local users to create or append to arbitrary files via a symlink attack on atop.debug.
CVSS Score: 2.1 (LOW)
References: http://bugs.gentoo.org/show_bug.cgi?id=104473; http://securityreason.com/securityalert/38; http://securitytracker.com/id?1014996
CVE: CVE-2005-3060
Published: 2005-09-30
Description: Buffer overflow in getconf in IBM AIX 5.2 to 5.3 allows local users to execute arbitrary code via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/16996; http://securitytracker.com/id?1014991; http://www-1.ibm.com/support/docview.wss?uid=isg1IY73814
CVE: CVE-2005-2804
Published: 2005-10-04
Description: Integer overflow in the registry parsing code in GroupWise 6.5.3, and possibly earlier version, allows remote attackers to cause a denial of service (application crash) via a large TCP/IP port in the Windows registry key.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0763.html; http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/037442.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6802&w=2
CVE: CVE-2005-3127
Published: 2005-10-04
Description: Cross-site scripting (XSS) vulnerability in index.php in lucidCMS 1.0.11 allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0859&w=2; http://securityreason.com/securityalert/29; http://www.securityfocus.com/bid/14951
CVE: CVE-2005-3128
Published: 2005-10-04
Description: Cross-site scripting (XSS) vulnerability in add.php in Address Add Plugin 1.9 and 2.0 for Squirrelmail allows remote attackers to inject arbitrary web script or HTML via the IMG tag.
CVSS Score: 4.3 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=306172; http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0766&w=2
CVE: CVE-2005-3129
Published: 2005-10-04
Description: Cross-site request forgery (CSRF) vulnerability in Serendipity 0.8.4 and earlier allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag to serendipity_admin.php.
CVSS Score: 5.1 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/037580.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1203&w=2; http://secunia.com/advisories/17011/
CVE: CVE-2005-3130
Published: 2005-10-04
Description: SQL injection vulnerability in lucidCMS 1.0.11 allows remote attackers to execute arbitrary SQL commands via the login field.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5743&w=2; http://rgod.altervista.org/lucidcms1011.html; http://securityreason.com/securityalert/33
CVE: CVE-2005-3131
Published: 2005-10-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to blank.html, or the createdataCX parameter to (2) calendar_d.html, (3) calendar_m.html, or (4) calendar_w.html.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4168&w=2; http://secunia.com/advisories/17046/; http://www.securityfocus.com/bid/14980
CVE: CVE-2005-3132
Published: 2005-10-04
Description: MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to bwlist_inc.html, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4168&w=2; http://secunia.com/advisories/17046/; http://www.vupen.com/english/advisories/2005/1933
CVE: CVE-2005-3133
Published: 2005-10-04
Description: Multiple directory traversal vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allows remote attackers to (1) delete arbitrary files or directories via a relative path to the id parameter to logout.html or (2) include arbitrary PHP files or other files via the helpid parameter to help.html.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4168&w=2; http://secunia.com/advisories/17046/; http://www.securityfocus.com/bid/14986
CVE: CVE-2005-3134
Published: 2005-10-04
Description: Citrix Metaframe Presentation Server 3.0 and 4.0 allows remote attackers to bypass policy restrictions by downloading the launch.ica file and changing the client device name (ClientName).
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0696&w=2; http://secunia.com/advisories/17032/; http://securityreason.com/securityalert/39
CVE: CVE-2005-3135
Published: 2005-10-04
Description: Buffer overflow in Virtools Web Player 3.0.0.100 and earlier allows remote attackers to execute arbitrary code via a long filename.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/virtbugs-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1997&w=2; http://secunia.com/advisories/17034/
CVE: CVE-2005-3136
Published: 2005-10-04
Description: Directory traversal vulnerability in Virtools Web Player 3.0.0.100 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a filename.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/virtbugs-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1997&w=2; http://secunia.com/advisories/17034/
CVE: CVE-2005-2758
Published: 2005-10-05
Description: Integer signedness error in the administrative interface for Symantec AntiVirus Scan Engine 4.0 and 4.3 allows remote attackers to execute arbitrary code via crafted HTTP headers with negative values, which lead to a heap-based buffer overflow.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/17049; http://securityreason.com/securityalert/48; http://securitytracker.com/id?1015001
CVE: CVE-2005-2960
Published: 2005-10-05
Description: cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulnerability than CVE-2005-3137.
CVSS Score: 2.1 (LOW)
References: http://bugs.gentoo.org/show_bug.cgi?id=107871; http://groups.google.com/group/gnu.cfengine.help/browse_thread/thread/fc25e7d98f8ba401/38151ed821803be0#38151ed821803be0; http://secunia.com/advisories/17037/
CVE: CVE-2005-2961
Published: 2005-10-05
Description: Buffer overflow in the get_string_ahref function for ProZilla 1.3.7.4 and possibly earlier, with the -ftpsearch option enabled, allows remote servers to execute arbitrary code via a search response with a crafted string in the HREF field of an <A> tag.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17021/; http://secunia.com/advisories/17035; http://www.debian.org/security/2005/dsa-834
CVE: CVE-2005-3137
Published: 2005-10-05
Description: The (1) cfmailfilter and (2) cfcron.in files for cfengine 1.6.5 allow local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CVE-2005-2960.
CVSS Score: 2.1 (LOW)
References: http://bugs.gentoo.org/show_bug.cgi?id=107871; http://groups.google.com/group/gnu.cfengine.help/browse_thread/thread/fc25e7d98f8ba401/38151ed821803be0#38151ed821803be0; http://secunia.com/advisories/17037/
CVE: CVE-2005-0023
Published: 2005-10-05
Description: gnome-pty-helper in GNOME libzvt2 and libvte4 allows local users to spoof the logon hostname via a modified DISPLAY environment variable. NOTE: the severity of this issue has been disputed.
CVSS Score: 2.1 (LOW)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=330907; http://bugzilla.gnome.org/show_bug.cgi?id=317312; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7250&w=2
CVE: CVE-2005-2966
Published: 2005-10-05
Description: The Python SVG import plugin (diasvg_import.py) for DIA 0.94 and earlier allows user-assisted attackers to execute arbitrary commands via a crafted SVG file.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/17047; http://secunia.com/advisories/17059; http://secunia.com/advisories/17083
CVE: CVE-2005-3138
Published: 2005-10-05
Description: Bugzilla 2.18rc1 through 2.18.3, 2.19 through 2.20rc2, and 2.21 allows remote attackers to obtain sensitive information such as the list of installed products via the config.cgi file, which is accessible even when the requirelogin parameter is set.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5484&w=2; http://secunia.com/advisories/17030/; http://www.bugzilla.org/security/2.18.4/
CVE: CVE-2005-3139
Published: 2005-10-05
Description: Bugzilla 2.19.1 through 2.20rc2 and 2.21, with user matching turned on in substring mode, allows attackers to list all users whose names match an arbitrary substring, even when the usevisibilitygroups parameter is set.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5484&w=2; http://secunia.com/advisories/17030/; http://www.bugzilla.org/security/2.18.4/
CVE: CVE-2005-3140
Published: 2005-10-05
Description: Procom NetFORCE 800 4.02 M10 Build 20 and possibly other versions sends the NIS password map (passwd.nis) as a file attachment in diagnostic e-mail messages, which allows remote attackers to obtain the cleartext NIS password hashes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2426&w=2; http://secunia.com/advisories/17033/; http://www.securityfocus.com/bid/14997
CVE: CVE-2005-3141
Published: 2005-10-05
Description: Cerulean Studios Trillian 3.0 allows remote attackers to cause a denial of service (crash) via a reverse direct connection from a different client, as demonstrated using LICQ.
CVSS Score: 5.0 (MEDIUM)
References: http://ceruleanstudios.com/forums/showthread.php?s=84987af3601384b1dc7ea1f36b237c9c&threadid=64889; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6441&w=2; http://securityreason.com/securityalert/43
CVE: CVE-2005-3142
Published: 2005-10-05
Description: Heap-based buffer overflow in Kaspersky Antivirus (KAV) 5.0 and Kaspersky Personal Security Suite 1.1 allows remote attackers to execute arbitrary code via a CAB file with large records after the header.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0018.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2571&w=2; http://secunia.com/advisories/17024/
CVE: CVE-2005-3143
Published: 2005-10-05
Description: Unspecified vulnerability in the Mailbox Server for 4D WebStar before 5.3.5 allows attackers to cause a denial of service (crash) via IMAP clients on Mac OS X 10.4 Mail 2.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.4d.com/ACI_PRODUCT_REFERENCE_LIBRARY/4D_PRODUCT_DOCUMENTATION/PDF_Docs_by_4D_Product_A-Z/4D_WebSTAR/Software_Change_History_535.txt; http://secunia.com/advisories/17003; http://www.securityfocus.com/bid/14981
CVE: CVE-2005-3144
Published: 2005-10-05
Description: httpAdapter.c in sblim-sfcb before 0.9.2 allows remote attackers to cause a denial of service via long HTTP headers.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16975; http://sourceforge.net/project/shownotes.php?release_id=359700; http://www.securityfocus.com/bid/14972
CVE: CVE-2005-3145
Published: 2005-10-05
Description: httpAdapter.c in sblim-sfcb before 0.9.2 allows remote attackers to cause a denial of service (resource consumption) by connecting to sblim-sfcb but not sending any data.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16975; http://sourceforge.net/project/shownotes.php?release_id=359700; http://secunia.com/advisories/16975
CVE: CVE-2005-3146
Published: 2005-10-05
Description: StoreBackup before 1.19 allows local users to perform unauthorized operations on arbitrary files via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434; http://secunia.com/advisories/17025; http://secunia.com/advisories/19489
CVE: CVE-2005-3147
Published: 2005-10-05
Description: StoreBackup before 1.19 creates the backup root with world-readable permissions, which allows local users to obtain sensitive information.
CVSS Score: 2.1 (LOW)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434; http://secunia.com/advisories/17025; http://secunia.com/advisories/19489
CVE: CVE-2005-3148
Published: 2005-10-05
Description: StoreBackup before 1.19 does not properly set the uid and guid for symbolic links (1) that are backed up by storeBackup.pl, or (2) recovered by storeBackupRecover.pl, which could cause files to be restored with incorrect ownership.
CVSS Score: 4.6 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332434; http://secunia.com/advisories/17025; http://secunia.com/advisories/19489
CVE: CVE-2005-3149
Published: 2005-10-05
Description: Uim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the LIBUIM_VANILLA environment variable when a suid or sgid application is linked to libuim, such as immodule for Qt, which allows local users to gain privileges.
CVSS Score: 4.6 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=331620; http://lists.freedesktop.org/pipermail/uim/2005-September/001346.html; http://lists.freedesktop.org/pipermail/uim/2005-September/001347.html
CVE: CVE-2005-3150
Published: 2005-10-05
Description: Format string vulnerability in the Log_Flush function in Weex 2.6.1.5, 2.6.1, and possibly other versions allows remote FTP servers to execute arbitrary code via format strings in filenames.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17028; http://secunia.com/advisories/17081; http://secunia.com/advisories/17112