deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-1250
Published: 2005-06-22
Description: SQL injection vulnerability in the logon screen of the web front end (NmConsole/Login.asp) for IpSwitch WhatsUp Professional 2005 SP1 allows remote attackers to execute arbitrary SQL commands via the (1) User Name field (sUserName parameter) or (2) Password (sPassword parameter).
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/secunia_research/2005-13/advisory/; http://www.corsaire.com/advisories/c050323-001.txt; http://www.idefense.com/application/poi/display?id=268&type=vulnerabilities
CVE: CVE-2005-1524
Published: 2005-06-22
Description: PHP file inclusion vulnerability in top_graph_header.php in Cacti 0.8.6d and possibly earlier versions allows remote attackers to execute arbitrary PHP code via the config[library_path] parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com/atualizacoes/index.php?id=a&anuncio=000978; http://secunia.com/advisories/15490; http://secunia.com/advisories/15931
CVE: CVE-2005-1525
Published: 2005-06-22
Description: SQL injection vulnerability in config_settings.php for Cacti before 0.8.6e allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com/atualizacoes/index.php?id=a&anuncio=000978; http://secunia.com/advisories/15490; http://secunia.com/advisories/15931
CVE: CVE-2005-1526
Published: 2005-06-22
Description: PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary PHP code via the config[include_path] parameter.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com/atualizacoes/index.php?id=a&anuncio=000978; http://secunia.com/advisories/15490; http://secunia.com/advisories/15931
CVE: CVE-2005-2045
Published: 2005-06-22
Description: Multiple SQL injection vulnerabilities in DUware DUportal PRO 3.4.3 allow remote attackers to execute arbitrary SQL commands via the (1) iChannel parameter to default.asp, (2) iData parameter to detail.asp, (3) iMem parameter to members.asp, (4) iCat parameter to cat.asp, (5) offset parameter to members_listing_approval.asp, or (6) iChannel parameter to channels_edit.asp.
CVSS Score: 7.5 (HIGH)
References: http://echo.or.id/adv/adv19-theday-2005.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5114&w=2; http://www.osvdb.org/17597
CVE: CVE-2005-2046
Published: 2005-06-22
Description: Multiple SQL injection vulnerabilities in DUware DUamazon Pro 3.0 and 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) iCat parameter to cat.asp, (2) iSub parameter to sub.asp, (3) iSub parameter to detail.asp, (4) iPro parameter to review.asp, iCat parameter to (5) catEdit.asp, (6) catDelete.asp, (7) productEdit.asp, or (8) productDelete.asp, or (9) iType parameter to type.asp.
CVSS Score: 7.5 (HIGH)
References: http://echo.or.id/adv/adv19-theday-2005.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5114&w=2; http://echo.or.id/adv/adv19-theday-2005.txt
CVE: CVE-2005-2047
Published: 2005-06-22
Description: Multiple SQL injection vulnerabilities in DUware DUpaypal Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) iCat parameter to cat.asp, (2) iPro parameter to detail.asp, (3) iSub parameter to sub.asp, (4) iCat parameter to catEdit.asp.
CVSS Score: 7.5 (HIGH)
References: http://echo.or.id/adv/adv19-theday-2005.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5114&w=2; http://echo.or.id/adv/adv19-theday-2005.txt
CVE: CVE-2005-2048
Published: 2005-06-22
Description: Multiple SQL injection vulnerabilities in DUware DUforum 3.1, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the (1) iMsg parameter to messages.asp, iFor parameter to (2) post.asp or (3) forums.asp, or (4) id parameter to userEdit.asp.  NOTE: vectors 1 and 3 were later reported to affect version 3.0.
CVSS Score: 7.5 (HIGH)
References: http://echo.or.id/adv/adv19-theday-2005.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5114&w=2; http://www.securityfocus.com/archive/1/453330/100/0/threaded
CVE: CVE-2005-2049
Published: 2005-06-22
Description: Multiple SQL injection vulnerabilities in DUware DUclassmate 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) iState parameter to default.asp or (2) iPro parameter to edit.asp.
CVSS Score: 7.5 (HIGH)
References: http://echo.or.id/adv/adv19-theday-2005.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5114&w=2; http://www.securityfocus.com/bid/14036
CVE: CVE-2005-0771
Published: 2005-06-23
Description: VERITAS Backup Exec Server (beserver.exe) 9.0 through 10.0 for Windows allows remote unauthenticated attackers to modify the registry by calling methods to the RPC interface on TCP port 6106.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/15789; http://securitytracker.com/id?1014273; http://seer.support.veritas.com/docs/276605.htm
CVE: CVE-2005-0772
Published: 2005-06-28
Description: VERITAS Backup Exec 9.0 through 10.0 for Windows Servers, and 9.0.4019 through 9.1.307 for Netware, allows remote attackers to cause a denial of service (Remote Agent crash) via (1) a crafted packet in NDMLSRVR.DLL or (2) a request packet with an invalid (non-0) "Error Status" value, which triggers a null dereference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://secunia.com/advisories/15789; http://securitytracker.com/id?1014273; http://seer.support.veritas.com/docs/276533.htm
CVE: CVE-2005-1277
Published: 2005-06-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-1766.  Reason: This candidate is a duplicate of CVE-2005-1766.  Notes: This duplicate occurred due to insufficient coordination across three separate parties.  All CVE users should reference CVE-2005-1766 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-1759
Published: 2005-06-28
Description: Race condition in shtool 2.0.1 and earlier allows local users to modify or create arbitrary files via a symlink attack on temporary files after they have been created, a different vulnerability than CVE-2005-1751.
CVSS Score: 1.2 (LOW)
References: http://bugs.gentoo.org/show_bug.cgi?id=93782; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2637&w=2; http://secunia.com/advisories/15668
CVE: CVE-2005-1766
Published: 2005-06-28
Description: Heap-based buffer overflow in rtffplin.cpp in RealPlayer 10.5 6.0.12.1056 on Windows, and 10, 10.0.1.436, and other versions before 10.0.5 on Linux, allows remote attackers to execute arbitrary code via a RealMedia file with a long RealText string, such as an SMIL file.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/16981; http://service.real.com/help/faq/security/050623_player/EN/; http://www.debian.org/security/2005/dsa-826
CVE: CVE-2005-2050
Published: 2005-06-28
Description: Unknown vulnerability in Tor before 0.1.0.10 allows remote attackers to read arbitrary memory and possibly key information from the exit server's process space.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.seul.org/or/announce/Jun-2005/msg00001.html; http://bugs.gentoo.org/show_bug.cgi?id=96320; http://secunia.com/advisories/15764/
CVE: CVE-2005-2051
Published: 2005-06-28
Description: Buffer overflow in the VERITAS Backup Exec Web Administration Console (BEWAC) 9.0 4367 through 10.0 rev. 5484 allows remote attackers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2252&w=2; http://secunia.com/advisories/15789; http://seer.support.veritas.com/docs/276606.htm
CVE: CVE-2005-2052
Published: 2005-06-28
Description: Heap-based buffer overflow in vidplin.dll in RealPlayer 10 and 10.5 (6.0.12.1040 through 1069), RealOne Player v1 and v2, RealPlayer 8 and RealPlayer Enterprise allows remote attackers to execute arbitrary code via an .avi file with a modified strf structure value.
CVSS Score: 5.1 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1840&w=2; http://service.real.com/help/faq/security/050623_player/EN/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1840&w=2
CVE: CVE-2005-2053
Published: 2005-06-28
Description: Just another flat file (JAF) CMS before 3.0 Final allows remote attackers to obtain sensitive information via (1) an * (asterisk) in the id parameter, (2) a blank id parameter, or (3) an * (asterisk) in the disp parameter to index.php, which reveals the path in an error message.  NOTE: a followup suggests that this may be a directory traversal or file inclusion vulnerability.
CVSS Score: 5.0 (MEDIUM)
References: http://echo.or.id/adv/adv20-theday-2005.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1126&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8512&w=2
CVE: CVE-2005-0201
Published: 2005-06-29
Description: D-BUS (dbus) before 0.22 does not properly restrict access to a socket, if the socket address is known, which allows local users to listen or send arbitrary messages on another user's per-user session bus via that socket.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/14119; http://secunia.com/advisories/15638; http://secunia.com/advisories/15833
CVE: CVE-2005-2054
Published: 2005-06-29
Description: Unknown vulnerability in RealPlayer 10 and 10.5 (6.0.12.1040-1069) and RealOne Player v1 and v2 allows remote attackers to overwrite arbitrary files or execute arbitrary ActiveX controls via a crafted MP3 file.
CVSS Score: 5.1 (MEDIUM)
References: http://service.real.com/help/faq/security/050623_player/EN/; http://service.real.com/help/faq/security/050623_player/EN/
CVE: CVE-2005-2055
Published: 2005-06-29
Description: RealPlayer 8, 10, 10.5 (6.0.12.1040-1069), and Enterprise and RealOne Player v1 and v2 allows remote malicious web server to create an arbitrary HTML file that executes an RM file via "default settings of earlier Internet Explorer browsers".
CVSS Score: 5.0 (MEDIUM)
References: http://service.real.com/help/faq/security/050623_player/EN/; http://service.real.com/help/faq/security/050623_player/EN/
CVE: CVE-2005-2056
Published: 2005-06-29
Description: The Quantum archive decompressor in Clam AntiVirus (ClamAV) before 0.86.1 allows remote attackers to cause a denial of service (application crash) via a crafted Quantum archive.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/15811; http://sourceforge.net/project/shownotes.php?release_id=337279; http://www.debian.org/security/2005/dsa-737
CVE: CVE-2005-2057
Published: 2005-06-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in Infopop UBB.Threads before 6.5.2 Beta allow remote attackers to inject arbitrary web script or HTML via the (1) Searchpage parameter to dosearch.php, (2) Number, (3) what, or (4) page parameter to newreply.php, (5) Number, (6) Board, or (7) what parameter to showprofile.php, (8) fpart or (9) page parameter to showflat.php, or (10) like parameter to showmembers.php.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2040&w=2; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5; http://www.ubbcentral.com/boards/showflat.php/Cat/0/Number/42351/Main/42351/#Post42351
CVE: CVE-2005-2058
Published: 2005-06-29
Description: Multiple SQL injection vulnerabilities in Infopop UBB.Threads before 6.5.2 Beta allow remote attackers to execute arbitrary SQL commands via the Number parameter to (1) download.php, (2) modifypost.php, (3) mailthread.php, or (4) notifymod.php, (5) month or (6) year parameter to calendar.php, (7) message parameter to viewmessage.php, (8) main parameter to addfav.php, or (9) posted parameter to grabnext.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2040&w=2; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5; http://www.ubbcentral.com/boards/showflat.php/Cat/0/Number/42351/Main/42351/#Post42351
CVE: CVE-2005-2059
Published: 2005-06-29
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in (1) addaddress.php, (2) toggleignore.php, (3) removeignore.php, and (4) removeaddress.php in Infopop UBB.Threads before 6.5.2 Beta allow remote attackers to modify settings as another user via a link or IMG tag.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2040&w=2; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5; http://www.ubbcentral.com/boards/showflat.php/Cat/0/Number/42351/Main/42351/#Post42351
CVE: CVE-2005-2060
Published: 2005-06-29
Description: Multiple HTTP Response Splitting vulnerabilities in (1) toggleshow.php, (2) togglecats.php, and (3) showprofile.php in Infopop UBB.Threads before 6.5.2 Beta allow remote attackers to spoof web content and poison web caches via CRLF ("%0d%0a") sequences in the Cat parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2040&w=2; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5; http://www.ubbcentral.com/boards/showflat.php/Cat/0/Number/42351/Main/42351/#Post42351
CVE: CVE-2005-2061
Published: 2005-06-29
Description: Infopop UBB.Threads before 6.5.2 Beta allows remote attackers to include arbitrary files via the language parameter in a cookie followed by a null (%00) byte.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2040&w=2; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]5; http://www.ubbcentral.com/boards/showflat.php/Cat/0/Number/42351/Main/42351/#Post42351
CVE: CVE-2005-2062
Published: 2005-06-29
Description: Multiple SQL injection vulnerabilities in ActiveBuyAndSell 6.2 allow remote attackers to execute arbitrary SQL commands via the catid parameter to (1) default.asp or (2) buyersend.asp, (3) Administrator ID field in admin.asp, E-mail field in (4) advertiserstart.asp or (5) buyer.asp, or Keyword field in search.asp.
CVSS Score: 7.5 (HIGH)
References: http://echo.or.id/adv/adv21-theday-2005.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9906&w=2; http://www.securityfocus.com/bid/23110
CVE: CVE-2005-2063
Published: 2005-06-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in ActiveBuyAndSell 6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Title parameter to sendpassword.asp or (2) Keyword field in search.asp.
CVSS Score: 4.3 (MEDIUM)
References: http://echo.or.id/adv/adv21-theday-2005.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9906&w=2; http://echo.or.id/adv/adv21-theday-2005.txt
CVE: CVE-2005-2064
Published: 2005-06-29
Description: Multiple cross-site scripting vulnerabilities in ASP Nuke 0.80 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to forgot_password.asp, or the (2) FirstName, (3) LastName, (4) Username, (5) Password, (6) Address1, (7) Address2, (8) City, (9) ZipCode, (10) Email parameter to register.asp.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6484&w=2; http://www.securityfocus.com/bid/14062; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6484&w=2
CVE: CVE-2005-2065
Published: 2005-06-29
Description: HTTP response splitting vulnerability in language_select.asp in ASP Nuke 0.80 allows remote attackers to spoof web content and poison web caches via CRLF ("%0d%0a") sequences in the LangCode parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6484&w=2; http://www.securityfocus.com/bid/14063; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6484&w=2
CVE: CVE-2005-2066
Published: 2005-06-29
Description: SQL injection vulnerability in comment_post.asp in ASP Nuke 0.80 allows remote attackers to execute arbitrary SQL statements via the TaskID parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6484&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2055&w=2; http://www.securityfocus.com/bid/14064
CVE: CVE-2005-2067
Published: 2005-06-29
Description: SQL injection vulnerability in article.asp in unknown versions of aspnuke allows remote attackers to execute arbitrary SQL commands via the articleid parameter.
CVSS Score: 7.5 (HIGH)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/ASPNuke-0601-sql.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2112&w=2; http://www.securityfocus.com/bid/18215
CVE: CVE-2005-2070
Published: 2005-06-29
Description: The ClamAV Mail fILTER (clamav-milter) 0.84 through 0.85d, when used in Sendmail using long timeouts, allows remote attackers to cause a denial of service by keeping an open connection, which prevents ClamAV from reloading.
CVSS Score: 5.0 (MEDIUM)
References: http://seclists.org/lists/bugtraq/2005/Jun/0197.html; http://www.debian.org/security/2005/dsa-737; http://www.novell.com/linux/security/advisories/2005_38_clamav.html
CVE: CVE-2005-2071
Published: 2005-06-29
Description: traceroute in Sun Solaris 10 on x86 systems allows local users to execute arbitrary code with PRIV_NET_RAWACCESS privileges via (1) a large number of -g arguments or (2) a malformed -s argument with a trailing . (dot).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4114&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1731&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3012&w=2
CVE: CVE-2005-2072
Published: 2005-06-29
Description: The runtime linker (ld.so) in Solaris 8, 9, and 10 trusts the LD_AUDIT environment variable in setuid or setgid programs, which allows local users to gain privileges by (1) modifying LD_AUDIT to reference malicious code and possibly (2) using a long value for LD_AUDIT.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034730.html; http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034731.html; http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034738.html
CVE: CVE-2005-2073
Published: 2005-06-29
Description: Unknown vulnerability in IBM DB2 8.1.4 through 8.1.9 and 8.2.0 through 8.2.2 allows local users with SELECT privileges to conduct unauthorized activities and insert, update or delete table contents.
CVSS Score: 2.1 (LOW)
References: http://www-1.ibm.com/support/search.wss?rs=0&q=IY73104&apar=only; http://www-1.ibm.com/support/search.wss?rs=0&q=IY73104&apar=only
CVE: CVE-2005-2074
Published: 2005-06-29
Description: Cross-site scripting (XSS) vulnerability in PHP-Fusion 6.0.105 allows remote attackers to inject arbitrary web script or HTML via a news or article post, possibly involving the (1) news_body, (2) article_description, or (3) article_body parameters to submit.php.
CVSS Score: 4.3 (MEDIUM)
References: http://dark-assassins.com/forum/viewtopic.php?t=145; http://secunia.com/advisories/15830; http://www.securityfocus.com/bid/14066
CVE: CVE-2005-2075
Published: 2005-06-29
Description: PHP-Fusion 5.0 and 6.0 stores the database file with a predictable filename under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to the filename in the administration/db_backups directory in PHP-Fusion 6.0 or the fusion_admin/db_backups directory in 5.0.
CVSS Score: 5.0 (MEDIUM)
References: http://dark-assassins.com/forum/viewtopic.php?t=142; http://secunia.com/advisories/15830; http://www.vupen.com/english/advisories/2005/0888
CVE: CVE-2005-2076
Published: 2005-06-29
Description: HP Version Control Repository Manager (VCRM) before 2.1.1.730 does not properly handle the "@" character in a proxy password, which could allow attackers with physical access to obtain portions of the password when it is displayed to the screen.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/15790; http://securitytracker.com/id?1014267; http://www.securityfocus.com/advisories/8734
CVE: CVE-2005-2077
Published: 2005-06-29
Description: Cross-site scripting (XSS) vulnerability in error.asp for Hosting Controller allows remote attackers to inject arbitrary web script or HTML via the error parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9685&w=2; http://securitytracker.com/id?1016456; http://www.securityfocus.com/archive/1/419597/100/0/threaded
CVE: CVE-2005-2078
Published: 2005-06-29
Description: BisonFTP Server V4R1 allows remote authenticated users to cause a denial of service via an invalid command with a long argument.
CVSS Score: 2.1 (LOW)
References: http://www.securityfocus.com/bid/14079; http://www.securityfocus.com/bid/14079
CVE: CVE-2005-2080
Published: 2005-06-29
Description: Unknown vulnerability in Remote Agent for Windows Servers (RAWS) in VERITAS Backup Exec 9.0 through 10.0 for Windows, and 9.0.4019 through 9.1.307 for NetWare, allows remote attackers to gain privileges by copying the handle for the server.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/15789; http://seer.support.veritas.com/docs/276608.htm; http://seer.support.veritas.com/docs/277429.htm
CVE: CVE-2005-1690
Published: 2005-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-1250.  Reason: This candidate is a duplicate of CVE-2005-1250.  Notes: this duplicate occurred as a result of multiple independent discoveries and insufficient coordination by the vendor and CNA.  All CVE users should reference CVE-2005-1250 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-1938
Published: 2005-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-1250.  Reason: This candidate is a duplicate of CVE-2005-1250.  Notes: this duplicate occurred as a result of multiple independent discoveries and insufficient coordination by the vendor and CNA.  All CVE users should reference CVE-2005-1250 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-2069
Published: 2005-06-30
Description: pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote attackers to sniff the password.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-319
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-07/0060.html; http://bugs.gentoo.org/show_bug.cgi?id=96767; http://bugzilla.padl.com/show_bug.cgi?id=210
CVE: CVE-2005-0360
Published: 2005-07-05
Description: The Microsoft Log Sink Class ActiveX control in pkmcore.dll is marked as "safe for scripting" for Internet Explorer, which allows remote attackers to create or append to arbitrary files.
CVSS Score: 5.0 (MEDIUM)
References: http://www.kb.cert.org/vuls/id/165022; http://www.kb.cert.org/vuls/id/165022
CVE: CVE-2005-0393
Published: 2005-07-05
Description: The helper scripts for crip 3.5 do not properly use temporary files, which allows local users to have an unknown impact with unknown attack vectors.
CVSS Score: 7.2 (HIGH)
References: http://www.debian.org/security/2005/dsa-733; http://www.debian.org/security/2005/dsa-733
CVE: CVE-2005-1625
Published: 2005-07-05
Description: Stack-based buffer overflow in the UnixAppOpenFilePerform function in Adobe Reader 5.0.9 and 5.0.10 for Unix allows remote attackers to execute arbitrary code via a PDF document with a long /Filespec tag.
CVSS Score: 5.0 (MEDIUM)
References: http://www.adobe.com/support/techdocs/329083.html; http://www.idefense.com/application/poi/display?id=279&type=vulnerabilities; http://www.novell.com/linux/security/advisories/2005_42_acroread.html
CVE: CVE-2005-1917
Published: 2005-07-05
Description: kpopper 1.0 and earlier allows local users to create and overwrite arbitrary files via a symlink attack on the .popper-new temporary file.
CVSS Score: 2.1 (LOW)
References: http://www.zataz.net/adviso/kpopper-06152005.txt; http://www.zataz.net/adviso/kpopper-06152005.txt