CVEs

343,083 total · page 6560 of 6,862

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2005-4698	Tellme Tellme	0.03	—	0.02	Dec 31, 2005	Cross-site scripting (XSS) vulnerability in TellMe 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the 91) q_IP (IP) or (2) q_Host (HOST) parameters.
CVE-2005-4699	Tellme Tellme	0.00	—	0.02	Dec 31, 2005	Argument injection vulnerability in TellMe 1.2 and earlier allows remote attackers to modify command line arguments for the Whois program and obtain sensitive information via "--" style options in the q_Host parameter.
CVE-2005-4700	Tellme Tellme	0.00	—	0.02	Dec 31, 2005	TellMe 1.2 and earlier, when the Server (o_Server) and HEAD (o_Head) options are enabled, allows remote attackers to obtain sensitive information via an invalid q_Host parameter, which reveals the full pathname of the application in an fsockopen error message.
CVE-2005-4701	Sun Corporation Solaris	0.00	—	0.00	Dec 31, 2005	Unspecified vulnerability in Process File System (procfs) in Sun Solaris 10 allows local users to obtain sensitive information such as process working directories via unknown attack vectors, possibly pwdx.
CVE-2005-4702	Ipbproarcade Ipbproarcade	0.03	—	0.01	Dec 31, 2005	SQL injection vulnerability in the favorites module in index.php in IPBProArcade 2.5.2 allows remote attackers to inject arbitrary SQL commands via the gameid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…
CVE-2005-4703	Apache Tomcat	0.05	—	0.25	Dec 31, 2005	Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.
CVE-2005-4704	Bea WebLogic Server	0.00	—	0.01	Dec 31, 2005	Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 through SP3, 7.0 through SP6, and 6.1 through SP7, when SSL is intended to be used, causes an unencrypted protocol to be used in certain unspecified circumstances, which causes user credentials to be sent…
CVE-2005-4705	Bea WebLogic Server	0.00	—	0.02	Dec 31, 2005	BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7, when a Java client application creates an SSL connection to the server after it has already created an insecure connection, will use the insecure connection, which allows remote…
CVE-2005-4706	Sun Corporation Solaris	0.00	—	0.00	Dec 31, 2005	Unspecified vulnerability in the "privilege management" feature of Sun Solaris 10 allows local users to cause a denial of service (panic) via unknown vectors that trigger a null dereference in the secpolicy_fs_common function.
CVE-2005-4707	PHP Gen PHP Gen	0.00	—	0.01	Dec 31, 2005	Multiple cross-site scripting (XSS) vulnerabilities in PHP GEN before 1.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVE-2005-4708	Adobe Inc. Captivate	0.00	—	0.01	Dec 31, 2005	Adobe Macromedia MX 2004 products, Captivate, Contribute 2, Contribute 3, and eLicensing client install the Macromedia Licensing Service with the Users group permitted to configure the service, including the path to executable, which allows local users to execute arbitrary code…
CVE-2005-4709	JBoss Enterprise Java Beans	0.00	—	0.02	Dec 31, 2005	The popSubjectContext method in the SecurityAssociation class in JBoss Enterprise Java Beans (EJB) 3.0 RC3 maintains the threadPrincipal and threadCredential values from a previous client's authentication after termination of a client session, which allows remote attackers to…
CVE-2005-4710	Autodesk Autocad	0.00	—	0.01	Dec 31, 2005	Unspecified vulnerability in multiple Autodesk and AutoCAD products and product families from 2006 and earlier allows remote attackers to "gain inappropriate access to another local user's computer," aka ID DL5549329.
CVE-2005-4711	Neocrome Land Down Under	0.00	—	0.01	Dec 31, 2005	SQL injection vulnerability in Neocrome Land Down Under (LDU) 801 allows remote attackers to execute arbitrary SQL commands via an HTTP Referer header. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2005-4712	PHP Handicapper PHP Handicapper	0.00	—	0.01	Dec 31, 2005	CRLF injection vulnerability in process_signup.php in PHP Handicapper allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the login parameter. NOTE: the vendor has disputed CVE-2005-3497, and it is possible that the dispute was intended to include…
CVE-2005-4713	Pam Mysql Pam Mysql	0.00	—	0.02	Dec 31, 2005	Unspecified vulnerability in the SQL logging facility in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors, probably involving the pam_mysql_sql_log function when being used in…
CVE-2005-4714	Openvmps Openvmps	0.03	—	0.04	Dec 31, 2005	Format string vulnerability in the vmps_log function in OpenVMPS (VLAN Management Policy Server) 1.3 allows remote attackers to execute arbitrary code via unknown vectors.
CVE-2005-4715	PHP-Nuke PHP Nuke	0.00	—	0.04	Dec 31, 2005	Multiple SQL injection vulnerabilities in modules.php in PHP-Nuke 7.8, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) name, (2) sid, and (3) pid parameters in a POST request, which bypasses security checks that are…
CVE-2005-4716	Hitachi TP1/NET/Library 2	0.00	—	0.02	Dec 31, 2005	Hitachi TP1/Server Base and TP1/NET/Library 2 on IBM AIX allow remote attackers to (1) cause a denial of service (OpenTP1 system outage) via invalid data to a port used by a system-server process, and (2) cause a denial of service (process failure) via invalid data to a port…
CVE-2005-4717	Microsoft Windows Nt	0.04	—	0.19	Dec 31, 2005	Microsoft Internet Explorer 6.0 on Windows NT 4.0 SP6a, Windows 2000 SP4, Windows XP SP1, Windows XP SP2, and Windows Server 2003 SP1 allows remote attackers to cause a denial of service (client crash) via a certain combination of a malformed HTML file and a CSS file that…
CVE-2005-4718	Opera Opera	0.04	—	0.10	Dec 31, 2005	Opera 8.02 and earlier allows remote attackers to cause a denial of service (client crash) via (1) a crafted HTML file with a "content: url(0);" style attribute, a "bodyA" tag, a long string, and a "u" tag with a long attribute, as demonstrated by opera.html; and (2) a BGSOUND…
CVE-2005-4719	Sysbotz Systems Panel	0.00	—	0.01	Dec 31, 2005	Multiple SQL injection vulnerabilities in Sysbotz Systems Panel 1.0.6 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the cid parameter in knowledgebase/index.php, (2) the aid parameter in knowledgebase/view.php, (3) the cid parameter in…
CVE-2005-4720	Mozilla Corporation Firefox	0.04	—	0.08	Dec 31, 2005	Mozilla Firefox 1.0.7 and earlier on Linux allows remote attackers to cause a denial of service (client crash) via an IFRAME element with a large value of the WIDTH attribute, which triggers a problem related to representation of floating-point numbers, leading to an infinite…
CVE-2005-4721	The Media Shoppe Berhad Tmspublisher	0.00	—	0.01	Dec 31, 2005	Cross-site scripting (XSS) vulnerability in search.cfm in tmsPUBLISHER 3.3 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVE-2005-4722	The Media Shoppe Berhad Tmspublisher	0.00	—	0.02	Dec 31, 2005	_Request_Message.cfm in tmsPUBLISHER 3.3 allows remote attackers to obtain sensitive information via an invalid id argument to pagename.cfm, which reveals the installation path in an error message.
CVE-2005-4723	Dlink Di 624	0.03	—	0.03	Dec 31, 2005	D-Link DI-524 Wireless Router, DI-624 Wireless Router, and DI-784 allow remote attackers to cause a denial of service (device reboot) via a series of crafted fragmented UDP packets, possibly involving a missing fragment.
CVE-2005-4724	PhpTagCool PhpTagCool	0.03	—	0.01	Dec 31, 2005	SQL injection vulnerability in post.php in PhpTagCool 1.0.3 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For field in an HTTP header.
CVE-2005-4725	Geeklog Geeklog	0.00	—	0.01	Dec 31, 2005	Geeklog before 1.3.11sr3 allows remote attackers to bypass intended access restrictions and comment on an arbitrary story or topic by guessing the story ID.
CVE-2005-4726	Mute Mute	0.00	—	0.01	Dec 31, 2005	MUTE 0.4 uses improper flood protection algorithms, which allows remote attackers to obtain sensitive information (privacy leak and search result data) by controlling a drop chain neighbor that is near the end of a message chain.
CVE-2005-4727	Gbook gBook	0.00	—	0.02	Dec 31, 2005	Cross-site scripting (XSS) vulnerability in gbook.cgi in gBook before 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header field.
CVE-2005-4728	Amaya amaya	0.00	—	0.00	Dec 31, 2005	Untrusted search path vulnerability (RPATH) in amaya 9.2.1 on Debian GNU/Linux allows local users to gain privileges via a malicious Mesa library in the /home/anand directory.
CVE-2005-4729	Vbzoom Vbzoom	0.00	—	0.01	Dec 31, 2005	SQL injection vulnerability in show.php in VBZooM Forum allows remote attackers to execute arbitrary SQL commands via the SubjectID parameter.
CVE-2005-4730	Pear Text Password	0.00	—	0.01	Dec 31, 2005	Unspecified vulnerability in PEAR Text_Password 1.0 has unknown impact and attack vectors, related to "problematic seeding" of the random number generator, possibly predictable seeds.
CVE-2005-4731	PHP Pear HTML Quickform Controller	0.00	—	0.01	Dec 31, 2005	The Next action in PEAR HTML_QuickForm_Controller 1.0.4 includes the SID in the URL even when session.use_only_cookies is configured, which allows remote attackers to obtain the SID via an HTTP Referer field and possibly other vectors.
CVE-2005-4732	Tux Racer Tuxbank	0.00	—	0.01	Dec 31, 2005	Multiple cross-site scripting (XSS) vulnerabilities in index.php in Tux Racer TuxBank 0.7x and 0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) description parameters.
CVE-2005-4733	NetBSD NetBSD	0.00	—	0.00	Dec 31, 2005	NetBSD 2.0 before 20050316 and NetBSD-current before 20050112 allow local users to cause a denial of service (infinite loop and system hang) by calling the F_CLOSEM fcntl with a parameter value of 0.
CVE-2005-4734	Rsa Authentication Agent For Web	0.07	—	0.54	Dec 31, 2005	Stack-based buffer overflow in IISWebAgentIF.dll in RSA Authentication Agent for Web (aka SecurID Web Agent) 5.2 and 5.3 for IIS allows remote attackers to execute arbitrary code via a long url parameter in the Redirect method.
CVE-2005-4735	IBM Db2 Universal Database	0.00	—	0.02	Dec 31, 2005	IBM DB2 Universal Database (UDB) 810 before 8.1 FP10 allows remote authenticated users to cause a denial of service (application crash) via (1) certain equality predicates that trigger self-removal, aka IY70808; and (2) a query with more than 32000 elements in the IN-list, aka…
CVE-2005-4736	IBM Db2 Universal Database	0.00	—	0.02	Dec 31, 2005	IBM DB2 Universal Database (UDB) 820 before 8.2 FP10 allows remote authenticated users to cause a denial of service (disk consumption) via a hash join (hsjn) that triggers an infinite loop in sqlri_hsjnFlushBlocks.
CVE-2005-4737	IBM Db2 Universal Database	0.00	—	0.02	Dec 31, 2005	IBM DB2 Universal Database (UDB) 820 before ESE AIX 5765F4100 allows remote authenticated users to cause a denial of service (CPU consumption) by "abnormally" terminating a connection, which prevents db2agents from being properly cleared.
CVE-2005-4738	IBM Db2 Universal Database	0.00	—	0.01	Dec 31, 2005	IBM DB2 Universal Database (UDB) 810 before ESE AIX 5765F4100 does not ensure that a user has execute privileges before permitting object creation based on routines, which allows remote authenticated users to gain privileges.
CVE-2005-4739	IBM Db2 Universal Database	0.00	—	0.01	Dec 31, 2005	IBM DB2 Universal Database (UDB) 820 before version 8 FixPak 10 (s050811) allows remote authenticated users to cause a denial of service (application crash) by using a table function for an instance of snapshot_tbreorg, which triggers a trap in sqlnr_EStoE_action.
CVE-2005-4740	IBM Db2 Universal Database	0.00	—	0.01	Dec 31, 2005	IBM DB2 Universal Database (UDB) 810 before version 8 FixPak 10 allows remote authenticated users to cause a denial of service (db2jd service crash) by "connecting from a downlevel client."
CVE-2005-4741	NetBSD NetBSD	0.00	—	0.01	Dec 31, 2005	NetBSD 1.6, NetBSD 2.0 through 2.1, and NetBSD-current before 20051031 allows local users to gain privileges by attaching a debugger to a setuid/setgid (P_SUGID) process that performs an exec without a reset of real credentials.
CVE-2005-4742	Echelog Echelog	0.00	—	0.00	Dec 31, 2005	Unspecified vulnerability in Echelog 0.6.2 allows attackers to "exploit function stacks on some architectures," with unknown impact and attack vectors.
CVE-2005-4743	Nelogic Technologies Nephp Publisher	0.00	—	0.01	Dec 31, 2005	Multiple SQL injection vulnerabilities in index.php in NeLogic Nephp Publisher 4.5.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) nnet_catid parameters.
CVE-2005-4744	FreeRADIUS Freeradius	0.00	—	0.04	Dec 31, 2005	Off-by-one error in the sql_error function in sql_unixodbc.c in FreeRADIUS 1.0.2.5-5, and possibly other versions including 1.0.4, might allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing the external database query to…
CVE-2005-4745	FreeRADIUS Freeradius	0.00	—	0.01	Dec 31, 2005	SQL injection vulnerability in the rlm_sqlcounter module in FreeRADIUS 1.0.3 and 1.0.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVE-2005-4746	FreeRADIUS Freeradius	0.00	—	0.02	Dec 31, 2005	Multiple buffer overflows in FreeRADIUS 1.0.3 and 1.0.4 allow remote attackers to cause denial of service (crash) via (1) the rlm_sqlcounter module or (2) unknown vectors "while expanding %t".
CVE-2005-4747	Webhost Automation Helm	0.00	—	0.01	Dec 31, 2005	Cross-site scripting (XSS) vulnerability in WebHost Automation Ltd Helm before 3.2.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors involving the default page.

CVE-2005-4698Dec 31, 2005
Tellme
Tellme
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in TellMe 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the 91) q_IP (IP) or (2) q_Host (HOST) parameters.
CVE-2005-4699Dec 31, 2005
Tellme
Tellme
risk 0.00cvss —epss 0.02
Argument injection vulnerability in TellMe 1.2 and earlier allows remote attackers to modify command line arguments for the Whois program and obtain sensitive information via "--" style options in the q_Host parameter.
CVE-2005-4700Dec 31, 2005
Tellme
Tellme
risk 0.00cvss —epss 0.02
TellMe 1.2 and earlier, when the Server (o_Server) and HEAD (o_Head) options are enabled, allows remote attackers to obtain sensitive information via an invalid q_Host parameter, which reveals the full pathname of the application in an fsockopen error message.
CVE-2005-4701Dec 31, 2005
Sun Corporation
Solaris
risk 0.00cvss —epss 0.00
Unspecified vulnerability in Process File System (procfs) in Sun Solaris 10 allows local users to obtain sensitive information such as process working directories via unknown attack vectors, possibly pwdx.
CVE-2005-4702Dec 31, 2005
Ipbproarcade
Ipbproarcade
risk 0.03cvss —epss 0.01
SQL injection vulnerability in the favorites module in index.php in IPBProArcade 2.5.2 allows remote attackers to inject arbitrary SQL commands via the gameid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…
CVE-2005-4703Dec 31, 2005
Apache
Tomcat
risk 0.05cvss —epss 0.25
Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.
CVE-2005-4704Dec 31, 2005
Bea
WebLogic Server
risk 0.00cvss —epss 0.01
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 through SP3, 7.0 through SP6, and 6.1 through SP7, when SSL is intended to be used, causes an unencrypted protocol to be used in certain unspecified circumstances, which causes user credentials to be sent…
CVE-2005-4705Dec 31, 2005
Bea
WebLogic Server
risk 0.00cvss —epss 0.02
BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7, when a Java client application creates an SSL connection to the server after it has already created an insecure connection, will use the insecure connection, which allows remote…
CVE-2005-4706Dec 31, 2005
Sun Corporation
Solaris
risk 0.00cvss —epss 0.00
Unspecified vulnerability in the "privilege management" feature of Sun Solaris 10 allows local users to cause a denial of service (panic) via unknown vectors that trigger a null dereference in the secpolicy_fs_common function.
CVE-2005-4707Dec 31, 2005
PHP Gen
PHP Gen
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in PHP GEN before 1.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
CVE-2005-4708Dec 31, 2005
Adobe Inc.
Captivate
risk 0.00cvss —epss 0.01
Adobe Macromedia MX 2004 products, Captivate, Contribute 2, Contribute 3, and eLicensing client install the Macromedia Licensing Service with the Users group permitted to configure the service, including the path to executable, which allows local users to execute arbitrary code…
CVE-2005-4709Dec 31, 2005
JBoss
Enterprise Java Beans
risk 0.00cvss —epss 0.02
The popSubjectContext method in the SecurityAssociation class in JBoss Enterprise Java Beans (EJB) 3.0 RC3 maintains the threadPrincipal and threadCredential values from a previous client's authentication after termination of a client session, which allows remote attackers to…
CVE-2005-4710Dec 31, 2005
Autodesk
Autocad
risk 0.00cvss —epss 0.01
Unspecified vulnerability in multiple Autodesk and AutoCAD products and product families from 2006 and earlier allows remote attackers to "gain inappropriate access to another local user's computer," aka ID DL5549329.
CVE-2005-4711Dec 31, 2005
Neocrome
Land Down Under
risk 0.00cvss —epss 0.01
SQL injection vulnerability in Neocrome Land Down Under (LDU) 801 allows remote attackers to execute arbitrary SQL commands via an HTTP Referer header. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2005-4712Dec 31, 2005
PHP Handicapper
PHP Handicapper
risk 0.00cvss —epss 0.01
CRLF injection vulnerability in process_signup.php in PHP Handicapper allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the login parameter. NOTE: the vendor has disputed CVE-2005-3497, and it is possible that the dispute was intended to include…
CVE-2005-4713Dec 31, 2005
Pam Mysql
Pam Mysql
risk 0.00cvss —epss 0.02
Unspecified vulnerability in the SQL logging facility in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors, probably involving the pam_mysql_sql_log function when being used in…
CVE-2005-4714Dec 31, 2005
Openvmps
Openvmps
risk 0.03cvss —epss 0.04
Format string vulnerability in the vmps_log function in OpenVMPS (VLAN Management Policy Server) 1.3 allows remote attackers to execute arbitrary code via unknown vectors.
CVE-2005-4715Dec 31, 2005
PHP-Nuke
PHP Nuke
risk 0.00cvss —epss 0.04
Multiple SQL injection vulnerabilities in modules.php in PHP-Nuke 7.8, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) name, (2) sid, and (3) pid parameters in a POST request, which bypasses security checks that are…
CVE-2005-4716Dec 31, 2005
Hitachi
TP1/NET/Library 2
risk 0.00cvss —epss 0.02
Hitachi TP1/Server Base and TP1/NET/Library 2 on IBM AIX allow remote attackers to (1) cause a denial of service (OpenTP1 system outage) via invalid data to a port used by a system-server process, and (2) cause a denial of service (process failure) via invalid data to a port…
CVE-2005-4717Dec 31, 2005
Microsoft
Windows Nt
risk 0.04cvss —epss 0.19
Microsoft Internet Explorer 6.0 on Windows NT 4.0 SP6a, Windows 2000 SP4, Windows XP SP1, Windows XP SP2, and Windows Server 2003 SP1 allows remote attackers to cause a denial of service (client crash) via a certain combination of a malformed HTML file and a CSS file that…
CVE-2005-4718Dec 31, 2005
Opera
Opera
risk 0.04cvss —epss 0.10
Opera 8.02 and earlier allows remote attackers to cause a denial of service (client crash) via (1) a crafted HTML file with a "content: url(0);" style attribute, a "bodyA" tag, a long string, and a "u" tag with a long attribute, as demonstrated by opera.html; and (2) a BGSOUND…
CVE-2005-4719Dec 31, 2005
Sysbotz
Systems Panel
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in Sysbotz Systems Panel 1.0.6 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the cid parameter in knowledgebase/index.php, (2) the aid parameter in knowledgebase/view.php, (3) the cid parameter in…
CVE-2005-4720Dec 31, 2005
Mozilla Corporation
Firefox
risk 0.04cvss —epss 0.08
Mozilla Firefox 1.0.7 and earlier on Linux allows remote attackers to cause a denial of service (client crash) via an IFRAME element with a large value of the WIDTH attribute, which triggers a problem related to representation of floating-point numbers, leading to an infinite…
CVE-2005-4721Dec 31, 2005
The Media Shoppe Berhad
Tmspublisher
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in search.cfm in tmsPUBLISHER 3.3 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVE-2005-4722Dec 31, 2005
The Media Shoppe Berhad
Tmspublisher
risk 0.00cvss —epss 0.02
_Request_Message.cfm in tmsPUBLISHER 3.3 allows remote attackers to obtain sensitive information via an invalid id argument to pagename.cfm, which reveals the installation path in an error message.
CVE-2005-4723Dec 31, 2005
Dlink
Di 624
risk 0.03cvss —epss 0.03
D-Link DI-524 Wireless Router, DI-624 Wireless Router, and DI-784 allow remote attackers to cause a denial of service (device reboot) via a series of crafted fragmented UDP packets, possibly involving a missing fragment.
CVE-2005-4724Dec 31, 2005
PhpTagCool
PhpTagCool
risk 0.03cvss —epss 0.01
SQL injection vulnerability in post.php in PhpTagCool 1.0.3 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For field in an HTTP header.
CVE-2005-4725Dec 31, 2005
Geeklog
Geeklog
risk 0.00cvss —epss 0.01
Geeklog before 1.3.11sr3 allows remote attackers to bypass intended access restrictions and comment on an arbitrary story or topic by guessing the story ID.
CVE-2005-4726Dec 31, 2005
Mute
Mute
risk 0.00cvss —epss 0.01
MUTE 0.4 uses improper flood protection algorithms, which allows remote attackers to obtain sensitive information (privacy leak and search result data) by controlling a drop chain neighbor that is near the end of a message chain.
CVE-2005-4727Dec 31, 2005
Gbook
gBook
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in gbook.cgi in gBook before 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header field.
CVE-2005-4728Dec 31, 2005
Amaya
amaya
risk 0.00cvss —epss 0.00
Untrusted search path vulnerability (RPATH) in amaya 9.2.1 on Debian GNU/Linux allows local users to gain privileges via a malicious Mesa library in the /home/anand directory.
CVE-2005-4729Dec 31, 2005
Vbzoom
Vbzoom
risk 0.00cvss —epss 0.01
SQL injection vulnerability in show.php in VBZooM Forum allows remote attackers to execute arbitrary SQL commands via the SubjectID parameter.
CVE-2005-4730Dec 31, 2005
Pear
Text Password
risk 0.00cvss —epss 0.01
Unspecified vulnerability in PEAR Text_Password 1.0 has unknown impact and attack vectors, related to "problematic seeding" of the random number generator, possibly predictable seeds.
CVE-2005-4731Dec 31, 2005
PHP
Pear HTML Quickform Controller
risk 0.00cvss —epss 0.01
The Next action in PEAR HTML_QuickForm_Controller 1.0.4 includes the SID in the URL even when session.use_only_cookies is configured, which allows remote attackers to obtain the SID via an HTTP Referer field and possibly other vectors.
CVE-2005-4732Dec 31, 2005
Tux Racer
Tuxbank
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Tux Racer TuxBank 0.7x and 0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) description parameters.
CVE-2005-4733Dec 31, 2005
NetBSD
NetBSD
risk 0.00cvss —epss 0.00
NetBSD 2.0 before 20050316 and NetBSD-current before 20050112 allow local users to cause a denial of service (infinite loop and system hang) by calling the F_CLOSEM fcntl with a parameter value of 0.
CVE-2005-4734Dec 31, 2005
Rsa
Authentication Agent For Web
risk 0.07cvss —epss 0.54
Stack-based buffer overflow in IISWebAgentIF.dll in RSA Authentication Agent for Web (aka SecurID Web Agent) 5.2 and 5.3 for IIS allows remote attackers to execute arbitrary code via a long url parameter in the Redirect method.
CVE-2005-4735Dec 31, 2005
IBM
Db2 Universal Database
risk 0.00cvss —epss 0.02
IBM DB2 Universal Database (UDB) 810 before 8.1 FP10 allows remote authenticated users to cause a denial of service (application crash) via (1) certain equality predicates that trigger self-removal, aka IY70808; and (2) a query with more than 32000 elements in the IN-list, aka…
CVE-2005-4736Dec 31, 2005
IBM
Db2 Universal Database
risk 0.00cvss —epss 0.02
IBM DB2 Universal Database (UDB) 820 before 8.2 FP10 allows remote authenticated users to cause a denial of service (disk consumption) via a hash join (hsjn) that triggers an infinite loop in sqlri_hsjnFlushBlocks.
CVE-2005-4737Dec 31, 2005
IBM
Db2 Universal Database
risk 0.00cvss —epss 0.02
IBM DB2 Universal Database (UDB) 820 before ESE AIX 5765F4100 allows remote authenticated users to cause a denial of service (CPU consumption) by "abnormally" terminating a connection, which prevents db2agents from being properly cleared.
CVE-2005-4738Dec 31, 2005
IBM
Db2 Universal Database
risk 0.00cvss —epss 0.01
IBM DB2 Universal Database (UDB) 810 before ESE AIX 5765F4100 does not ensure that a user has execute privileges before permitting object creation based on routines, which allows remote authenticated users to gain privileges.
CVE-2005-4739Dec 31, 2005
IBM
Db2 Universal Database
risk 0.00cvss —epss 0.01
IBM DB2 Universal Database (UDB) 820 before version 8 FixPak 10 (s050811) allows remote authenticated users to cause a denial of service (application crash) by using a table function for an instance of snapshot_tbreorg, which triggers a trap in sqlnr_EStoE_action.
CVE-2005-4740Dec 31, 2005
IBM
Db2 Universal Database
risk 0.00cvss —epss 0.01
IBM DB2 Universal Database (UDB) 810 before version 8 FixPak 10 allows remote authenticated users to cause a denial of service (db2jd service crash) by "connecting from a downlevel client."
CVE-2005-4741Dec 31, 2005
NetBSD
NetBSD
risk 0.00cvss —epss 0.01
NetBSD 1.6, NetBSD 2.0 through 2.1, and NetBSD-current before 20051031 allows local users to gain privileges by attaching a debugger to a setuid/setgid (P_SUGID) process that performs an exec without a reset of real credentials.
CVE-2005-4742Dec 31, 2005
Echelog
Echelog
risk 0.00cvss —epss 0.00
Unspecified vulnerability in Echelog 0.6.2 allows attackers to "exploit function stacks on some architectures," with unknown impact and attack vectors.
CVE-2005-4743Dec 31, 2005
Nelogic Technologies
Nephp Publisher
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in index.php in NeLogic Nephp Publisher 4.5.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) nnet_catid parameters.
CVE-2005-4744Dec 31, 2005
FreeRADIUS
Freeradius
risk 0.00cvss —epss 0.04
Off-by-one error in the sql_error function in sql_unixodbc.c in FreeRADIUS 1.0.2.5-5, and possibly other versions including 1.0.4, might allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing the external database query to…
CVE-2005-4745Dec 31, 2005
FreeRADIUS
Freeradius
risk 0.00cvss —epss 0.01
SQL injection vulnerability in the rlm_sqlcounter module in FreeRADIUS 1.0.3 and 1.0.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVE-2005-4746Dec 31, 2005
FreeRADIUS
Freeradius
risk 0.00cvss —epss 0.02
Multiple buffer overflows in FreeRADIUS 1.0.3 and 1.0.4 allow remote attackers to cause denial of service (crash) via (1) the rlm_sqlcounter module or (2) unknown vectors "while expanding %t".
CVE-2005-4747Dec 31, 2005
Webhost Automation
Helm
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in WebHost Automation Ltd Helm before 3.2.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors involving the default page.