deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-2996
Published: 2005-09-20
Description: Multiple heap-based and stack-based buffer overflows in certain DCOM server components in VERITAS Storage Exec Storage Exec 5.3 before Hotfix 9 and StorageCentral 5.2 before Hot Fix 2 allow remote attackers to execute arbitrary code via certain ActiveX controls.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16871; http://securityresponse.symantec.com/avcenter/security/Content/2005.09.19.html; http://www.kb.cert.org/vuls/id/620497
CVE: CVE-2005-2997
Published: 2005-09-20
Description: Multiple directory traversal vulnerabilities in PHP Advanced Transfer Manager 1.30 allow remote attackers to read arbitrary files via ".." sequences in (1) the currentdir parameter to txt.php, or the current_dir parameter to (2) htm.php or (3) html.php.
CVSS Score: 5.0 (MEDIUM)
References: http://rgod.altervista.org/phpatm130.html; http://secunia.com/advisories/16867; http://rgod.altervista.org/phpatm130.html
CVE: CVE-2005-2998
Published: 2005-09-20
Description: PHP Advanced Transfer Manager 1.30 has a default password for the administrator user, which allows remote attackers to upload and execute arbitrary PHP files.
CVSS Score: 7.5 (HIGH)
References: http://rgod.altervista.org/phpatm130.html; http://rgod.altervista.org/phpatm130.html
CVE: CVE-2005-2999
Published: 2005-09-20
Description: PHP Advanced Transfer Manager 1.30 allows remote attackers to obtain sensitive PHP configuration information via a direct request to test.php.
CVSS Score: 5.0 (MEDIUM)
References: http://rgod.altervista.org/phpatm130.html; http://secunia.com/advisories/16867; http://rgod.altervista.org/phpatm130.html
CVE: CVE-2005-3000
Published: 2005-09-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in viewers/txt.php in PHP Advanced Transfer Manager 1.30 allow remote attackers to inject arbitrary web script or HTML via the (1) font, (2) normalfontcolor, or (3) mess[31] parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://rgod.altervista.org/phpatm130.html; http://secunia.com/advisories/16867; http://rgod.altervista.org/phpatm130.html
CVE: CVE-2005-2919
Published: 2005-09-20
Description: libclamav/fsg.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to cause a denial of service (infinite loop) via a crafted FSG packed executable.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17, CWE-399
References: http://secunia.com/advisories/16848; http://secunia.com/advisories/16989; http://sourceforge.net/project/shownotes.php?release_id=356974
CVE: CVE-2005-2920
Published: 2005-09-20
Description: Buffer overflow in libclamav/upx.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to execute arbitrary code via a crafted UPX packed executable.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16848; http://secunia.com/advisories/16989; http://sourceforge.net/project/shownotes.php?release_id=356974
CVE: CVE-2005-3001
Published: 2005-09-20
Description: Unspecified vulnerability in the "tl" driver in Solaris 10 allows local users to cause a denial of service (panic) via unknown vectors.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/16874; http://sunsolve.sun.com/search/document.do?assetkey=1-26-101899-1; http://www.vupen.com/english/advisories/2005/1788
CVE: CVE-2005-3002
Published: 2005-09-20
Description: Multi-Computer Control System (MCCS) 1.0 allows remote attackers to cause a denial of service via a malformed UDP packet.
CVSS Score: 5.0 (MEDIUM)
References: http://k.domaindlx.com/shellcore/advisories.asp?bug_report=display&infamous_group=93; http://secunia.com/advisories/16865; http://k.domaindlx.com/shellcore/advisories.asp?bug_report=display&infamous_group=93
CVE: CVE-2005-2662
Published: 2005-09-21
Description: masqmail before 0.2.18 allows remote attackers to execute arbitrary commands via crafted e-mail addresses that are not properly sanitized when creating a failed delivery message.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16883; http://secunia.com/advisories/17109; http://www.debian.org/security/2005/dsa-848
CVE: CVE-2005-2663
Published: 2005-09-21
Description: masqmail before 0.2.18 allows local users to overwrite arbitrary files via a symlink attack on a log file.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/16883; http://secunia.com/advisories/17109; http://www.debian.org/security/2005/dsa-848
CVE: CVE-2005-0138
Published: 2005-09-21
Description: rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not correctly allow access to anonymous clients that connect from a system whose hostname can not be determined.  NOTE: while this issue occurs in a security mechanism, there is no apparent attacker role and probably does not satisfy the CVE definition of a vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: ftp://patches.sgi.com/support/free/security/advisories/20050601-01-U; http://secunia.com/advisories/15619; http://www.ciac.org/ciac/bulletins/p-214.shtml
CVE: CVE-2005-0139
Published: 2005-09-21
Description: Unknown vulnerability in rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not sufficiently restrict access rights for read-mostly exports, which allows attackers to conduct unauthorized activities.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: ftp://patches.sgi.com/support/free/security/advisories/20050601-01-U; http://secunia.com/advisories/15619; http://www.ciac.org/ciac/bulletins/p-214.shtml
CVE: CVE-2005-2764
Published: 2005-09-21
Description: Multiple buffer overflows in OpenTTD before 0.4.0.1 allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=102631; http://www.gentoo.org/security/en/glsa/glsa-200509-03.xml; http://www.vupen.com/english/advisories/2005/1640
CVE: CVE-2005-3003
Published: 2005-09-21
Description: SQL injection vulnerability in index.php in NooTopList 1.0.0 release 17 allows remote attackers to execute arbitrary SQL commands via the (1) o or (2) sort parameters.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1014931; http://www.systemsecure.org/ssforum/viewtopic.php?t=249; http://securitytracker.com/id?1014931
CVE: CVE-2005-3004
Published: 2005-09-21
Description: SQL injection vulnerability in Interakt MX Shop 3.2.0 allows remote attackers to execute arbitrary SQL commands via the (1) idp, (2) id_ctg, or (3) id_prd parameters to the pages module in index.php.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1014932; http://www.osvdb.org/19611; http://www.securityfocus.com/bid/14876
CVE: CVE-2005-3005
Published: 2005-09-21
Description: Helpdesk Software Hesk allows remote attackers to bypass authentication for (1) admin.php and (2) admin_main.php by modifying the PHPSESSID session ID parameter or cookie.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0521&w=2; http://secunia.com/advisories/16859; http://www.phpjunkyard.com/extras/hesk_0931_patch.zip
CVE: CVE-2005-3006
Published: 2005-09-21
Description: The mail client in Opera before 8.50 opens attached files from the user's cache directory without warning the user, which might allow remote attackers to inject arbitrary web script and spoof attachment filenames.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9695&w=2; http://secunia.com/advisories/16645; http://secunia.com/secunia_research/2005-42/advisory/
CVE: CVE-2005-3007
Published: 2005-09-21
Description: Opera before 8.50 allows remote attackers to spoof the content type of files via a filename with a trailing "." (dot), which might allow remote attackers to trick users into processing dangerous content.
CVSS Score: 2.6 (LOW)
CWE: CWE-74
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9695&w=2; http://secunia.com/advisories/16645; http://secunia.com/secunia_research/2005-42/advisory/
CVE: CVE-2005-3008
Published: 2005-09-21
Description: Tofu 0.2 allows remote attackers to execute arbitrary Python code via crafted pickled objects, which Tofu unpickles and executes.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16876; http://soya.literati.org/; http://www.osvdb.org/19570
CVE: CVE-2005-3009
Published: 2005-09-21
Description: Cross-site scripting (XSS) vulnerability in CuteNews allows remote attackers to inject arbitrary web script or HTML via the mod parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1014929; http://www.aria-security.net/advisory/portals/cutenews.txt; http://www.securityfocus.com/archive/1/432110/100/0/threaded
CVE: CVE-2005-3010
Published: 2005-09-21
Description: Direct static code injection vulnerability in the flood protection feature in inc/shows.inc.php in CuteNews 1.4.0 and earlier allows remote attackers to execute arbitrary PHP code via the HTTP_CLIENT_IP header (Client-Ip), which is injected into data/flood.db.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/14; http://www.securityfocus.com/archive/1/411057; http://www.securityfocus.com/bid/14869
CVE: CVE-2005-3011
Published: 2005-09-21
Description: The sort_offline function for texindex in texinfo 4.8 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVSS Score: 1.2 (LOW)
CWE: CWE-59
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:01.texindex.asc; ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=328365
CVE: CVE-2005-3012
Published: 2005-09-21
Description: The MasterDataCD::createImage function in masterdatacd.cpp for SimpleCDR-X 1.3.3 creates the .temp temporary directory with insecure permissions, which allows local users to read sensitive ISO images.
CVSS Score: 2.1 (LOW)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/037174.html; http://secunia.com/advisories/16835; http://www.securityfocus.com/bid/14855
CVE: CVE-2005-3013
Published: 2005-09-21
Description: Buffer overflow in liby2util in Yet another Setup Tool (YaST) for SuSE Linux 9.3 allows local users to execute arbitrary code via a long Loc entry.
CVSS Score: 4.6 (MEDIUM)
References: http://www.novell.com/linux/security/advisories/2005_22_sr.html; http://www.securityfocus.com/bid/14861; https://exchange.xforce.ibmcloud.com/vulnerabilities/24323
CVE: CVE-2005-3014
Published: 2005-09-21
Description: Cross-site scripting (XSS) vulnerability in Ensim webplliance allows remote attackers to inject arbitrary web script or HTML via the Login (OCW_login_username) field.
CVSS Score: 4.3 (MEDIUM)
References: http://membres.lycos.fr/newnst/exploit/Ensim_Autentification_XSS_By_ConcorDHacK.html; http://www.securityfocus.com/bid/14836; http://www.zataz.com/forum/viewtopic.php?id=113
CVE: CVE-2005-3015
Published: 2005-09-21
Description: Cross-site scripting (XSS) vulnerability in IBM Lotus Domino 6.5.2 allows remote attackers to inject arbitrary web script or HTML via the (1) BaseTarget or (2) Src parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/16830; http://www-1.ibm.com/support/docview.wss?rs=0&uid=swg1LO07849&loc=en_US&cs=utf-8&cc=us&lang=all; http://www-1.ibm.com/support/docview.wss?uid=swg1LO07850
CVE: CVE-2005-3016
Published: 2005-09-21
Description: Multiple unspecified vulnerabilities in the WYSIWYG editor in PHP-Nuke before 7.9 Final have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/16843; http://www.phpnuke.org/modules.php?name=News&file=article&sid=7435; http://secunia.com/advisories/16843
CVE: CVE-2005-3017
Published: 2005-09-21
Description: PHP file inclusion vulnerability in index.php in Content2Web 1.0.1 allows remote attackers to include arbitrary files via the show parameter, which can lead to resultant errors such as path disclosure, SQL error messages, and cross-site scripting (XSS).
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1014900; http://securitytracker.com/id?1014900
CVE: CVE-2005-3018
Published: 2005-09-21
Description: Apple Safari allows remote attackers to cause a denial of service (application crash) via a crafted data:// URL.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1672&w=2; http://secunia.com/advisories/16875/; http://www.osvdb.org/19569
CVE: CVE-2005-3019
Published: 2005-09-21
Description: Multiple SQL injection vulnerabilities in vBulletin before 3.0.9 allow remote attackers to execute arbitrary SQL commands via the (1) request parameter to joinrequests.php, (2) limitnumber or (3) limitstart to user.php, (4) usertitle.php, or (5) usertools.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0677&w=2; http://morph3us.org/advisories/20050917-vbulletin-3.0.8.txt; http://secunia.com/advisories/16873/
CVE: CVE-2005-3020
Published: 2005-09-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in vBulletin before 3.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter to css.php, (2) redirect parameter to index.php, (3) email parameter to user.php, (4) goto parameter to language.php, (5) orderby parameter to modlog.php, and the (6) hex, (7) rgb, or (8) expandset parameter to template.php.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0677&w=2; http://morph3us.org/advisories/20050917-vbulletin-3.0.8.txt; http://secunia.com/advisories/16873/
CVE: CVE-2005-3021
Published: 2005-09-21
Description: image.php in vBulletin 3.0.9 and earlier allows remote attackers with access to the administrator panel to upload arbitrary files via the upload action.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0677&w=2; http://morph3us.org/advisories/20050917-vbulletin-3.0.8.txt; http://secunia.com/advisories/16873/
CVE: CVE-2005-3022
Published: 2005-09-21
Description: Multiple SQL injection vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) announcement parameter to announcement.php, (2) userid parameter to user.php, (3) calendar parameter to admincalendar.php, (4) cronid parameter to cronlog.php, (5) usergroupid parameter to email.php, (6) help parameter to help.php, (7) rvt parameter to language.php, (8) keep parameter to phrase.php, or (9) updateprofilepic parameter to usertools.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0677&w=2; http://morph3us.org/advisories/20050917-vbulletin-3.0.8.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0677&w=2
CVE: CVE-2005-3023
Published: 2005-09-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via certain arguments to (1) announcement.php, (2) admincalendar.php, (3) bbcode.php, (4) cronadmin.php, (5) email.php, (6) faq.php, (7) forum.php, (8) image.php, (9) language.php, (10) ranks.php, (11) replacement.php, (12) replacement.php, (13) template.php, (14) template.php, (15) usergroup.php, or (16) usertitle.php.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0677&w=2; http://morph3us.org/advisories/20050917-vbulletin-3.0.8.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0677&w=2
CVE: CVE-2005-3024
Published: 2005-09-21
Description: Multiple SQL injection vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) announcement parameter to announcement.php, the (2) thread[forumid] or (3) criteria parameters to thread.php, (4) userid parameter to user.php, the (5) calendarcustomfieldid, (6) calendarid, (7) moderatorid, (8) holidayid, (9) calendarmoderatorid, or (10) calendar[0] parameters to admincalendar.php, (11) the cronid parameter to cronlog.php, (12) user[usergroupid][0] parameter to email.php, (13) help[0] parameter to help.php, the (14) limitnumber or (15) limitstart parameter to user.php, the (16) usertitleid or (17) ids parameters to usertitle.php, (18) rvt[0] parameter to language.php, (19) keep[0] parameter to phrase.php, (20) dostyleid parameter to template.php, (21) thread[forumid] parameter to thread.php, or (22) usertools.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2939&w=2; http://morph3us.org/advisories/20050917-vbulletin-3.0.7.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2939&w=2
CVE: CVE-2005-3025
Published: 2005-09-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the loc parameter to (1) modcp/index.php or (2) admincp/index.php, or the ip parameter to (3) modcp/user.php or (4) admincp/usertitle.php.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2939&w=2; http://morph3us.org/advisories/20050917-vbulletin-3.0.7.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2939&w=2
CVE: CVE-2005-3026
Published: 2005-09-21
Description: Directory traversal vulnerability in index.php in Alstrasoft Epay Pro 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the read parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-September/037225.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1323&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5851&w=2
CVE: CVE-2005-3027
Published: 2005-09-21
Description: Sybari Antigen 8.0 SR2 does not properly filter SMTP messages, which allows remote attackers to bypass custom filter rules and send file attachments of arbitrary file types via a message with a subject of "Antigen forwarded attachment".
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2107&w=2; http://secunia.com/advisories/16759/; http://securityreason.com/securityalert/15
CVE: CVE-2005-3028
Published: 2005-09-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-2986.  Reason: This candidate is a duplicate of CVE-2005-2986.  Notes: All CVE users should reference CVE-2005-2986 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-3029
Published: 2005-09-21
Description: Stack-based buffer overflow in AhnLab V3Pro 2004 build 6.0.0.383, V3 VirusBlock 2005 build 6.0.0.383, and V3Net for Windows Server 6.0 build 6.0.0.383 allows remote attackers to execute arbitrary code via a long filname in an ACE archive.
CVSS Score: 7.5 (HIGH)
References: http://info.ahnlab.com/english/advisory/01.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9377&w=2; http://secunia.com/advisories/15674/
CVE: CVE-2005-3030
Published: 2005-09-21
Description: Directory traversal vulnerability in the archive decompression library in AhnLab V3Pro 2004 build 6.0.0.383, V3 VirusBlock 2005 build 6.0.0.383, and V3Net for Windows Server 6.0 build 6.0.0.383 allows remote attackers to write arbitrary files via a .. (dot dot) in the filename in a compressed archive.
CVSS Score: 5.0 (MEDIUM)
References: http://info.ahnlab.com/english/advisory/01.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9377&w=2; http://secunia.com/advisories/15674/
CVE: CVE-2005-3031
Published: 2005-09-22
Description: Buffer overflow in vxFtpSrv 0.9.7 allows remote attackers to execute arbitrary code via a long USER name.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16837; http://securitytracker.com/id?1014911; http://www.airscanner.com/security/05081102_vxftpsrv.htm
CVE: CVE-2005-3032
Published: 2005-09-22
Description: Buffer overflow in vxTftpSrv 1.7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TFTP request with a long filename argument.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16840; http://securitytracker.com/id?1014912; http://www.airscanner.com/security/05081203_vxtftpsrv.htm
CVE: CVE-2005-3033
Published: 2005-09-22
Description: Stack-based buffer overflow in vxWeb 1.1.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1014910; http://www.airscanner.com/security/05081101_vxweb.htm; http://securitytracker.com/id?1014910
CVE: CVE-2005-3034
Published: 2005-09-22
Description: Compuware DriverStudio Remote Control service (DSRsvc.exe) 2.7 and 3.0 beta 2 allows remote attackers to bypass authentication via a null session.
CVSS Score: 7.5 (HIGH)
References: http://lists.seifried.org/pipermail/security/2005-September/009956.html; http://secunia.com/advisories/16838; http://www.securityfocus.com/bid/14837
CVE: CVE-2005-3035
Published: 2005-09-22
Description: Compuware DriverStudio Remote Control service (DSRsvc.exe) 2.7 and 3.0 beta 2 allows remote attackers to cause a denial of service (reboot) via a UDP packet sent directly to port 9110.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.seifried.org/pipermail/security/2005-September/009956.html; http://secunia.com/advisories/16838; http://www.securityfocus.com/bid/14838
CVE: CVE-2005-3036
Published: 2005-09-22
Description: File Transfer Anywhere 3.01 stores sensitive password information in plaintext in the PASS value in the "File Transfer Anywhere" registry key, which allows local users to gain privileges.
CVSS Score: 4.6 (MEDIUM)
References: http://securitytracker.com/id?1014919; http://securitytracker.com/id?1014919
CVE: CVE-2005-3037
Published: 2005-09-22
Description: Cross-site scripting (XSS) vulnerability in Handy Address Book Server 1.1 allows remote attackers to inject arbitrary web script or HTML via the SEARCHTEXT parameter in a demos URL.
CVSS Score: 4.3 (MEDIUM)
References: http://secubox.teria.org/index.php?menu=24&action=detail&aid=82; http://secunia.com/advisories/16798; http://securitytracker.com/id?1014901
CVE: CVE-2005-3038
Published: 2005-09-22
Description: Unspecified vulnerability in Hosting Controller 6.1 before Hotfix 2.4 allows remote attackers to list and read contents of arbitrary drives, related to "the PHP vulnerability."
CVSS Score: 5.0 (MEDIUM)
References: http://hostingcontroller.com/english/logs/hotfixlogv61_2_4.html; http://secunia.com/advisories/16824; http://www.securityfocus.com/bid/14840
CVE: CVE-2005-3039
Published: 2005-09-22
Description: SQL injection vulnerability in infopage.asp in Mall23 eCommerce allows remote attackers to execute arbitrary SQL commands via the idPage parameter.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1014882; http://systemsecure.org/ssforum/viewtopic.php?t=219; http://www.securityfocus.com/bid/14803
CVE: CVE-2005-3040
Published: 2005-09-22
Description: Directory traversal vulnerability in the web interface (ISALogin.dll) for TAC Vista 4.0, and possibly other versions before 4.3, allows remote attackers to read arbitrary files via ".." sequences in the Template parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0469.html; http://secunia.com/advisories/16854; http://securitytracker.com/id?1014923
CVE: CVE-2005-3041
Published: 2005-09-22
Description: Unspecified "drag-and-drop vulnerability" in Opera Web Browser before 8.50 on Windows allows "unintentional file uploads."
CVSS Score: 5.0 (MEDIUM)
References: http://www.opera.com/docs/changelogs/windows/850/; http://www.securityfocus.com/bid/14884; http://www.vupen.com/english/advisories/2005/1789
CVE: CVE-2005-3042
Published: 2005-09-22
Description: miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters (line feed or carriage return).
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2005-09/0257.html; http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://secunia.com/advisories/16858