deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-1983
Published: 2005-08-10
Description: Stack-based buffer overflow in the Plug and Play (PnP) service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob (aka Mytob) worm.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0384.html; http://secunia.com/advisories/16372; http://securitytracker.com/id?1014640
CVE: CVE-2005-1984
Published: 2005-08-10
Description: Buffer overflow in the Print Spooler service (Spoolsv.exe) for Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via a malicious message.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16356/; http://securitytracker.com/id?1014638; http://www.kb.cert.org/vuls/id/220821
CVE: CVE-2005-1988
Published: 2005-08-10
Description: Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to execute arbitrary code via a web site or an HTML e-mail containing a crafted JPEG image that causes memory corruption, aka "JPEG Image Rendering Memory Corruption Vulnerability".
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/16373/; http://www.kb.cert.org/vuls/id/965206; http://www.us-cert.gov/cas/techalerts/TA05-221A.html
CVE: CVE-2005-1989
Published: 2005-08-10
Description: Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing from a web site to a web folder view using WebDAV, aka "Web Folder Behaviors Cross-Domain Vulnerability".
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16373/; http://www.securityfocus.com/bid/14512; http://www.vupen.com/english/advisories/2005/1353
CVE: CVE-2005-1990
Published: 2005-08-10
Description: Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, including (1) devenum.dll, (2) diactfrm.dll, (3) wmm2filt.dll, (4) fsusd.dll, (5) dmdskmgr.dll, (6) browsewm.dll, (7) browseui.dll, (8) shell32.dll, (9) mshtml.dll, (10) inetcfg.dll, (11) infosoft.dll, (12) query.dll, (13) syncui.dll, (14) clbcatex.dll, (15) clbcatq.dll, (16) comsvcs.dll, and (17) msconf.dll, which causes memory corruption, aka "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2087.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/16373/; http://securitytracker.com/id?1014643; http://www.kb.cert.org/vuls/id/959049
CVE: CVE-2005-2360
Published: 2005-08-10
Description: Unknown vulnerability in the LDAP dissector in Ethereal 0.8.5 through 0.10.11 allows remote attackers to cause a denial of service (free static memory and application crash) via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16225/; http://secunia.com/advisories/17102; http://www.debian.org/security/2005/dsa-853
CVE: CVE-2005-2361
Published: 2005-08-10
Description: Unknown vulnerability in the (1) AgentX dissector, (2) PER dissector, (3) DOCSIS dissector, (4) SCTP graphs, (5) HTTP dissector, (6) DCERPC, (7) DHCP, (8) RADIUS dissector, (9) Telnet dissector, (10) IS-IS LSP dissector, or (11) NCP dissector in Ethereal 0.8.19 through 0.10.11 allows remote attackers to cause a denial of service (application crash or abort) via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16225/; http://secunia.com/advisories/17102; http://www.debian.org/security/2005/dsa-853
CVE: CVE-2005-2362
Published: 2005-08-10
Description: Unknown vulnerability several dissectors in Ethereal 0.9.0 through 0.10.11 allows remote attackers to cause a denial of service (application crash) by reassembling certain packets.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16225; http://www.ethereal.com/appnotes/enpa-sa-00020.html; http://www.gentoo.org/security/en/glsa/glsa-200507-27.xml
CVE: CVE-2005-2363
Published: 2005-08-10
Description: Unknown vulnerability in the (1) SMPP dissector, (2) 802.3 dissector, (3) DHCP, (4) MEGACO dissector, or (5) H1 dissector in Ethereal 0.8.15 through 0.10.11 allows remote attackers to cause a denial of service (infinite loop) via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16225/; http://secunia.com/advisories/17102; http://www.debian.org/security/2005/dsa-853
CVE: CVE-2005-2364
Published: 2005-08-10
Description: Unknown vulnerability in the (1) GIOP dissector, (2) WBXML, or (3) CAMEL dissector in Ethereal 0.8.20 through 0.10.11 allows remote attackers to cause a denial of service (application crash) via certain packets that cause a null pointer dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16225/; http://secunia.com/advisories/17102; http://www.debian.org/security/2005/dsa-853
CVE: CVE-2005-2365
Published: 2005-08-10
Description: Unknown vulnerability in the SMB dissector in Ethereal 0.9.0 through 0.10.11 allows remote attackers to cause a buffer overflow or a denial of service (memory consumption) via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16225/; http://secunia.com/advisories/17102; http://www.debian.org/security/2005/dsa-853
CVE: CVE-2005-2366
Published: 2005-08-10
Description: Unknown vulnerability in the BER dissector in Ethereal 0.10.11 allows remote attackers to cause a denial of service (abort or infinite loop) via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16225/; http://secunia.com/advisories/17102; http://www.debian.org/security/2005/dsa-853
CVE: CVE-2005-2367
Published: 2005-08-10
Description: Format string vulnerability in the proto_item_set_text function in Ethereal 0.9.4 through 0.10.11, as used in multiple dissectors, allows remote attackers to write to arbitrary memory locations and gain privileges via a crafted AFP packet.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16225/; http://secunia.com/advisories/17102; http://www.debian.org/security/2005/dsa-853
CVE: CVE-2005-2535
Published: 2005-08-10
Description: Buffer overflow in the Discovery Service in BrightStor ARCserve Backup 9.0 through 11.1 allows remote attackers to execute arbitrary commands via a large packet to TCP port 41523, a different vulnerability than CVE-2005-0260.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2005-02/0123.html; http://archives.neohapsis.com/archives/bugtraq/2005-02/0141.html; http://archives.neohapsis.com/archives/bugtraq/2005-02/0201.html
CVE: CVE-2005-2536
Published: 2005-08-10
Description: pstotext before 1.8g does not properly use the "-dSAFER" option when calling Ghostscript to extract plain text from PostScript and PDF files, which allows remote attackers to execute arbitrary commands via a malicious PostScript file.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16183/; http://secunia.com/advisories/16305; http://secunia.com/advisories/16624
CVE: CVE-2005-2537
Published: 2005-08-10
Description: FlatNuke 2.5.5 and possibly earlier versions allows remote attackers to obtain sensitive information via a direct request to structure.php.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0127&w=2; http://secunia.com/advisories/16330; http://www.osvdb.org/18549
CVE: CVE-2005-2538
Published: 2005-08-10
Description: FlatNuke 2.5.5 and possibly earlier versions allows remote attackers to obtain sensitive information via (1) a null byte or (2) an MS-DOS device name such as AUX, CON, PRN, COM1, or LPT1 in the mod parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0127&w=2; http://secunia.com/advisories/16330; http://www.osvdb.org/18550
CVE: CVE-2005-2539
Published: 2005-08-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in FlatNuke 2.5.5 and possibly earlier versions allow remote attackers to inject arbitrary web script or HTML via the (1) bodycolor, (2) backimage, (3) theme, or (4) logo parameter to structure.php, (5) admin, (6) admin_mail, or (7) back parameter to footer.php, or (8) the message body in a news post.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0127&w=2; http://secunia.com/advisories/16330; http://www.osvdb.org/18551
CVE: CVE-2005-2540
Published: 2005-08-10
Description: CRLF injection vulnerability in FlatNuke 2.5.5 and possibly earlier versions allows remote attackers to execute arbitrary PHP commands via an ASCII char 13 (carriage return) in the signature field, which is injected into a PHP script without a preceding comment character, which can then be executed by a direct request.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0127&w=2; http://secunia.com/advisories/16330; http://www.osvdb.org/18554
CVE: CVE-2005-2541
Published: 2005-08-10
Description: Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0258&w=2; https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a[PII_REDACTED]c%40%3Cissues.guacamole.apache.org%3E; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0258&w=2
CVE: CVE-2005-2542
Published: 2005-08-10
Description: Invision Power Board (IPB) 1.0.3 allows remote attackers to inject arbitrary web script or HTML via an attachment, which is automatically downloaded and processed as HTML.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4854&w=2; http://secunia.com/advisories/16348; http://www.securityfocus.com/bid/14492
CVE: CVE-2005-2543
Published: 2005-08-10
Description: Directory traversal vulnerability in wce.download.php in Comdev eCommerce 3.0 allows remote attackers to download arbitrary files via a .. (dot dot) in the download parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0062&w=2; http://www.securityfocus.com/bid/14479; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0062&w=2
CVE: CVE-2005-2544
Published: 2005-08-10
Description: PHP remote file inclusion vulnerability in config.php in Comdev eCommerce 3.0 allows remote attackers to execute arbitrary PHP code via the path[docroot] parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2520&w=2; http://secunia.com/advisories/16346; http://www.osvdb.org/18601
CVE: CVE-2005-2545
Published: 2005-08-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHPOpenChat 3.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) content parameter to profile.php and profile_misc.php, (3) the profile fields in userpage.php, (4) subject or (5) body in mail.php, or (8) disinvited_chatter or (7) invited_chatter parameter to invite.php.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4137&w=2; http://secunia.com/advisories/16350; http://securitytracker.com/id?1014634
CVE: CVE-2005-2546
Published: 2005-08-10
Description: Arab Portal 2.0 allows remote attackers to obtain sensitive information via a long (1) username or (2) password, which reveals the path in an error message when the undefined "errmsg" function is called.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7175&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7175&w=2
CVE: CVE-2005-2547
Published: 2005-08-12
Description: security.c in hcid for BlueZ 2.16, 2.17, and 2.18 allows remote attackers to execute arbitrary commands via shell metacharacters in the Bluetooth device name when invoking the PIN helper.
CVSS Score: 7.5 (HIGH)
References: http://cvs.sourceforge.net/viewcvs.py/bluez/utils/hcid/security.c?r1=1.31&r2=1.34; http://secunia.com/advisories/16453; http://secunia.com/advisories/16476
CVE: CVE-2005-2548
Published: 2005-08-12
Description: vlan_dev.c in the VLAN code for Linux kernel 2.6.8 allows remote attackers to cause a denial of service (kernel oops from null dereference) via certain UDP packets that lead to a function call with the wrong argument, as demonstrated using snmpwalk on snmpd.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=309308; http://lists.osdl.org/pipermail/bridge/2004-September/000638.html; http://secunia.com/advisories/17826
CVE: CVE-2005-2549
Published: 2005-08-12
Description: Multiple format string vulnerabilities in Evolution 1.5 through 2.3.6.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) full vCard data, (2) contact data from remote LDAP servers, or (3) task list data from remote servers.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2032&w=2; http://secunia.com/advisories/16394; http://secunia.com/advisories/19380
CVE: CVE-2005-2550
Published: 2005-08-12
Description: Format string vulnerability in Evolution 1.4 through 2.3.6.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the calendar entries such as task lists, which are not properly handled when the user selects the Calendars tab.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2032&w=2; http://secunia.com/advisories/16394; http://secunia.com/advisories/19380
CVE: CVE-2005-2551
Published: 2005-08-12
Description: Buffer overflow in dhost.exe in iMonitor for Novell eDirectory 8.7.3 on Windows allows attackers to cause a denial of service (crash) and obtain access to files via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16393; http://securitytracker.com/id?1014661; http://support.novell.com/cgi-bin/search/searchtid.cgi?/10098568.htm
CVE: CVE-2005-2552
Published: 2005-08-12
Description: Unknown vulnerability in HP ProLiant DL585 servers running Integrated Lights Out (ILO) firmware before 1.81 allows attackers to access server controls when the server is "powered down."
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1738&w=2; http://secunia.com/advisories/16402; http://securitytracker.com/id?1014658
CVE: CVE-2005-2553
Published: 2005-08-12
Description: The find_target function in ptrace32.c in the Linux kernel 2.4.x before 2.4.29 does not properly handle a NULL return value from another function, which allows local users to cause a denial of service (kernel crash/oops) by running a 32-bit ltrace program with the -i option on a 64-bit executable program.
CVSS Score: 2.1 (LOW)
References: http://linux.bkbits.net:8080/linux-2.4/cset%4041dd3455GwQPufrGvBJjcUOXQa3WXA; http://lists.suse.de/archive/suse-security-announce/2006-Feb/0010.html; http://lkml.org/lkml/2005/1/5/245
CVE: CVE-2005-2554
Published: 2005-08-12
Description: The web server for Network Associates ePolicy Orchestrator Agent 3.5.0 (patch 3) uses insecure permissions for the "Common Framework\Db" folder, which allows local users to read arbitrary files by creating a subfolder in the EPO agent web root directory.
CVSS Score: 2.1 (LOW)
References: http://knowledgemap.nai.com/KanisaSupportSite/search.do?cmd=displayKC&docType=kc&externalId=KBkb42216xml; http://lists.virus.org/full-disclosure-0508/msg00376.html; http://reedarvin.thearvins.com/20050811-01.html
CVE: CVE-2005-1527
Published: 2005-08-15
Description: Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/16412; http://secunia.com/advisories/17463; http://securitytracker.com/id?1014636
CVE: CVE-2005-2498
Published: 2005-08-15
Description: Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be nested, which are injected into an eval function call, a different vulnerability than CVE-2005-1921.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2890&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0344&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7335&w=2
CVE: CVE-2005-2097
Published: 2005-08-16
Description: xpdf and kpdf do not properly validate the "loca" table in PDF files, which allows local users to cause a denial of service (disk consumption and hang) via a PDF file with a "broken" loca table, which causes a large temporary file to be created when xpdf attempts to reconstruct the information.
CVSS Score: 2.1 (LOW)
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.42/SCOSA-2005.42.txt; http://secunia.com/advisories/17277; http://secunia.com/advisories/18398
CVE: CVE-2005-2102
Published: 2005-08-16
Description: The AIM/ICQ module in Gaim before 1.5.0 allows remote attackers to cause a denial of service (application crash) via a filename that contains invalid UTF-8 characters.
CVSS Score: 5.0 (MEDIUM)
References: http://gaim.sourceforge.net/security/?id=21; http://www.novell.com/linux/security/advisories/2005_19_sr.html; http://www.redhat.com/support/errata/RHSA-2005-627.html
CVE: CVE-2005-2103
Published: 2005-08-16
Description: Buffer overflow in the AIM and ICQ module in Gaim before 1.5.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an away message with a large number of AIM substitution strings, such as %t or %n.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-131, CWE-131
References: http://gaim.sourceforge.net/security/?id=22; http://www.novell.com/linux/security/advisories/2005_19_sr.html; http://www.redhat.com/support/errata/RHSA-2005-589.html
CVE: CVE-2005-2357
Published: 2005-08-16
Description: Directory traversal vulnerability in EMC Navisphere Manager 6.4.1.0.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16344; http://securitytracker.com/id?1014629; http://www.idefense.com/application/poi/display?id=288&type=vulnerabilities&flashstatus=true
CVE: CVE-2005-2358
Published: 2005-08-16
Description: EMC Navisphere Manager 6.4.1.0.0 allows remote attackers to list arbitrary directories via an HTTP request for a directory that ends in a "." (trailing dot).
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16344; http://securitytracker.com/id?1014629; http://www.idefense.com/application/poi/display?id=288&type=vulnerabilities&flashstatus=true
CVE: CVE-2005-2470
Published: 2005-08-16
Description: Buffer overflow in a "core application plug-in" for Adobe Reader 5.1 through 7.0.2 and Acrobat 5.0 through 7.0.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16466; http://securitytracker.com/id?1014712; http://www.adobe.com/support/techdocs/321644.html
CVE: CVE-2005-2555
Published: 2005-08-16
Description: Linux kernel 2.6.x does not properly restrict socket policy access to users with the CAP_NET_ADMIN capability, which could allow local users to conduct unauthorized activities via (1) ipv4/ip_sockglue.c and (2) ipv6/ipv6_sockglue.c.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/17002; http://secunia.com/advisories/17073; http://secunia.com/advisories/17826
CVE: CVE-2005-2558
Published: 2005-08-16
Description: Stack-based buffer overflow in the init_syms function in MySQL 4.0 before 4.0.25, 4.1 before 4.1.13, and 5.0 before 5.0.7-beta allows remote authenticated users who can create user-defined functions to execute arbitrary code via a long function_name field.
CVSS Score: 4.6 (MEDIUM)
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.18.1/SCOSA-2006.18.1.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2005-August/035845.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2427&w=2
CVE: CVE-2005-2559
Published: 2005-08-16
Description: doping.php in ePing plugin 1.02 and earlier for e107 portal allows remote attackers to execute arbitrary code or overwrite files via (1) shell metacharacters in the eping_count parameter or (2) restricted shell metacharacters such as ">" and "&" in the eping_host parameter, which is not handled by the validation function.
CVSS Score: 7.5 (HIGH)
References: http://e107plugins.co.uk/news.php; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9148&w=2; http://e107plugins.co.uk/news.php
CVE: CVE-2005-2560
Published: 2005-08-16
Description: Cross-site scripting (XSS) vulnerability in index.cfm in CFBB 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5868&w=2; http://secunia.com/advisories/16311; http://www.securityfocus.com/bid/14440
CVE: CVE-2005-2561
Published: 2005-08-16
Description: Multiple SQL injection vulnerabilities in MYFAQ 1.0 allow remote attackers to execute arbitrary SQL commands via the Theme parameter to (1) affichagefaq.php3, (2) choixsoustheme.php3, (3) consultation.php3, (4) insfaq.php3, (5) inssoustheme.php3, (6) instheme.php3, (7) saisiefaqtotale.php3, (8) saisiesoustheme.php3, or (9) voirfaq.php3, the SousTheme parameter to (10) affichagefaq.php3, (11) consultation.php3, (12) insfaq.php3, (13) inssoustheme.php3, (14) saisiefaq.php3, (15) saisiefaqtotale.php3, or (16) voirfaq.php3, the Faq parameter to (17) saisiefaq.php3, (18) voirfaq.php3, or (19) inssolution.php3, or (20) question parameter to affichagefaq.php3.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2309&w=2; http://secunia.com/advisories/16366; http://svt.nukleon.us/lab/svadvisory13.txt
CVE: CVE-2005-2562
Published: 2005-08-16
Description: SQL injection vulnerability in Gravity Board X (GBX) 1.1 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the login field.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3443&w=2; http://securitytracker.com/alerts/2005/Aug/1014631.html; http://www.securityfocus.com/bid/14497
CVE: CVE-2005-2563
Published: 2005-08-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in Gravity Board X (GBX) 1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the board_id parameter to deletethread.php or (2) the template.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3443&w=2; http://securitytracker.com/alerts/2005/Aug/1014631.html; http://www.securityfocus.com/bid/14497
CVE: CVE-2005-2564
Published: 2005-08-16
Description: Direct static code injection vulnerability in editcss.php in Gravity Board X (GBX) 1.1 allows remote attackers to execute arbitrary PHP code, HTML, and script via the csscontent parameter, which is directly inserted into the gbxfinal.css file.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3443&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/21742; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3443&w=2