rainbutterfly/cve_corpus huggingface dataset:
CVE-2005-0896 
Multiple cross-site scripting (XSS) vulnerabilities in review.php in phpMyDirectory 10.1.3-rel allow remote attackers to inject arbitrary web script or HTML via the (1) subcat, (2) page, or (3) subsubcat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0897 
PHP remote file inclusion vulnerability in catalog.php in E-Store Kit-2 PayPal Edition allows remote attackers to execute arbitrary PHP code by modifying the menu and main parameters to reference a URL on a remote web server that contains the code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0898 
Cross-site scripting (XSS) vulnerability in downloadform.php in E-Store Kit-2 PayPal Edition allows remote attackers to inject arbitrary web script or HTML via the txn_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0899 
AS/400 running OS400 5.2 installs and enables LDAP by default, which allows remote authenticated users to obtain OS/400 user profiles by performing a search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0900 
marks.php in NukeBookmarks 0.6 for PHP-Nuke allows remote attackers to obtain sensitive information via an invalid (1) file or (2) category parameter, which reveal the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0901 
Multiple cross-site scripting (XSS) vulnerabilities in NukeBookmarks 0.6 for PHP-Nuke allow remote attackers to inject arbitrary web script or HTML via the (1) catname, (2) markname, (3) comment, or (4) category parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0902 
SQL injection vulnerability in marks.php in NukeBookmarks 0.6 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the category parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0903 
Buffer overflow in QuickTime PictureViewer 6.5.1 allows remote attackers to cause a denial of service (application crash) via a JPEG file with crafted Huffman Table (marker DHT) data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0904 
Remote Desktop in Windows XP SP1 does not verify the "Force shutdown from a remote system" setting, which allows remote attackers to shut down the system by executing TSShutdn.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0905 
Maxthon 1.2.0 allows remote malicious web sites to obtain potentially sensitive data from the search bar via the m2_search_text property.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0906 
Buffer overflow in a player logging function in the Tincat network library 2.x before 2.0.28, as used in games such as Sacred and The Settlers: Heritage of Kings, allows remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0907 
Multiple SQL injection vulnerabilities in Valdersoft Shopping Cart 3.0 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to category.php, (2) the id parameter to item.php, (3) the lang parameter to index.php, (4) the searchQuery parameter to search_result.php, (5) or the searchTopCategoryID parameter to search_result.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0908 
Multiple cross-site scripting (XSS) vulnerabilities in Valdersoft Shopping Cart 3.0 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter to index.php or (2) the searchTopCategoryID parameter to search_result.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0909 
PHP remote file inclusion vulnerability in shoutact.php for TKai's Shoutbox allows remote attackers to execute arbitrary PHP code via the query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0910 
Multiple cross-site scripting (XSS) vulnerabilities in exoops allow remote attackers to inject arbitrary web script or HTML via (1) the sortdays parameter to viewforum.php or (2) the viewcat parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0911 
Multiple SQL injection vulnerabilities in exoops may allow remote attackers to execute arbitrary SQL commands via (1) the viewcat parameter to index.php or (2) the artid parameter in the viewarticle action for index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0912 
Unknown vulnerabilities in deplate before 0.7.2 have unknown impact, possibly involving elements.rb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0913 
Unknown vulnerability in the regex_replace modifier (modifier.regex_replace.php) in Smarty before 2.6.8 allows attackers to execute arbitrary PHP code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0914 
Multiple cross-site scripting (XSS) vulnerabilities in CPG Dragonfly 9.0.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) the profile parameter to index.php or (2) the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0915 
Webmasters-Debutants WD Guestbook 2.8 allows remote attackers to bypass authentication and perform certain administrator actions via a direct HTTP POST request to (1) ajout_admin2.php or (2) suppr.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0916 
AIO in the Linux kernel 2.6.11 on the PPC64 or IA64 architectures with CONFIG_HUGETLB_PAGE enabled allows local users to cause a denial of service (system panic) via a process that executes the io_queue_init function but exits without running io_queue_release, which causes exit_aio and is_hugepage_only_range to fail.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0917 
PHP remote file inclusion vulnerability in index_header.php for EncapsBB 0.3.2_fixed, and possibly other versions, allows remote attackers to execute arbitrary PHP code via the root parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0918 
The NPSVG3.dll ActiveX control for Adobe SVG Viewer 3.02 and earlier, when running on Internet Explorer, allows remote attackers to determine the existence of arbitrary files by setting the src property to the target filename and using Javascript to determine if the web page immediately stops loading, which indicates whether the file exists or not.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-05T04:00:00.000Z
CVE-2005-0919 
Adventia Chat 3.1 and Server Pro 3.0 allows remote attackers to inject arbitrary web script or HTML into the chat space, which leaves other users vulnerable to cross-site scripting (XSS) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0920 
Multiple SQL injection vulnerabilities in Bugtracker.NET 2.0.1 allow remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0921 
Microsoft Outlook 2002 Connector for IBM Lotus Domino 2.0 allows local users to save passwords and login credentials locally, even when password caching is disabled by a group policy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0922 
Unknown vulnerability in the Auto-Protect module in Symantec Norton AntiVirus 2004 and 2005, as also used in Internet Security 2004/2005 and System Works 2004/2005, allows attackers to cause a denial of service (system hang or crash) by triggering a scan of a certain file type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0923 
The SmartScan feature in the Auto-Protect module for Symantec Norton AntiVirus 2004 and 2005, as also used in Internet Security 2004/2005 and System Works 2004/2005, allows attackers to cause a denial of service (CPU consumption and system crash) by renaming a file on a network share.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0924 
Cross-site scripting (XSS) vulnerability in Adventia E-Data 2.0 allows remote attackers to inject arbitrary web script or HTML via a query keyword.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0925 
Cross-site scripting (XSS) vulnerability in login.asp for Ublog Reload 1.0 through 1.0.4 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0926 
Buffer overflow in Sylpheed before 1.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attachments with MIME-encoded file names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0927 
Unknown vulnerability in subs.pl for WebAPP 0.9.9 through 0.9.9.2 has unknown impact and attack vectors, probably involving shell metacharacters or .. sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0928 
Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP Pro 5.x allow remote attackers to inject arbitrary web script or HTML via the (1) cat, (2) password, (3) ppuser, (4) sort, or (5) si parameters to showgallery.php, the (6) ppuser, (7) sort, or (8) si parameters to showmembers.php, or (9) the photo parameter to slideshow.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0929 
SQL injection vulnerability in PhotoPost PHP Pro 5.x may allow remote attackers to execute arbitrary SQL commands via (1) the sl parameter to showmembers.php or (2) the photo parameter to showphoto.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0930 
Cross-site scripting (XSS) vulnerability in message.php in Chatness 2.5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) the user field or (2) the message parameter to message.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0931 
PHP remote file inclusion vulnerability in The Includer 1.0 and 1.1 allows remote attackers to execute arbitrary PHP code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0932 
Multiple SQL injection vulnerabilities in phpCOIN 1.2.1b and earlier allow remote attackers to execute arbitrary SQL commands (1) via the search engine, (2) the username or email fields in the "forgotten password" feature, or (3) the domain name in a package order.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0933 
Directory traversal vulnerability in auxpage.php for phpCOIN 1.2.1b and earlier allows remote attackers to read arbitrary files via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0934 
Multiple cross-site scripting (XSS) vulnerabilities in WackoWiki R4 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0935 
Multiple SQL injection vulnerabilities in ESMI PayPal Storefront allow remote attackers to execute arbitrary SQL commands via the (1) idpages parameter to pages.php or the (2) id2 parameter to products1.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0936 
Cross-site scripting vulnerability in products1h.php in ESMI PayPal Storefront allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-29T05:00:00.000Z
CVE-2005-0937 
Some futex functions in futex.c for Linux kernel 2.6.x perform get_user calls while holding the mmap_sem semaphore, which could allow local users to cause a deadlock condition in do_page_fault by triggering get_user faults while another thread is executing mmap or other functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-30T05:00:00.000Z
CVE-2005-0938 
Ublog Reload 1.0 through 1.0.4 stores ublogreload.mdb under the web root, which allows remote attackers to read usernames and hashed passwords via a direct request to ublogreload.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-30T05:00:00.000Z
CVE-2005-0941 
The StgCompObjStream::Load function in OpenOffice.org OpenOffice 1.1.4 and earlier allocates memory based on 16 bit length values, but process memory using 32 bit values, which allows remote attackers to cause a denial of service and possibly execute arbitrary code via a DOC document with certain length values, which leads to a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-12T04:00:00.000Z
CVE-2005-0942 
The XP Server process (xp_server) in Sybase Adaptive Server Enterprise (ASE) XP Server 12.x before 12.5.3 ESD#1 allows attackers to cause a denial of service (process crash) via malformed data sent to the XP Server TCP port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0943 
Cisco VPN 3000 series Concentrator running firmware 4.1.7.A and earlier allows remote attackers to cause a denial of service (device reload or drop user connection) via a crafted HTTPS packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0944 
Unknown vulnerability in Microsoft Jet DB engine (msjet40.dll) 4.00.8618.0, related to insufficient data validation, allows remote attackers to execute arbitrary code via a crafted mdb file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0945 
Cross-site scripting (XSS) vulnerability in ACS Blog 1.1.1 allows remote attackers to inject arbitrary web script or HTML via onmouseover or onload events in (1) img, (2) link, or (3) mail tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0946 
SQL injection vulnerability in phpCoin 1.2.1b and earlier allows remote attackers to execute arbitrary SQL commands via the (1) term/keywords field on the search page, (2) username or (3) e-mail field on the forgot password page, or (4) domain name on the ordering new package page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0947 
Directory traversal vulnerability in auxpage.php in phpCoin 1.2.1b and earlier allows remote attackers to read and execute arbitrary files via a .. (dot dot) in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0948 
SQL injection vulnerability in ad_click.asp for PortalApp allows remote attackers to execute arbitrary SQL commands via the banner_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0949 
Multiple cross-site scripting (XSS) vulnerabilities in content.asp in Iatek PortalApp allow remote attackers to inject arbitrary web script or HTML via the (1) contenttype or (2) keywords parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0950 
Directory traversal vulnerability in FastStone 4in1 Browser 1.2 allows remote attackers to read arbitrary files via a (1) ... (triple dot) or (2) ..\ (dot dot backslash) in the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0952 
Cross-site scripting vulnerability in pafiledb.php in PaFileDB 3.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0953 
Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0954 
Windows Explorer and Internet Explorer in Windows 2000 SP1 allows remote attackers to cause a denial of service (CPU consumption) via a malformed Windows Metafile (WMF) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0955 
SQL injection vulnerability in InterAKT MX Shop 1.1.1 allows remote attackers to execute arbitrary SQL commands via the id_ctg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0956 
Multiple SQL injection vulnerabilities in index.php in InterAKT MX Kart 1.1.2 allow remote attackers to execute arbitrary SQL commands via the (1) idp, (2) id_ctg, or (3) id_man parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0957 
Bay Technical Associates RPC-3 Telnet Host 3.05 allows remote attackers to bypass authentication by pressing the escape and enter keys at the username prompt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0958 
Format string vulnerability in the log_do function in log.c for YepYep mtftpd 0.0.3, when the statistics option is enabled, allows remote attackers to execute arbitrary code via the CWD command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0959 
Buffer overflow in the mt_do_dir function in YepYep mtftpd 0.0.3 may allow attackers to execute arbitrary code via a long path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0960 
Multiple vulnerabilities in the SACK functionality in (1) tcp_input.c and (2) tcp_usrreq.c OpenBSD 3.5 and 3.6 allow remote attackers to cause a denial of service (memory exhaustion or system crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0961 
Cross-site scripting (XSS) vulnerability in Horde 3.0.4 before 3.0.4-RC2 allows remote attackers to inject arbitrary web script or HTML via the parent frame title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0962 
SQL injection vulnerability in index.php for Lighthouse Squirrelcart allows remote attackers to execute arbitrary SQL commands via the (1) crn parameter in a show action or (2) rn parameter in a show_detail action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0963 
An error in the Toshiba ACPI BIOS 1.6 causes the BIOS to only examine the first slot in the Master Boot Record (MBR) table for an active partition, which prevents the system from booting even though the MBR is not malformed.  NOTE: it has been debated as to whether or not this issue poses a security vulnerability, since administrative privileges would be required, and other DoS attacks are possible with such privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0964 
Unknown vulnerability in Kerio Personal Firewall 4.1.2 and earlier allows local users to bypass firewall rules via a malicious process that impersonates a legitimate process that has fewer restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-03T05:00:00.000Z
CVE-2005-0965 
The gaim_markup_strip_html function in Gaim 1.2.0, and possibly earlier versions, allows remote attackers to cause a denial of service (application crash) via a string that contains malformed HTML, which causes an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-04T04:00:00.000Z
CVE-2005-0966 
The IRC protocol plugin in Gaim 1.2.0, and possibly earlier versions, allows (1) remote attackers to inject arbitrary Gaim markup via irc_msg_kick, irc_msg_mode, irc_msg_part, irc_msg_quit, (2) remote attackers to inject arbitrary Pango markup and pop up empty dialog boxes via irc_msg_invite, or (3) malicious IRC servers to cause a denial of service (application crash) by injecting certain Pango markup into irc_msg_badmode, irc_msg_banned, irc_msg_unknown, irc_msg_nochan functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-04T04:00:00.000Z
CVE-2005-0967 
Gaim 1.2.0 allows remote attackers to cause a denial of service (application crash) via a malformed file transfer request to a Jabber user, which leads to an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-06T04:00:00.000Z
CVE-2005-0968 
Computer Associates (CA) eTrust Intrusion Detection 3.0 allows remote attackers to cause a denial of service via large size values that are not properly validated before calling the CPImportKey function in the Crypto API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-05T04:00:00.000Z
CVE-2005-0969 
Heap-based buffer overflow in the syscall emulation functionality in Mac OS X before 10.3.9 allows local users to cause a denial of service (kernel panic) and possibly execute arbitrary code via crafted parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-12T04:00:00.000Z
CVE-2005-0970 
Mac OS X 10.3.9 and earlier allows users to install, create, and execute setuid/setgid scripts, contrary to the intended design, which may allow attackers to conduct unauthorized activities with escalated privileges via vulnerable scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-22T04:00:00.000Z