deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-2434
Published: 2005-08-03
Description: Linksys WRT54G router uses the same private key and certificate for every router, which allows remote attackers to sniff the SSL connection and obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6340&w=2; http://secunia.com/advisories/16271; http://securitytracker.com/id?1014596
CVE: CVE-2005-2435
Published: 2005-08-03
Description: Cross-site scripting (XSS) vulnerability in browse.php in Website Baker Project allows remote attackers to inject arbitrary web script or HTML via the dir parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8762&w=2; http://secunia.com/advisories/16263; http://www.osvdb.org/18342
CVE: CVE-2005-2436
Published: 2005-08-03
Description: browse.php in Website Baker Project allows remote attackers to obtain sensitive data via (1) a directory that does not exist in the dir parameter or (2) a direct request to certain php files, which reveal the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8762&w=2; http://secunia.com/advisories/16263; http://www.osvdb.org/18343
CVE: CVE-2005-2437
Published: 2005-08-03
Description: Website Baker Project does not properly verify the file extensions of uploaded files, which allows remote attackers to upload and execute arbitrary PHP code.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8762&w=2; http://secunia.com/advisories/16263; http://www.osvdb.org/18345
CVE: CVE-2005-2438
Published: 2005-08-03
Description: Cross-site scripting (XSS) vulnerability in UseBB 0.5.1 and earlier allows remote attackers to inject arbitrary Javascript via the BBCode color value.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3040&w=2; http://www.hardened-php.net/advisory_122005.60.html; http://www.securityfocus.com/bid/14412
CVE: CVE-2005-2439
Published: 2005-08-03
Description: SQL injection vulnerability in UseBB 0.5.1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the search function.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3040&w=2; http://www.hardened-php.net/advisory_122005.60.html; http://www.securityfocus.com/bid/14413
CVE: CVE-2005-2440
Published: 2005-08-03
Description: SQL injection vulnerability in login.asp in Thomson Web Skill Vantage Manager allows remote attackers to execute arbitrary SQL commands via the svmPassword parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7822&w=2; http://secunia.com/advisories/16268/; http://www.osvdb.org/18330
CVE: CVE-2005-2441
Published: 2005-08-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in VBzoom allow remote attackers to inject arbitrary web script and HTML via the (1) UserName parameter to profile.php or (2) UserID parameter to login.php.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9568&w=2; http://secunia.com/advisories/16220; http://securitytracker.com/id?1014614
CVE: CVE-2005-2442
Published: 2005-08-03
Description: Cross-Application Scripting (XAS) vulnerability in SPI Dynamics WebInspect 5.0.196 allows remote attackers to inject Javascript from one application into another.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-July/035414.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9324&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6499&w=2
CVE: CVE-2005-2443
Published: 2005-08-03
Description: Kshout 2.x and 3.x stores settings.dat under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as usernames and passwords.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3893&w=2; http://www.soulblack.com.ar/repo/papers/advisory/kshout_advisory.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/24352
CVE: CVE-2005-2444
Published: 2005-08-03
Description: Trillian Pro 3.1 build 121, when checking Yahoo e-mail, stores the password in plaintext in a world readable file and does not delete the file after login, which allows local users to obtain sensitive information.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3628&w=2; http://secunia.com/advisories/16289; https://exchange.xforce.ibmcloud.com/vulnerabilities/21667
CVE: CVE-2005-2445
Published: 2005-08-03
Description: SQL injection vulnerability in viewPrd.asp in Product Cart 2.6 allows remote attackers to execute arbitrary SQL commands via the idcategory parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0521&w=2; http://secunia.com/advisories/14833; http://securitytracker.com/id?1014129
CVE: CVE-2005-2446
Published: 2005-08-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-2369.  Reason: This candidate is a duplicate of CVE-2005-2369.  Notes: All CVE users should reference CVE-2005-2369 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-2447
Published: 2005-08-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-2370.  Reason: This candidate is a duplicate of CVE-2005-2370.  Notes: All CVE users should reference CVE-2005-2370 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-2448
Published: 2005-08-03
Description: Multiple "endianness errors" in libgadu in ekg before 1.6rc2 allow remote attackers to cause a denial of service (invalid behavior in applications) on big-endian systems.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7250&w=2; http://secunia.com/advisories/16140; http://secunia.com/advisories/16155
CVE: CVE-2005-2449
Published: 2005-08-03
Description: Race condition in sandbox before 1.2.11 allows local users to create or overwrite arbitrary files via symlink attack on sandboxpids.tmp.
CVSS Score: 1.2 (LOW)
References: http://bugs.gentoo.org/show_bug.cgi?id=96782; http://secunia.com/advisories/16214; http://securitytracker.com/id?1014574
CVE: CVE-2005-2450
Published: 2005-08-03
Description: Multiple integer overflows in the (1) TNEF, (2) CHM, or (3) FSG file format processors in libclamav for Clam AntiVirus (ClamAV) 0.86.1 and earlier allow remote attackers to gain privileges via a crafted e-mail message.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000987; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2932&w=2; http://secunia.com/advisories/16180
CVE: CVE-2005-2451
Published: 2005-08-03
Description: Cisco IOS 12.0 through 12.4 and IOS XR before 3.2, with IPv6 enabled, allows remote attackers on a local network segment to cause a denial of service (device reload) and possibly execute arbitrary code via a crafted IPv6 packet.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-07/0663.html; http://secunia.com/advisories/16272; http://securitytracker.com/id?1014598
CVE: CVE-2005-2452
Published: 2005-08-03
Description: libtiff up to 3.7.0 allows remote attackers to cause a denial of service (application crash) via a TIFF image header with a zero "YCbCr subsampling" value, which causes a divide-by-zero error in (1) tif_strip.c and (2) tif_tile.c, a different vulnerability than CVE-2004-0804.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16266; http://secunia.com/advisories/16486; http://www.mandriva.com/security/advisories?name=MDKSA-2005:142
CVE: CVE-2005-2453
Published: 2005-08-04
Description: Cross-site scripting (XSS) vulnerability in NetworkActiv Web Server 1.0, 2.0.0.6, 3.0.1.1, and 3.5.13, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/16301; http://secunia.com/secunia_research/2005-31/advisory/; http://securitytracker.com/id?1014624
CVE: CVE-2005-2455
Published: 2005-08-04
Description: Greasemonkey before 0.3.5 allows remote web servers to (1) read arbitrary files via a GET request to a file:// URL in the GM_xmlhttpRequest API function, (2) list installed scripts using GM_scripts, or obtain sensitive information via (3) GM_setValue and GM_getValue.
CVSS Score: 5.0 (MEDIUM)
References: http://greaseblog.blogspot.com/2005/07/mandatory-greasemonkey-update.html; http://greasemonkey.mozdev.org/changes/0.3.5.html; http://mozdev.org/pipermail/greasemonkey/2005-July/004000.html
CVE: CVE-2005-2456
Published: 2005-08-04
Description: Array index overflow in the xfrm_sk_policy_insert function in xfrm_user.c in Linux kernel 2.6 allows local users to cause a denial of service (oops or deadlock) and possibly execute arbitrary code via a p->dir value that is larger than XFRM_POLICY_OUT, which is used as an index in the sock->sk_policy array.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: http://secunia.com/advisories/16298; http://secunia.com/advisories/16500; http://secunia.com/advisories/17002
CVE: CVE-2005-1268
Published: 2005-08-05
Description: Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-193
References: http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html; http://rhn.redhat.com/errata/RHSA-2005-582.html; http://secunia.com/advisories/19072
CVE: CVE-2005-1272
Published: 2005-08-05
Description: Stack-based buffer overflow in the Backup Agent for Microsoft SQL Server in BrightStor ARCserve Backup Agent for SQL Server 11.0 allows remote attackers to execute arbitrary code via a long string sent to port (1) 6070 or (2) 6050.
CVSS Score: 7.5 (HIGH)
References: http://www.idefense.com/application/poi/display?id=287&type=vulnerabilities&flashstatus=true; http://www.kb.cert.org/vuls/id/279774; http://www.securityfocus.com/bid/14453
CVE: CVE-2005-1761
Published: 2005-08-05
Description: Linux kernel 2.6 and 2.4 on the IA64 architecture allows local users to cause a denial of service (kernel crash) via ptrace and the restore_sigcontext function.
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4ea78729b8dbfc400fe165a57b90a394a7275a54; http://secunia.com/advisories/17002; http://secunia.com/advisories/17073
CVE: CVE-2005-1767
Published: 2005-08-05
Description: traps.c in the Linux kernel 2.6.x and 2.4.x executes stack segment faults on an exception stack, which allows local users to cause a denial of service (oops and stack fault exception).
CVSS Score: 2.1 (LOW)
References: http://kernel.org/git/?p=linux/kernel/git/marcelo/linux-2.4.git%3Ba=commit%3Bh=51e31546a2fc46cb978da2ee0330a6a68f07541e; http://secunia.com/advisories/17002; http://secunia.com/advisories/18056
CVE: CVE-2005-1854
Published: 2005-08-05
Description: Unknown vulnerability in apt-cacher in Debian 3.1, related to "missing input sanitising," allows remote attackers to execute arbitrary commands on the caching server.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16327; http://www.debian.org/security/2005/dsa-772; http://www.securityfocus.com/bid/14459
CVE: CVE-2005-2353
Published: 2005-08-05
Description: run-mozilla.sh in Thunderbird, with debugging enabled, allows local users to create or overwrite arbitrary files via a symlink attack on temporary files.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/19863; http://secunia.com/advisories/19941; http://www.debian.org/security/2006/dsa-1046
CVE: CVE-2005-2359
Published: 2005-08-05
Description: The AES-XCBC-MAC algorithm in IPsec in FreeBSD 5.3 and 5.4, when used for authentication without other encryption, uses a constant key instead of the one that was assigned by the system administrator, which can allow remote attackers to spoof packets to establish an IPsec session.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:19.ipsec.asc; http://secunia.com/advisories/16244/; http://securitytracker.com/id?1014586
CVE: CVE-2005-2471
Published: 2005-08-05
Description: pstopnm in netpbm does not properly use the "-dSAFER" option when calling Ghostscript to convert a PostScript file into a (1) PBM, (2) PGM, or (3) PNM file, which allows external user-assisted attackers to execute arbitrary commands.
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=319757; http://secunia.com/advisories/16184; http://secunia.com/advisories/18330
CVE: CVE-2005-2472
Published: 2005-08-05
Description: Multiple buffer overflows in BusinessMail 4.60.00 allow remote attackers to cause a denial of service (application crash) via a long string to SMTP (1) HELO or (2) MAIL FROM commands.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-August/035647.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5261&w=2; http://reedarvin.thearvins.com/20050730-01.html
CVE: CVE-2005-2473
Published: 2005-08-05
Description: Multiple SQL injection vulnerabilities in ChurchInfo allow remote attackers to execute arbitrary SQL commands via the PersonID parameter to (1) PersonView.php, (2) MemberRoleChange.php, (3) PropertyAssign.php, (4) WhyCameEditor.php, (5) GroupPropsEditor.php, (6) Reports/PDFLabel.php, or (7) UserDelete.php, (8) DepositSlipID parameter to DepositSlipEditor.php, (9) QueryID parameter to QueryView.php, GroupID parameter to (10) GroupView.php, (11) GroupMemberList.php, (12) MemberRoleChange.php, (13) GroupDelete.php, (14) /Reports/ClassAttendance.php, or (15) /Reports/GroupReport.php, (16) PropertyID parameter to PropertyEditor.php, FamilyID parameter to (17) Canvas05Editor.php, (18) CanvasEditor.php, or (19) FamilyView.php, or (20) PledgeID parameter to PledgeDetails.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3546&w=2; http://secunia.com/advisories/16292; http://securitytracker.com/id?1014617
CVE: CVE-2005-2474
Published: 2005-08-05
Description: ChurchInfo allows remote attackers to execute obtain sensitive information via the PersonID parameter to (1) PersonView.php, (2) MemberRoleChange.php, (3) PropertyAssign.php, (4) WhyCameEditor.php, (5) GroupPropsEditor.php, (6) Reports/PDFLabel.php, or (7) UserDelete.php, an invalid Number parameter to (8) SelectList.php or (9) SelectDelete.php, GroupID parameter to (10) GroupView.php, (11) GroupMemberList.php, (12) MemberRoleChange.php, (13) GroupDelete.php, (14) /Reports/ClassAttendance.php, or (15) /Reports/GroupReport.php, (16) PropertyID parameter to PropertyEditor.php, FamilyID parameter to (17) Canvas05Editor.php, (18) CanvasEditor.php, or (19) FamilyView.php, or (20) PledgeID parameter to PledgeDetails.php, which reveal the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3546&w=2; http://secunia.com/advisories/16292; http://securitytracker.com/id?1014617
CVE: CVE-2005-2475
Published: 2005-08-05
Description: Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.
CVSS Score: 1.2 (LOW)
References: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4117&w=2; http://secunia.com/advisories/16309
CVE: CVE-2005-2476
Published: 2005-08-05
Description: Cross-site scripting (XSS) vulnerability in lost_passowrd.php in Naxtor Shopping Cart 1.0 allows remote attackers to inject arbitrary web script or HTML via the email parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8192&w=2; http://secunia.com/advisories/16262; http://securitytracker.com/id?1014613
CVE: CVE-2005-2477
Published: 2005-08-05
Description: shop_display_products.php in Naxtor Shopping Cart 1.0 allows remote attackers to obtain sensitive information via a cat_id with a "'" (single quote), which reveals the path in an error message, possibly due to an SQL injection vulnerability.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8192&w=2; http://secunia.com/advisories/16262; http://securitytracker.com/id?1014613
CVE: CVE-2005-2478
Published: 2005-08-05
Description: SQL injection vulnerability in SilverNews 2.0.3 allows remote attackers to execute arbitrary SQL commands via the user field on the login page in the Admin control panel.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1088&w=2; http://secunia.com/advisories/16315; http://securitytracker.com/id?1014622
CVE: CVE-2005-2479
Published: 2005-08-05
Description: Quick 'n Easy FTP Server 3.0 allows remote attackers to cause a denial of service (application crash or CPU consumption) via a long USER command.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7889&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4047&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1249&w=2
CVE: CVE-2005-2480
Published: 2005-08-05
Description: Cross-site scripting (XSS) vulnerability in ColdFusion Fusebox 4.1.0 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter, which is not quoted in an error page, as demonstrated using index.cfm.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2615&w=2; http://secunia.com/advisories/16320; http://www.securityfocus.com/bid/14460
CVE: CVE-2005-2481
Published: 2005-08-05
Description: ColdFusion Fusebox 4.1.0 allows remote attackers to obtain sensitive information via an invalid fuseaction parameter, which leaks the full server path in an error message, as demonstrated using the "?" (question mark) character.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2615&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2615&w=2
CVE: CVE-2005-2482
Published: 2005-08-07
Description: The StateToOptions function in msfweb in Metasploit Framework 2.4 and earlier, when running with the -D option (defanged mode), allows attackers to modify temporary environment variables before the "_Defanged" environment option is checked when processing the Exploit command.
CVSS Score: 5.0 (MEDIUM)
References: http://metasploit.com/archive/framework/msg00469.html; http://secunia.com/advisories/16318; http://www.osvdb.org/18495
CVE: CVE-2005-2483
Published: 2005-08-07
Description: Eval injection vulnerability in Karrigell before 2.1.8 allows remote attackers to execute arbitrary Python code via modified arguments to a Karrigell services (.ks) script, which can reference functions from libraries that are used by that script.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16319; http://sourceforge.net/mailarchive/forum.php?thread_id=7863293&forum_id=32318; http://sourceforge.net/mailarchive/message.php?msg_id=12539317
CVE: CVE-2005-2484
Published: 2005-08-07
Description: Buffer overflow in the rdb_query function for Denora IRC Stats 1.0 might allow attackers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://denora.nomadirc.net/index.php; http://secunia.com/advisories/16281; http://sourceforge.net/project/shownotes.php?release_id=346819
CVE: CVE-2005-2485
Published: 2005-08-07
Description: Cross-site scripting (XSS) vulnerability in the Helpdesk in Logicampus before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/16297; http://sourceforge.net/project/shownotes.php?release_id=346801; http://www.securityfocus.com/bid/14472
CVE: CVE-2005-2486
Published: 2005-08-07
Description: SQL injection vulnerability in mod_forum/read_message.php in PortailPHP allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php with the affiche parameter set to "Forum-read_mess", a different vulnerability than CVE-2005-1701.
CVSS Score: 7.5 (HIGH)
References: http://msgs.securepoint.com/cgi-bin/get/bugtraq0508/53.html; http://www.osvdb.org/18685; http://www.securityfocus.com/bid/14474
CVE: CVE-2005-2487
Published: 2005-08-07
Description: Unknown vulnerability in Sun McData switches and directors 4300, 4500, 6064, and 6140 before E/OS 6.0.0 may allow attackers to cause a denial of service (connectivity and array access loss) via a network broadcast storm.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/16295; http://sunsolve.sun.com/search/document.do?assetkey=1-26-101833-1; http://www.securityfocus.com/bid/14475
CVE: CVE-2005-2488
Published: 2005-08-07
Description: Cross-site scripting (XSS) vulnerability in Web Content Management News System allows remote attackers to inject arbitrary web script or HTML via (1) the strRootpath parameter to validsession.php or (2) the strTable parameter to Admin/News/List.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/16317; http://securitytracker.com/id?1014616; http://www.rgod.altervista.org/webc.html
CVE: CVE-2005-2489
Published: 2005-08-07
Description: Web Content Management News System allows remote attackers to create arbitrary accounts and gain privileges via a direct request to Admin/Users/AddModifyInput.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16317; http://securitytracker.com/id?1014616; http://www.osvdb.org/18524
CVE: CVE-2005-2500
Published: 2005-08-08
Description: Buffer overflow in the xdr_xcode_array2 function in xdr.c in Linux kernel 2.6.12, as used in SuSE Linux Enterprise Server 9, might allow remote attackers to cause a denial of service and possibly execute arbitrary code via crafted XDR data for the nfsacl protocol.
CVSS Score: 7.5 (HIGH)
References: http://linux.bkbits.net:8080/linux-2.6/cset%4042b9c4fdYUuaq0joRUZi8W0Q-2hA1A; http://lkml.org/lkml/2005/6/23/126; http://lkml.org/lkml/2005/6/23/19
CVE: CVE-2005-0058
Published: 2005-08-10
Description: Buffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to elevate privileges or execute arbitrary code via a crafted message.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16354/; http://securitytracker.com/id?1014639; http://www.securityfocus.com/bid/14518
CVE: CVE-2005-1218
Published: 2005-08-10
Description: The Microsoft Windows kernel in Microsoft Windows 2000 Server, Windows XP, and Windows Server 2003 allows remote attackers to cause a denial of service (crash) via crafted Remote Desktop Protocol (RDP) requests.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9436&w=2; http://security-protocols.com/modules.php?name=News&file=article&sid=2783; http://www.kb.cert.org/vuls/id/490628
CVE: CVE-2005-1981
Published: 2005-08-10
Description: Unknown vulnerability in Microsoft Windows 2000 Server and Windows Server 2003 domain controllers allows remote authenticated users to cause a denial of service (system crash) via a crafted Kerberos message.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/16368/; http://securitytracker.com/id?1014642; http://www.kb.cert.org/vuls/id/610133
CVE: CVE-2005-1982
Published: 2005-08-10
Description: Unknown vulnerability in the PKINIT Protocol for Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when PKINIT smart card authentication is being used.
CVSS Score: 3.6 (LOW)
References: http://secunia.com/advisories/16368/; http://securitytracker.com/id?1014642; http://www.kb.cert.org/vuls/id/477341