rainbutterfly/cve_corpus huggingface dataset:
CVE-2005-3018 
Apple Safari allows remote attackers to cause a denial of service (application crash) via a crafted data:// URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-21T04:00:00.000Z
CVE-2005-3019 
Multiple SQL injection vulnerabilities in vBulletin before 3.0.9 allow remote attackers to execute arbitrary SQL commands via the (1) request parameter to joinrequests.php, (2) limitnumber or (3) limitstart to user.php, (4) usertitle.php, or (5) usertools.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-21T04:00:00.000Z
CVE-2005-3020 
Multiple cross-site scripting (XSS) vulnerabilities in vBulletin before 3.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter to css.php, (2) redirect parameter to index.php, (3) email parameter to user.php, (4) goto parameter to language.php, (5) orderby parameter to modlog.php, and the (6) hex, (7) rgb, or (8) expandset parameter to template.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-21T04:00:00.000Z
CVE-2005-3021 
image.php in vBulletin 3.0.9 and earlier allows remote attackers with access to the administrator panel to upload arbitrary files via the upload action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-21T04:00:00.000Z
CVE-2005-3022 
Multiple SQL injection vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) announcement parameter to announcement.php, (2) userid parameter to user.php, (3) calendar parameter to admincalendar.php, (4) cronid parameter to cronlog.php, (5) usergroupid parameter to email.php, (6) help parameter to help.php, (7) rvt parameter to language.php, (8) keep parameter to phrase.php, or (9) updateprofilepic parameter to usertools.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-21T04:00:00.000Z
CVE-2005-3023 
Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via certain arguments to (1) announcement.php, (2) admincalendar.php, (3) bbcode.php, (4) cronadmin.php, (5) email.php, (6) faq.php, (7) forum.php, (8) image.php, (9) language.php, (10) ranks.php, (11) replacement.php, (12) replacement.php, (13) template.php, (14) template.php, (15) usergroup.php, or (16) usertitle.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-21T04:00:00.000Z
CVE-2005-3024 
Multiple SQL injection vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) announcement parameter to announcement.php, the (2) thread[forumid] or (3) criteria parameters to thread.php, (4) userid parameter to user.php, the (5) calendarcustomfieldid, (6) calendarid, (7) moderatorid, (8) holidayid, (9) calendarmoderatorid, or (10) calendar[0] parameters to admincalendar.php, (11) the cronid parameter to cronlog.php, (12) user[usergroupid][0] parameter to email.php, (13) help[0] parameter to help.php, the (14) limitnumber or (15) limitstart parameter to user.php, the (16) usertitleid or (17) ids parameters to usertitle.php, (18) rvt[0] parameter to language.php, (19) keep[0] parameter to phrase.php, (20) dostyleid parameter to template.php, (21) thread[forumid] parameter to thread.php, or (22) usertools.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-21T04:00:00.000Z
CVE-2005-3025 
Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the loc parameter to (1) modcp/index.php or (2) admincp/index.php, or the ip parameter to (3) modcp/user.php or (4) admincp/usertitle.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-21T04:00:00.000Z
CVE-2005-3026 
Directory traversal vulnerability in index.php in Alstrasoft Epay Pro 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the read parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-21T04:00:00.000Z
CVE-2005-3027 
Sybari Antigen 8.0 SR2 does not properly filter SMTP messages, which allows remote attackers to bypass custom filter rules and send file attachments of arbitrary file types via a message with a subject of "Antigen forwarded attachment".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-21T04:00:00.000Z
CVE-2005-3029 
Stack-based buffer overflow in AhnLab V3Pro 2004 build 6.0.0.383, V3 VirusBlock 2005 build 6.0.0.383, and V3Net for Windows Server 6.0 build 6.0.0.383 allows remote attackers to execute arbitrary code via a long filname in an ACE archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-21T04:00:00.000Z
CVE-2005-3030 
Directory traversal vulnerability in the archive decompression library in AhnLab V3Pro 2004 build 6.0.0.383, V3 VirusBlock 2005 build 6.0.0.383, and V3Net for Windows Server 6.0 build 6.0.0.383 allows remote attackers to write arbitrary files via a .. (dot dot) in the filename in a compressed archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-21T04:00:00.000Z
CVE-2005-3031 
Buffer overflow in vxFtpSrv 0.9.7 allows remote attackers to execute arbitrary code via a long USER name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-22T04:00:00.000Z
CVE-2005-3032 
Buffer overflow in vxTftpSrv 1.7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TFTP request with a long filename argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-22T04:00:00.000Z
CVE-2005-3033 
Stack-based buffer overflow in vxWeb 1.1.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-22T04:00:00.000Z
CVE-2005-3034 
Compuware DriverStudio Remote Control service (DSRsvc.exe) 2.7 and 3.0 beta 2 allows remote attackers to bypass authentication via a null session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-22T04:00:00.000Z
CVE-2005-3035 
Compuware DriverStudio Remote Control service (DSRsvc.exe) 2.7 and 3.0 beta 2 allows remote attackers to cause a denial of service (reboot) via a UDP packet sent directly to port 9110.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-22T04:00:00.000Z
CVE-2005-3036 
File Transfer Anywhere 3.01 stores sensitive password information in plaintext in the PASS value in the "File Transfer Anywhere" registry key, which allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-22T04:00:00.000Z
CVE-2005-3037 
Cross-site scripting (XSS) vulnerability in Handy Address Book Server 1.1 allows remote attackers to inject arbitrary web script or HTML via the SEARCHTEXT parameter in a demos URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-22T04:00:00.000Z
CVE-2005-3038 
Unspecified vulnerability in Hosting Controller 6.1 before Hotfix 2.4 allows remote attackers to list and read contents of arbitrary drives, related to "the PHP vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-22T04:00:00.000Z
CVE-2005-3039 
SQL injection vulnerability in infopage.asp in Mall23 eCommerce allows remote attackers to execute arbitrary SQL commands via the idPage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-22T04:00:00.000Z
CVE-2005-3040 
Directory traversal vulnerability in the web interface (ISALogin.dll) for TAC Vista 4.0, and possibly other versions before 4.3, allows remote attackers to read arbitrary files via ".." sequences in the Template parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-22T04:00:00.000Z
CVE-2005-3041 
Unspecified "drag-and-drop vulnerability" in Opera Web Browser before 8.50 on Windows allows "unintentional file uploads."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-22T04:00:00.000Z
CVE-2005-3042 
miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters (line feed or carriage return).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-22T04:00:00.000Z
CVE-2005-3043 
SQL injection vulnerability in AddItem.asp in Mall23 eCommerce allows remote attackers to execute arbitrary SQL commands via the idOption_Dropdown_2 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-22T04:00:00.000Z
CVE-2005-3044 
Multiple vulnerabilities in Linux kernel before 2.6.13.2 allow local users to cause a denial of service (kernel OOPS from null dereference) via (1) fput in a 32-bit ioctl on 64-bit x86 systems or (2) sockfd_put in the 32-bit routing_ioctl function on 64-bit systems.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-22T04:00:00.000Z
CVE-2005-3045 
SQL injection vulnerability in search.php in My Little Forum 1.5 and 1.6 beta allows remote attackers to execute arbitrary SQL commands via the phrase field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-23T04:00:00.000Z
CVE-2005-3046 
SQL injection vulnerability in password.php in PhpMyFaq 1.5.1 allows remote attackers to modify SQL queries and gain administrator privileges via the user field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-23T04:00:00.000Z
CVE-2005-3047 
Multiple cross-site scripting (XSS) vulnerabilities in PhpMyFaq 1.5.1 allow remote attackers to inject arbitrary web script or HTML via the (1) PMF_CONF[version] parameter to footer.php or (2) PMF_LANG[metaLanguage] to header.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-23T04:00:00.000Z
CVE-2005-3048 
Directory traversal vulnerability in index.php in PhpMyFaq 1.5.1 allows remote attackers to read arbitrary files or include arbitrary PHP files via a .. (dot dot) in the LANGCODE parameter, which also allows direct code injection via the User Agent field in a request packet, which can be activated by using LANGCODE to reference the user tracking data file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-23T04:00:00.000Z
CVE-2005-3049 
PhpMyFaq 1.5.1 stores data files under the web document root with insufficient access control and predictable filenames, which allows remote attackers to obtain sensitive information via a direct request to the data/tracking[DATE] file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-23T04:00:00.000Z
CVE-2005-3050 
PhpMyFaq 1.5.1 allows remote attackers to obtain sensitive information via a LANGCODE parameter that does not exist, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-23T04:00:00.000Z
CVE-2005-3051 
Stack-based buffer overflow in the ARJ plugin (arj.dll) 3.9.2.0 for 7-Zip 3.13, 4.23, and 4.26 BETA, as used in products including Turbo Searcher, allows remote attackers to execute arbitrary code via a large ARJ block.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-23T04:00:00.000Z
CVE-2005-3052 
SQL injection vulnerability in module/down.inc.php in jportal 2.3.1 allows remote attackers to execute arbitrary SQL commands via the search field to download.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-23T04:00:00.000Z
CVE-2005-3053 
The sys_set_mempolicy function in mempolicy.c in Linux kernel 2.6.x allows local users to cause a denial of service (kernel BUG()) via a negative first argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-26T04:00:00.000Z
CVE-2005-3054 
fopen_wrappers.c in PHP 4.4.0, and possibly other versions, does not properly restrict access to other directories when the open_basedir directive includes a trailing slash, which allows PHP scripts in one directory to access files in other directories whose names are substrings of the original directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-26T04:00:00.000Z
CVE-2005-3055 
Linux kernel 2.6.8 to 2.6.14-rc2 allows local users to cause a denial of service (kernel OOPS) via a userspace process that issues a USB Request Block (URB) to a USB device and terminates before the URB is finished, which leads to a stale pointer reference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-26T04:00:00.000Z
CVE-2005-3056 
TWiki allows arbitrary shell command execution via the Include function
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-01T12:40:12.000Z
CVE-2005-3057 
The FTP component in FortiGate 2.8 running FortiOS 2.8MR10 and v3beta, and other versions before 3.0 MR1, allows remote attackers to bypass the Fortinet FTP anti-virus engine by sending a STOR command and uploading a file before the FTP server response has been sent, as demonstrated using LFTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-14T19:00:00.000Z
CVE-2005-3058 
Interpretation conflict in Fortinet FortiGate 2.8, running FortiOS 2.8MR10 and v3beta, allows remote attackers to bypass the URL blocker via an (1) HTTP request terminated with a line feed (LF) and not carriage return line feed (CRLF) or (2) HTTP request with no Host field, which is still processed by most web servers without violating RFC2616.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-14T19:00:00.000Z
CVE-2005-3059 
Multiple unspecified vulnerabilities in Opera 8.50 on Linux and Windows have unknown impact and attack vectors, related to (1) " handling of must-revalidate cache directive for HTTPS pages" or (2) a "display issue with cookie comment encoding."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-26T04:00:00.000Z
CVE-2005-3060 
Buffer overflow in getconf in IBM AIX 5.2 to 5.3 allows local users to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-30T04:00:00.000Z
CVE-2005-3061 
Multiple stack-based buffer overflows in PowerArchiver 8.10 through 9.5 Beta 4 and Beta 5 allow remote attackers to execute arbitrary code via a long filename in a (1) ACE or (2) ARJ archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3062 
PHP remote file inclusion vulnerability in index.php in AlstraSoft E-Friends 4.0 allows remote attackers to execute arbitrary PHP code via the mode parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3063 
SQL injection vulnerability in MailGust 1.9 allows remote attackers to execute arbitrary SQL commands via the email field on the password reminder page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3064 
MultiTheftAuto 0.5 patch 1 and earlier does not properly verify client privileges when running command 40, which allows remote attackers to change or delete the message of the day (motd.txt).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3065 
MultiTheftAuto 0.5 patch 1 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted command 40 that causes a -1 length to be used and triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3066 
Cross-site scripting (XSS) vulnerability in perldiver.pl in PerlDiver 1.x allows remote attackers to inject arbitrary web script or HTML via the query string.  NOTE: this issue was originally disputed by the vendor, but it has since been acknowledged.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3067 
Cross-site scripting (XSS) vulnerability in perldiver.cgi in PerlDiver 2.x allows remote attackers to inject arbitrary web script or HTML via the module parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3068 
Unspecified vulnerability in Eric Integrated Development Environment (eric3) before 3.7.2 has unknown impact and attack vectors related to a "potential security exploit."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3069 
xferfaxstats in HylaFax 4.2.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on the xferfax$$ temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3070 
HylaFax 4.2.1 and earlier does not create or verify ownership of the UNIX domain socket, which might allow local users to read faxes and cause a denial of service by creating the socket using the hyla.unix temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3071 
Unspecified vulnerability in Unix File System (UFS) on Solaris 8 and 9, when logging is enabled, allows local users to cause a denial of service ("soft hang") via certain write operations to UFS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3072 
SQL injection vulnerability in pages/forum/submit.html in Interchange 4.9.3 up to 5.2.0 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3073 
Unspecified vulnerability in Interchange 5.0.1 allows attackers 4.9.3, 5.0 before 5.0.2, and 5.2, when a catalog has been created using the (1) "mike", (2) "standard", or (3) "foundation" demo, allows attackers to inject Interchange Tag Language (ITL) elements into the forum/submit.html page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3074 
SQL injection vulnerability in rsyslogd in RSyslog before 1.0.1 and before 1.10.1 allows remote attackers to execute arbitrary SQL commands via crafted syslog messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3075 
SQL injection vulnerability in Zengaia before 0.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3076 
Simplog 0.9.1 might allow remote attackers to execute arbitrary SQL commands or trigger SQL error messages via invalid (1) pid, (2) blogid, (3) cid, or (4) m parameters to archive.php, or the (5) blogid parameter to blogadmin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3077 
Microsoft Internet Explorer 5.2.3 for Mac OS allows remote attackers to cause a denial of service (crash) via a web page with malformed attributes in a BGSOUND tag, possibly involving double-quotes in an about: URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3078 
Cross-site scripting (XSS) vulnerability in PunBB before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the "forgotten e-mail" feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3079 
PunBB before 1.2.8 allows remote attackers to perform "code inclusion" via the user language selection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3080 
contrib/example.php in GeSHi before 1.0.7.3 allows remote attackers to read arbitrary files via the language field without a source field set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3081 
wzdftpd 0.5.4 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the SITE command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3082 
SQL injection vulnerability in admin.php in SEO-Board 1.0.2 allows remote attackers to execute arbitrary SQL commands via the user_pass_sha1 value in a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3083 
Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 0.10 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3084 
Buffer overflow in the TIFF library in the Photo Viewer for Sony PSP 2.0 firmware allows remote attackers to cause a denial of service via a crafted TIFF image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3085 
Multiple cross-site scripting (XSS) vulnerabilities in rss.php in Riverdark Studios RSS Syndicator module 2.1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) forum or (2) topic parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3086 
Directory traversal vulnerability in admin/about.php in contentServ 3.1 allows remote attackers to read or include arbitrary files via ".." sequences in the ctsWebsite parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3087 
The SecureW2 3.0 TLS implementation uses weak random number generators (rand and srand from system time) during generation of the pre-master secret (PMS), which makes it easier for attackers to guess the secret and decrypt sensitive data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-27T04:00:00.000Z
CVE-2005-3088 
fetchmailconf before 1.49 in fetchmail 6.2.0, 6.2.5 and 6.2.5.2 creates configuration files with insecure world-readable permissions, which allows local users to obtain sensitive information such as passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-27T04:00:00.000Z
CVE-2005-3089 
Firefox 1.0.6 allows attackers to cause a denial of service (crash) via a Proxy Auto-Config (PAC) script that uses an eval statement. NOTE: it is not clear whether an untrusted party has any role in triggering this issue, so it might not be a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-28T04:00:00.000Z