Archive
May 2005
Vulnerabilities first published in this month (UTC), newest first.
856 results · Feed
-
Unscored —CVE-2004-1882 Public exploit
Cross-site scripting (XSS) vulnerability in popuplargeimage.asp in CactuShop 5.x allows remote attackers to inject arbi…
-
Unscored —CVE-2004-1861 Public exploit
Invision NetSupport School Pro uses a weak encryption algorithm to encrypt passwords, which allows local users to obtai…
-
Unscored —CVE-2004-1824 Public exploit
Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin before 3.0 allows remote attackers to inject arbitrary we…
-
Unscored —
SQL injection vulnerability in index.cfm in CFWebstore 5.0 allows remote attackers to execute SQL commands via the (1) …
-
Unscored —
Microsoft Internet Explorer 5.5 and 6.0 allocates memory based on the memory size written in the BMP file instead of th…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in XMB (aka extreme message board) 1.9 beta (aka Nexus beta) allow …
-
Unscored —
Format string vulnerability in the logging function in IGI 2 Covert Strike server 1.3 and earlier allows remote attacke…
-
Unscored —CVE-2004-1788 Public exploit
ASP-Nuke 1.3 and earlier places user credentials under the web document root with insufficient access control, which al…
-
Unscored —
Unknown vulnerability in ColdFusion MX 6.0 and 6.1, and JRun 4.0, when a SOAP web service expects an array of objects a…
-
Unscored —CVE-2004-1812 EPSS 45%
Multiple stack-based buffer overflows in Agent Common Services (1) cam.exe and (2) awservices.exe in Unicenter TNG 2.4 …
-
Medium 5.5
Portage before 2.0.50-r3 allows local users to overwrite arbitrary files via a hard link attack on the lockfiles.
-
Unscored —CVE-2004-1987 EPSS 10%
picmgmtbatch.inc.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrative privi…
-
Unscored —
Ipswitch WS_FTP Server 4.0.2 allows remote authenticated users to execute arbitrary programs as SYSTEM by using the SIT…
-
Unscored —
SQL injection vulnerability in calendar.php for Invision Power Board 1.3 allows remote attackers to execute arbitrary S…
-
Unscored —CVE-2004-1871 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to in…
-
Unscored —
The "%f" feature in the VirusEvent directive in Clam AntiVirus daemon (clamd) before 0.70 allows local users to execute…
-
Unscored —CVE-2004-1786 Public exploit
PortalApp places user credentials under the web root with insufficient access control, which allows remote attackers to…
-
Unscored —CVE-2004-1904 Public exploit
Buffer overflow in ascontrol.dll in Panda ActiveScan 5.0 allows remote attackers to execute arbitrary code via the Inte…
-
Unscored —
Heap-based buffer overflow in in_mod.dll in Nullsoft Winamp 2.91 through 5.02 allows remote attackers to execute arbitr…
-
Unscored —
Extcompose in metamail does not verify the output file before writing to it, which allows local users to overwrite arbi…
-
Unscored —
SQL injection vulnerability in MS Analysis module 2.0 for PHP-Nuke allows remote attackers to execute arbitrary SQL via…
-
Unscored —CVE-2004-1805 Public exploit
Format string vulnerability in games using the Epic Games Unreal Engine 436 allows remote attackers to cause a denial o…
-
Unscored —
The Javascript engine in Opera 7.23 allows remote attackers to cause a denial of service (crash) by creating a new Arra…
-
Unscored —
The admin.ib file in Borland Interbase 7.1 for Linux has default world writable permissions, which allows local users t…
-
Unscored —CVE-2004-1829 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in error.php in Gijza.net Error Manager 2.1 for PHP-Nuke 6.0 allow …
-
Unscored —
blocker.php in Protector System 1.15b1 allows remote attackers to bypass SQL injection protection and execute limited S…
-
Unscored —
The p_submit_url value in the sample login form in the Oracle 9i Application Server (9iAS) Single Sign-on Administrator…
-
Unscored —
Unknown vulnerability in ftpd in SGI IRIX 6.5.20 through 6.5.23 allows remote attackers to cause a denial of service (h…
-
Unscored —
3com NBX IP VOIP NetSet Configuration Manager allows remote attackers to cause a denial of service (crash) via a Nessus…
-
Unscored —
PF in certain OpenBSD versions, when stateful filtering is enabled, does not limit packets for a session to the origina…
-
Unscored —CVE-2004-1923 Public exploit
Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to gain sensitive information via a direct requ…
-
Unscored —CVE-2004-1995 Public exploit
Cross-Site Request Forgery (CSRF) vulnerability in FuseTalk 2.0 allows remote attackers to create arbitrary accounts vi…
-
Unscored —
Citadel/UX 5.00 through 6.14 installs the database directory and files with world-read permissions, which could allow l…
-
Unscored —CVE-2004-1983 Public exploit
The arch_get_unmapped_area function in mmap.c in the PaX patches for Linux kernel 2.6, when Address Space Layout Random…
-
Unscored —
The Citrix MetaFrame Password Manager 2.0, when a central credential store is not configured, does not encrypt password…
-
Unscored —CVE-2004-1947 Public exploit
The AVXSCANONLINE.AvxScanOnlineCtrl.1 ActiveX control in BitDefender Scan Online allows remote attackers to (1) obtain …
-
Unscored —
Stack-based buffer overflow in the administration interface in Monit 1.4 through 4.2 allows remote attackers to execute…
-
Unscored —
NcFTP client 3.1.6 and 3.1.7, when the username and password are included in an FTP URL that is provided on the command…
-
Unscored —CVE-2004-1957 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.726 allows remote attackers to inject arbitrary web s…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the administration panel in bBlog 0.7.2 allows remote authenticated users w…