morpheuslord/cve-llm-training huggingface dataset:
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1652.

assistant: message.htm for Woppoware PostMaster 4.2.2 (build 3.2.5) allows remote attackers to bypass authentication by modifying the email parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1653.

assistant: Cross-site scripting (XSS) vulnerability in message.htm for Woppoware PostMaster 4.2.2 (build 3.2.5) allows remote attackers to inject arbitrary web script or HTML via the email parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1654.

assistant: Hosting Controller 6.1 Hotfix 1.9 and earlier allows remote attackers to register arbitrary users via a direct request to addsubsite.asp with the loginname and password parameters set.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1655.

assistant: AOL Instant Messenger 5.5.x and earlier allows remote attackers to cause a denial of service (client crash) via an invalid smiley icon location in the sml parameter of a font tag.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1656.

assistant: Mercur Messaging 2005 SP2 allows remote attackers to read the source code of .ctml files via a URL with a trailing hex-encoded space ("%20").
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1657.

assistant: Multiple directory traversal vulnerabilities in Mercur Messaging 2005 SP2 allow remote attackers to perform unauthorized file operations via the Folder.Id parameter to (1) deletefolder.ctml, (2) deletemessage.ctml, (3) origmessage.ctml, or (4) readmessage.ctml, the Message.Id parameter to editmessage.ctml, or the (5) Message.Command parameter to messages.ctml.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1658.

assistant: Directory traversal vulnerability in filemanager.cpp in MyServer 0.8 allows remote attackers to list the parent directory of the web root via a URL with a "..."  (triple dot).
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1659.

assistant: Cross-site scripting (XSS) vulnerability in filemanager.cpp in MyServer 0.8 allows remote attackers to inject arbitrary Javascript via a URL with a "..."  (triple dot) followed by an onmouseover event.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1660.

assistant: HTMLJunction EZGuestbook stores the guestbook.mdb file under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as the administrative password.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1661.

assistant: Jeuce Personal Webserver 2.13 allows remote attackers to cause a denial of service (server crash) via a long GET request, possibly triggering a buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1662.

assistant: Directory traversal vulnerability in Jeuce Personal Web Server 2.13 allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1663.

assistant: Jeuce Personal Web Server 2.13 allows remote attackers to cause a denial of service (server crash) via a GET request beginning with "://".
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1664.

assistant: The __VIEWSTATE functionality in Microsoft ASP.NET 1.x allows remote attackers to conduct replay attacks to (1) apply a ViewState generated from one view to a different view, (2) reuse ViewState information after the application's state has changed, or (3) use the ViewState to conduct attacks or expose content to third parties.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1665.

assistant: The __VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not cryptographically signed, allows remote attackers to cause a denial of service (CPU consumption) via deeply nested markup.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1666.

assistant: Multiple buffer overflows in Orenosv HTTP/FTP Server 0.8.1 allow remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via long arguments to FTP commands such as MKD, RMD, or DELE, which are processed by the (1) ftp_xlate_path, (2) ftp_is_canonical, or (3) os_fn_nativize functions, or (4) a long SSI command that is processed by the parse_cmd function in cgissi.exe.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1667.

assistant: DataTrac Activity Console 1.1 allows remote attackers to cause a denial of service via a long HTTP GET request.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1668.

assistant: YusASP Web Asset Manager 1.0 allows remote attackers to gain privileges via a direct request to assetmanager.asp.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1669.

assistant: Cross-site scripting (XSS) vulnerability in Opera 8.0 Final Build 1095 allows remote attackers to inject arbitrary web script or HTML via "javascript:" URLs when a new window or frame is opened, which allows remote attackers to bypass access restrictions and perform unauthorized actions on other domains.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1670.

assistant: Unknown vulnerability in Extreme BlackDiamond 10808 and 8800 switches running ExtremeWare XOS 11.1 before 11.1.3.3, 11.0 before 11.0.2.4, and 10.x allows remote authenticated users to execute arbitrary commands.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1671.

assistant: The Logfile feature in Yahoo! Messenger 5.x through 6.0 can be activated by a YMSGR: URL and writes all output to a single ypager.log file, even when there are multiple users, and does not properly warn later users that the feature has been enabled, which allows local users to obtain sensitive information from other users.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1672.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in Help Center Live allow remote attackers to inject arbitrary web script or HTML via the (1) find parameter to index.php, (2) name or (3) message field of a chat request, or (4) the message body when opening a trouble ticket.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1673.

assistant: Multiple SQL injection vulnerabilities in Help Center Live allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to index.php, (2) tid parameter to view.php, fid parameter to (3) download.php or (4) chat_download.php, (5) status parameter to icon.php, TICKET_tid parameter to (6) index.php or (7) view.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1674.

assistant: Cross-Site Request Forgery (CSRF) vulnerability in Help Center Live allows remote attackers to perform actions as the administrator via a link or IMG tag to view.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1675.

assistant: Groove Virtual Office before 3.1 build 2338, before 3.1a build 2364, and Groove Workspace before 2.5n build 1871 installs the client installation directories with insecure EVERYBODY permissions, which allows local users to gain sensitive information.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1676.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in Groove Mobile Workspace in Groove Virtual Office before 3.1 build 2338, before 3.1a build 2364, and Groove Workspace before 2.5n build 1871 allow remote attackers to inject arbitrary web script or HTML via the (1) picture columns embedded within SharePoint lists or (2) drop-down menus in a SharePoint list.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1677.

assistant: Unknown vulnerability in Groove Virtual Office before 3.1 build 2338, before 3.1a build 2364, and Groove Workspace before 2.5n build 1871 allows remote attackers to bypass restrictions on COM objects.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1678.

assistant: Groove Virtual Office before 3.1 build 2338, before 3.1a build 2364, and Groove Workspace before 2.5n build 1871 does not properly display file extensions on attached or embedded files in a compound document, which may allow remote attackers to trick users into executing malicious code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1679.

assistant: Stack-based buffer overflow in the error directive in picasm 1.12b and earlier allows attackers to execute arbitrary code via a long error message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1680.

assistant: D-Link DSL-502T, DSL-504T, DSL-562T, and DSL-G604T, when /cgi-bin/firmwarecfg is executed, allows remote attackers to bypass authentication (1) if their IP address already exists in /var/tmp/fw_ip or (2) if their request is the first, which causes /var/tmp/fw_ip to be created and contain their IP address.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1681.

assistant: PHP remote file inclusion vulnerability in common.php in phpATM 1.21, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code via a URL in the include_location parameter to index.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1682.

assistant: JavaMail API, as used by Solstice Internet Mail Server POP3 2.0, does not properly validate the message number in the MimeMessage constructor in javax.mail.internet.InternetHeaders, which allows remote authenticated users to read other users' e-mail messages by modifying the msgno parameter.  NOTE: Sun disputes this issue, stating "The report makes references to source code and files that do not exist in the mentioned products.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1683.

assistant: Buffer overflow in winword.exe 10.2627.6714 and earlier in Microsoft Word for the Macintosh, before SP3 for Word 2002, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted mcw file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1684.

assistant: Cross-site scripting (XSS) vulnerability in default.asp for episodex guestbook allows remote attackers to inject arbitrary web script or HTML via the Name field and other fields.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1685.

assistant: episodex guestbook allows remote attackers to bypass authentication and edit scripts via a direct request to admin.asp.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1686.

assistant: Format string vulnerability in gedit 2.10.2 may allow attackers to cause a denial of service (application crash) via a bin file with format string specifiers in the filename.  NOTE: while this issue is triggered on the command line by the gedit user, it has been reported that web browsers and email clients could be configured to provide a file name as an argument to gedit, so there is a valid attack that crosses security boundaries.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1687.

assistant: SQL injection vulnerability in wp-trackback.php in Wordpress 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the tb_id parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1688.

assistant: Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/, (2) wp-includes/, or (3) wp-admin/, which reveal the path in an error message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1689.

assistant: Double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1691.

assistant: Directory traversal vulnerability in Internet Graphics Server in SAP before 6.40 Patch 11 allows remote attackers to read arbitrary files via ".." sequences in an HTTP GET request.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1692.

assistant: Format string vulnerability in gxine 0.4.1 through 0.4.4, and other versions down to 0.3, allows remote attackers to execute arbitrary code via a ram file with a URL whose hostname contains format string specifiers.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1693.

assistant: Integer overflow in Computer Associates Vet Antivirus library, as used by CA InoculateIT 6.0, eTrust Antivirus r6.0 through 7.1, eTrust Antivirus for the Gateway r7.0 and r7.1, eTrust Secure Content Manager, eTrust Intrusion Detection, BrightStor ARCserve Backup (BAB) r11.1, Vet Antivirus, Zonelabs ZoneAlarm Security Suite, and ZoneAlarm Antivirus, allows remote attackers to gain privileges via a compressed VBA directory with a project name length of -1, which leads to a heap-based buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1694.

assistant: Multiple SQL injection vulnerabilities in Xanthia.php in the Xanthia module in PostNuke 0.750 allow remote attackers to execute arbitrary SQL commands via the (1) name or (2) module parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1695.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in the RSS module in PostNuke 0.750 and 0.760RC2 and RC3 allow remote attackers to inject arbitrary web script or HTML via the (1) rss_url parameter to magpie_slashbox.php, or the url parameter to (2) magpie_simple.php or (3) magpie_debug.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1696.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.750 and 0.760RC3 allow remote attackers to inject arbitrary web script or HTML via the (1) skin or (2) paletteid parameter to demo.php in the Xanthia module, or (3) the serverName parameter to config.php in the Multisites (aka NS-Multisites) module.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1697.

assistant: The RSS module in PostNuke 0.750 and 0.760RC2 and RC3 allows remote attackers to obtain sensitive information via a direct request to simple_smarty.php, which reveals the path in an error message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1698.

assistant: PostNuke 0.750 and 0.760RC3 allows remote attackers to obtain sensitive information via a direct request to (1) theme.php or (2) Xanthia.php in the Xanthia module, (3) user.php, (4) thelang.php, (5) text.php, (6) html.php, (7) menu.php, (8) finclude.php, or (9) button.php in the pnblocks directory in the Blocks module, (10) config.php in the NS-Multisites (aka Multisites) module, or (11) xmlrpc.php, which reveals the path in an error message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1699.

assistant: Directory traversal vulnerability in pnadminapi.php in the Xanthia module in PostNuke 0.760-RC3 allows remote administrators to read arbitrary files via a .. (dot dot) in the skin parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1700.

assistant: SQL injection vulnerability in pnadmin.php in the Xanthia module in PostNuke 0.760-RC3 allows remote administrators to execute arbitrary SQL commands via the riga[0] parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1701.

assistant: SQL injection vulnerability in PortailPHP 1.3 allows remote attackers to execute arbitrary SQL commands via the id parameter to the (1) News, (2) File, (3) Liens, or (4) Faq modules.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1702.

assistant: Format string vulnerability in Warrior Kings: Battles 1.23 and earlier and Warrior Kings 1.3 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a nickname.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1703.

assistant: Warrior Kings: Battles 1.23 and earlier allows remote attackers to cause a denial of service (server crash) via a partial join packet that triggers a NULL pointer dereference.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1704.

assistant: Integer overflow in the Binary File Descriptor (BFD) library for gdb before 6.3, binutils, elfutils, and possibly other packages, allows user-assisted attackers to execute arbitrary code via a crafted object file that specifies a large number of section headers, leading to a heap-based buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1705.

assistant: gdb before 6.3 searches the current working directory to load the .gdbinit configuration file, which allows local users to execute arbitrary commands as the user running gdb.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1706.

assistant: Unknown vulnerability in MailScanner 4.41.3 and earlier, related to "incomplete reporting of viruses in zip files," allows remote attackers to bypass virus detection.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1707.

assistant: The fn_show_postinst function in Gentoo webapp-config before 1.10-r14 allows local users to overwrite arbitrary files via a symlink attack on the postinst.txt temporary file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1708.

assistant: templates.admin.users.user_form_processing in Blue Coat Reporter before 7.1.2 allows authenticated users to gain administrator privileges via an HTTP POST that sets volatile.user.administrator to true.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1709.

assistant: Unknown vulnerability in Blue Coat Reporter before 7.1.2 allows remote unauthenticated attackers to add a license.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1710.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in Blue Coat Reporter before 7.1.2 allow remote attackers to inject arbitrary web script or HTML via (1) the username in an Add User window or (2) the license key (volatile.license_to_add parameter) in the Licensing page.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1711.

assistant: Gibraltar Firewall 2.2 and earlier, when using the ClamAV update to 0.81 for Squid, uses a defunct ClamAV method to scan memory for viruses, which does not return an error code and prevents viruses from being detected.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1712.

assistant: Unknown vulnerability in Serendipity 0.8, when used with multiple authors, allows unprivileged authors to upload arbitrary media files.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1713.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in Serendipity 0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) templatedropdown and (2) shoutbox plugins.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1714.

assistant: Cross-site scripting (XSS) vulnerability in NetWin SurgeMail 3.0c2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1715.

assistant: Cross-site scripting (XSS) vulnerability in index.php for TOPo 2.2 (2.2.178) allows remote attackers to inject arbitrary web script or HTML via the (1) m, (2) s, (3) ID, or (4) t parameters, or the (5) field name, (6) Your Web field, or (7) email field in the comments section.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1716.

assistant: TOPo 2.2 (2.2.178) stores data files in the data directory under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as client IP addresses.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1717.

assistant: ZyXEL Prestige 650R-31 router running ZyNOS FW v3.40(KO.1) allows remote attackers to cause a denial of service (CPU consumption and network loss) via crafted fragmented IP packets.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1718.

assistant: Buffer overflow in LS Games War Times 1.03 and earlier allows remote attackers to cause a denial of service (server crash) via a long nickname.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1719.

assistant: Unknown vulnerability in ALWIL avast! antivirus 4 (4.6.6230) and earlier, when running on Windows NT 4.0, does not properly detect certain viruses.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1720.

assistant: AFP Server for Mac OS X 10.4.1, when using an ACL enabled volume, does not properly remove an ACL when a file is copied to a directory that does not use ACLs, which will override the POSIX file permissions for that ACL.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1721.

assistant: Buffer overflow in the legacy client support for AFP Server for Mac OS X 10.4.1 allows attackers to execute arbitrary code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1722.

assistant: Unknown vulnerability in the CoreGraphics Window Server for Mac OS X 10.4.x up to 10.4.1 allows local users to inject arbitrary commands into root sessions.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1723.

assistant: LaunchServices in Apple Mac OS X 10.4.x up to 10.4.1 does not properly mark file extensions and MIME types as unsafe if an Apple Uniform Type Identifier (UTI) is not created when the type is added to the database of unsafe types, which could allow attackers to bypass intended restrictions.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1724.

assistant: NFS on Apple Mac OS X 10.4.x up to 10.4.1 does not properly obey the -network or -mask flags for a filesystem and exports it to everyone, which allows remote attackers to bypass intended access restrictions.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1725.

assistant: launchd 106 in Apple Mac OS X 10.4.x up to 10.4.1 allows local users to overwrite arbitrary files via a symlink attack on the socket file in an insecure temporary directory.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1726.

assistant: The CoreGraphics Window Server in Mac OS X 10.4.1 allows local users with console access to gain privileges by "launching commands into root sessions."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1727.

assistant: Apple Mac OS X 10.4.x up to 10.4.1 sets insecure world- and group-writable permissions for the (1) system cache folder and (2) Dashboard system widgets, which allows local users to conduct unauthorized file operations via "file race conditions."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1728.

assistant: MCX Client for Apple Mac OS X 10.4.x up to 10.4.1 insecurely logs Portable Home Directory credentials, which allows local users to obtain the credentials.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1729.

assistant: Novell eDirectory 8.7.3 allows remote attackers to cause a denial of service (application crash) via a URL containing an MS-DOS device name such as AUX, CON, PRN, COM1, or LPT1.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1730.

assistant: Multiple vulnerabilities in the OpenSSL ASN.1 parser, as used in Novell iManager 2.0.2, allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted packets, as demonstrated by "OpenSSL ASN.1 brute forcer."  NOTE: this issue might overlap CVE-2004-0079, CVE-2004-0081, or CVE-2004-0112.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1732.

assistant: Cookie Cart allows remote attackers to read the Order Notification list via the testmycgi and path parameters to testmy.cgi.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1733.

assistant: Cookie Cart stores the password file under the web document root with insufficient access control, which allows remote attackers to obtain usernames and encrypted passwords via a direct request to passwd.txt.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1734.

assistant: Multiple SQL injection vulnerabilities in PROMS before 0.11 allow remote attackers to execute arbitrary SQL commands via unknown vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1735.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in PROMS before 0.11 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1736.

assistant: PROMS 0.11 does not properly handle "certain combinations of rights," which gives more rights to users than intended.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1737.

assistant: Multiple unknown vulnerabilities in PROMS 0.11 allow "non-authorized users" to (1) view or modify the project member list or (2) modify the todos list.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1738.

assistant: Format string vulnerability in the logPrintBadfile function in delbadfiles.c Iron Bars SHell (ibsh) before 0.3d allows users to "access files outside the home directory" and possibly execute arbitrary code via certain inputs that are not properly handled in a syslog call.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1739.

assistant: The XWD Decoder in ImageMagick before 6.2.2.3, and GraphicsMagick before 1.1.6-r1, allows remote attackers to cause a denial of service (infinite loop) via an image with a zero color mask.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1740.

assistant: fixproc in Net-snmp 5.x before 5.2.1-r1 creates temporary files insecurely, which allows local users to modify the contents of those files to execute arbitrary commands, or overwrite arbitrary files via a symlink attack.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1741.

assistant: Gearbox Software Halo: Combat Evolved 1.6 allows remote attackers to cause a denial of service (infinite loop) via malformed data.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1742.

assistant: BEA WebLogic Server and WebLogic Express 8.1 SP2 and SP3 allows users with the Monitor security role to "shrink or reset JDBC connection pools."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1743.

assistant: BEA WebLogic Server and WebLogic Express 8.1 through Service Pack 3 and 7.0 through Service Pack 5 does not properly handle when a security provider throws an exception, which may cause WebLogic to use incorrect identity for the thread, or to fail to audit security exceptions.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1744.

assistant: BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the application without having to log in again, which may be in violation of newly changed security constraints or role mappings.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1745.

assistant: The UserLogin control in BEA WebLogic Portal 8.1 through Service Pack 3 prints the password to standard output when an incorrect login attempt is made, which could make it easier for attackers to guess the correct password.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1746.

assistant: The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host or port specified in a cookie, even when it is not in the cluster, which allows remote attackers to cause a denial of service (cluster slowdown) via modified cookies.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1747.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 6, allow remote attackers to inject arbitrary web script or HTML, and possibly gain administrative privileges, via the (1) j_username or (2) j_password parameters in the login page (LoginForm.jsp), (3) parameters to the error page in the Administration Console, (4) unknown vectors in the Server Console while the administrator has an active session to obtain the ADMINCONSOLESESSION cookie, or (5) an alternate vector in the Server Console that does not require an active session but also leaks the username and password.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1748.

assistant: The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 5, allows remote anonymous binds, which may allow remote attackers to view user entries or cause a denial of service.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1749.

assistant: Buffer overflow in BEA WebLogic Server and WebLogic Express 6.1 Service Pack 4 allows remote attackers to cause a denial of service (CPU consumption from thread looping).
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1750.

assistant: SQL injection vulnerability in login.asp in ezdwc NewsletterEz 3.0 allows remote attackers to execute arbitrary SQL commands via the password parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1751.

assistant: Race condition in shtool 2.0.1 and earlier allows local users to create or modify arbitrary files via a symlink attack on the .shtool.$$ temporary file, a different vulnerability than CVE-2005-1759.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1752.

assistant: viewFile.php in the scm component of Gforge before 4.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file_name parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1753.

assistant: ReadMessage.jsp in JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to view other users' e-mail attachments via a direct request to /mailboxesdir/username@domainname. NOTE: Sun and Apache dispute this issue.  Sun states: "The report makes references to source code and files that do not exist in the mentioned products.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1754.

assistant: JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter.  NOTE: Sun and Apache dispute this issue.  Sun states: "The report makes references to source code and files that do not exist in the mentioned products.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1755.

assistant: PHP remote file inclusion vulnerability in poll_vote.php in PHP Poll Creator 1.01 allows remote attackers to execute arbitrary PHP code via the relativer_pfad parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1756.

assistant: Cross-site scripting (XSS) vulnerability in the ModWeb agent for Novell NetMail 3.52 before 3.52C allows remote attackers to inject arbitrary web script or HTML via calendar display fields.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1757.

assistant: Buffer overflow in the Modweb agent for Novell NetMail 3.52 before 3.52C, when renaming folders, may allow attackers to execute arbitrary code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1758.

assistant: Buffer overflow in the IMAP command continuation function in Novell NetMail 3.52 before 3.52C may allow remote attackers to execute arbitrary code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1759.

assistant: Race condition in shtool 2.0.1 and earlier allows local users to modify or create arbitrary files via a symlink attack on temporary files after they have been created, a different vulnerability than CVE-2005-1751.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1760.

assistant: sysreport 1.3.15 and earlier includes contents of the up2date file in a report, which leaks the password for a proxy server in plaintext and allows local users to gain privileges.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1761.

assistant: Linux kernel 2.6 and 2.4 on the IA64 architecture allows local users to cause a denial of service (kernel crash) via ptrace and the restore_sigcontext function.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1762.

assistant: The ptrace call in the Linux kernel 2.6.8.1 and 2.6.10 for the AMD64 platform allows local users to cause a denial of service (kernel crash) via a "non-canonical" address.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1763.

assistant: Buffer overflow in ptrace in the Linux Kernel for 64-bit architectures allows local users to write bytes into kernel memory.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1764.

assistant: Linux 2.6.11 on 64-bit x86 (x86_64) platforms does not use a guard page for the 47-bit address page to protect against an AMD K8 bug, which allows local users to cause a denial of service.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1765.

assistant: syscall in the Linux kernel 2.6.8.1 and 2.6.10 for the AMD64 platform, when running in 32-bit compatibility mode, allows local users to cause a denial of service (kernel hang) via crafted arguments.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1766.

assistant: Heap-based buffer overflow in rtffplin.cpp in RealPlayer 10.5 6.0.12.1056 on Windows, and 10, 10.0.1.436, and other versions before 10.0.5 on Linux, allows remote attackers to execute arbitrary code via a RealMedia file with a long RealText string, such as an SMIL file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1767.

assistant: traps.c in the Linux kernel 2.6.x and 2.4.x executes stack segment faults on an exception stack, which allows local users to cause a denial of service (oops and stack fault exception).
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1768.

assistant: Race condition in the ia32 compatibility code for the execve system call in Linux kernel 2.4 before 2.4.31 and 2.6 before 2.6.6 allows local users to cause a denial of service (kernel panic) and possibly execute arbitrary code via a concurrent thread that increments a pointer count after the nargs function has counted the pointers, but before the count is copied from user space to kernel space, which leads to a buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1769.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.4 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in (1) the URL or (2) an e-mail message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1770.

assistant: Buffer overflow in the Aavmker4 device driver in Avast! Antivirus 4.6 and possibly other versions allows local users to cause a denial of service (system crash) and possibly execute arbitrary code via certain signals combined with crafted input.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1771.

assistant: Unknown vulnerability in HP-UX trusted systems B.11.00 through B.11.23 allows remote attackers to gain unauthorized access, possibly involving remshd and/or telnet -t.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1772.

assistant: Buffer overflow in the client cd-key hash in Terminator 3: War of the Machines 1.16 and earlier allows remote attackers to cause a denial of service (application crash) via a long client cd-key hash value, a different vulnerability than CVE-2005-1556.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1773.

assistant: Multiple unknown vulnerabilities in L-Soft LISTSERV 14.3, 1.8e, and 1.8d allow remote attackers to execute arbitrary code or cause a denial of service.  NOTE: this candidate may be SPLIT in the future when more precise technical details become available.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1774.

assistant: WEB-DAV Linux File System (davfs2) 0.2.3 does not properly enforce Unix permissions, which allows local users to write arbitrary files on a davfs2 mounted filesystem.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1775.

assistant: Terminator 3: War of the Machines 1.16 and earlier allows remote attackers to cause a denial of service (application crash) via a large nickname.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1776.

assistant: Buffer overflow in the READ_TCP_STRING function in game_message_functions.cpp in the network plugin for C'Nedra 0.4.0 and earlier allows remote attackers to execute arbitrary code via a long text string.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1777.

assistant: SQL injection vulnerability in readpmsg.php in PostNuke 0.750 allows remote attackers to execute arbitrary SQL commands via the start parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1778.

assistant: Cross-site scripting (XSS) vulnerability in readpmsg.php in PostNuke 0.750 allows remote attackers to inject arbitrary web script or HTML via the start parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1779.

assistant: SQL injection vulnerability in password.asp in MaxWebPortal 1.35, 1.36, 2.0, and 20050418 Next allows remote attackers to execute arbitrary SQL commands via the memKey parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1780.

assistant: SQL injection vulnerability in admin/login.asp in Active News Manager allows remote attackers to execute arbitrary SQL commands via the password.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1781.

assistant: Unknown vulnerability in SMTP authentication for MailEnable allows remote attackers to cause a denial of service (crash).
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1782.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary web script or HTML via the node parameter to (1) add_review.htm, (2) suggest_review.htm, (3) suggest_category.htm, (4) add_booklist.htm, or (5) add_url.htm, the isbn parameter to (6) add_review.htm, (7) add_contents.htm, (8) add_classification.htm, the (9) chapters parameter to the add_contents page in index.php (aka add_contents.htm), (10) the user parameter to contact.htm, or (11) the submit[string] parameter to search.htm. NOTE: it is not clear whether BookReview is available to the public. If not, then it should not be included in CVE.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1783.

assistant: BookReview beta 1.0 allows remote attackers to obtain the path of the web server via certain parameters to search.htm, possibly due to a search[string] parameter with a missing value or an incorrect submit[type] value, which reveals the path in the resulting error message.  NOTE: it is not clear whether BookReview is available to the public.  If not, then it should not be included in CVE.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1784.

assistant: Hosting Controller 6.1 HotFix 2.0 and earlier allows remote attackers to steal passwords and gain privileges via a modified emailaddress parameter in an updateprofile action for UserProfile.asp.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1785.

assistant: SQL injection vulnerability in ad/login.asp in ZonGG 1.2 allows remote attackers to execute arbitrary SQL commands via the password parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1786.

assistant: SQL injection vulnerability in admin.asp in FunkyASP AD System 1.1 allows remote attackers to execute arbitrary SQL commands and gain privileges via the password parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1787.

assistant: setup.php in phpStat 1.5 allows remote attackers to bypass authentication and gain administrator privileges by setting the $check variable.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1788.

assistant: SQL injection vulnerability in resellerresources.asp in Hosting Controller 6.1 Hotfix 2.0 allows remote attackers to execute arbitrary SQL commands via the jresourceid parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1789.

assistant: SQL injection vulnerability in SignIn.asp in India Software Solution shopping cart allows remote attackers to execute arbitrary SQL commands via the password.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1790.

assistant: Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object Model Objects Memory Corruption Vulnerability."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1791.

assistant: Microsoft Internet Explorer 6 SP2 (6.0.2900.2180) crashes when the user attempts to add a URI to the restricted zone, in which the full domain name of the URI begins with numeric sequences similar to an IP address.  NOTE: if there is not an exploit scenario in which an attacker can trigger this behavior, then perhaps this issue should not be included in CVE.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1792.

assistant: Memory leak in Windows Management Instrumentation (WMI) service allows attackers to cause a denial of service (memory consumption and crash) by creating security contexts more quickly than they can be cleared from the RPC cache.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1793.

assistant: User32.DLL in Microsoft Windows 98SE, and possibly other operating systems, allows local and remote attackers to cause a denial of service (crash) via an icon (.ico) bitmap file with large width and height values.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1794.

assistant: Microsoft Terminal Server using Remote Desktop Protocol (RDP) 5.2 stores an RSA private key in mstlsapi.dll and uses it to sign a certificate, which allows remote attackers to spoof public keys of legitimate servers and conduct man-in-the-middle attacks.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1795.

assistant: The filecopy function in misc.c in Clam AntiVirus (ClamAV) before 0.85, on Mac OS, allows remote attackers to execute arbitrary code via a virus in a filename that contains shell metacharacters, which are not properly handled when HFS permissions prevent the file from being deleted and ditto is invoked.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1796.

assistant: Format string vulnerability in the curses_msg function in the Ncurses interface (ec_curses.c) for Ettercap before 0.7.3 allows remote attackers to execute arbitrary code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2005-1797.

assistant: The design of Advanced Encryption Standard (AES), aka Rijndael, allows remote attackers to recover AES keys via timing attacks on S-box lookups, which are difficult to perform in constant time in AES implementations.