deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-2846
Published: 2005-09-08
Description: PHP remote file inclusion vulnerability in lang.php in CMS Made Simple 0.10 and earlier allows remote attackers to execute arbitrary PHP code via the nls[file][vx][vxsfx] parameter.
CVSS Score: 7.5 (HIGH)
References: http://forum.cmsmadesimple.org/index.php/topic%2C1549.0.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4406&w=2; http://secunia.com/advisories/16654/
CVE: CVE-2005-2847
Published: 2005-09-08
Description: img.pl in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote attackers to execute arbitrary commands via shell metacharacters in the f parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3390&w=2; http://secunia.com/advisories/16683/; http://www.securityfocus.com/bid/14712
CVE: CVE-2005-2848
Published: 2005-09-08
Description: Directory traversal vulnerability in img.pl in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote attackers to read arbitrary files via a .. (dot dot) in the f parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3390&w=2; http://secunia.com/advisories/16683/; http://securiweb.net/wiki/Ressources/AvisDeSecurite/2005.1
CVE: CVE-2005-2849
Published: 2005-09-08
Description: Argument injection vulnerability in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote attackers to (1) read portions of source code via the -f option to Dig (dig_device.cgi), (2) determine file existence via the -r argument to Tcpdump (tcpdump_device.cgi) or (3) modify files in the cgi-bin directory via the -w argument to Tcpdump.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3390&w=2; http://secunia.com/advisories/16683/; http://securiweb.net/wiki/Ressources/AvisDeSecurite/2005.1
CVE: CVE-2005-2850
Published: 2005-09-08
Description: SlimFTPd 3.17 allows remote attackers to cause a denial of service (crash) via certain (1) USER and (2) PASS commands, possibly due to a buffer overflow or off-by-one error.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1014831; http://www.critical.lt/?vulnerabilities/8; http://www.critical.lt/research/slimftpd_dos2.c
CVE: CVE-2005-2851
Published: 2005-09-08
Description: smb4k 0.4 and other versions before 0.6.3 allows local users to read sensitive files via a symlink attack on the (1) smb4k.tmp or (2) sudoers temporary files.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/16724; http://secunia.com/advisories/17636; http://smb4k.berlios.de/
CVE: CVE-2005-2852
Published: 2005-09-08
Description: Unknown vulnerability in CIFS.NLM in Novell Netware 6.5 SP2 and SP3, 5.1, and 6.0 allows remote attackers to cause a denial of service (ABEND) via an incorrect password length, as exploited by the "worm.rbot.ccc" worm.
CVSS Score: 5.0 (MEDIUM)
References: http://support.novell.com/cgi-bin/search/searchtid.cgi?/2971821.htm; http://support.novell.com/cgi-bin/search/searchtid.cgi?/2971822.htm; http://support.novell.com/cgi-bin/search/searchtid.cgi?/2971832.htm
CVE: CVE-2005-2853
Published: 2005-09-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in GuppY 4.5.3a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the pg parameter to printfaq.php, or the (2) Referer or (3) User-Agent HTTP headers, which are not properly handled by error.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/16707; http://www.freeguppy.org/download.php?lng=en; http://www.freeguppy.org/thread.php?lng=en&pg=81882&fid=1&cat=200
CVE: CVE-2005-2854
Published: 2005-09-08
Description: CRLF injection vulnerability in thesitewizard.com chfeedback.pl Feedback Form Perl Script 2.0.1 allows remote attackers to use the script as a mail relay (spam proxy) via CRLF sequences in the (1) name or (2) email fields, which are injected into mail headers.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0094.html; http://www.securityfocus.com/bid/14749; http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0094.html
CVE: CVE-2005-2855
Published: 2005-09-08
Description: Cross-site scripting (XSS) vulnerability in Unclassified NewsBoard 1.5.3 allows remote attackers to inject arbitrary web script or HTML via the description field.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4473&w=2; http://packetstormsecurity.org/0509-exploits/unb153.html; http://secunia.com/advisories/16726
CVE: CVE-2005-2856
Published: 2005-09-08
Description: Stack-based buffer overflow in the WinACE UNACEV2.DLL third-party compression utility before 2.6.0.0, as used in multiple products including (1) ALZip 5.51 through 6.11, (2) Servant Salamander 2.0 and 2.5 Beta 1, (3) WinHKI 1.66 and 1.67, (4) ExtractNow 3.x, (5) Total Commander 6.53, (6) Anti-Trojan 5.5.421, (7) PowerArchiver before 9.61, (8) UltimateZip 2.7,1, 3.0.3, and 3.1b, (9) Where Is It (WhereIsIt) 3.73.501, (10) FilZip 3.04, (11) IZArc 3.5 beta3, (12) Eazel 1.0, (13) Rising Antivirus 18.27.21 and earlier, (14) AutoMate 6.1.0.0, (15) BitZipper 4.1 SR-1, (16) ZipTV, and other products, allows user-assisted attackers to execute arbitrary code via a long filename in an ACE archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8458&w=2; http://secunia.com/advisories/16479; http://secunia.com/advisories/19454
CVE: CVE-2005-2857
Published: 2005-09-08
Description: Free SMTP Server 2.2 allows remote attackers to use the server as an open mail relay (spam proxy).
CVSS Score: 7.5 (HIGH)
References: http://k.domaindlx.com/shellcore/advisories.asp?bug_report=display&infamous_group=87; http://secunia.com/advisories/16698; http://k.domaindlx.com/shellcore/advisories.asp?bug_report=display&infamous_group=87
CVE: CVE-2005-2858
Published: 2005-09-08
Description: The Fetch.FetchContact.1 ActiveX control (Fetch.dll) for Rediff Bol 7.0 allows remote attackers to read the Windows Address Book via the FullAddressBook method.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/16685; http://www.infogreg.com/security/im/rediff-bol-7-exposes-wab.html; http://secunia.com/advisories/16685
CVE: CVE-2005-2859
Published: 2005-09-08
Description: Savant Web Server stores user credentials in plaintext in the Savant\Users registry key, which allows local users to gain privileges.
CVSS Score: 4.6 (MEDIUM)
References: http://k.domaindlx.com/shellcore/advisories.asp?bug_report=display&infamous_group=84; http://secunia.com/advisories/16666; http://k.domaindlx.com/shellcore/advisories.asp?bug_report=display&infamous_group=84
CVE: CVE-2005-2860
Published: 2005-09-08
Description: Cross-site scripting (XSS) vulnerability in Nikto 1.35 and earlier allows remote attackers to inject arbitrary web script or HTML via the Server field in an HTTP response header, which is directly injected into an HTML report.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0914&w=2; http://seclists.org/lists/vulnwatch/2005/Jul-Sep/0032.html; http://www.cybsec.com/vuln/010905-multiple_webscanner_script_injection.pdf
CVE: CVE-2005-2861
Published: 2005-09-08
Description: Cross-site scripting (XSS) vulnerability in N-Stealth Commercial Edition before 5.8.0.38 and Free Edition before 5.8.1.03 allows remote attackers to inject arbitrary web script or HTML via the Server field in an HTTP response header, which is directly injected into an HTML report.
CVSS Score: 4.3 (MEDIUM)
References: http://seclists.org/lists/vulnwatch/2005/Jul-Sep/0032.html; http://www.cybsec.com/vuln/010905-multiple_webscanner_script_injection.pdf; http://www.securityfocus.com/bid/14717
CVE: CVE-2005-2862
Published: 2005-09-08
Description: ADSL Road Runner modem in the Annex A family has a service running on port 224, which allows remote attackers to login to the modem with a blank password and gain unauthorized access.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0750&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0750&w=2
CVE: CVE-2005-2863
Published: 2005-09-08
Description: Cross-site scripting (XSS) vulnerability in openwebmail-main.pl in OpenWebMail 2.41 allows remote attackers to inject arbitrary web script or HTML via the sessionid parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6918&w=2; http://secunia.com/advisories/16734/; http://www.securityfocus.com/bid/14771
CVE: CVE-2005-2864
Published: 2005-09-08
Description: URBAN 1.5.3_1 allows local users to overwrite arbitrary files via a symlink attack on the (1) high score or (2) save game files.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9036&w=2; http://secunia.com/advisories/16680/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9036&w=2
CVE: CVE-2005-2865
Published: 2005-09-08
Description: Multiple PHP remote file inclusion vulnerabilities in aMember Pro 2.3.4 allow remote attackers to execute arbitrary PHP code via the config[root_dir] parameter to (1) mysql.inc.php, (2) efsnet.inc.php, (3) theinternetcommerce.inc.php, (4) cdg.inc.php, (5) compuworld.inc.php, (6) directone.inc.php, (7) authorize_aim.inc.php, (8) beanstream.inc.php, (9) config.inc.php, (10) eprocessingnetwork.inc.php, (11) eway.inc.php, (12) linkpoint.inc.php, (13) logiccommerce.inc.php, (14) netbilling.inc.php, (15) payflow_pro.inc.php, (16) paymentsgateway.inc.php, (17) payos.inc.php, (18) payready.inc.php, or (19) plugnplay.inc.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6801&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/22157; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6801&w=2
CVE: CVE-2005-2866
Published: 2005-09-08
Description: Mercora IMRadio 4.0.0.0 stores usernames and passwords in plaintext in the MercoraClient\Profiles registry key, which allows local users to gain privileges.
CVSS Score: 4.6 (MEDIUM)
References: http://securitytracker.com/id?1014780; http://securitytracker.com/id?1014780
CVE: CVE-2005-2867
Published: 2005-09-08
Description: SQL injection vulnerability in BlueWhaleCRM allows remote attackers to execute arbitrary SQL commands via the Account ID field.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/16615; http://www.securityfocus.com/bid/14697; http://secunia.com/advisories/16615
CVE: CVE-2005-2868
Published: 2005-09-08
Description: ZipTorrent 1.3.7.3 stores sensitive information in plaintext in the pref.txt file, which allows local users to obtain sensitive information such as proxy server information and passwords.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/16542; http://www.spyinstructors.com/show.php?name=Advisories&pa=showpage&pid=65; http://secunia.com/advisories/16542
CVE: CVE-2005-2869
Published: 2005-09-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the Username to libraries/auth/cookie.auth.lib.php or (2) the error parameter to error.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/16605; http://secunia.com/advisories/17337; http://secunia.com/advisories/17559
CVE: CVE-2005-2870
Published: 2005-09-08
Description: Unknown vulnerability in the net-svc script on Solaris 10 allows remote authenticated users to execute arbitrary code on a DHCP client via certain DHCP responses.
CVSS Score: 7.5 (HIGH)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-101897-1; http://sunsolve.sun.com/search/document.do?assetkey=1-26-101897-1
CVE: CVE-2005-2871
Published: 2005-09-09
Description: Buffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a hostname with all "soft" hyphens (character 0xAD), which is not properly handled by the NormalizeIDN call in nsStandardURL::BuildNormalizedSpec.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0316.html; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]8387&w=2; http://secunia.com/advisories/16764
CVE: CVE-2005-2872
Published: 2005-09-09
Description: The ipt_recent kernel module (ipt_recent.c) in Linux kernel before 2.6.12, when running on 64-bit processors such as AMD64, allows remote attackers to cause a denial of service (kernel panic) via certain attacks such as SSH brute force, which leads to memset calls using a length based on the u_int32_t type, acting on an array of unsigned long elements, a different vulnerability than CVE-2005-2873.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=322237; http://secunia.com/advisories/17073; http://secunia.com/advisories/17826
CVE: CVE-2005-2873
Published: 2005-09-09
Description: The ipt_recent kernel module (ipt_recent.c) in Linux kernel 2.6.12 and earlier does not properly perform certain time tests when the jiffies value is greater than LONG_MAX, which can cause ipt_recent netfilter rules to block too early, a different vulnerability than CVE-2005-2872.
CVSS Score: 2.1 (LOW)
References: http://blog.blackdown.de/2005/05/09/fixing-the-ipt_recent-netfilter-module/; http://rhn.redhat.com/errata/RHBA-2007-0304.html; http://secunia.com/advisories/17826
CVE: CVE-2005-2874
Published: 2005-09-13
Description: The is_path_absolute function in scheduler/client.c for the daemon in CUPS before 1.1.23 allows remote attackers to cause a denial of service (CPU consumption by tight loop) via a "..\.." URL in an HTTP request.
CVSS Score: 5.0 (MEDIUM)
References: http://lwn.net/Alerts/152835/; http://securitytracker.com/id?1012811; http://www.cups.org/relnotes.php#010123
CVE: CVE-2005-2875
Published: 2005-09-13
Description: Py2Play allows remote attackers to execute arbitrary Python code via pickled objects, which Py2Play unpickles and executes.
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=326976; http://secunia.com/advisories/16855; http://secunia.com/advisories/17106
CVE: CVE-2005-2876
Published: 2005-09-13
Description: umount in util-linux 2.8 to 2.12q, 2.13-pre1, and 2.13-pre2, and other packages such as loop-aes-utils, allows local users with unmount permissions to gain privileges via the -r (remount) option, which causes the file system to be remounted with just the read-only flag, which effectively clears the nosuid, nodev, and other flags.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5857&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2266&w=2; http://secunia.com/advisories/16785
CVE: CVE-2005-2878
Published: 2005-09-13
Description: Format string vulnerability in search.c in the imap4d server in GNU Mailutils 0.6 allows remote authenticated users to execute arbitrary code via format string specifiers in the SEARCH command.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6043&w=2; http://savannah.gnu.org/patch/index.php?func=detailitem&item_id=4407; http://secunia.com/advisories/16783
CVE: CVE-2005-1913
Published: 2005-09-14
Description: The Linux kernel 2.6 before 2.6.12.1 allows local users to cause a denial of service (kernel panic) via a non group-leader thread executing a different program than was pending in itimer, which causes the signal to be delivered to the old group-leader task, which does not exist.
CVSS Score: 2.1 (LOW)
References: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.12.1; http://secunia.com/advisories/15786/; http://www.securityfocus.com/bid/14054
CVE: CVE-2005-2490
Published: 2005-09-14
Description: Stack-based buffer overflow in the sendmsg function call in the Linux kernel 2.6 before 2.6.13.1 allows local users to execute arbitrary code by calling sendmsg and modifying the message contents in another thread.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2266&w=2; http://secunia.com/advisories/16747/; http://secunia.com/advisories/17002
CVE: CVE-2005-2492
Published: 2005-09-14
Description: The raw_sendmsg function in the Linux kernel 2.6 before 2.6.13.1 allows local users to cause a denial of service (change hardware state) or read from arbitrary memory via crafted input.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2266&w=2; http://secunia.com/advisories/16747/; http://secunia.com/advisories/17073
CVE: CVE-2005-2879
Published: 2005-09-14
Description: Advansysperu Software USB Lock Auto-Protect (AP) 1.5 uses a weak encryption scheme to encrypt passwords, which allows local users to gain sensitive information and bypass USB interface protection.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8852&w=2; http://www.shadock.net/secubox/.data/adv_usblock/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8852&w=2
CVE: CVE-2005-2880
Published: 2005-09-14
Description: Multiple SQL injection vulnerabilities in phpCommunityCalendar 4.0.3, and possibly earlier versions, allow remote attackers to execute arbitrary SQL commands via the (1) login field in login.php or (2) LocationID parameter to week.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4004&w=2; http://rgod.altervista.org/phpccal.html; http://secunia.com/advisories/16721/
CVE: CVE-2005-2881
Published: 2005-09-14
Description: phpCommunityCalendar 4.0.3 allows remote attackers to bypass authentication and gain unauthorized access via a direct request to the admin directory.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4004&w=2; http://rgod.altervista.org/phpccal.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/22182
CVE: CVE-2005-2882
Published: 2005-09-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpCommunityCalendar 4.0.3, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the LocationID parameter to (1) thankyou.php or (2) day.php, font parameter to (3) calDaily.php, (4) calMonthly.php, (5) calMonthlyP.php, (6) calWeekly.php, (7) calWeeklyP.php, (8) calYearly.php, (9) calYearlyP.php, (10) day.php, or (11) week.php, or (12) CeTi, (13) Contact, (14) Description, (15) ShowAddress parameter to event.php, and other attack vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4004&w=2; http://rgod.altervista.org/phpccal.html; http://secunia.com/advisories/16721/
CVE: CVE-2005-2883
Published: 2005-09-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-2855.  Reason: This candidate is a duplicate of CVE-2005-2855.  Notes: All CVE users should reference CVE-2005-2855 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-2884
Published: 2005-09-14
Description: Cross-site scripting (XSS) vulnerability in events.php in Land Down Under (LDU) 801 and earlier allows remote attackers to inject arbitrary web script or HTML via the Description field in an event.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3252&w=2; http://secunia.com/advisories/16710/; http://www.securityfocus.com/bid/14746
CVE: CVE-2005-2885
Published: 2005-09-14
Description: The Downloads page in MAXdev MD-Pro 1.0.73, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which could allow remote attackers to bypass file extension checks and execute arbitrary commands by uploading a file with a different extension, as demonstrated using .inc files.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7458&w=2; http://secunia.com/advisories/16731/; http://www.securityfocus.com/bid/14750
CVE: CVE-2005-2886
Published: 2005-09-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in MAXdev MD-Pro 1.0.73, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via (1) the print parameter to the print module, the sitename parameter to (2) bb_smilies or (3) bbcode_ref module, or (4) the hlpfile parameter to openwindow.php.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7458&w=2; http://rgod.altervista.org/maxdev1073.html; http://secunia.com/advisories/16731/
CVE: CVE-2005-2887
Published: 2005-09-14
Description: MAXdev MD-Pro 1.0.73, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to (1) wiki.php, (2) AutoTheme directory, (3) Blocks directory, (4) admin.php, (5) pnadmin.php, or (6) Topics directory, which reveal the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7458&w=2; http://rgod.altervista.org/maxdev1073.html; http://secunia.com/advisories/16731/
CVE: CVE-2005-2888
Published: 2005-09-14
Description: Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) Preview Release 2 allow remote attackers to execute arbitrary SQL commands via the (1) fid parameter to misc.php or (2) Content-Disposition field in the HTTP header to newreply.php.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2781&w=2; http://secunia.com/advisories/16738/; https://exchange.xforce.ibmcloud.com/vulnerabilities/22192
CVE: CVE-2005-2889
Published: 2005-09-14
Description: Check Point NGX R60 does not properly verify packets against the predefined service group "CIFS" rule, which allows remote attackers to bypass intended restrictions.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4821&w=2; http://www.kb.cert.org/vuls/id/508209; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4821&w=2
CVE: CVE-2005-2890
Published: 2005-09-14
Description: SecureOL VE2 1.05.1008 does not properly restrict public access to physical memory, which allows local users to bypass intended restrictions and gain access to the secured environment via direct access to the PhysicalMemory device.
CVSS Score: 4.6 (MEDIUM)
References: http://cybermessageboard.xeran.com/secureol/viewtopic.php?t=26; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8771&w=2; http://secunia.com/advisories/16739/
CVE: CVE-2005-2891
Published: 2005-09-14
Description: WebArchiveX.dll 5.5.0.76 installed before September 6th, 2005 is marked safe for scripting by default, which allows remote attackers to read or write to arbitrary files via the (1) MakeArchive or (2) MakeArchiveStr methods.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4937&w=2; http://secunia.com/advisories/16722/; http://security-assessment.com/Advisories/WebArchiveX_-_Unsafe_Methods_Vulnerability.pdf
CVE: CVE-2005-2892
Published: 2005-09-14
Description: Directory traversal vulnerability in setcookie.php in PBLang 4.65, and possibly earlier versions, allows remote attackers to read arbitrary files via ".." sequences and "%00" (trailing null byte) in the u parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7979&w=2; http://secunia.com/advisories/16711/; http://securitytracker.com/alerts/2005/Sep/1014861.html
CVE: CVE-2005-2893
Published: 2005-09-14
Description: Direct static code injection vulnerability in setcookie.php in PBLang 4.65, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code via the username (u parameter), which is directly injected into a file that is later executed upon login.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7979&w=2; http://secunia.com/advisories/16711/; http://securitytracker.com/alerts/2005/Sep/1014861.html
CVE: CVE-2005-2894
Published: 2005-09-14
Description: Cross-site scripting (XSS) vulnerability in the user registration in PBLang 4.65, and possibly earlier versions, allows remote attackers to inject arbitrary web script or PHP via the location field.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7979&w=2; http://www.securityfocus.com/bid/14766; https://exchange.xforce.ibmcloud.com/vulnerabilities/22190