yahoo-inc/cve-impacts huggingface dataset:
CVE-2005-2109: wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change the content of the forgotten password e-mail message via the message variable, which is not initialized before use.
Key phrases: change the content of the forgotten password e
CVE-2005-2110: WordPress 1.5.1.2 and earlier allows remote attackers to obtain sensitive information via (1) a direct request to menu-header.php or a "1" value in the feed parameter to (2) wp-atom.php, (3) wp-rss.php, or (4) wp-rss2.php, which reveal the path in an error message.  NOTE: vector [1] was later reported to also affect WordPress 2.0.1.
Key phrases: obtain sensitive information, obtain sensitive information via (1) a, vector
CVE-2005-2111: login.cgi in Community Link Pro Web Editor allows remote attackers to execute arbitrary commands via the file parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the file parameter
CVE-2005-2112: Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) order parameter to edit.php or (2) cid parameter to comment_edit.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-2113: SQL injection vulnerability in the loginUser function in the XMLRPC server in XOOPS 2.0.11 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via crafted values in an XML file, as demonstrated using the blogger.getPost method.
Key phrases: execute arbitrary SQL commands, bypass authentication, execute arbitrary SQL commands and bypass authentication via, sql injection
CVE-2005-2114: Mozilla 1.7.8, Firefox 1.0.4, Camino 0.8.4, Netscape 8.0.2, and K-Meleon 0.9, and possibly other products that use the Gecko engine, allow remote attackers to cause a denial of service (application crash) via JavaScript that repeatedly calls an empty function.
Key phrases: denial of service (application crash), cause a denial of service (application crash, empty function
CVE-2005-2115: Soldier of Fortune II 1.02x and 1.03 allows remote attackers to cause a denial of service (server crash) via a large ID value in the ignore command, which is used as an array index and causes an out-of-bounds operation.
Key phrases: denial of service (server crash), cause a denial of service (server crash, large id value, out-of-bounds operation
CVE-2005-2117: Web View in Windows Explorer on Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 does not properly handle certain HTML characters in preview fields, which allows remote user-assisted attackers to execute arbitrary code.
Key phrases: execute arbitrary code
CVE-2005-2118: Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote user-assisted attackers to execute arbitrary commands via a crafted shortcut (.lnk) file with long font properties that lead to a buffer overflow when the user views the file's properties using Windows Explorer, a different vulnerability than CVE-2005-2122.
Key phrases: execute arbitrary commands, execute arbitrary commands via a crafted shortcut (, buffer overflow
CVE-2005-2119: The MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer.
Key phrases: overwrite arbitrary memory locations, overwrite arbitrary memory locations using an incorrect size, incorrect size value
CVE-2005-2120: Stack-based buffer overflow in the Plug and Play (PnP) service (UMPNPMGR.DLL) in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows remote or local authenticated attackers to execute arbitrary code via a large number of "\\\\" (backslash) characters in a registry key name, which triggers the overflow in a wsprintfW function call.
Key phrases: execute arbitrary code, execute arbitrary code via a large number of, stack-based buffer overflow, stack based buffer overflow
CVE-2005-2122: Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a different vulnerability than CVE-2005-2118.
Key phrases: execute arbitrary commands, execute arbitrary commands via a shortcut (.lnk, buffer overflow
CVE-2005-2123: Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile (WMF) and Enhanced Metafile (EMF) format images that lead to heap-based buffer overflows, as demonstrated using MRBP16::bCheckRecord.
Key phrases: execute arbitrary code, execute arbitrary code via crafted Windows Metafile (, integer overflows, heap-based buffer overflows, heap based buffer overflow
CVE-2005-2124: Unspecified vulnerability in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1, related to "An unchecked buffer" and possibly buffer overflows, allows remote attackers to execute arbitrary code via a crafted Windows Metafile (WMF) format image, aka "Windows Metafile Vulnerability."
Key phrases: execute arbitrary code, execute arbitrary code via a crafted Windows Metafile, unspecified, unchecked buffer, buffer overflows, windows metafile, unspecified vulnerability
CVE-2005-2126: The FTP client in Windows XP SP1 and Server 2003, and Internet Explorer 6 SP1 on Windows 2000 SP4, when "Enable Folder View for FTP Sites" is enabled and the user manually initiates a file transfer, allows user-assisted, remote FTP servers to overwrite files in arbitrary locations via crafted filenames.
Key phrases: overwrite files in arbitrary locations via crafted filenames
CVE-2005-2127: Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability."
Key phrases: execute arbitrary code, denial of service (application crash), cause a denial of service (application crash, heap corruption, uninitialized memory
CVE-2005-2128: QUARTZ.DLL in Microsoft Windows Media Player 9 allows remote attackers to write a null byte to arbitrary memory via an AVI file with a crafted strn element with a modified length value.
Key phrases: write a null byte to arbitrary memory via
CVE-2005-2132: RPC portmapper (rpcbind) in SCO UnixWare 7.1.1 m5, 7.1.3 mp5, and 7.1.4 mp2 allows remote attackers or local users to cause a denial of service (lack of response) via multiple invalid portmap requests.
Key phrases: denial of service (lack of response), cause a denial of service (lack of, invalid portmap requests
CVE-2005-2134: The (1) clcs and (2) emuxki drivers in NetBSD 1.6 through 2.0.2 allow local users to cause a denial of service (kernel crash) by using the set-parameters ioctl on an audio device to change the block size and set the pause state to "unpaused" in the same ioctl, which causes a divide-by-zero error.
Key phrases: denial of service (kernel crash), cause a denial of service (kernel crash
CVE-2005-2135: SQL injection vulnerability in verify.asp in EtoShop Dynamic Biz Website Builder (QuickWeb) 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) T1 or (2) T2 parameters.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the (1, sql injection
CVE-2005-2136: Raritan Dominion SX (DSX) Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 set (1) world-readable permissions for /etc/shadow and (2) world-writable permissions for /bin/busybox, which allows local users to obtain hashed passwords or execute arbitrary code as other users.
Key phrases: execute arbitrary code, obtain hashed passwords, obtain hashed passwords or execute arbitrary code as, world-readable permissions, world-writable permissions
CVE-2005-2137: Unknown vulnerability in NateOn Messenger 3.0 allows remote attackers to list arbitrary directories via unknown attack vectors.
Key phrases: list arbitrary directories, list arbitrary directories via unknown attack vectors
CVE-2005-2138: Cross-site scripting (XSS) vulnerability in index.php in Comdev eCommerce 3.0 and 3.1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the onMouseOver event of an "A" tag in a review message.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via Javascript, cross-site scripting (xss)
CVE-2005-2139: PHP remote file inclusion vulnerability in user_check.php for Pavsta Auto Site allows remote attackers to execute arbitrary PHP code via the sitepath parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the sitepath parameter, php remote file inclusion, arbitrary php code
CVE-2005-2140: Directory traversal vulnerability in default.asp for FSboard 2.0 allows remote attackers to read arbitrary files via ".." sequences in the filename parameter.
Key phrases: read arbitrary files, read arbitrary files via ".." sequences, directory traversal
CVE-2005-2141: TCP Chat 1.0 allows remote attackers to cause a denial of service (crash) via a long string to the chat service, possibly triggering a buffer overflow.
Key phrases: denial of service (crash), cause a denial of service (crash), buffer overflow
CVE-2005-2142: Directory traversal vulnerability in Golden FTP Server 2.60 allows remote authenticated attackers to list arbitrary directories via a "\\\\.."  (backslash dot dot) in an LS (LIST) command.
Key phrases: list arbitrary directories, list arbitrary directories via a "\\\\.., directory traversal
CVE-2005-2143: Microsoft Front Page allows attackers to cause a denial of service (crash) via a crafted style tag in a web page.
Key phrases: denial of service (crash), cause a denial of service (crash)
CVE-2005-2144: Prevx Pro 2005 1.0 allows local users to bypass file protection and modify files by using MapViewOfFile to perform memory mapping on the file.
Key phrases: bypass file protection, bypass file protection and modify files by using
CVE-2005-2145: The kernel driver in Prevx Pro 2005 1.0 does not verify the source of certain messages, which allows local users to bypass protection by sending certain messages to the driver, as demonstrated by sending an "allow" message to bypass a warning message.
Key phrases: bypass protection, bypass a warning message, bypass protection by sending certain messages to the
CVE-2005-2146: SSH Tectia Server 4.3.1 and earlier, and SSH Secure Shell for Windows Servers, uses insecure permissions when generating the Secure Shell host identification key, which allows local users to access the key and spoof the server.
Key phrases: access the key and spoof the server, insecure permissions, spoofing
CVE-2005-2147: Trac before 0.8.4 allows remote attackers to read or upload arbitrary files via a full pathname in the id parameter to the (1) upload or (2) attachment viewer scripts.
Key phrases: upload arbitrary files, read or upload arbitrary files via a full
CVE-2005-2148: Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks, which allows remote attackers to execute arbitrary commands or SQL by sending a legitimate value in a POST request or cookie, then specifying the attack string in the URL, which causes the get_request_var function to return the wrong value in the $_REQUEST variable, which is cleansed while the original malicious $_GET value remains unmodified, as demonstrated in (1) graph_image.php and (2) graph.php.
Key phrases: execute arbitrary commands or SQL, execute arbitrary commands or SQL by sending a, common
CVE-2005-2149: config.php in Cacti 0.8.6e and earlier allows remote attackers to set the no_http_headers switch, then modify session information to gain privileges and disable the use of addslashes to conduct SQL injection attacks.
Key phrases: gain privileges, set the no_http_headers switch, addslashes, sql injection
CVE-2005-2150: Windows NT 4.0 and Windows 2000 before URP1 for Windows 2000 SP4 does not properly prevent NULL sessions from accessing certain alternate named pipes, which allows remote attackers to (1) list Windows services via svcctl or (2) read eventlogs via eventlog.
Key phrases: (1) list Windows services via svcctl, null sessions
CVE-2005-2151: spf.c in Courier Mail Server does not properly handle DNS failures when looking up Sender Policy Framework (SPF) records, which could allow attackers to cause memory corruption.
Key phrases: cause memory corruption, dns failures
CVE-2005-2152: SQL injection vulnerability in Geeklog before 1.3.11 allows remote attackers to execute arbitrary SQL commands via user comments for an article.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via user comments for, sql injection
CVE-2005-2153: SQL injection vulnerability in class.ticket.php in osTicket 1.3.1 beta and earlier allows remote attackers to execute arbitrary SQL commands via the ticket variable.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the ticket variable, sql injection
CVE-2005-2154: PHP local file inclusion vulnerability in (1) view.php and (2) open.php in osTicket 1.3.1 beta and earlier allows remote attackers to include and possibly execute arbitrary local files via the inc parameter.
Key phrases: include and possibly execute arbitrary local files via, php local file inclusion
CVE-2005-2155: PHP remote file inclusion vulnerability in EasyPHPCalendar 6.1.5 and earlier allows remote attackers to execute arbitrary code via the serverPath parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the serverPath parameter, php remote file inclusion
CVE-2005-2156: SQL injection vulnerability in news.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the prevnext parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the prevnext parameter, sql injection
CVE-2005-2157: PHP remote file inclusion vulnerability in survey.inc.php for nabopoll 1.2 allows remote attackers to execute arbitrary PHP code via the path parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the path parameter, php remote file inclusion, arbitrary php code
CVE-2005-2158: A regression error in the embedded HSQLDB in JBoss jBPM 2.0 allows remote attackers to execute arbitrary comands, a re-introduction of a vulnerability that was originally identified by CVE-2003-0845.
Key phrases: execute arbitrary comands, regression error
CVE-2005-2159: mshftp.dll in PlanetDNS PlanetFileServer 2.0.1.3 allows remote attackers to cause a denial of service (application crash) via a long request.
Key phrases: denial of service (application crash), cause a denial of service (application crash
CVE-2005-2160: IMail stores usernames and passwords in cleartext in a cookie, which allows remote attackers to obtain sensitive information.
Key phrases: obtain sensitive information, cleartext
CVE-2005-2161: Cross-site scripting (XSS) vulnerability in phpBB 2.0.16 allows remote attackers to inject arbitrary web script or HTML via nested [url] tags.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via nested, cross-site scripting (xss)
CVE-2005-2162: PHP remote file inclusion vulnerability in form.inc.php3 in MyGuestbook 0.6.1 allows remote attackers to execute arbitrary PHP code via the lang parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the lang parameter, php remote file inclusion, arbitrary php code
CVE-2005-2163: Cross-site scripting (XSS) vulnerability in index.php in AutoIndex PHP Script 1.5.2 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-2164: SQL injection vulnerability in Covide Groupware-CRM allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unknown attack vectors, sql injection
CVE-2005-2165: read.cgi in GlobalNoteScript allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameters.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-2005-2166: SQL injection vulnerability in index.php in Plague News System 0.6 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the cid parameter, sql injection
CVE-2005-2167: Cross-site scripting (XSS) vulnerability in index.php in Plague News System 0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the cid parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-2168: delete.php in Plague News System 0.6 and earlier allows remote unauthenticated attackers to delete news, comments, and shoutbox posts by modifying the id parameter.
Key phrases: delete news, id parameter
CVE-2005-2169: Directory traversal vulnerability in source.php in Quick & Dirty PHPSource Printer 1.1 and earlier allows remote attackers to read arbitrary files via ".../...//" sequences in the file parameter, which are reduced to "../" when PHPSource Printer uses a regular expression to remove "../" sequences.
Key phrases: read arbitrary files, read arbitrary files via ".../..., directory traversal
CVE-2005-2170: The LCF component (lcfd) in IBM Tivoli Management Framework Endpoint allows remote attackers to cause a denial of service (process exit and connection loss) by connecting to LCF and ending the connection without sending any data.
Key phrases: denial of service (process exit and connection loss), cause a denial of service (process exit
CVE-2005-2173: The Flag::validate and Flag::modify functions in Bugzilla 2.17.1 to 2.18.1 and 2.19.1 to 2.19.3 do not verify that the flag ID is appropriate for the given bug or attachment ID, which allows users to change flags on arbitrary bugs and obtain a bug summary via process_bug.cgi.
Key phrases: obtain a bug summary via process_bug.cgi., change flags on arbitrary bugs and obtain a
CVE-2005-2174: Bugzilla 2.17.x, 2.18 before 2.18.2, 2.19.x, and 2.20 before 2.20rc1 inserts a bug into the database before it is marked private, which introduces a race condition and allows attackers to access information about the bug via buglist.cgi before MySQL replication is complete.
Key phrases: access information about the bug via buglist.cgi before, race condition
CVE-2005-2175: The web interface for Lotus Notes mail automatically processes HTML in an attachment without prompting the user to save or open it, which makes it easier for remote attackers to conduct web-based attacks and steal cookies.
Key phrases: cookies, steal cookie
CVE-2005-2176: Novell NetMail automatically processes HTML in an attachment without prompting the user to save or open it, which makes it easier for remote attackers to conduct web-based attacks and steal cookies.
Key phrases: web-based, cookies, steal cookie
CVE-2005-2177: Net-SNMP 5.0.x before 5.0.10.2, 5.2.x before 5.2.1.2, and 5.1.3, when net-snmp is using stream sockets such as TCP, allows remote attackers to cause a denial of service (daemon hang and CPU consumption) via a TCP packet of length 1, which triggers an infinite loop.
Key phrases: denial of service (daemon hang and CPU consumption), cause a denial of service (daemon hang, cpu consumption, infinite loop
CVE-2005-2178: probe.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the olddat parameter.  NOTE: it is unclear which product or vendor this program is associated with, if any.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-2005-2179: PHP remote file inclusion vulnerability in BlogModel.php in Jaws 0.5.2 and earlier allows remote attackers to execute arbitrary PHP code via the path parameter.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code via the path parameter, php remote file inclusion, arbitrary php code
CVE-2005-2180: gen-index in GNATS 4.0, 4.1.0, and possibly earlier versions, when installed setuid, does not properly check files passed to the -o argument and opens the file with write access, which allows local users to overwrite arbitrary files.
Key phrases: overwrite arbitrary files, file write
CVE-2005-2181: Cisco 7940/7960 Voice over IP (VoIP) phones do not properly check the Call-ID, branch, and tag values in a NOTIFY message to verify a subscription, which allows remote attackers to spoof messages such as the "Messages waiting" message.
Key phrases: spoof messages such as the "Messages waiting, spoofing
CVE-2005-2182: Grandstream BudgeTone (BT) 100 Voice over IP (VoIP) phones do not properly check the Call-ID, branch, and tag values in a NOTIFY message to verify a subscription, which allows remote attackers to spoof messages such as the "Messages waiting" message.
Key phrases: spoof messages such as the "Messages waiting, spoofing
CVE-2005-2183: class.xmail.php in PhpXmail 0.7 through 1.1 does not properly handle large passwords, which prevents an error message from being returned and allows remote attackers to bypass authentication and gain unauthorized access.
Key phrases: bypass authentication, gain unauthorized access, bypass authentication and gain unauthorized access, large passwords
CVE-2005-2184: eRoom 6.x does not properly restrict files that can be attached, which allows remote attackers to execute arbitrary commands via a .lnk file.
Key phrases: execute arbitrary commands, execute arbitrary commands via a .lnk file
CVE-2005-2185: eRoom does not set an expiration for Cookies, which allows remote attackers to capture cookies and conduct replay attacks.
Key phrases: capture cookies and conduct replay attacks
CVE-2005-2186: Multiple cross-site scripting (XSS) vulnerabilities in McAfee IntruShield Security Management System allow remote authenticated users to inject arbitrary web script or HTML via the (1) thirdMenuName or (2) resourceName parameter to SystemEvent.jsp.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-2187: McAfee IntruShield Security Management System allows remote authenticated users to access the "Generate Reports" feature and modify alerts by setting the Access option to true, as demonstrated using the (1) fullAccess or (2) fullAccessRight parameter in reports-column-center.jsp, or (3) fullAccess parameter to SystemEvent.jsp.
Key phrases: access the "Generate Reports" feature and
CVE-2005-2188: McAfee IntruShield Security Management System obtains the user ID from the URL, which allows remote attackers to guess the Manager account and possibly gain privileges via a brute force attack.
Key phrases: gain privileges, guess the Manager account and possibly gain privileges, brute force
CVE-2005-2189: Lantronix SecureLinx console server running firmware 2.0 and 3.0 stores /etc/ssh under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as SSH private keys.
Key phrases: obtain sensitive information, obtain sensitive information such as SSH private keys, insufficient access control
CVE-2005-2190: Multiple SQL injection vulnerabilities in Comersus shopping cart allow remote attackers to execute arbitrary SQL commands via the (1) email parameter to comersus_optAffiliateRegistrationExec.asp or (2) idProduct parameter to comersus_optReviewReadExec.asp.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the (1, sql injection, arbitrary sql commands
CVE-2005-2191: Multiple cross-site scripting (XSS) vulnerabilities in Comersus shopping cart allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter to comersus_backoffice_listAssignedPricesToCustomer.asp or (2) message parameter to comersus_backoffice_message.asp.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-2192: SimplePHPBlog 0.4.0 stores password hashes in config/password.txt with insufficient access control, which allows remote attackers to obtain passwords via a brute force attack.
Key phrases: obtain passwords, obtain passwords via a brute force attack, insufficient access control
CVE-2005-2193: SQL injection vulnerability in the user profile edit module in profile.php for PunBB 1.2.5 and earlier allows remote attackers to execute arbitrary SQL statements via the temp array, which is not initialized before it is used and prevents the attacker-supplied portions of the array from being properly escaped.
Key phrases: execute arbitrary SQL statements, execute arbitrary SQL statements via the temp array, sql injection
CVE-2005-2194: Unspecified vulnerability in the Apple Mac OS X kernel before 10.4.2 allows remote attackers to cause a denial of service (kernel panic) via a crafted TCP packet, possibly related to source routing or loose source routing.
Key phrases: denial of service (kernel panic), cause a denial of service (kernel panic, unspecified, unspecified vulnerability
CVE-2005-2195: Apple Darwin Streaming Server 5.5 and earlier allows remote attackers to cause a denial of service (application crash) via a URL with a filename containing a .cgi extension and an MS-DOS device name such as AUX, CON, PRN, COM1, or LPT1, a different vulnerability than CVE-2003-0421 and CVE-2003-0502.
Key phrases: denial of service (application crash), cause a denial of service (application crash
CVE-2005-2196: The Apple AirPort card uses a default WEP key when not connected to a known or trusted network, which can cause it to automatically connect to a malicious network.
Key phrases: default wep key
CVE-2005-2197: SQL injection vulnerability in sql.cls.php in Id Board 1.1.3 allows remote attackers to modify SQL queries, as demonstrated using the f parameter to index.php.
Key phrases: modify SQL queries, sql injection
CVE-2005-2198: PHP remote file inclusion vulnerability in lang.php in SPiD before 1.3.1 allows remote attackers to execute arbitrary code via the lang_path parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the lang_path parameter, php remote file inclusion
CVE-2005-2199: PHP remote file inclusion vulnerability in inc/functions.inc.php in PPA web photo gallery 0.5.6 allows remote attackers to execute arbitrary code via the config[ppa_root_path] variable.
Key phrases: execute arbitrary code, execute arbitrary code via the config[ppa_root_path] variable, php remote file inclusion
CVE-2005-2200: Multiple unknown vulnerabilities in the MicroServer Web Server for Xerox WorkCentre Pro Color 2128, 2636, and 3545, version 0.001.04.044 through 0.001.04.504, allow attackers to bypass authentication.
Key phrases: bypass authentication, multiple unknown
CVE-2005-2201: Unknown vulnerability in the MicroServer Web Server for Xerox WorkCentre Pro Color 2128, 2636, and 3545, version 0.001.04.044 through 0.001.04.504, allow attackers to cause a denial of service or access files via crafted HTTP requests.
Key phrases: cause a denial of service or access files, unknown
CVE-2005-2202: Cross-site scripting (XSS) vulnerability in the MicroServer Web Server for Xerox WorkCentre Pro Color 2128, 2636, and 3545, version 0.001.04.044 through 0.001.04.504, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unknown, cross-site scripting (xss), unknown vectors
CVE-2005-2203: login.php in phpWishlist before 0.1.15 allows remote attackers to bypass authentication via a direct request to admin.php.
Key phrases: bypass authentication, bypass authentication via a direct request to admin.php
CVE-2005-2204: Cross-site scripting (XSS) vulnerability in Computer Associates (CA) eTrust SiteMinder 5.5, when the "CSSChecking" parameter is set to "NO," allows remote attackers to inject arbitrary web script or HTML via the (1) PASSWORD or (2) BUFFER parameters to smpwservicescgi.exe, (3) the TARGET parameter to login.fcc, and possibly other vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-2205: The ReadLog function in kaiseki.cgi in pngren allows remote attackers to execute arbitrary commands via shell metacharacters in the query string.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in the
CVE-2005-2206: Multiple SQL injection vulnerabilities in CartWIZ allow remote attackers to modify SQL statements via the (1) idProduct parameter to tellAFriend.asp, (2) sortType parameter to viewSupportTickets.asp, or the id parameter to (3) updateCreditCards.asp or (4) deleteCreditCards.asp.
Key phrases: modify SQL statements via the (1), sql injection
CVE-2005-2207: Cross-site scripting (XSS) vulnerability in store/login.asp in CartWIZ allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-2208: PrivaShare 1.1b allows remote attackers to cause a denial of service (crash) via a malformed message.
Key phrases: denial of service (crash), cause a denial of service (crash), malformed message
CVE-2005-2209: Capturix ScanShare 1.06 build 50 stores sensitive information such as the password in cleartext in capturixss_cfg.ini, which is readable by local users.
Key phrases: cleartext, sensitive information
CVE-2005-2210: Stack-based buffer overflow in Internet Download Manager 4.05 allows remote attackers to execute arbitrary code via a long URL.
Key phrases: execute arbitrary code, execute arbitrary code via a long URL, stack-based buffer overflow, stack based buffer overflow
CVE-2005-2211: Backup Manager 0.5.8a creates temporary files insecurely, which allows local users to conduct unauthorized file operations when a user is burning a CDR.
Key phrases: conduct unauthorized file operations when a user is
CVE-2005-2212: Backup Manager 0.5.8a creates an archive repository with world readable and writable permissions, which allows attackers to modify or read the repository.
Key phrases: modify or read the repository, world readable and writable permissions
CVE-2005-2213: Buffer overflow in the mms_interp_header function in mms.c in MMS Ripper before 0.6.4 might allow remote attackers to execute arbitrary code via a file with more than 20 streams.
Key phrases: execute arbitrary code, execute arbitrary code via a file with more, buffer overflow
CVE-2005-2214: apt-setup in Debian GNU/Linux installs the apt.conf file with insecure permissions, which allows local users to obtain sensitive information such as passwords.
Key phrases: obtain sensitive information, obtain sensitive information such as passwords, insecure permissions
CVE-2005-2215: Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.x before 1.4.6 and 1.5 before 1.5beta3 allows remote attackers to inject arbitrary web script or HTML via a parameter in the page move template, a different vulnerability than CVE-2005-1888.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2005-2216: PHP remote file inclusion vulnerability in gals.php in PhotoGal Photo Gallery 1.5 and earlier allows remote attackers to execute arbitrary code via the news_file parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the news_file parameter, php remote file inclusion
CVE-2005-2217: Dansie Shopping Cart stores the vars.dat file under the web root with insufficient access control, which might allow remote attackers to obtain sensitive information such as program variables.
Key phrases: obtain sensitive information, obtain sensitive information such as program variables, insufficient access control
CVE-2005-2218: The device file system (devfs) in FreeBSD 5.x does not properly check parameters of the node type when creating a device node, which makes hidden devices available to attackers, who can then bypass restrictions on a jailed process.
Key phrases: bypass restrictions, hidden devices
CVE-2005-2219: Hosting Controller 6.1 Hotfix 2.1 allows remote authenticated users to perform unauthorized actions, such as modifying the credit limit, via a direct request to AccountActions.asp and modifying the CreditLimit parameter in an UpdateCreditLimit action.
Key phrases: perform unauthorized actions
CVE-2005-2220: Dragonfly Commerce allows remote attackers to change a product price by modifying the x_DragonflyCartProductPrice hidden field to (1) dc_Categorieslist.asp, (2) dc_Categoriesview.asp, (3) dc_productslist.asp, and (4) dc_productslist_Clearance.asp.  NOTE: the vendor has disputed this issue, saying that "Dragonfly Commerce does not allow for editing prices nor does it allow for viewing information about clients stored in the database except by the store owner and authorized staff as appointed in the store administration."  However, SecurityTracker claims that they have been able to confirm the problem
Key phrases: change a product price by modifying the x_DragonflyCartProductPrice, confirm the problem
CVE-2005-2221: Multiple SQL injection vulnerabilities in Dragonfly Commerce allows remote attackers to modify SQL statements and possibly execute arbitrary SQL commands via the (1) key parameter to dc_Categoriesview.asp, (2) dc_productslist_Clearance.asp, (3) PID parameter to ratings.asp, (4) dc_Productsview.asp, (5) start, (6) key_mp, (7) searchtype, or (8) psearch parameters to dc_forum_Postslist.asp.  NOTE: the vendor has disputed this issue, saying that the error messages arise from invalid category and product numbers.  Assuming that this is the case, the issue still satisfies the CVE definition of "exposure.
Key phrases: execute arbitrary SQL commands, modify SQL statements and possibly execute arbitrary SQL, sql injection
CVE-2005-2222: Unknown vulnerability in the HTTPMail service in MailEnable Professional before 1.6 has unknown impact and attack vectors.
Key phrases: unknown, unknown impact
CVE-2005-2223: Unknown vulnerability in the SMTP service in MailEnable Standard before 1.9 and Professional before 1.6 allows remote attackers to cause a denial of service (crash) during authentication.
Key phrases: denial of service (crash), cause a denial of service (crash), unknown
CVE-2005-2224: aspnet_wp.exe in Microsoft ASP.NET web services allows remote attackers to cause a denial of service (CPU consumption from infinite loop) via a crafted SOAP message to an RPC/Encoded method.
Key phrases: denial of service (CPU consumption from infinite loop), cause a denial of service (CPU consumption
CVE-2005-2225: Microsoft MSN Messenger allows remote attackers to cause a denial of service via a plaintext message containing the ".pif" string, which is interpreted as a malicious file extension and causes users to be kicked from a group conversation. NOTE: it has been reported that Gaim is also affected, so this may be an issue in the protocol or MSN servers.
Key phrases: cause a denial of service via a plaintext
CVE-2005-2226: Microsoft Outlook Express 6.0 leaks the default news server account when a user responds to a "watched" conversation thread, which could allow remote attackers to obtain sensitive information.
Key phrases: obtain sensitive information, default news server account
CVE-2005-2227: Softiacom wMailserver 1.0 stores passwords in plaintext in the Darsite\\\\MAILSRV\\\\Admin key, which allows local users to gain administrator privileges.
Key phrases: gain administrator privileges, plaintext
CVE-2005-2228: Web Wiz Forums 7.9 and 8.0 allows remote attackers to view message titles of a hidden forum.
Key phrases: view message titles of a hidden forum
CVE-2005-2229: Blog Torrent 0.92 and earlier stores sensitive files under the web document root in the (1) data or (2) torrents directories with insufficient access control, which allows remote attackers to obtain sensitive information such as account names and password hashes, as demonstrated using data/newusers.
Key phrases: obtain sensitive information, obtain sensitive information such as account names and, insufficient access control
CVE-2005-2230: Electronic Mail Operator (elmo) 1.3.2-r1 and earlier creates the elmostats temporary file insecurely, which allows local users to overwrite arbitrary files.
Key phrases: overwrite arbitrary files
CVE-2005-2231: High Availability Linux Project Heartbeat 1.2.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2005-2232: Buffer overflow in invscout in IBM AIX 5.1.0 through 5.3.0 might allow local users to execute arbitrary code via a long command line argument.
Key phrases: execute arbitrary code, execute arbitrary code via a long command line, buffer overflow
CVE-2005-2233: Buffer overflow in multiple "p" commands in IBM AIX 5.1, 5.2 and 5.3 might allow local users to execute arbitrary code via long command line arguments to (1) penable or other hard-linked files including (2) pdisable, (3) pstart, (4) phold, (5) pdelay, or (6) pshare.
Key phrases: execute arbitrary code, execute arbitrary code via long command line arguments, buffer overflow
CVE-2005-2234: Buffer overflow in the getlvname command in IBM AIX 5.1, 5.2 and 5.3, might allow local users to execute arbitrary code via long command line arguments.
Key phrases: execute arbitrary code, execute arbitrary code via long command line arguments, buffer overflow
CVE-2005-2235: Buffer overflow in the diagTasksWebSM command in IBM AIX 5.1, 5.2 and 5.3, might allow local users to execute arbitrary code via long command line arguments.
Key phrases: execute arbitrary code, execute arbitrary code via long command line arguments, buffer overflow
CVE-2005-2236: Format string vulnerability in the paginit command in IBM AIX 5.3, and possibly other versions, might allow local users to execute arbitrary code via format strings in command line arguments.
Key phrases: execute arbitrary code, execute arbitrary code via format strings in command
CVE-2005-2237: Format string vulnerability in the swcons command in IBM AIX 5.3, and possibly other versions, might allow local users to execute arbitrary code via long command line arguments.
Key phrases: execute arbitrary code, execute arbitrary code via long command line arguments, format string
CVE-2005-2238: ftpd in IBM AIX 5.1, 5.2 and 5.3 allows remote authenticated users to cause a denial of service (port exhaustion and memory consumption) by using all ephemeral ports.
Key phrases: denial of service (port exhaustion and memory consumption), cause a denial of service (port exhaustion, ephemeral ports
CVE-2005-2239: oftpd 0.3.7 allows remote attackers to cause a denial of service via a USER command with a large number of null (\\\\0) characters.
Key phrases: cause a denial of service via a USER
CVE-2005-2240: xpvm.tcl in xpvm 1.2.5 allows local users to overwrite arbitrary files via a symlink attack on the xpvm.trace.$user temporary file.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on
CVE-2005-2241: Cisco CallManager (CCM) 3.2 and earlier, 3.3 before 3.3(5), 4.0 before 4.0(2a)SR2b, and 4.1 4.1 before 4.1(3)SR1 does not quickly time out Realtime Information Server Data Collection (RISDC) sockets, which results in a "resource leak" that allows remote attackers to cause a denial of service (memory and connection consumption) in RisDC.exe.
Key phrases: denial of service (memory and connection consumption), cause a denial of service (memory and, resource leak
CVE-2005-2242: Cisco CallManager (CCM) 3.2 and earlier, 3.3 before 3.3(5), 4.0 before 4.0(2a)SR2b, and 4.1 4.1 before 4.1(3)SR1 allows remote attackers to cause a denial of service (memory consumption and restart) via crafted packets to (1) the CTI Manager (ctimgr.exe) or (2) the CallManager (ccm.exe).
Key phrases: denial of service (memory consumption and restart), cause a denial of service (memory consumption
CVE-2005-2243: Memory leak in inetinfo.exe in Cisco CallManager (CCM) 3.2 and earlier, 3.3 before 3.3(5), 4.0 before 4.0(2a)SR2b, and 4.1 4.1 before 4.1(3)SR1, when Multi Level Admin (MLA) is enabled, allows remote attackers to cause a denial of service (memory consumption) via a large number of Admin Service Tool (AST) logins that fail.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption, memory leak
CVE-2005-2244: The aupair service (aupair.exe) in Cisco CallManager (CCM) 3.2 and earlier, 3.3 before 3.3(5), 4.0 before 4.0(2a)SR2b, and 4.1 4.1 before 4.1(3)SR1 allows remote attackers to execute arbitrary code or corrupt memory via crafted packets that trigger a memory allocation failure and lead to a buffer overflow.
Key phrases: execute arbitrary code, execute arbitrary code or corrupt memory via crafted, memory allocation failure, buffer overflow
CVE-2005-2245: Unknown vulnerability in F5 BIG-IP 9.0.2 through 9.1 allows attackers to "subvert the authentication of SSL transactions," via unknown attack vectors, possibly involving NATIVE ciphers.
Key phrases: "subvert the authentication of SSL transactions, unknown, unknown attack vectors
CVE-2005-2246: Multiple PHP remote file inclusion vulnerabilities in iPhotoAlbum 1.1 allow remote attackers to execute arbitrary code via the (1) doc_path parameter to getpage.php or (2) set_menu parameter to lib/static/header.php.
Key phrases: execute arbitrary code, execute arbitrary code via the (1), php remote file inclusion
CVE-2005-2247: Multiple unknown vulnerabilities in Moodle before 1.5.1 have unknown impact and attack vectors.
Key phrases: multiple unknown, unknown impact
CVE-2005-2248: Directory traversal vulnerability in DownloadProtect before 1.0.3 allows remote attackers to read files above the download folder.
Key phrases: read files above the download folder, directory traversal
CVE-2005-2249: Multiple unknown vulnerabilities in Jinzora 2.0.1 have unknown impact and attack vectors, possibly involving a PHP file inclusion vulnerability.
Key phrases: unknown impact, php file inclusion
CVE-2005-2250: Buffer overflow in Bluetooth FTP client (BTFTP) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary code via a long filename in an OBEX file share.
Key phrases: execute arbitrary code, execute arbitrary code via a long filename in, buffer overflow
CVE-2005-2251: PHP remote file inclusion vulnerability in secure.php in PHPSecurePages (phpSP) 0.28beta and earlier allows remote attackers to execute arbitrary code via the cfgProgDir parameter, a variant of CVE-2001-1468.
Key phrases: execute arbitrary code, execute arbitrary code via the cfgProgDir parameter, php remote file inclusion
CVE-2005-2252: PhpAuction 2.5 allows remote attackers to bypass authentication and gain privileges as another user by setting the PHPAUCTION_RM_ID cookie to the user ID.
Key phrases: bypass authentication, gain privileges, bypass authentication and gain privileges as another user
CVE-2005-2253: SQL injection vulnerability in PhpAuction 2.5 allow remote attackers to modify SQL queries via the category parameter to adsearch.php. NOTE: there is evidence that viewnews.php may not be part of the PhpAuction product, so it is not included in this description.
Key phrases: modify SQL queries via the category parameter to, sql injection
CVE-2005-2254: Multiple cross-site scripting (XSS) vulnerabilities in PhpAuction 2.5 allow remote attackers to inject arbitrary web script or HTML via the lan parameter to (1) index.php or (2) admin/index.php, or (3) the auction_id parameter to profile.php.  NOTE: there is evidence that viewnews.php and login.php may not be part of the PhpAuction product, so they are not included in this description.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-2255: Directory traversal vulnerability in PhpAuction 2.5 allows remote attackers to read arbitrary files, include local PHP files, or obtain sensitive path information via ".."  sequences in the lan parameter to (1) index.php or (2) admin/index.php.
Key phrases: read arbitrary files, obtain sensitive path information, directory traversal
CVE-2005-2256: Encoded directory traversal vulnerability in phpPgAdmin 3.1 to 3.5.3 allows remote attackers to access arbitrary files via "%2e%2e%2f" (encoded dot dot) sequences in the formLanguage parameter.
Key phrases: access arbitrary files, access arbitrary files via "%2e%2e%2f", encoded directory traversal
CVE-2005-2257: The saveProfile function in PhpSlash 0.8.0 allows remote attackers to modify arbitrary profiles and gain privileges by modifying the author_id parameter.
Key phrases: modify arbitrary profiles, gain privileges, modify arbitrary profiles and gain privileges by modifying
CVE-2005-2258: PHP remote file inclusion vulnerability in photolist.inc.php in Squito Gallery 1.33 allows remote attackers to execute arbitrary code via the photoroot parameter.
Key phrases: execute arbitrary code, execute arbitrary code via the photoroot parameter, php remote file inclusion
CVE-2005-2259: The dispallclosed2 function in dispallclosed.pl for multiple USANet Creations products, including (1) USANet Shopping Mall Software, (2) Domain Name Auction Software, (3) Standard Classified Ads Software, and (4) MakeBid Reverse Auction allows remote attackers to execute arbitrary code via shell metacharacters in the DISPCLOSED parameter.
Key phrases: execute arbitrary code, execute arbitrary code via shell metacharacters in the
CVE-2005-2260: The browser user interface in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 does not properly distinguish between user-generated events and untrusted synthetic events, which makes it easier for remote attackers to perform dangerous actions that normally could only be performed manually by the user.
Key phrases: user-generated events, untrusted synthetic events, dangerous actions
CVE-2005-2261: Firefox before 1.0.5, Thunderbird before 1.0.5, Mozilla before 1.7.9, Netscape 8.0.2, and K-Meleon 0.9 runs XBL scripts even when Javascript has been disabled, which makes it easier for remote attackers to bypass such protection.
Key phrases: bypass such protection, xbl scripts
CVE-2005-2262: Firefox 1.0.3 and 1.0.4, and Netscape 8.0.2, allows remote attackers to execute arbitrary code by tricking the user into using the "Set As Wallpaper" (in Firefox) or "Set as Background" (in Netscape) context menu on an image URL that is really a javascript: URL with an eval statement, aka "Firewalling."
Key phrases: execute arbitrary code, execute arbitrary code by tricking the user into, firewalling