deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-3511
Published: 2005-11-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Spymac Web OS 4.0 allow remote attackers to inject arbitrary web script or HTML via (a) the blogs module, including the (1) curr parameter in index.php, (2) inspire, (3) system, or (4) title parameter in blog_newentry.php, (5) entry parameter in blog_newentry_comment.php, (6) entry parameter in blog_edit_entry.php, or (7) caldate parameter in blog.php; and (b) the notes module, including the (1) forwardid parameter in a noteform action; (2) del_folder parameter in a delete_folder action; (3) isread, (4) dateorder, (5) subjectorder, (6) curr, (7) fromorder, or (8) action parameters; (9) ppp or (10) totalreplies parameter in an Inbox action; (11) totalnotes parameter; or (12) touserid parameter in a noteform action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lostmon.blogspot.com/2005/11/spymac-web-os-v4-blogs-and-notes.html; http://www.vupen.com/english/advisories/2005/2312; http://lostmon.blogspot.com/2005/11/spymac-web-os-v4-blogs-and-notes.html
CVE: CVE-2005-3512
Published: 2005-11-06
Description: Cross-site scripting (XSS) vulnerability in index.php in VUBB alpha rc1 allows remote attackers to inject arbitrary web script or HTML via the t parameter in a newreply action.
CVSS Score: 4.3 (MEDIUM)
References: http://irannetjob.com/content/view/152/28/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8496&w=2; http://www.securityfocus.com/bid/15260/
CVE: CVE-2005-3513
Published: 2005-11-06
Description: index.php in VUBB alpha rc1 allows remote attackers to obtain the installation path of the application via a viewforum action with the f parameter set to a single quote (').
CVSS Score: 5.0 (MEDIUM)
References: http://irannetjob.com/content/view/152/28/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8496&w=2; http://irannetjob.com/content/view/152/28/
CVE: CVE-2005-3514
Published: 2005-11-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Chipmunk Forum script allow remote attackers to inject arbitrary web script or HTML via the forumID parameter to (1) newtopic.php, (2) quote.php, (3) index.php, and (4) reply.php.
CVSS Score: 4.3 (MEDIUM)
References: http://irannetjob.com/content/view/148/28/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4274&w=2; http://secunia.com/advisories/17239/
CVE: CVE-2005-3515
Published: 2005-11-06
Description: Cross-site scripting (XSS) vulnerability in recommend.php in Chipmunk Topsites script allows remote attackers to inject arbitrary web script or HTML via the ID parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://irannetjob.com/content/view/148/28/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4274&w=2; http://secunia.com/advisories/17262/
CVE: CVE-2005-3516
Published: 2005-11-06
Description: Cross-site scripting (XSS) vulnerability in recommend.php in Chipmunk Directory script allows remote attackers to inject arbitrary web script or HTML via the entryID parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://irannetjob.com/content/view/148/28/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4274&w=2; http://secunia.com/advisories/17283/
CVE: CVE-2005-3517
Published: 2005-11-06
Description: Chipmunk Scripts Guestbook allows remote attackers to obtain the installation path of the script via a URL that causes an error message to be displayed, such as a URL that contains a single quote (') in the start parameter of index.php.
CVSS Score: 5.0 (MEDIUM)
References: http://irannetjob.com/content/view/148/28/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4274&w=2; http://securityreason.com/securityalert/96
CVE: CVE-2005-3518
Published: 2005-11-06
Description: SQL injection vulnerability in search.php in PunBB 1.2.7 and 1.2.8 allows remote attackers to execute arbitrary SQL commands via the old_searches parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8430&w=2; http://secunia.com/advisories/17227/; http://securityreason.com/securityalert/87
CVE: CVE-2005-3519
Published: 2005-11-06
Description: Multiple PHP file inclusion vulnerabilities in MySource 2.14.0 allow remote attackers to execute arbitrary PHP code and include arbitrary local files via the (1) INCLUDE_PATH and (2) SQUIZLIB_PATH parameters in new_upgrade_functions.php, (3) the INCLUDE_PATH parameter in init_mysource.php, and the PEAR_PATH parameter in (4) Socket.php, (5) Request.php, (6) Mail.php, (7) Date.php, (8) Span.php, (9) mimeDecode.php, and (10) mime.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2769&w=2; http://secunia.com/advisories/16946/; http://securityreason.com/securityalert/92
CVE: CVE-2005-3520
Published: 2005-11-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in MySource 2.14.0 allow remote attackers to inject arbitrary web script or HTML via (1) the target_url parameter in upgrade_in_progress_backend.php, (2) the stylesheet parameter in edit_table_cell_type_wysiwyg.php, and the bgcolor parameter in (3) insert_table.php, (4) edit_table_cell_props.php, (5) header.php, (6) edit_table_row_props.php, and (7) edit_table_props.php.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2769&w=2; http://secunia.com/advisories/16946/; http://securityreason.com/securityalert/92
CVE: CVE-2005-3521
Published: 2005-11-06
Description: SQL injection vulnerability in resetcore.php in e107 0.617 through 0.6173 allows remote attackers to execute arbitrary SQL commands, bypass authentication, and inject HTML or script via the (1) a_name parameter or (2) user field of the login page.
CVSS Score: 7.5 (HIGH)
References: http://e107.org/news.php; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2966&w=2; http://secunia.com/advisories/17237/
CVE: CVE-2005-3522
Published: 2005-11-06
Description: Cross-site scripting (XSS) vulnerability in index.jsp in ManageEngine Netflow Analyzer 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the grDisp parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9401&w=2; http://secunia.com/advisories/17253/; http://securitytracker.com/id?1015078
CVE: CVE-2005-3523
Published: 2005-11-07
Description: Format string vulnerability in friendsd2 in GpsDrive allows remote attackers to execute arbitrary code via the dir (direction) field.
CVSS Score: 7.5 (HIGH)
References: http://seclists.org/lists/fulldisclosure/2005/Nov/0130.html; http://secunia.com/advisories/17473; http://secunia.com/advisories/17477
CVE: CVE-2005-3524
Published: 2005-11-07
Description: Buffer overflow in the SSL-ready version of linux-ftpd (linux-ftpd-ssl) 0.17 allows remote attackers to execute arbitrary code by creating a long directory name, then executing the XPWD command.
CVSS Score: 10.0 (HIGH)
References: http://seclists.org/lists/fulldisclosure/2005/Nov/0140.html; http://secunia.com/advisories/17465; http://secunia.com/advisories/17529
CVE: CVE-2005-3527
Published: 2005-11-09
Description: Race condition in do_coredump in signal.c in Linux kernel 2.6 allows local users to cause a denial of service by triggering a core dump in one thread while another thread has a pending SIGSTOP.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/17917; http://secunia.com/advisories/17918; http://www.kernel.org/git/?p=linux/kernel/git/davem/sparc-2.6.git%3Ba=commitdiff%3Bh=788e05a67c343fa22f2ae1d3ca264e7f15c25eaf
CVE: CVE-2005-2659
Published: 2005-11-16
Description: Buffer overflow in the LZX decompression in CHM Lib (chmlib) 0.35, as used in products such as KchmViewer, has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://mail-index.netbsd.org/pkgsrc-changes/2005/09/12/0010.html; http://secunia.com/advisories/17325; http://secunia.com/advisories/17494
CVE: CVE-2005-3344
Published: 2005-11-16
Description: The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access.
CVSS Score: 10.0 (HIGH)
References: http://www.debian.org/security/2005/dsa-884; http://www.networkscanning.com/Horde-Default-Admin-Password-Vulnerability-VSS_20171.html; http://www.osvdb.org/24117
CVE: CVE-2005-3542
Published: 2005-11-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-3508.  Reason: This candidate is a reservation duplicate of CVE-2005-3508.  Notes: All CVE users should reference CVE-2005-3508 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-3543
Published: 2005-11-16
Description: SQL injection vulnerability in search.php in Phorum 5.0.0alpha through 5.0.20, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the forum_ids parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4216&w=2; http://phorum.org/story.php?57; http://secunia.com/advisories/17456
CVE: CVE-2005-3544
Published: 2005-11-16
Description: Cross-site scripting (XSS) vulnerability in u2u.php in XMB 1.9.3 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/17458; http://www.securityfocus.com/archive/1/415800/30/0/threaded; http://www.securityfocus.com/bid/15342
CVE: CVE-2005-3545
Published: 2005-11-16
Description: SQL injection vulnerability in index.php of the report module in ibProArcade 2.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/20514; http://secunia.com/advisories/17457; http://securityreason.com/securityalert/151
CVE: CVE-2005-3546
Published: 2005-11-16
Description: suid.cgi scripts in F-Secure (1) Internet Gatekeeper for Linux before 2.15.484 and (2) Anti-Virus Linux Gateway before 2.16 are installed SUID with world-executable permissions, which allows local users to gain privilege.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/17467; http://securitytracker.com/id?1015159; http://securitytracker.com/id?1015160
CVE: CVE-2005-3547
Published: 2005-11-16
Description: Cross-site scripting (XSS) vulnerability in Invision Power Board 2.1 allows remote attackers to inject arbitrary web script or HTML via the (1) adsess, (2) name, and (3) description parameters in admin.php, and the (4) ACP Notes, (5) Member Name, (6) Password, (7) Email Address, (8) Components, and multiple other input fields.
CVSS Score: 4.3 (MEDIUM)
References: http://benji.redkod.org/audits/ipb.2.1.pdf; http://osvdb.org/20516; http://osvdb.org/20517
CVE: CVE-2005-3548
Published: 2005-11-16
Description: Directory traversal vulnerability in Task Manager in Invision Power Board (IP.Board) 2.0.1 allows limited remote attackers to include files via a ..  (dot dot) in the "Task PHP File To Run" field.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/17443; http://www.osvdb.org/35429; http://www.securityfocus.com/archive/1/415798/30/0/threaded
CVE: CVE-2005-3549
Published: 2005-11-16
Description: Direct code injection vulnerability in Task Manager in Invision Power Board 2.0.1 allows limited remote attackers to execute arbitrary code by referencing the file in "Task PHP File To Run" field and selecting "Run Task Now".
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/17443; http://www.securityfocus.com/archive/1/415798/30/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/40003
CVE: CVE-2005-3550
Published: 2005-11-16
Description: Directory traversal vulnerability in admin.php in toendaCMS before 0.6.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the id_user parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17471; http://www.securityfocus.com/archive/1/415975/30/0/threaded; http://www.securityfocus.com/bid/15348
CVE: CVE-2005-3551
Published: 2005-11-16
Description: toendaCMS before 0.6.2 stores user account and session data in the web root directory, which allows remote attackers to obtain sensitive information via a direct request to the appropriate XML file.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17471; http://www.securityfocus.com/archive/1/415975/30/0/threaded; http://www.vupen.com/english/advisories/2005/2343
CVE: CVE-2005-3552
Published: 2005-11-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHPKIT 1.6.1 R2 and earlier allow remote attackers to inject arbitrary web script or HTML via multiple vectors in (1) login/profile.php, (2) login/userinfo.php, (3) admin/admin.php, (4) imcenter.php, and the (5) referer statistics, the (6) HTML title element and (7) logo alt attributes in forum postings, and the (8) Homepage field in the Guestbook.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cert.uni-stuttgart.de/archive/bugtraq/2005/11/msg00110.html; http://secunia.com/advisories/17479; http://securitytracker.com/id?1015167
CVE: CVE-2005-3553
Published: 2005-11-16
Description: Multiple SQL injection vulnerabilities in include.php in PHPKIT 1.6.1 R2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in conjunction with the login/userinfo.php path and (2) the session parameter (aka the PHPKITSID variable).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://cert.uni-stuttgart.de/archive/bugtraq/2005/11/msg00110.html; http://secunia.com/advisories/17479; http://securitytracker.com/id?1015167
CVE: CVE-2005-3554
Published: 2005-11-16
Description: Multiple eval injection vulnerabilities in the help function in PHPKIT 1.6.1 R2 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary code on the server via unknown attack vectors involving uninitialized variables.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://cert.uni-stuttgart.de/archive/bugtraq/2005/11/msg00110.html; http://secunia.com/advisories/17479; http://securitytracker.com/id?1015167
CVE: CVE-2005-3555
Published: 2005-11-16
Description: Multiple SQL injection vulnerabilities in PHPlist 2.10.1 and earlier allow authenticated remote attackers with administrator privileges to execute arbitrary SQL commands via the id parameter in the (1) editattributes or (2) admin page.
CVSS Score: 6.5 (MEDIUM)
References: http://osvdb.org/20567; http://osvdb.org/20568; http://secunia.com/advisories/17476
CVE: CVE-2005-3556
Published: 2005-11-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHPlist 2.10.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) listname parameter in (a) admin/editlist.php, (2) title parameter in (b) admin/spageedit.php, (3) title field in (c) admin/template.php, (4) filter, (5) delete, and (6) start parameters in (d) admin/eventlog.php, (7) id parameter in (e) admin/configure.php, (8) find parameter in (f) admin/users.php, (9) start parameter in (g) admin/admin.php, and (10) action parameter in (h) admin/fckphplist.php.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/20570; http://osvdb.org/20571; http://osvdb.org/20572
CVE: CVE-2005-3557
Published: 2005-11-16
Description: Directory traversal vulnerability in admin/defaults.php in PHPlist 2.10.1 and earlier allows remote attackers to access arbitrary files via a .. (dot dot) in the selected%5B%5D parameter in an HTTP POST request.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/20569; http://secunia.com/advisories/17476; http://www.securityfocus.com/archive/1/416005/30/0/threaded
CVE: CVE-2005-3558
Published: 2005-11-16
Description: PHP file inclusion vulnerability in index.php in OSTE 1.0 allows remote attackers to execute arbitrary code via the (1) page and (2) site parameters.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/20578; http://secunia.com/advisories/17493; http://securitytracker.com/id?1015163
CVE: CVE-2005-3559
Published: 2005-11-16
Description: Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a .. (dot dot) in the folder parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/20577; http://secunia.com/advisories/17459; http://secunia.com/advisories/19872
CVE: CVE-2005-3560
Published: 2005-11-16
Description: Zone Labs (1) ZoneAlarm Pro 6.0, (2) ZoneAlarm Internet Security Suite 6.0, (3) ZoneAlarm Anti-Virus 6.0, (4) ZoneAlarm Anti-Spyware 6.0 through 6.1, and (5) ZoneAlarm 6.0 allow remote attackers to bypass the "Advanced Program Control and OS Firewall filters" setting via URLs in "HTML Modal Dialogs" (window.location.href) contained within JavaScript tags.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17450; http://securityreason.com/securityalert/155; http://www.osvdb.org/20677
CVE: CVE-2005-3561
Published: 2005-11-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-2954.  Reason: This candidate is a reservation duplicate of CVE-2005-2954.  Notes: All CVE users should reference CVE-2005-2954 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-3562
Published: 2005-11-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-2955.  Reason: This candidate is a reservation duplicate of CVE-2005-2955.  Notes: All CVE users should reference CVE-2005-2955 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-3563
Published: 2005-11-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-2956.  Reason: This candidate is a duplicate of CVE-2005-2956.  Notes: All CVE users should reference CVE-2005-2956 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-3564
Published: 2005-11-16
Description: envd daemon in HP-UX B.11.00 through B.11.11 allows local users to obtain privileges via unknown attack vectors.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/17506; http://securitytracker.com/id?1015172; http://www.osvdb.org/20678
CVE: CVE-2005-3565
Published: 2005-11-16
Description: Unknown vulnerability in remshd daemon in HP-UX B.11.00, B.11.11, and B.11.23 while running in "Trusted Mode" allows remote attackers to gain unauthorized system access via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/20679; http://secunia.com/advisories/17507; http://securitytracker.com/id?1015173
CVE: CVE-2005-3566
Published: 2005-11-16
Description: Buffer overflow in various ha commands of VERITAS Cluster Server for UNIX before 4.0MP2 allows local users to execute arbitrary code via a long VCSI18N_LANG environment variable to (1) haagent, (2) haalert, (3) haattr, (4) hacli, (5) hacli_runcmd, (6) haclus, (7) haconf, (8) hadebug, (9) hagrp, (10) hahb, (11) halog, (12) hareg, (13) hares, (14) hastatus, (15) hasys, (16) hatype, (17) hauser, and (18) tststew.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6880&w=2; http://osvdb.org/20673; http://secunia.com/advisories/17502
CVE: CVE-2005-3567
Published: 2005-11-16
Description: slapd daemon in IBM Tivoli Directory Server (ITDS) 5.2.0 and 6.0.0 binds using SASL EXTERNAL, which allows attackers to bypass authentication and modify and delete directory data via unknown attack vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/17484; http://securitytracker.com/id?1015171; http://www-1.ibm.com/support/docview.wss?rs=767&context=SSVJJU&dc=D400&uid=swg24010819&loc=en_US&cs=UTF-8&lang=en
CVE: CVE-2005-3568
Published: 2005-11-16
Description: db2fmp process in IBM DB2 Content Manager before 8.2 Fix Pack 10 allows local users to cause a denial of service (CPU consumption) by importing a corrupted Microsoft Excel file, aka "CORRUPTED EXEL FILE WILL CAUSE TEXT SEARCH PROCESS LOOPING."
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/17388; http://www-1.ibm.com/support/docview.wss?uid=swg1IO00737; http://www.osvdb.org/20707
CVE: CVE-2005-3569
Published: 2005-11-16
Description: INSO service in IBM DB2 Content Manager before 8.2 Fix Pack 10 on AIX allows attackers to cause a denial of service (application crash) via unknown attack vectors involving LZH files.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17388; http://www-1.ibm.com/support/docview.wss?uid=swg27005891&aid=3#wq213; http://www.osvdb.org/20708
CVE: CVE-2005-3570
Published: 2005-11-16
Description: Unspecified cross-site scripting (XSS) vulnerability in Horde before 2.2.9 allows remote attackers to inject arbitrary web script or HTML via "not properly escaped error messages".
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.207.2.109&r2=1.207.2.111&ty=h; http://lists.horde.org/archives/announce/2005/000231.html; http://secunia.com/advisories/17468
CVE: CVE-2005-3571
Published: 2005-11-16
Description: PHP file inclusion vulnerability in protection.php in CodeGrrl (a) PHPCalendar 1.0, (b) PHPClique 1.0, (c) PHPCurrently 2.0, (d) PHPFanBase 2.1, and (e) PHPQuotes 1.0 allows remote attackers to include arbitrary local files via the siteurl parameter when register_globals is enabled.  NOTE: It was later reported that PHPFanBase 2.2 is also affected.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3444&w=2; http://secunia.com/advisories/17542; http://securityreason.com/securityalert/176
CVE: CVE-2005-3572
Published: 2005-11-16
Description: SQL injection vulnerability in index.php in Peel 2.6 through 2.7 allows remote attackers to execute arbitrary SQL commands via the rubid parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/17536; http://www.osvdb.org/20818; http://www.securityfocus.com/bid/15415
CVE: CVE-2005-3573
Published: 2005-11-16
Description: Scrubber.py in Mailman 2.1.5-8 does not properly handle UTF8 character encodings in filenames of e-mail attachments, which allows remote attackers to cause a denial of service (application crash).
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=327732; http://lists.suse.com/archive/suse-security-announce/2006-Jan/0003.html
CVE: CVE-2005-3574
Published: 2005-11-16
Description: PHP file inclusion vulnerability in index.php of iCMS allows remote attackers to include arbitrary files via the page parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://hackers.by.lv/showthread.php?p=416; http://osvdb.org/ref/20/20820-icms-file_inclusion.txt; http://secunia.com/advisories/17561
CVE: CVE-2005-3575
Published: 2005-11-16
Description: SQL injection vulnerability in show.php in Cyphor 0.19 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/180; http://www.osvdb.org/20983; http://www.securiteam.com/unixfocus/6P00F1FEKC.html
CVE: CVE-2005-3576
Published: 2005-11-16
Description: ts.exe in Walla TeleSite 3.0 and earlier allows remote attackers to access privileged information by entering the article number in tsurl parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/17547; http://www.securityfocus.com/archive/1/416581/30/0/threaded; http://www.securityfocus.com/bid/15419
CVE: CVE-2005-3577
Published: 2005-11-16
Description: Cross-site scripting vulnerability (XSS) in ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the sug parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/17547; http://securitytracker.com/id?1015204; http://www.securityfocus.com/archive/1/416581/30/0/threaded
CVE: CVE-2005-3578
Published: 2005-11-16
Description: SQL injection vulnerability in ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to inject arbitrary SQL commands via the sug parameter.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1015204; http://www.osvdb.org/20883; http://www.securityfocus.com/archive/1/416581/30/0/threaded