deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-2895
Published: 2005-09-14
Description: setcookie.php in PBLang 4.65, and possibly earlier versions, allows remote attackers to obtain sensitive information via a %00 (a null byte) in the u parameter, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7979&w=2; http://securitytracker.com/alerts/2005/Sep/1014861.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/22191
CVE: CVE-2005-2896
Published: 2005-09-14
Description: SQL injection vulnerability in WEB//NEWS 1.4 allows remote attackers to execute arbitrary SQL commands via the (1) wn_userpw parameter to startup.php, (2) cat, (3) id, or (4) stof parameter to news.php, or (5) id parameter to print.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9410&w=2; http://secunia.com/advisories/16727/; http://www.securityfocus.com/bid/14776
CVE: CVE-2005-2897
Published: 2005-09-14
Description: WEB//NEWS 1.4 allows remote attackers to obtain sensitive information via a direct request to files in the actions directory, which reveal the path in an error message, as demonstrated using cat.add.php.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9410&w=2; http://secunia.com/advisories/16727/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9410&w=2
CVE: CVE-2005-2898
Published: 2005-09-14
Description: NOTE: this issue has been disputed by the vendor.  FileZilla 2.2.14b and 2.2.15, and possibly earlier versions, when "Use secure mode" is disabled, uses a weak encryption scheme to store the user's password in the configuration settings file, which allows local users to obtain sensitive information.  NOTE: the vendor has disputed the issue, stating that "the problem is not a vulnerability at all, but in fact a fundamental issue of every single program that can store passwords transparently.
CVSS Score: 4.6 (MEDIUM)
References: http://filezilla.sourceforge.net/forum/viewtopic.php?t=1328; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0442&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7521&w=2
CVE: CVE-2005-2899
Published: 2005-09-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in details.php in CjTagBoard 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) date, (2) time, (3) name, (4) ip, (5) agent, or (6) msg parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2619&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2619&w=2
CVE: CVE-2005-2900
Published: 2005-09-14
Description: Cross-site scripting (XSS) vulnerability in top.php in CjLinkOut 1.0 allows remote attackers to inject arbitrary web script or HTML via the 123 parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2619&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2619&w=2
CVE: CVE-2005-2901
Published: 2005-09-14
Description: Multiple Cross-site scripting (XSS) vulnerabilities in CjWeb2Mail 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) message, or (3) ip parameter to thankyou.php or (4) emsg parameter to web2mail.php.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2619&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2619&w=2
CVE: CVE-2005-2902
Published: 2005-09-14
Description: SQL injection vulnerability in class-1 Forum Software 0.24.4 allows remote attackers to execute arbitrary SQL commands and bypass the file extension check via SQL code in the file extension of an uploaded file.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2785&w=2; http://secunia.com/advisories/16762/; http://www.rgod.altervista.org/class1.html
CVE: CVE-2005-2903
Published: 2005-09-14
Description: Heap-based buffer overflow in NOD32 2.5 with nod32.002 1.033 build 1127, with active scanning enabled, allows remote attackers to execute arbitrary code via an ARJ archive containing a file with a long filename.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5054&w=2; http://secunia.com/advisories/16604/; http://secunia.com/secunia_research/2005-40/advisory/
CVE: CVE-2005-2904
Published: 2005-09-14
Description: Zebedee 2.4.1, when "allowed redirection port" is not set, allows remote attackers to cause a denial of service (application crash) via a zero in the port number of the protocol option header, which triggers an assert error in the makeConnection function in zebedee.c.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5488&w=2; http://secunia.com/advisories/16788/; http://www.gentoo.org/security/en/glsa/glsa-200509-14.xml
CVE: CVE-2005-2912
Published: 2005-09-14
Description: Linksys WRT54G router allows remote attackers to cause a denial of service (CPU consumption and server hang) via an HTTP POST request with a negative Content-Length value.
CVSS Score: 5.0 (MEDIUM)
References: http://www.idefense.com/application/poi/display?id=308&type=vulnerabilities; http://www.idefense.com/application/poi/display?id=308&type=vulnerabilities
CVE: CVE-2005-2913
Published: 2005-09-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-2799.  Reason: This candidate is a duplicate of CVE-2005-2799.  Notes: All CVE users should reference CVE-2005-2799 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-2914
Published: 2005-09-14
Description: ezconfig.asp in Linksys WRT54G router 3.01.03, 3.03.6, non-default configurations of 2.04.4, and possibly other versions, does not use an authentication initialization function, which allows remote attackers to obtain encrypted configuration information and, if the key is known, modify the configuration.
CVSS Score: 7.5 (HIGH)
References: http://www.idefense.com/application/poi/display?id=304&type=vulnerabilities; http://www.idefense.com/application/poi/display?id=304&type=vulnerabilities
CVE: CVE-2005-2915
Published: 2005-09-14
Description: ezconfig.asp in Linksys WRT54G router 3.01.03, 3.03.6, non-default configurations of 2.04.4, and possibly other versions, uses weak encryption (XOR encoding with a fixed byte mask) for configuration information, which could allow attackers to decrypt the information and possibly re-encrypt it in conjunction with CVE-2005-2914.
CVSS Score: 5.0 (MEDIUM)
References: http://www.idefense.com/application/poi/display?id=304&type=vulnerabilities; http://www.idefense.com/application/poi/display?id=304&type=vulnerabilities
CVE: CVE-2005-2916
Published: 2005-09-14
Description: Linksys WRT54G 3.01.03, 3.03.6, 4.00.7, and possibly other versions before 4.20.7, does not verify user authentication until after an HTTP POST request has been processed, which allows remote attackers to (1) modify configuration using restore.cgi or (2) upload new firmware using upgrade.cgi.
CVSS Score: 5.0 (MEDIUM)
References: http://www.idefense.com/application/poi/display?id=306&type=vulnerabilities; http://www.idefense.com/application/poi/display?id=307&type=vulnerabilities; http://www.idefense.com/application/poi/display?id=306&type=vulnerabilities
CVE: CVE-2005-2495
Published: 2005-09-15
Description: Multiple integer overflows in XFree86 before 4.3.0 allow user-assisted attackers to execute arbitrary code via a crafted pixmap image.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-189
References: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.22/SCOSA-2006.22.txt; ftp://patches.sgi.com/support/free/security/advisories/20060403-01-U; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2266&w=2
CVE: CVE-2005-2658
Published: 2005-09-15
Description: Buffer overflow in utility.cpp in Turquoise SuperStat (turqstat) 2.2.4 and earlier might allow remote NNTP servers to execute arbitrary code via a date with a long month.
CVSS Score: 7.5 (HIGH)
References: http://cvs.alioth.debian.org/cgi-bin/cvsweb.cgi/turqstat/utility.cpp.diff?cvsroot=turqstat&r2=1.41&r1=1.40&f=u; http://www.debian.org/security/2005/dsa-812; http://www.securityfocus.com/bid/14852
CVE: CVE-2005-2799
Published: 2005-09-15
Description: Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03, 3.03.6, and possibly other versions before 4.20.7, allows remote attackers to execute arbitrary code via a long HTTP POST request.
CVSS Score: 7.5 (HIGH)
References: http://www.idefense.com/application/poi/display?id=305&type=vulnerabilities; http://www.idefense.com/application/poi/display?id=305&type=vulnerabilities
CVE: CVE-2005-2918
Published: 2005-09-15
Description: The open_cmd_tube function in mount.c for gtkdiskfree 1.9.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on the gtkdiskfree temporary file.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=104565; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5109&w=2; http://secunia.com/advisories/16951
CVE: CVE-2005-2935
Published: 2005-09-15
Description: Unquoted Windows search path vulnerability in Microsoft AntiSpyware might allow local users to execute code via a malicious c:\program.exe file, which is run by AntiSpywareMain.exe when it attempts to execute gsasDtServ.exe.  NOTE: it is not clear whether this overlaps CVE-2005-2940.
CVSS Score: 4.6 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-May/033909.html; http://lists.grok.org.uk/pipermail/full-disclosure/2005-May/033910.html; http://lists.grok.org.uk/pipermail/full-disclosure/2005-May/033909.html
CVE: CVE-2005-2877
Published: 2005-09-16
Description: The history (revision control) function in TWiki 02-Sep-2004 and earlier allows remote attackers to execute arbitrary code via shell metacharacters, as demonstrated via the rev parameter to TWikiUsers.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7550&w=2; http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev; http://www.kb.cert.org/vuls/id/757181
CVE: CVE-2005-2944
Published: 2005-09-16
Description: The perform_file_save function in GNOME Workstation Command Center (gwcc) 0.9.6 and earlier allows local users to create and overwrite arbitrary files via a symlink attack on the gwcc_out.txt temporary file.
CVSS Score: 4.6 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=104566; http://secunia.com/advisories/16833; http://www.zataz.net/adviso/gwcc-09052005.txt
CVE: CVE-2005-2945
Published: 2005-09-16
Description: arc 5.21j and earlier create temporary files with world-readable permissions, which allows local users to read sensitive information from files created by (1) arc (arc.c) or (2) marc (marc.c).
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4383&w=2; http://secunia.com/advisories/16805; http://secunia.com/advisories/17068
CVE: CVE-2005-2657
Published: 2005-09-16
Description: Unknown vulnerability in common-lisp-controller 4.18 and earlier allows local users to gain privileges by compiling arbitrary code in the cache directory, which is executed by another user if the user has not run Common Lisp before.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/16822/; http://www.debian.org/security/2005/dsa-811; http://www.securityfocus.com/bid/14829
CVE: CVE-2005-2946
Published: 2005-09-16
Description: The default configuration on OpenSSL before 0.9.8 uses MD5 for creating message digests instead of a more cryptographically strong algorithm, which makes it easier for remote attackers to forge certificates with a valid certificate authority signature.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: http://www.cits.rub.de/MD5Collisions/; http://www.ubuntu.com/usn/usn-179-1; https://bugzilla.ubuntu.com/show_bug.cgi?id=13593
CVE: CVE-2005-2947
Published: 2005-09-16
Description: Buffer overflow in KillProcess 2.20 and earlier allows user-assisted attackers to execute arbitrary code via an exe file with a long FileDescription in the version resource.
CVSS Score: 5.1 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0071&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8406&w=2; http://www.securityfocus.com/bid/14795
CVE: CVE-2005-2948
Published: 2005-09-16
Description: KillProcess 2.20 and earlier allows local users to bypass kill list restrictions by launching multiple processes at the same time, which are not all killed by KillProcess.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0071&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0071&w=2
CVE: CVE-2005-2949
Published: 2005-09-16
Description: pam_per_user before 0.4 does not verify if the user name changes between authentication attempts and uses the same subrequest handle, which allows remote attackers or local users to login as other users by using certain applications that allow the username to be changed during authentication, such as /bin/login.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5661&w=2; http://secunia.com/advisories/16781/; http://securityreason.com/securityalert/2
CVE: CVE-2005-2950
Published: 2005-09-16
Description: Cross-site scripting (XSS) vulnerability in Sawmill 7.0.0 through 7.1.13 allows remote attackers to inject arbitrary web script or HTML via the query string in an HTTP GET request.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0488&w=2; http://secunia.com/advisories/16744/; http://securityreason.com/securityalert/1
CVE: CVE-2005-2951
Published: 2005-09-16
Description: Directory traversal vulnerability in security.inc.php in AzDGDatingLite 2.1.3, and possibly earlier versions, allows remote attackers to execute arbitrary PHP commands via ".." sequences and "%00" (trailing null byte) characters in the l parameter, which is used in an include_once statement.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1403&w=2; http://rgod.altervista.org/azdg.html; http://secunia.com/advisories/16814/
CVE: CVE-2005-2952
Published: 2005-09-16
Description: Directory traversal vulnerability in s.pl in Subscribe Me Pro 2.044.09P and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the l parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8368&w=2; http://secunia.com/advisories/16796/; http://securityreason.com/securityalert/4
CVE: CVE-2005-2953
Published: 2005-09-16
Description: Cross-site scripting (XSS) vulnerability in merchant.mvc in MIVA Merchant 5 allows remote attackers to inject arbitrary web script or HTML via the Customer_Login parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3655&w=2; http://secunia.com/advisories/16829/; http://www.securityfocus.com/bid/14828
CVE: CVE-2005-2954
Published: 2005-09-16
Description: SQL injection vulnerability in password_reminder.php in ATutor before 1.5.1 pl1 allows remote attackers to execute arbitrary SQL commands via the email field.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0432&w=2; http://rgod.altervista.org/atutor151.html; http://secunia.com/advisories/16813/
CVE: CVE-2005-2955
Published: 2005-09-16
Description: config.inc.php in ATutor 1.5.1, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which allows authenticated administrators or educators to execute arbitrary code by uploading files with other executable extensions such as .inc, .php4, or others.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0432&w=2; http://rgod.altervista.org/atutor151.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0432&w=2
CVE: CVE-2005-2956
Published: 2005-09-16
Description: ATutor 1.5.1, and possibly earlier versions, stores temporary chat logs under the web document root with insufficient access control and predictable filenames, which allows remote attackers to obtain user chat conversations via direct requests to those files.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0432&w=2; http://rgod.altervista.org/atutor151.html; http://securityreason.com/securityalert/9
CVE: CVE-2005-2957
Published: 2005-09-16
Description: Stack-based buffer overflow in AVIRA Desktop for Windows 1.00.00.68 with AVPACK32.DLL 6.31.0.3, when archive scanning is enabled, allows remote attackers to execute arbitrary code via a long filename in an ACE archive.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4841&w=2; http://secunia.com/advisories/16691/; http://secunia.com/secunia_research/2005-43/advisory/
CVE: CVE-2005-2979
Published: 2005-09-20
Description: SQL injection vulnerability in index.php in phpoutsourcing Noah's classifieds allows remote attackers to execute arbitrary SQL commands via the rollid parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0442&w=2; http://secunia.com/advisories/16826/; http://www.irannetjob.com/index.php?option=com_content&task=view&id=122&Itemid=28
CVE: CVE-2005-2980
Published: 2005-09-20
Description: Cross-site scripting (XSS) vulnerability in index.php in phpoutsourcing Noah's classifieds 1.3 allows remote attackers to inject arbitrary web script or HTML via the rollid parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0442&w=2; http://secunia.com/advisories/16826/; http://www.irannetjob.com/index.php?option=com_content&task=view&id=122&Itemid=28
CVE: CVE-2005-2981
Published: 2005-09-20
Description: Cross-site scripting (XSS) vulnerability in Orion 1.3.8 and 1.4.5 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting 404 error page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8639&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8639&w=2
CVE: CVE-2005-2982
Published: 2005-09-20
Description: Cross-site scripting (XSS) vulnerability in CompaqHTTPServer 2.1 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting 404 error page.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8639&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8639&w=2
CVE: CVE-2005-2983
Published: 2005-09-20
Description: SQL injection vulnerability in Oracle Reports that use Lexical References allows remote attackers to execute arbitrary SQL commands via the values in the parameter form that appears when the paramform parameter is set to yes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/037156.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3948&w=2; http://www.red-database-security.com/wp/sql_injection_reports_us.pdf
CVE: CVE-2005-2984
Published: 2005-09-20
Description: Avocent CCM console server running firmware 2.1 CCM4850 allows remote authenticated attackers to bypass port restrictions by connecting to the server via SSH and using the connect command to access the serial port.
CVSS Score: 4.6 (MEDIUM)
References: http://drwetter.org/cs-probs/avocent-sshbug.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3315&w=2; http://secunia.com/advisories/16836/
CVE: CVE-2005-2985
Published: 2005-09-20
Description: SQL injection vulnerability in search_result.php in AEwebworks aeDating Script 4.0 and earlier allows remote attackers to execute arbitrary SQL statements via the Country parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9262&w=2; http://secunia.com/advisories/16831/; http://www.securityfocus.com/bid/14847
CVE: CVE-2005-2986
Published: 2005-09-20
Description: The v3flt2k.sys driver in AhnLab V3Pro 2004 Build 6.0.0.383, V3 VirusBlock 2005 Build 6.0.0.383, V3Net for Windows Server 6.0 Build 6.0.0.383 does not properly validate the source of the DeviceIoControl commands, which allows remote attackers to gain privileges.
CVSS Score: 7.5 (HIGH)
References: http://info.ahnlab.com/english/advisory/01.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9377&w=2; http://secunia.com/advisories/15674/
CVE: CVE-2005-2987
Published: 2005-09-20
Description: SQL injection vulnerability in login.php in Digital Scribe 1.4 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5325&w=2; http://rgod.altervista.org/dscribe14.html; http://secunia.com/advisories/16841/
CVE: CVE-2005-2988
Published: 2005-09-20
Description: HP LaserJet 2430, and possibly other printers that use Jetdirect controls, stores information about recently printed documents without proper protection, which could allow remote attackers to obtain sensitive information via SNMP.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6652&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/22289; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6652&w=2
CVE: CVE-2005-2989
Published: 2005-09-20
Description: Multiple SQL injection vulnerabilities in DeluxeBB 1.0 and 1.0.5 allow remote attackers to execute arbitrary SQL commands via the (1) tid parameter to topic.php, the uid parameter to (2) misc.php or (3) pm.php, or the fid parameter to (3) forums.php or (4) newpost.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16819; http://www.securityfocus.com/bid/14851; http://www.vupen.com/english/advisories/2005/1752
CVE: CVE-2005-2990
Published: 2005-09-20
Description: AuthInfo.java in LineContol Java Client (jlc) before 0.8.1 stores sensitive information such as user passwords in log files.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/16817; http://sourceforge.net/project/shownotes.php?release_id=356248; http://www.securityfocus.com/bid/14830
CVE: CVE-2005-2991
Published: 2005-09-20
Description: ncompress 4.2.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files using (1) zdiff or (2) zcmp, a different vulnerability than CVE-2004-0970.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2098&w=2; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]0314&w=2; http://securityreason.com/securityalert/12
CVE: CVE-2005-2993
Published: 2005-09-20
Description: Unspecified vulnerability in the FTP Daemon (ftpd) for HP Tru64 UNIX 4.0F PK8 and other versions up to HP Tru64 UNIX 5.1B-3, and HP-UX B.11.00, B.11.04, B.11.11, and B.11.23, allows remote authenticated users to cause a denial of service (hang).
CVSS Score: 1.7 (LOW)
References: http://secunia.com/advisories/18543; http://secunia.com/advisories/18569; http://securityreason.com/securityalert/360
CVE: CVE-2005-2968
Published: 2005-09-20
Description: Firefox 1.0.6 and Mozilla 1.7.10 allows attackers to execute arbitrary commands via shell metacharacters in a URL that is provided to the browser on the command line, which is sent unfiltered to bash.
CVSS Score: 7.5 (HIGH)
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt; http://secunia.com/advisories/16869; http://secunia.com/advisories/17042
CVE: CVE-2005-2994
Published: 2005-09-20
Description: Unspecified vulnerability in the web client for IBM Rational ClearQuest 2002.05.00 and 2002.05.20, and 2003.06.00 through 2003.06.15 before SR5, allows remote attackers to execute XML Style Sheets (XSS).
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/16717; http://www-1.ibm.com/support/docview.wss?rs=0&uid=swg21216901&loc=en_US&cs=utf-8&cc=us&lang=all; http://secunia.com/advisories/16717
CVE: CVE-2005-2995
Published: 2005-09-20
Description: bacula 1.36.3 and earlier allows local users to modify or read sensitive files via symlink attacks on (1) the temporary file used by autoconf/randpass when openssl is not available, or (2) the mtx.[PID] temporary file in mtx-changer.in.
CVSS Score: 3.6 (LOW)
References: http://bugs.gentoo.org/show_bug.cgi?id=104986; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]6735&w=2; http://www.novell.com/linux/security/advisories/2005_22_sr.html