yahoo-inc/cve-impacts huggingface dataset:
CVE-2005-3439: Multiple unspecified vulnerabilities in Oracle Database Server 10g up to 10.1.0.4.2 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB02, (2) DB03, and (3) DB05 in Change Data Capture; (4) DB07 in Data Pump Export; and (5) DB18, (6) DB19, (7) DB20, (8) DB21, (9) DB22, (10) DB23, (11) DB24, and (12) DB25 in the Spatial component.
Key phrases: unknown impact, oracle vuln#, unspecified, unspecified vulnerability
CVE-2005-3440: Unspecified vulnerability in Database Scheduler in Oracle Database Server 10g up to 10.1.0.3 has unknown impact and attack vectors, aka Oracle Vuln# DB08.
Key phrases: unspecified, unknown impact, oracle vuln#, unspecified vulnerability
CVE-2005-3441: Unspecified vulnerability in Intelligent Agent in Oracle Database Server 9i up to 9.0.1.5 has unknown impact and attack vectors, aka Oracle Vuln# DB14.
Key phrases: unspecified, unknown impact, oracle vuln#, unspecified vulnerability
CVE-2005-3442: Multiple unspecified vulnerabilities in Oracle Database Server 8i up to 10.1.0.4.2 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB09 in Export, (2) DB11 in Materialized Views, and (3) DB16 in Security Service.
Key phrases: unknown impact, oracle vuln#, unspecified, unspecified vulnerability
CVE-2005-3443: Unspecified vulnerability in the Spatial component in Oracle Database Server from 9i up to 10.1.0.3 has unknown impact and attack vectors, aka Oracle Vuln# DB17.
Key phrases: unspecified, unknown impact, oracle vuln#, unspecified vulnerability
CVE-2005-3444: Multiple unspecified vulnerabilities in the Programmatic Interface in Oracle Database Server from 8i up to 9.2.0.5 have unknown impact and attack vectors, aka Oracle Vuln# DB26.
Key phrases: unknown impact, oracle vuln#, unspecified, unspecified vulnerability
CVE-2005-3445: Multiple unspecified vulnerabilities in HTTP Server in Oracle Database Server 8i up to 10.1.0.4.2 and Application Server 1.0.2.2 up to 10.1.2.0 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB30 and AS03 or (2) DB31 and AS05.
Key phrases: unknown impact, unspecified, unspecified vulnerability
CVE-2005-3446: Unspecified vulnerability in Internet Directory in Oracle Database Server 9i up to 9.2.0.6 and Application Server 9.0.2.3 up to 10.1.2.0 has unknown impact and attack vectors, aka Oracle Vuln# DB32 and AS06.
Key phrases: unspecified, unknown impact, oracle vuln#, unspecified vulnerability
CVE-2005-3447: Unspecified vulnerability in Single Sign-On in Oracle Database Server 10g up to 10.1.0.4.2 and Application Server 9.0.2.3 up to 9.0.4.2 has unknown impact and attack vectors, aka Oracle Vuln# DB33 and AS08.
Key phrases: unspecified, unknown impact, oracle vuln#, unspecified vulnerability
CVE-2005-3448: Unspecified vulnerability in the OC4J Module in Oracle Application Server 9.0 up to 10.1.2.0.2 has unknown impact and attack vectors, as identified by Oracle Vuln# AS01.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2005-3449: Multiple unspecified vulnerabilities in Oracle Application Server 9.0 up to 10.1.2.0 have unknown impact and attack vectors, as identified by Oracle Vuln# (1) AS02 in Containers for J2EE, (2) AS07 in Internet Directory, (3) AS09 in Report Server, and (4) AS11 in Web Cache.
Key phrases: unknown impact, oracle vuln#, unspecified, unspecified vulnerability
CVE-2005-3450: Unspecified vulnerability in the HTTP Server in Oracle Application Server 1.0 up to 9.0.2.3 has unknown impact and attack vectors, as identified by Oracle Vuln# AS04.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2005-3451: Unspecified vulnerability in SQL*ReportWriter in Oracle Application Server 9.0 up to 9.0.2.1 has unknown impact and attack vectors, as identified by Oracle Vuln# AS10.
Key phrases: unspecified, unknown impact, oracle vuln#, unspecified vulnerability
CVE-2005-3452: Unspecified vulnerability in Web Cache in Oracle Application Server 1.0 up to 9.0.4.2 has unknown impact and attack vectors, as identified by Oracle Vuln# AS13.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2005-3453: Multiple unspecified vulnerabilities in Web Cache in Oracle Application Server 1.0 up to 10.1.2.0 has unknown impact and attack vectors, as identified by Oracle Vuln# (1) AS12 and (2) AS14.
Key phrases: unknown impact, unspecified, unspecified vulnerability
CVE-2005-3454: Multiple unspecified vulnerabilities in Oracle Collaboration Suite 10g Release 1 version 10.1.1 and 9i Release 2 9.0.4.2 have unknown impact and attack vectors, as identified by Oracle Vuln# (1) OCS01, (2) OCS02, (3) OCS03, and (4) OCS04 for Calendar; (5) OCS05, (6) OCS06, (7) OCS07, (8) OCS08, (9) OCS09, and (10) OCS10 for Email Server; and (11) OCS11, (12) OCS12, and (13) OCS13 for Oracle Files.
Key phrases: unknown impact, unspecified, unspecified vulnerability
CVE-2005-3455: Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5 up to 11.5.10 have unknown impact and attack vectors, as identified by Oracle Vuln# (1) APPS01 in Application Install; (2) APPS02 and (3) APPS03 in Application Object Library; (4) APPS05 and (5) APPS06 in Applications Technology Stack; (6) APPS07 in Applications Utilities; (7) APPS09, (8) APPS10, and (9) APPS11 in HRMS; (10) APPS12 in Mobile Application Foundation; (11) APPS13 in SDP Number Portability; (12) APPS14 in Oracle Service; (13) APPS15 in Service Fulfillment Manage, (14) APPS16 in Universal Work Queue; and (15) APPS20 in Workflow Cartridge.
Key phrases: unknown impact, oracle vuln#, unspecified, unspecified vulnerability
CVE-2005-3456: Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5 up to 11.5.9 have unknown impact and attack vectors, as identified by Oracle Vuln# (1) APPS04 in Application Object Library, and (2) APPS17, (3) APPS18, and (4) APPS21 in Workflow Cartridge.
Key phrases: unknown impact, oracle vuln#, unspecified, unspecified vulnerability
CVE-2005-3457: Unspecified vulnerability in Oracle E-Business Suite and Applications 11.0 up to 11.5.10 has unknown impact and attack vectors, as identified by Oracle Vuln# APPS08 in HRMS.
Key phrases: unspecified, unknown impact, oracle vuln#, unspecified vulnerability
CVE-2005-3458: Unspecified vulnerability in Oracle E-Business Suite and Applications 11.0 up to 11.5.9 has unknown impact and attack vectors, as identified by Oracle Vuln# APPS19 in Workflow Cartridge.
Key phrases: unspecified, unknown impact, oracle vuln#, unspecified vulnerability
CVE-2005-3459: Unspecified vulnerability in Oracle E-Business Suite and Applications 4.5 up to 4.5.1 has unknown impact and attack vectors, as identified by Oracle Vuln# APPS22 in Oracle Clinical.
Key phrases: unspecified, unknown impact, oracle vuln#, unspecified vulnerability
CVE-2005-3460: Unspecified vulnerability in Oracle Agent in Oracle Enterprise Manager 9.0.4.1 up to 10.1.0.4 has unknown impact and attack vectors, as identified by Oracle Vuln# EM01.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2005-3461: Unspecified vulnerability in PeopleTools in Oracle PeopleSoft Enterprise 8.42 up to 8.45.17 has unknown impact and attack vectors, as identified by Oracle Vuln# PSE01.
Key phrases: unspecified, unknown impact, oracle vuln#, unspecified vulnerability
CVE-2005-3462: Unspecified vulnerability in PeopleTools in Oracle PeopleSoft Enterprise 8.44 up to 8.46.02 has unknown impact and attack vectors, as identified by Oracle Vuln# PSE02.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2005-3463: Unspecified vulnerability in PeopleTools in Oracle PeopleSoft Enterprise 8.44 up to 8.46.03 has unknown impact and attack vectors, as identified by Oracle Vuln# PSE03.
Key phrases: unspecified, unknown impact, oracle vuln#, unspecified vulnerability
CVE-2005-3464: Unspecified vulnerability in PeopleTools in Oracle PeopleSoft Enterprise 8.44 up to 8.46 has unknown impact and attack vectors, as identified by Oracle Vuln# PSE04.
Key phrases: unspecified, unknown impact, oracle vuln#, unspecified vulnerability
CVE-2005-3465: Unspecified vulnerability in JDEdwards HTML Server in Oracle EnterpriseOne 8.94 OneWorld XE up to 8.95_B1, 8.94_Q1, and SP23_K1 has unknown impact and attack vectors, as identified by Oracle Vuln# JDE01.
Key phrases: unspecified, unknown impact, oracle vuln#, unspecified vulnerability
CVE-2005-3466: Unspecified vulnerability in Enterprise CRM Sales in Oracle 8.81 up to 8.9 has unknown impact and attack vectors, as identified by Oracle Vuln# CRM01.
Key phrases: unspecified, unknown impact, oracle vuln#, unspecified vulnerability
CVE-2005-3467: Serv-U FTP Server before 6.1.0.4 allows attackers to cause a denial of service (crash) via (1) malformed packets and possibly other unspecified issues with unknown impact and attack vectors including (2) use of "~" in a pathname, and (3) memory consumption of the daemon.  NOTE: it is not clear whether items (2) and above are vulnerabilities.
Key phrases: denial of service (crash), cause a denial of service (crash), malformed packets, unspecified issues, unknown impact, memory consumption of the daemon
CVE-2005-3468: Directory traversal vulnerability in F-Secure Anti-Virus for Microsoft Exchange 6.40 and Internet Gatekeeper 6.40 to 6.42 allows limited remote attackers to bypass Web Console authentication and read files.
Key phrases: bypass Web Console authentication, bypass Web Console authentication and read files, directory traversal
CVE-2005-3469: SQL injection vulnerability in index.php in News2Net 3.0.0.0 allows remote attackers to execute arbitrary SQL commands via the category parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the category parameter, sql injection
CVE-2005-3470: SQL injection vulnerability in in the authenticate function in MailWatch for MailScanner 1.0.2 allows remote attackers to execute arbitrary SQL commands.
Key phrases: execute arbitrary SQL commands, sql injection, arbitrary sql commands
CVE-2005-3471: Directory traversal vulnerability in the ruleset view for MailWatch for MailScanner 1.0.2 allows remote attackers to access arbitrary files.
Key phrases: access arbitrary files, directory traversal
CVE-2005-3472: Unspecified vulnerability in Sun Java System Communications Express 2005Q1 and 2004Q2 allows local and remote attackers to read sensitive information from configuration files.
Key phrases: read sensitive information from configuration files, unspecified, unspecified vulnerability
CVE-2005-3473: Multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog 0.4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) entry, (2) blog_subject, and (3) blog_text parameters (involving the temp_subject variable) in (a) preview_cgi.php and (b) preview_static_cgi.php, or (4) scheme_name parameter and (5) bg_color parameters (involving the preset_name and result variables) in (c) colors.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-3474: The aries.sys driver in Sony First4Internet XCP DRM software hides any file, registry key, or process with a name that starts with "$sys$", which allows attackers to hide activities on a system that uses XCP.
Key phrases: hide activities on a system that uses XCP
CVE-2005-3475: Hasbani Web Server (WindWeb) 2.0 allows remote attackers to cause a denial of service (infinite loop) via HTTP crafted GET requests.
Key phrases: denial of service (infinite loop), cause a denial of service (infinite loop
CVE-2005-3476: Unspecified vulnerability in HP OpenVMS Integrity 8.2-1 and 8.2, and OpenVMS Alpha 7.3-2 and 8.2, allows local users to cause a denial of service.
Key phrases: cause a denial of service, unspecified, unspecified vulnerability
CVE-2005-3477: Multiple interpretation error in the image upload handling code in Invision Gallery 2.0.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML or script in an image whose type does not match its extension, which is rendered by Internet Explorer due to CVE-2005-3312.  NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer and the proper fix should be in that browser; if so, then this should not be treated as a vulnerability in Invision Gallery.
Key phrases: conduct cross-site scripting (XSS), multiple interpretation error, design flaw
CVE-2005-3478: SQL injection vulnerability in index.php in PHPCafe.net Tutorials Manager 1.0 Beta 2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the id, sql injection
CVE-2005-3479: Cross-site scripting (XSS) vulnerability in login.asp in Ringtail CaseBook 6.1.0 allows remote attackers to inject arbitrary web script or HTML via the users parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-3480: login.asp in Ringtail CaseBook 6.1.0 displays different error messages depending on whether a user exists or not, which allows remote attackers to determine valid usernames.
Key phrases: determine valid usernames
CVE-2005-3481: Cisco IOS 12.0 to 12.4 might allow remote attackers to execute arbitrary code via a heap-based buffer overflow in system timers. NOTE: this issue does not correspond to a specific vulnerability, rather a general weakness that only increases the feasibility of exploitation of any vulnerabilities that might exist.  Such design-level weaknesses normally are not included in CVE, so perhaps this issue should be REJECTed.
Key phrases: execute arbitrary code, execute arbitrary code via a heap-based, heap-based buffer overflow, specific, general weakness, feasibility of exploitation, design-level weaknesses, heap based buffer overflow
CVE-2005-3482: Cisco 1200, 1131, and 1240 series Access Points, when operating in Lightweight Access Point Protocol (LWAPP) mode and controlled by 2000 and 4400 series Airespace WLAN controllers running 3.1.59.24, allow remote attackers to send unencrypted traffic to a secure network using frames with the MAC address of an authenticated end host.
Key phrases: send unencrypted traffic to a secure network using
CVE-2005-3483: Buffer overflow in GO-Global for Windows 3.1.0.3270 and earlier allows remote attackers to execute arbitrary code via a data block that is longer than the specified data block size.
Key phrases: execute arbitrary code, execute arbitrary code via a data block that, buffer overflow
CVE-2005-3484: Directory traversal vulnerability in NeroNET 1.2.0.2 and earlier allows remote attackers to read arbitrary files with certain file extensions (such as ZIP, AVI, JPG, TXT, and HTML) via ".." and hex-encoded (1) slash "/" ("%2f") or (2) backslash "\\\\" ("%5c") sequences.
Key phrases: read arbitrary files, read arbitrary files with certain file extensions (, directory traversal
CVE-2005-3485: Buffer overflow in Glider Collect'n kill 1.0.0.0 allows remote attackers to execute arbitrary code via a gl_playerEnter command with a long player name.
Key phrases: execute arbitrary code, execute arbitrary code via a gl_playerEnter command with, buffer overflow
CVE-2005-3486: Multiple format string vulnerabilities in Scorched 3D 39.1 (bf) and earlier allow remote attackers to execute arbitrary code via various (1) GLConsole::addLine, (2) ServerCommon::sendString, (3) ServerCommon::serverLog functions, and possibly other unspecified vectors.
Key phrases: execute arbitrary code, execute arbitrary code via various (1), multiple format string, unspecified vectors
CVE-2005-3487: Multiple buffer overflows in Scorched 3D 39.1 (bf) and earlier allow remote attackers to execute arbitrary code via various (1) GLConsole::addLine, (2) ServerCommon::sendString, (3) ServerCommon::serverLog functions, (4) a long command that is not properly handled in ComsMessageHandler.cpp when generating an error message, (5) a long UniqueID value in Logger.cpp, and possibly other unspecified vectors.
Key phrases: execute arbitrary code, execute arbitrary code via various (1), multiple buffer overflows, unspecified vectors
CVE-2005-3488: Scorched 3D 39.1 (bf) and earlier allows remote attackers to cause a denial of service (long loop and server hang) via a negative numplayers value that bypasses a signed check in ServerConnectHandler.cpp.
Key phrases: denial of service (long loop and server hang), cause a denial of service (long loop, negative numplayers value, signed check
CVE-2005-3489: Buffer overflow in Asus Video Security 3.5.0.0 and earlier, when using authorization, allows remote attackers to execute arbitrary code via a long username/password string.
Key phrases: execute arbitrary code, execute arbitrary code via a long username/, buffer overflow
CVE-2005-3490: Directory traversal vulnerability in the web server in Asus Video Security 3.5.0.0 and earlier allows remote attackers to read arbitrary files via "../" or "..\\\\" sequences in the URL.
Key phrases: read arbitrary files, read arbitrary files via "../", directory traversal
CVE-2005-3491: Multiple buffer overflows in the receiver function in loop.c in FlatFrag 0.3 and earlier allow remote attackers to execute arbitrary code via the (1) version, (2) name, and (3) model fields.
Key phrases: execute arbitrary code, execute arbitrary code via the (1), buffer overflows
CVE-2005-3492: FlatFrag 0.3 and earlier allows remote attackers to cause a denial of service (crash) by sending an NT_CONN_OK command from a client that is not connected, which triggers a null dereference.
Key phrases: denial of service (crash), cause a denial of service (crash), null dereference
CVE-2005-3493: Battle Carry .005 and earlier allows remote attackers to cause a denial of service (inaccessible port) via a large packet, which triggers a socket error and terminates the socket that is listening on the server's UDP port.
Key phrases: denial of service (inaccessible port), cause a denial of service (inaccessible port, socket error
CVE-2005-3494: Cross-site scripting (XSS) vulnerability in Ar-blog 5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a blog comment.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2005-3495: Ar-blog 5.2 and earlier allows remote attackers to bypass authentication by modifying cookies.
Key phrases: bypass authentication, bypass authentication by modifying cookies
CVE-2005-3496: Cross-site scripting (XSS) vulnerability in PHP Handicapper allows remote attackers to inject arbitrary web script or HTML via the msg parameter to msg.php.  NOTE: some sources identify a second vector in the login parameter to process_signup.php, but the original source says that it is for CRLF injection (CVE-2005-4712).  Also note: the vendor has disputed CVE-2005-3497, and it is possible that the dispute was intended to include this issue as well.  If so, followup investigation strongly suggests that the original report is correct.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss), crlf injection
CVE-2005-3497: SQL injection vulnerability in process_signup.php in PHP Handicapper allows remote attackers to execute arbitrary SQL commands via the serviceid parameter.  NOTE: on 20060210, the vendor disputed this issue, saying "this is 100% false reporting, this is a slander campaign from a customer who had a vulnerability in his SERVER not the software."  However, followup investigation strongly suggests that the original report is correct
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the serviceid parameter, sql injection
CVE-2005-3498: IBM WebSphere Application Server 5.0.x before 5.02.15, 5.1.x before 5.1.1.8, and 6.x before fixpack V6.0.2.5, when session trace is enabled, records a full URL including the queryString in the trace logs when an application encodes a URL, which could allow attackers to obtain sensitive information.
Key phrases: obtain sensitive information
CVE-2005-3499: Frisk F-Prot Antivirus allows remote attackers to bypass protection via a ZIP file with a version header greater than 15, which prevents F-Prot from decompressing and analyzing the file.
Key phrases: bypass protection, bypass protection via a ZIP file with a
CVE-2005-3500: The tnef_attachment function in tnef.c for Clam AntiVirus (ClamAV) before 0.87.1 allows remote attackers to cause a denial of service (infinite loop and memory exhaustion) via a crafted value in a CAB file that causes ClamAV to repeatedly scan the same block.
Key phrases: denial of service (infinite loop and memory exhaustion), cause a denial of service (infinite loop
CVE-2005-3501: The cabd_find function in cabd.c of the libmspack library (mspack) for Clam AntiVirus (ClamAV) before 0.87.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted CAB file that causes cabd_find to be called with a zero length.
Key phrases: denial of service (infinite loop), cause a denial of service (infinite loop, zero length
CVE-2005-3502: attachment_send.php in Cerberus Helpdesk allows remote attackers to view attachments and tickets of other users via a modified file_id parameter.
Key phrases: view attachments and tickets of other users via, modified file_id parameter
CVE-2005-3503: chfn in pwdutils 3.0.4 and earlier on SuSE Linux, and possibly other operating systems, does not properly check arguments for the GECOS field, which allows local users to gain privileges.
Key phrases: gain privileges
CVE-2005-3504: Buffer overflow in swcons in IBM AIX 5.2, when debug malloc is enabled, allows remote attackers to cause a core dump and possibly execute arbitrary code.
Key phrases: execute arbitrary code, cause a core dump and possibly execute arbitrary, buffer overflow
CVE-2005-3505: Cross-site scripting (XSS) vulnerability in the Entropy Chat script in cPanel 10.2.0-R82 and 10.6.0-R137 allows remote attackers to inject arbitrary web script or HTML via a chat message containing Javascript in style attributes in tags such as <b>, which are processed by Internet Explorer.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2005-3506: Cross-site scripting (XSS) vulnerability in proxy.asp in Sambar Server 6.3 BETA 2 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via the (1) Remote Proxy Server or (2) Proxy Filter IPs field.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-3507: Directory traversal vulnerability in CuteNews 1.4.1 allows remote attackers to include arbitrary files, execute code, and gain privileges via "../" sequences in the template parameter to (1) show_archives.php and (2) show_news.php.
Key phrases: include arbitrary files, gain privileges, directory traversal, execute code
CVE-2005-3508: SQL injection vulnerability in showGallery.php in Gallery (Galerie) 2.4 allows remote attackers to execute arbitrary SQL commands via the galid parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the galid parameter, sql injection
CVE-2005-3509: Multiple SQL injection vulnerabilities in JPortal allow remote attackers to execute arbitrary SQL commands via (1) banner.php or the id parameter to (2) print.php, (3) comment.php, and (4) news.php.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via (1), sql injection, arbitrary sql commands
CVE-2005-3510: Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, cpu consumption
CVE-2005-3511: Multiple cross-site scripting (XSS) vulnerabilities in Spymac Web OS 4.0 allow remote attackers to inject arbitrary web script or HTML via (a) the blogs module, including the (1) curr parameter in index.php, (2) inspire, (3) system, or (4) title parameter in blog_newentry.php, (5) entry parameter in blog_newentry_comment.php, (6) entry parameter in blog_edit_entry.php, or (7) caldate parameter in blog.php; and (b) the notes module, including the (1) forwardid parameter in a noteform action; (2) del_folder parameter in a delete_folder action; (3) isread, (4) dateorder, (5) subjectorder, (6) curr, (7) fromorder, or (8) action parameters; (9) ppp or (10) totalreplies parameter in an Inbox action; (11) totalnotes parameter; or (12) touserid parameter in a noteform action.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via (, cross-site scripting (xss)
CVE-2005-3512: Cross-site scripting (XSS) vulnerability in index.php in VUBB alpha rc1 allows remote attackers to inject arbitrary web script or HTML via the t parameter in a newreply action.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-3513: index.php in VUBB alpha rc1 allows remote attackers to obtain the installation path of the application via a viewforum action with the f parameter set to a single quote (').
Key phrases: obtain the installation path of the application via
CVE-2005-3514: Multiple cross-site scripting (XSS) vulnerabilities in Chipmunk Forum script allow remote attackers to inject arbitrary web script or HTML via the forumID parameter to (1) newtopic.php, (2) quote.php, (3) index.php, and (4) reply.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-3515: Cross-site scripting (XSS) vulnerability in recommend.php in Chipmunk Topsites script allows remote attackers to inject arbitrary web script or HTML via the ID parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-3516: Cross-site scripting (XSS) vulnerability in recommend.php in Chipmunk Directory script allows remote attackers to inject arbitrary web script or HTML via the entryID parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-3517: Chipmunk Scripts Guestbook allows remote attackers to obtain the installation path of the script via a URL that causes an error message to be displayed, such as a URL that contains a single quote (') in the start parameter of index.php.
Key phrases: obtain the installation path of the script via
CVE-2005-3518: SQL injection vulnerability in search.php in PunBB 1.2.7 and 1.2.8 allows remote attackers to execute arbitrary SQL commands via the old_searches parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the old_searches parameter, sql injection, arbitrary sql commands
CVE-2005-3519: Multiple PHP file inclusion vulnerabilities in MySource 2.14.0 allow remote attackers to execute arbitrary PHP code and include arbitrary local files via the (1) INCLUDE_PATH and (2) SQUIZLIB_PATH parameters in new_upgrade_functions.php, (3) the INCLUDE_PATH parameter in init_mysource.php, and the PEAR_PATH parameter in (4) Socket.php, (5) Request.php, (6) Mail.php, (7) Date.php, (8) Span.php, (9) mimeDecode.php, and (10) mime.php.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code and include arbitrary local, php file inclusion, arbitrary php code
CVE-2005-3520: Multiple cross-site scripting (XSS) vulnerabilities in MySource 2.14.0 allow remote attackers to inject arbitrary web script or HTML via (1) the target_url parameter in upgrade_in_progress_backend.php, (2) the stylesheet parameter in edit_table_cell_type_wysiwyg.php, and the bgcolor parameter in (3) insert_table.php, (4) edit_table_cell_props.php, (5) header.php, (6) edit_table_row_props.php, and (7) edit_table_props.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via (, cross-site scripting (xss)
CVE-2005-3521: SQL injection vulnerability in resetcore.php in e107 0.617 through 0.6173 allows remote attackers to execute arbitrary SQL commands, bypass authentication, and inject HTML or script via the (1) a_name parameter or (2) user field of the login page.
Key phrases: execute arbitrary SQL commands, bypass authentication, sql injection
CVE-2005-3522: Cross-site scripting (XSS) vulnerability in index.jsp in ManageEngine Netflow Analyzer 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the grDisp parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-3523: Format string vulnerability in friendsd2 in GpsDrive allows remote attackers to execute arbitrary code via the dir (direction) field.
Key phrases: execute arbitrary code, execute arbitrary code via the dir (direction, format string
CVE-2005-3524: Buffer overflow in the SSL-ready version of linux-ftpd (linux-ftpd-ssl) 0.17 allows remote attackers to execute arbitrary code by creating a long directory name, then executing the XPWD command.
Key phrases: execute arbitrary code, execute arbitrary code by creating a long directory, buffer overflow
CVE-2005-3525: Stack-based buffer overflow in an ActiveX control for the installer for Adobe Macromedia Shockwave Player 10.1.0.11 and earlier allows remote attackers to execute arbitrary code via crafted large values for unspecified parameters.
Key phrases: execute arbitrary code, execute arbitrary code via crafted large values for, stack-based buffer overflow, stack based buffer overflow, unspecified
CVE-2005-3526: Buffer overflow in the IMAP daemon in Ipswitch Collaboration Suite 2006.02 and earlier allows remote authenticated users to execute arbitrary code via a long FETCH command.
Key phrases: execute arbitrary code, execute arbitrary code via a long FETCH command, buffer overflow
CVE-2005-3527: Race condition in do_coredump in signal.c in Linux kernel 2.6 allows local users to cause a denial of service by triggering a core dump in one thread while another thread has a pending SIGSTOP.
Key phrases: cause a denial of service by triggering a, race condition
CVE-2005-3528: Cross-site scripting (XSS) vulnerability in tiki-view_forum_thread.php in TikiWiki 1.9.0 through 1.9.2 allows remote attackers to inject arbitrary web script or HTML via the topics_offset parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-3529: tiki-view_forum_thread.php in TikiWiki 1.9.0 through 1.9.2 allows remote attackers to obtain the installation path via an invalid topics_sort_mode parameter, possibly related to an SQL injection vulnerability.
Key phrases: obtain the installation path via an invalid topics_sort_mode parameter, sql injection
CVE-2005-3530: Cross-site scripting (XSS) vulnerability in Antville 1.1 allows remote attackers to inject arbitrary web script or HTML via the notfound.skin error document.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-3531: fusermount in FUSE before 2.4.1, if installed setuid root, allows local users to corrupt /etc/mtab and possibly modify mount options by performing a mount over a directory whose name contains certain special characters.
Key phrases: corrupt /etc/mtab and possibly modify mount, setuid root
CVE-2005-3532: authpam.c in courier-authdaemon for Courier Mail Server 0.37.3 through 0.52.1, when using pam_tally, does not call the pam_acct_mgmt function to verify that access should be granted, which allows attackers to authenticate to the server using accounts that have been disabled.
Key phrases: authenticate to the server using accounts that have
CVE-2005-3533: Buffer overflow in OSH before 1.7-15 allows local users to execute arbitrary code via a long current working directory and filename.
Key phrases: execute arbitrary code, execute arbitrary code via a long current working, buffer overflow
CVE-2005-3534: Buffer overflow in the Network Block Device (nbd) server 2.7.5 and earlier, and 2.8.0 through 2.8.2, allows remote attackers to execute arbitrary code via a large request, which is written past the end of the buffer because nbd does not account for memory taken by the reply header.
Key phrases: execute arbitrary code, execute arbitrary code via a large request, buffer overflow
CVE-2005-3535: Buffer overflow in KETM 0.0.6 allows local users to execute arbitrary code via unknown vectors.
Key phrases: execute arbitrary code, execute arbitrary code via unknown vectors, buffer overflow
CVE-2005-3536: SQL injection vulnerability in phpBB 2 before 2.0.18 allows remote attackers to execute arbitrary SQL commands via the topic type.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the topic type, sql injection
CVE-2005-3537: A "missing request validation" error in phpBB 2 before 2.0.18 allows remote attackers to edit private messages of other users, probably by modifying certain parameters or other inputs.
Key phrases: edit private messages of other users, missing request validation error
CVE-2005-3538: hfaxd in HylaFAX 4.2.3, when PAM support is disabled, accepts arbitrary passwords, which allows remote attackers to gain privileges.
Key phrases: accepts arbitrary passwords, gain privileges
CVE-2005-3539: Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via (1) the notify script in HylaFAX 4.2.0 to 4.2.3 and (2) crafted CallID parameters to the faxrcvd script in HylaFAX 4.2.2 and 4.2.3.
Key phrases: execute arbitrary commands, execute arbitrary commands via (1) the, multiple eval injection
CVE-2005-3540: Buffer overflow in petris before 1.0.1 allows remote attackers to execute arbitrary code via unspecified attack vectors.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified attack vectors, buffer overflow
CVE-2005-3543: SQL injection vulnerability in search.php in Phorum 5.0.0alpha through 5.0.20, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the forum_ids parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the forum_ids parameter, sql injection
CVE-2005-3544: Cross-site scripting (XSS) vulnerability in u2u.php in XMB 1.9.3 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-3545: SQL injection vulnerability in index.php of the report module in ibProArcade 2.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the user parameter, sql injection, arbitrary sql commands
CVE-2005-3546: suid.cgi scripts in F-Secure (1) Internet Gatekeeper for Linux before 2.15.484 and (2) Anti-Virus Linux Gateway before 2.16 are installed SUID with world-executable permissions, which allows local users to gain privilege.
Key phrases: gain privilege, suid, gain privileges
CVE-2005-3547: Cross-site scripting (XSS) vulnerability in Invision Power Board 2.1 allows remote attackers to inject arbitrary web script or HTML via the (1) adsess, (2) name, and (3) description parameters in admin.php, and the (4) ACP Notes, (5) Member Name, (6) Password, (7) Email Address, (8) Components, and multiple other input fields.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-3548: Directory traversal vulnerability in Task Manager in Invision Power Board (IP.Board) 2.0.1 allows limited remote attackers to include files via a ..  (dot dot) in the "Task PHP File To Run" field.
Key phrases: include files via a ..  (dot, directory traversal
CVE-2005-3549: Direct code injection vulnerability in Task Manager in Invision Power Board 2.0.1 allows limited remote attackers to execute arbitrary code by referencing the file in "Task PHP File To Run" field and selecting "Run Task Now".
Key phrases: execute arbitrary code, execute arbitrary code by referencing the file in, direct code injection
CVE-2005-3550: Directory traversal vulnerability in admin.php in toendaCMS before 0.6.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the id_user parameter.
Key phrases: access arbitrary files, access arbitrary files via a .. (dot, directory traversal
CVE-2005-3551: toendaCMS before 0.6.2 stores user account and session data in the web root directory, which allows remote attackers to obtain sensitive information via a direct request to the appropriate XML file.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2005-3552: Multiple cross-site scripting (XSS) vulnerabilities in PHPKIT 1.6.1 R2 and earlier allow remote attackers to inject arbitrary web script or HTML via multiple vectors in (1) login/profile.php, (2) login/userinfo.php, (3) admin/admin.php, (4) imcenter.php, and the (5) referer statistics, the (6) HTML title element and (7) logo alt attributes in forum postings, and the (8) Homepage field in the Guestbook.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via multiple, cross-site scripting (xss), multiple vectors
CVE-2005-3553: Multiple SQL injection vulnerabilities in include.php in PHPKIT 1.6.1 R2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in conjunction with the login/userinfo.php path and (2) the session parameter (aka the PHPKITSID variable).
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the (1, sql injection, arbitrary sql commands
CVE-2005-3554: Multiple eval injection vulnerabilities in the help function in PHPKIT 1.6.1 R2 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary code on the server via unknown attack vectors involving uninitialized variables.
Key phrases: execute arbitrary code, execute arbitrary code on the server via unknown, eval injection, unknown attack vectors, uninitialized variables
CVE-2005-3555: Multiple SQL injection vulnerabilities in PHPlist 2.10.1 and earlier allow authenticated remote attackers with administrator privileges to execute arbitrary SQL commands via the id parameter in the (1) editattributes or (2) admin page.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the id, sql injection, arbitrary sql commands
CVE-2005-3556: Multiple cross-site scripting (XSS) vulnerabilities in PHPlist 2.10.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) listname parameter in (a) admin/editlist.php, (2) title parameter in (b) admin/spageedit.php, (3) title field in (c) admin/template.php, (4) filter, (5) delete, and (6) start parameters in (d) admin/eventlog.php, (7) id parameter in (e) admin/configure.php, (8) find parameter in (f) admin/users.php, (9) start parameter in (g) admin/admin.php, and (10) action parameter in (h) admin/fckphplist.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-3557: Directory traversal vulnerability in admin/defaults.php in PHPlist 2.10.1 and earlier allows remote attackers to access arbitrary files via a .. (dot dot) in the selected%5B%5D parameter in an HTTP POST request.
Key phrases: access arbitrary files, access arbitrary files via a .. (dot, directory traversal
CVE-2005-3558: PHP file inclusion vulnerability in index.php in OSTE 1.0 allows remote attackers to execute arbitrary code via the (1) page and (2) site parameters.
Key phrases: execute arbitrary code, execute arbitrary code via the (1), php file inclusion
CVE-2005-3559: Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a .. (dot dot) in the folder parameter.
Key phrases: access WAV files via a .. (dot, directory traversal
CVE-2005-3560: Zone Labs (1) ZoneAlarm Pro 6.0, (2) ZoneAlarm Internet Security Suite 6.0, (3) ZoneAlarm Anti-Virus 6.0, (4) ZoneAlarm Anti-Spyware 6.0 through 6.1, and (5) ZoneAlarm 6.0 allow remote attackers to bypass the "Advanced Program Control and OS Firewall filters" setting via URLs in "HTML Modal Dialogs" (window.location.href) contained within JavaScript tags.
Key phrases: bypass the "Advanced Program Control, bypass the "Advanced Program Control and OS
CVE-2005-3564: envd daemon in HP-UX B.11.00 through B.11.11 allows local users to obtain privileges via unknown attack vectors.
Key phrases: obtain privileges, obtain privileges via unknown attack vectors
CVE-2005-3565: Unknown vulnerability in remshd daemon in HP-UX B.11.00, B.11.11, and B.11.23 while running in "Trusted Mode" allows remote attackers to gain unauthorized system access via unknown attack vectors.
Key phrases: gain unauthorized system access, gain unauthorized system access via unknown attack vectors
CVE-2005-3566: Buffer overflow in various ha commands of VERITAS Cluster Server for UNIX before 4.0MP2 allows local users to execute arbitrary code via a long VCSI18N_LANG environment variable to (1) haagent, (2) haalert, (3) haattr, (4) hacli, (5) hacli_runcmd, (6) haclus, (7) haconf, (8) hadebug, (9) hagrp, (10) hahb, (11) halog, (12) hareg, (13) hares, (14) hastatus, (15) hasys, (16) hatype, (17) hauser, and (18) tststew.
Key phrases: execute arbitrary code, execute arbitrary code via a long VCSI18N_LANG environment, buffer overflow
CVE-2005-3567: slapd daemon in IBM Tivoli Directory Server (ITDS) 5.2.0 and 6.0.0 binds using SASL EXTERNAL, which allows attackers to bypass authentication and modify and delete directory data via unknown attack vectors.
Key phrases: bypass authentication, bypass authentication and modify and delete directory data, sasl external, unknown attack vectors
CVE-2005-3568: db2fmp process in IBM DB2 Content Manager before 8.2 Fix Pack 10 allows local users to cause a denial of service (CPU consumption) by importing a corrupted Microsoft Excel file, aka "CORRUPTED EXEL FILE WILL CAUSE TEXT SEARCH PROCESS LOOPING."
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, cpu consumption, text search process looping
CVE-2005-3569: INSO service in IBM DB2 Content Manager before 8.2 Fix Pack 10 on AIX allows attackers to cause a denial of service (application crash) via unknown attack vectors involving LZH files.
Key phrases: denial of service (application crash), cause a denial of service (application crash, unknown attack vectors
CVE-2005-3570: Unspecified cross-site scripting (XSS) vulnerability in Horde before 2.2.9 allows remote attackers to inject arbitrary web script or HTML via "not properly escaped error messages".
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via ", cross-site scripting (xss), unspecified
CVE-2005-3571: PHP file inclusion vulnerability in protection.php in CodeGrrl (a) PHPCalendar 1.0, (b) PHPClique 1.0, (c) PHPCurrently 2.0, (d) PHPFanBase 2.1, and (e) PHPQuotes 1.0 allows remote attackers to include arbitrary local files via the siteurl parameter when register_globals is enabled.  NOTE: It was later reported that PHPFanBase 2.2 is also affected.
Key phrases: include arbitrary local files via the siteurl parameter, php file inclusion
CVE-2005-3572: SQL injection vulnerability in index.php in Peel 2.6 through 2.7 allows remote attackers to execute arbitrary SQL commands via the rubid parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the rubid parameter, sql injection
CVE-2005-3573: Scrubber.py in Mailman 2.1.5-8 does not properly handle UTF8 character encodings in filenames of e-mail attachments, which allows remote attackers to cause a denial of service (application crash).
Key phrases: denial of service (application crash), cause a denial of service (application crash
CVE-2005-3574: PHP file inclusion vulnerability in index.php of iCMS allows remote attackers to include arbitrary files via the page parameter.
Key phrases: include arbitrary files, include arbitrary files via the page parameter, php file inclusion
CVE-2005-3575: SQL injection vulnerability in show.php in Cyphor 0.19 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the id, sql injection
CVE-2005-3576: ts.exe in Walla TeleSite 3.0 and earlier allows remote attackers to access privileged information by entering the article number in tsurl parameter.
Key phrases: access privileged information by entering the article number
CVE-2005-3577: Cross-site scripting vulnerability (XSS) in ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the sug parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting vulnerability (xss)
CVE-2005-3578: SQL injection vulnerability in ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to inject arbitrary SQL commands via the sug parameter.
Key phrases: inject arbitrary SQL commands, inject arbitrary SQL commands via the sug parameter, sql injection
CVE-2005-3579: ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to access arbitrary local files via the querystring.
Key phrases: access arbitrary local files via the querystring
CVE-2005-3580: QDBM before 1.8.33-r2 allows local users in the portage group to increase privileges via a shared object in the Portage temporary build directory, which is added to the search path allowing objects in it to be loaded at runtime.
Key phrases: increase privileges via a shared object in the, be loaded at runtime, increased privileges
CVE-2005-3581: GDAL before 1.3.0-r1 allows local users in the portage group to increase privileges via a shared object in the Portage temporary build directory, which is added to the search path allowing objects in it to be loaded at runtime.
Key phrases: increase privileges via a shared object in the, be loaded at runtime, increased privileges
CVE-2005-3582: ImageMagick before 6.2.4.2-r1 allows local users in the portage group to increase privileges via a shared object in the Portage temporary build directory, which is added to the search path allowing objects in it to be loaded at runtime.
Key phrases: increase privileges via a shared object in the, be loaded at runtime, increased privileges
CVE-2005-3583: (1) Java Runtime Environment (JRE) and (2) Software Development Kit (SDK) 1.4.2_08, 1.4.2_09, and 1.5.0_05 and possibly other versions allow remote attackers to cause a denial of service (JVM unresponsive) via a crafted serialized object, such as a font object as demonstrated on JBoss.
Key phrases: denial of service (JVM unresponsive), cause a denial of service (JVM unresponsive, font object
CVE-2005-3584: Cross-site scripting (XSS) vulnerability in forum.php in PhpWebThings 1.4.4 allows remote attackers to inject arbitrary web script or HTML via the forum parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2005-3585: SQL injection vulnerability in forum.php in PhpWebThings 1.4.4 allows remote attackers to execute arbitrary SQL commands via the forum parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the forum parameter, sql injection
CVE-2005-3586: content.php in Mambo 4.5.2 through 4.5.2.3 allows remote attackers to obtain the installation path of the application via a URL that causes the application to return an error.
Key phrases: obtain the installation path of the application via, error
CVE-2005-3587: Improper boundary checks in petite.c in Clam AntiVirus (ClamAV) before 0.87.1 allows attackers to perform unknown attacks via unknown vectors.
Key phrases: perform unknown attacks via unknown vectors, improper boundary checks