Archive
May 2005
Vulnerabilities first published in this month (UTC), newest first.
856 results · Feed
-
Unscored —
Gurgens (GASoft) Ultimate Forum 1.0 stores the db/Genid.dat database file under the web document root with insufficient…
-
Unscored —
Jeuce Personal Webserver 2.13 allows remote attackers to cause a denial of service (server crash) via a long GET reques…
-
Unscored —
The default installation of Fastream NETFile FTP/Web Server 7.4.6, which supports FXP, does not require that the IP add…
-
Unscored —CVE-2005-1665 EPSS 40%
The __VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not cryptographically signed, allows remote attackers to c…
-
Unscored —CVE-2005-1655 Public exploit
AOL Instant Messenger 5.5.x and earlier allows remote attackers to cause a denial of service (client crash) via an inva…
-
Unscored —
Directory traversal vulnerability in message.htm for Woppoware PostMaster 4.2.2 (build 3.2.5) allows remote attackers t…
-
Unscored —
Cross-site scripting (XSS) vulnerability in guestbook.php for 1Two Livre d'Or 1.0 allows remote attackers to inject arb…
-
Unscored —
HTMLJunction EZGuestbook stores the guestbook.mdb file under the web document root with insufficient access control, wh…
-
Unscored —
Cross-site scripting (XSS) vulnerability in message.htm for Woppoware PostMaster 4.2.2 (build 3.2.5) allows remote atta…
-
Unscored —
Mercur Messaging 2005 SP2 allows remote attackers to read the source code of .ctml files via a URL with a trailing hex-…
-
Unscored —
The IPv6 support in Windows XP SP2, 2003 Server SP1, and Longhorn, with Windows Firewall turned off, allows remote atta…
-
Unscored —
The web mail service in Woppoware PostMaster 4.2.2 (build 3.2.5) generates different error messages depending on whethe…
-
Unscored —CVE-2005-1666 Public exploit
Multiple buffer overflows in Orenosv HTTP/FTP Server 0.8.1 allow remote authenticated users to cause a denial of servic…
-
Unscored —CVE-2005-1667 Public exploit
DataTrac Activity Console 1.1 allows remote attackers to cause a denial of service via a long HTTP GET request.
-
Unscored —CVE-2005-1589 Public exploit
The pkt_ioctl function in the pktcdvd block device ioctl handler (pktcdvd.c) in Linux kernel 2.6.12-rc4 and earlier cal…
-
Unscored —
Multiple buffer overflows in handlers.c for Pico Server (pServ) before 3.3 may allow attackers to execute arbitrary cod…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in JGS-XA JGS-Portal 3.0.2 and earlier allow remote attackers to in…
-
High —
Cheetah Path Search Order Hijacking
Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitrary code via a malicious module in /tmp/.
-
Unscored —CVE-2005-1633 Public exploit
Multiple SQL injection vulnerabilities in JGS-XA JGS-Portal 3.0.2 and earlier allow remote attackers to execute arbitra…
-
Unscored —
SQL injection vulnerability in Sigmaweb.DLL in Sigma ISP Manager 6.6 allows remote attackers to execute arbitrary SQL c…
-
Unscored —
Unknown vulnerability in Viewglob before 2.0.1, related to "a potential security issue with the Viewglob display and ss…
-
Unscored —
Raw character devices (raw.c) in the Linux kernel 2.6.x call the wrong function before passing an ioctl to the block de…
-
Unscored —CVE-2005-1642 Public exploit
SQL injection vulnerability in the verify_email function in Woltlab Burning Board 2.x and earlier allows remote attacke…
-
Unscored —CVE-2005-1307 Public exploit
The (1) stopserver.sh and (2) startserver.sh scripts in Adobe Version Cue on Mac OS X uses the current working director…
-
Unscored —
JGS-XA JGS-Portal 3.0.2 and earlier allows remote attackers to obtain the full server path via direct requests to (1) j…
-
Unscored —
mod_channel.bas in The Ignition Project ignitionServer 0.3.0 to 0.3.6, and possibly earlier versions, does not properly…
-
Unscored —CVE-2005-1629 Public exploit
SQL injection vulnerability in member.php for Photopost PHP Pro allows remote attackers to execute arbitrary SQL comman…
-
Unscored —CVE-2005-1637 Public exploit
Multiple SQL injection vulnerabilities in NPDS 4.8 and 5.0 allow remote attackers to execute arbitrary SQL commands via…
-
Unscored —
The ZCom_BitStream::Deserialize function in Zoidcom 1.0 beta 4 and earlier allows remote attackers to cause a denial of…
-
Unscored —
Unknown vulnerability in Attachment Mod before 2.3.13, related to a "serious issue with realnames," has unknown impact …
-
Unscored —
apage.cgi in WebAPP 0.9.9.2.1, and possibly earlier versions, allows remote attackers to execute arbitrary commands via…
-
Unscored —
mod_channel in The Ignition Project ignitionServer 0.3.0 to 0.3.6, and possibly earlier versions, does not allow protec…
-
Unscored —
mysql_install_db in MySQL 4.1.x before 4.1.12 and 5.x up to 5.0.4 creates the mysql_install_db.X file with a predictabl…
-
Unscored —
The _writeAttrs function in SafeHTML before 1.3.2 does not properly handle quotes in attribute values, which could allo…
-
Unscored —
booby.php in Booby 1.0.0 and earlier allows remote attackers to view private bookmarks by guessing item IDs.
-
Unscored —
The Altiris Client Service for Windows 5.6 SP1 Hotfix E (5.6.181) allows local users to execute arbitrary commands by o…
-
Unscored —
SQL injection vulnerability in Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to execute arbitrar…
-
Unscored —
Pico Server (pServ) 3.2 and earlier allows local users to read arbitrary files as the pServ user via a symlink to a fil…
-
Unscored —
index.php in Fusion SBX 1.2 and earlier does not properly use the extract function, which allows remote attackers to by…
-
Unscored —CVE-2005-1614 Public exploit
Cross-site scripting (XSS) vulnerability in viewforum.php in Ultimate PHP Board (UPB) 1.8 through 1.9.6 allows remote a…