| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2005-2540 | 0.04 | — | 0.06 | Aug 10, 2005 | CRLF injection vulnerability in FlatNuke 2.5.5 and possibly earlier versions allows remote attackers to execute arbitrary PHP commands via an ASCII char 13 (carriage return) in the signature field, which is injected into a PHP script without a preceding comment character, which… | |||
| CVE-2005-2541 | 0.00 | — | 0.04 | Aug 10, 2005 | Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges. | |||
| CVE-2005-2542 | 0.03 | — | 0.02 | Aug 10, 2005 | Invision Power Board (IPB) 1.0.3 allows remote attackers to inject arbitrary web script or HTML via an attachment, which is automatically downloaded and processed as HTML. | |||
| CVE-2005-2543 | 0.03 | — | 0.06 | Aug 10, 2005 | Directory traversal vulnerability in wce.download.php in Comdev eCommerce 3.0 allows remote attackers to download arbitrary files via a .. (dot dot) in the download parameter. | |||
| CVE-2005-2544 | 0.00 | — | 0.01 | Aug 10, 2005 | PHP remote file inclusion vulnerability in config.php in Comdev eCommerce 3.0 allows remote attackers to execute arbitrary PHP code via the path[docroot] parameter. | |||
| CVE-2005-2545 | 0.00 | — | 0.02 | Aug 10, 2005 | Multiple cross-site scripting (XSS) vulnerabilities in PHPOpenChat 3.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) content parameter to profile.php and profile_misc.php, (3) the profile fields in userpage.php, (4) subject or (5) body… | |||
| CVE-2005-2546 | 0.00 | — | 0.01 | Aug 10, 2005 | Arab Portal 2.0 allows remote attackers to obtain sensitive information via a long (1) username or (2) password, which reveals the path in an error message when the undefined "errmsg" function is called. | |||
| CVE-2005-2500 | 0.00 | — | 0.05 | Aug 8, 2005 | Buffer overflow in the xdr_xcode_array2 function in xdr.c in Linux kernel 2.6.12, as used in SuSE Linux Enterprise Server 9, might allow remote attackers to cause a denial of service and possibly execute arbitrary code via crafted XDR data for the nfsacl protocol. | |||
| CVE-2005-2482 | 0.00 | — | 0.01 | Aug 7, 2005 | The StateToOptions function in msfweb in Metasploit Framework 2.4 and earlier, when running with the -D option (defanged mode), allows attackers to modify temporary environment variables before the "_Defanged" environment option is checked when processing the Exploit command. | |||
| CVE-2005-2483 | 0.04 | — | 0.03 | Aug 7, 2005 | Eval injection vulnerability in Karrigell before 2.1.8 allows remote attackers to execute arbitrary Python code via modified arguments to a Karrigell services (.ks) script, which can reference functions from libraries that are used by that script. | |||
| CVE-2005-2484 | 0.00 | — | 0.03 | Aug 7, 2005 | Buffer overflow in the rdb_query function for Denora IRC Stats 1.0 might allow attackers to execute arbitrary code. | |||
| CVE-2005-2485 | 0.00 | — | 0.01 | Aug 7, 2005 | Cross-site scripting (XSS) vulnerability in the Helpdesk in Logicampus before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. | |||
| CVE-2005-2486 | 0.03 | — | 0.01 | Aug 7, 2005 | SQL injection vulnerability in mod_forum/read_message.php in PortailPHP allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php with the affiche parameter set to "Forum-read_mess", a different vulnerability than CVE-2005-1701. | |||
| CVE-2005-2487 | 0.00 | — | 0.00 | Aug 7, 2005 | Unknown vulnerability in Sun McData switches and directors 4300, 4500, 6064, and 6140 before E/OS 6.0.0 may allow attackers to cause a denial of service (connectivity and array access loss) via a network broadcast storm. | |||
| CVE-2005-2488 | 0.03 | — | 0.02 | Aug 7, 2005 | Cross-site scripting (XSS) vulnerability in Web Content Management News System allows remote attackers to inject arbitrary web script or HTML via (1) the strRootpath parameter to validsession.php or (2) the strTable parameter to Admin/News/List.php. | |||
| CVE-2005-2489 | 0.00 | — | 0.02 | Aug 7, 2005 | Web Content Management News System allows remote attackers to create arbitrary accounts and gain privileges via a direct request to Admin/Users/AddModifyInput.php. | |||
| CVE-2005-1268 | 0.00 | — | 0.08 | Aug 5, 2005 | Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte. | |||
| CVE-2005-1272 | 0.09 | — | 0.66 | Aug 5, 2005 | Stack-based buffer overflow in the Backup Agent for Microsoft SQL Server in BrightStor ARCserve Backup Agent for SQL Server 11.0 allows remote attackers to execute arbitrary code via a long string sent to port (1) 6070 or (2) 6050. | |||
| CVE-2005-1761 | 0.00 | — | 0.00 | Aug 5, 2005 | Linux kernel 2.6 and 2.4 on the IA64 architecture allows local users to cause a denial of service (kernel crash) via ptrace and the restore_sigcontext function. | |||
| CVE-2005-1767 | 0.00 | — | 0.00 | Aug 5, 2005 | traps.c in the Linux kernel 2.6.x and 2.4.x executes stack segment faults on an exception stack, which allows local users to cause a denial of service (oops and stack fault exception). | |||
| CVE-2005-1854 | 0.00 | — | 0.02 | Aug 5, 2005 | Unknown vulnerability in apt-cacher in Debian 3.1, related to "missing input sanitising," allows remote attackers to execute arbitrary commands on the caching server. | |||
| CVE-2005-2353 | 0.00 | — | 0.00 | Aug 5, 2005 | run-mozilla.sh in Thunderbird, with debugging enabled, allows local users to create or overwrite arbitrary files via a symlink attack on temporary files. | |||
| CVE-2005-2359 | 0.00 | — | 0.01 | Aug 5, 2005 | The AES-XCBC-MAC algorithm in IPsec in FreeBSD 5.3 and 5.4, when used for authentication without other encryption, uses a constant key instead of the one that was assigned by the system administrator, which can allow remote attackers to spoof packets to establish an IPsec… | |||
| CVE-2005-2471 | 0.00 | — | 0.04 | Aug 5, 2005 | pstopnm in netpbm does not properly use the "-dSAFER" option when calling Ghostscript to convert a PostScript file into a (1) PBM, (2) PGM, or (3) PNM file, which allows external user-assisted attackers to execute arbitrary commands. | |||
| CVE-2005-2472 | 0.05 | — | 0.05 | Aug 5, 2005 | Multiple buffer overflows in BusinessMail 4.60.00 allow remote attackers to cause a denial of service (application crash) via a long string to SMTP (1) HELO or (2) MAIL FROM commands. | |||
| CVE-2005-2473 | 0.00 | — | 0.02 | Aug 5, 2005 | Multiple SQL injection vulnerabilities in ChurchInfo allow remote attackers to execute arbitrary SQL commands via the PersonID parameter to (1) PersonView.php, (2) MemberRoleChange.php, (3) PropertyAssign.php, (4) WhyCameEditor.php, (5) GroupPropsEditor.php, (6)… | |||
| CVE-2005-2474 | 0.00 | — | 0.02 | Aug 5, 2005 | ChurchInfo allows remote attackers to execute obtain sensitive information via the PersonID parameter to (1) PersonView.php, (2) MemberRoleChange.php, (3) PropertyAssign.php, (4) WhyCameEditor.php, (5) GroupPropsEditor.php, (6) Reports/PDFLabel.php, or (7) UserDelete.php, an… | |||
| CVE-2005-2475 | 0.00 | — | 0.00 | Aug 5, 2005 | Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete. | |||
| CVE-2005-2476 | 0.03 | — | 0.02 | Aug 5, 2005 | Cross-site scripting (XSS) vulnerability in lost_passowrd.php in Naxtor Shopping Cart 1.0 allows remote attackers to inject arbitrary web script or HTML via the email parameter. | |||
| CVE-2005-2477 | 0.00 | — | 0.01 | Aug 5, 2005 | shop_display_products.php in Naxtor Shopping Cart 1.0 allows remote attackers to obtain sensitive information via a cat_id with a "'" (single quote), which reveals the path in an error message, possibly due to an SQL injection vulnerability. | |||
| CVE-2005-2478 | 0.00 | — | 0.02 | Aug 5, 2005 | SQL injection vulnerability in SilverNews 2.0.3 allows remote attackers to execute arbitrary SQL commands via the user field on the login page in the Admin control panel. | |||
| CVE-2005-2479 | 0.03 | — | 0.04 | Aug 5, 2005 | Quick 'n Easy FTP Server 3.0 allows remote attackers to cause a denial of service (application crash or CPU consumption) via a long USER command. | |||
| CVE-2005-2480 | 0.03 | — | 0.04 | Aug 5, 2005 | Cross-site scripting (XSS) vulnerability in ColdFusion Fusebox 4.1.0 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter, which is not quoted in an error page, as demonstrated using index.cfm. | |||
| CVE-2005-2481 | 0.00 | — | 0.01 | Aug 5, 2005 | ColdFusion Fusebox 4.1.0 allows remote attackers to obtain sensitive information via an invalid fuseaction parameter, which leaks the full server path in an error message, as demonstrated using the "?" (question mark) character. | |||
| CVE-2005-2453 | 0.03 | — | 0.02 | Aug 4, 2005 | Cross-site scripting (XSS) vulnerability in NetworkActiv Web Server 1.0, 2.0.0.6, 3.0.1.1, and 3.5.13, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the query string. | |||
| CVE-2005-2455 | 0.04 | — | 0.09 | Aug 4, 2005 | Greasemonkey before 0.3.5 allows remote web servers to (1) read arbitrary files via a GET request to a file:// URL in the GM_xmlhttpRequest API function, (2) list installed scripts using GM_scripts, or obtain sensitive information via (3) GM_setValue and GM_getValue. | |||
| CVE-2005-2456 | Med | 0.36 | 5.5 | 0.00 | Aug 4, 2005 | Array index overflow in the xfrm_sk_policy_insert function in xfrm_user.c in Linux kernel 2.6 allows local users to cause a denial of service (oops or deadlock) and possibly execute arbitrary code via a p->dir value that is larger than XFRM_POLICY_OUT, which is used as an index… | ||
| CVE-2005-1853 | 0.00 | — | 0.01 | Aug 3, 2005 | gopher.c in the Gopher client 3.0.5 does not properly create temporary files, which allows local users to gain privileges. | |||
| CVE-2005-2132 | 0.00 | — | 0.01 | Aug 3, 2005 | RPC portmapper (rpcbind) in SCO UnixWare 7.1.1 m5, 7.1.3 mp5, and 7.1.4 mp2 allows remote attackers or local users to cause a denial of service (lack of response) via multiple invalid portmap requests. | |||
| CVE-2005-2346 | 0.00 | — | 0.03 | Aug 3, 2005 | Buffer overflow in Novell GroupWise 6.5 Client allows remote attackers to execute arbitrary code via a GWVW02xx.INI language file with a long entry, as demonstrated using a long ES02TKS.VEW value in the Group Task section. | |||
| CVE-2005-2412 | 0.03 | — | 0.03 | Aug 3, 2005 | PHP remote file inclusion vulnerability in block.php in PHP FirstPost allows remote attackers to execute arbitrary PHP code via the Include parameter. | |||
| CVE-2005-2413 | 0.00 | — | 0.02 | Aug 3, 2005 | PHP remote file inclusion vulnerability in apa_phpinclude.inc.php in Atomic Photo Album (APA) allows remote attackers to execute arbitrary PHP code via the apa_module_basedir parameter. | |||
| CVE-2005-2414 | 0.03 | — | 0.03 | Aug 3, 2005 | Race condition in the xpcom library, as used by web browsers such as Firefox, Mozilla, Netscape, and Galeon, allows remote attackers to cause a denial of service (application crash) via a large HTML file that loads a DOM call from within nested DIV tags, which causes part of the… | |||
| CVE-2005-2415 | 0.00 | — | 0.02 | Aug 3, 2005 | Multiple SQL injection vulnerabilities in Contrexx before 1.0.5 allow remote attackers to execute arbitrary SQL commands via the (1) value parameter to the poll module or (2) pId parameter to the gallery module. | |||
| CVE-2005-2416 | 0.00 | — | 0.02 | Aug 3, 2005 | Multiple cross-site scripting (XSS) vulnerabilities in Contrexx before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) term parameter to the search module or (2) title in the blog aggregation module. | |||
| CVE-2005-2417 | 0.00 | — | 0.02 | Aug 3, 2005 | Contrexx before 1.0.5 allows remote attackers to obtain sensitive information via a direct request to /config/version.xml. | |||
| CVE-2005-2419 | 0.00 | — | 0.02 | Aug 3, 2005 | B-FOCuS Router 312+ allows remote attackers to bypass authentication and gain unauthorized access via a direct request to firmwarecfg. | |||
| CVE-2005-2420 | 0.04 | — | 0.06 | Aug 3, 2005 | flsearch.pl in FtpLocate 2.02 allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP GET request. | |||
| CVE-2005-2421 | 0.00 | — | 0.01 | Aug 3, 2005 | Multiple SQL injection vulnerabilities in index.php and other pages in Beehive Forum allow remote attackers to execute arbitrary SQL commands via the webtag parameter. | |||
| CVE-2005-2422 | 0.00 | — | 0.01 | Aug 3, 2005 | Cross-site scripting (XSS) vulnerability in index.php in Beehive Forum allows remote attackers to inject arbitrary web script or HTML via the webtag parameter. |
- CVE-2005-2540Aug 10, 2005risk 0.04cvss —epss 0.06
CRLF injection vulnerability in FlatNuke 2.5.5 and possibly earlier versions allows remote attackers to execute arbitrary PHP commands via an ASCII char 13 (carriage return) in the signature field, which is injected into a PHP script without a preceding comment character, which…
- CVE-2005-2541Aug 10, 2005risk 0.00cvss —epss 0.04
Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.
- CVE-2005-2542Aug 10, 2005risk 0.03cvss —epss 0.02
Invision Power Board (IPB) 1.0.3 allows remote attackers to inject arbitrary web script or HTML via an attachment, which is automatically downloaded and processed as HTML.
- CVE-2005-2543Aug 10, 2005risk 0.03cvss —epss 0.06
Directory traversal vulnerability in wce.download.php in Comdev eCommerce 3.0 allows remote attackers to download arbitrary files via a .. (dot dot) in the download parameter.
- CVE-2005-2544Aug 10, 2005risk 0.00cvss —epss 0.01
PHP remote file inclusion vulnerability in config.php in Comdev eCommerce 3.0 allows remote attackers to execute arbitrary PHP code via the path[docroot] parameter.
- CVE-2005-2545Aug 10, 2005risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in PHPOpenChat 3.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) content parameter to profile.php and profile_misc.php, (3) the profile fields in userpage.php, (4) subject or (5) body…
- CVE-2005-2546Aug 10, 2005risk 0.00cvss —epss 0.01
Arab Portal 2.0 allows remote attackers to obtain sensitive information via a long (1) username or (2) password, which reveals the path in an error message when the undefined "errmsg" function is called.
- CVE-2005-2500Aug 8, 2005risk 0.00cvss —epss 0.05
Buffer overflow in the xdr_xcode_array2 function in xdr.c in Linux kernel 2.6.12, as used in SuSE Linux Enterprise Server 9, might allow remote attackers to cause a denial of service and possibly execute arbitrary code via crafted XDR data for the nfsacl protocol.
- CVE-2005-2482Aug 7, 2005risk 0.00cvss —epss 0.01
The StateToOptions function in msfweb in Metasploit Framework 2.4 and earlier, when running with the -D option (defanged mode), allows attackers to modify temporary environment variables before the "_Defanged" environment option is checked when processing the Exploit command.
- CVE-2005-2483Aug 7, 2005risk 0.04cvss —epss 0.03
Eval injection vulnerability in Karrigell before 2.1.8 allows remote attackers to execute arbitrary Python code via modified arguments to a Karrigell services (.ks) script, which can reference functions from libraries that are used by that script.
- CVE-2005-2484Aug 7, 2005risk 0.00cvss —epss 0.03
Buffer overflow in the rdb_query function for Denora IRC Stats 1.0 might allow attackers to execute arbitrary code.
- CVE-2005-2485Aug 7, 2005risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Helpdesk in Logicampus before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- CVE-2005-2486Aug 7, 2005risk 0.03cvss —epss 0.01
SQL injection vulnerability in mod_forum/read_message.php in PortailPHP allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php with the affiche parameter set to "Forum-read_mess", a different vulnerability than CVE-2005-1701.
- CVE-2005-2487Aug 7, 2005risk 0.00cvss —epss 0.00
Unknown vulnerability in Sun McData switches and directors 4300, 4500, 6064, and 6140 before E/OS 6.0.0 may allow attackers to cause a denial of service (connectivity and array access loss) via a network broadcast storm.
- CVE-2005-2488Aug 7, 2005risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Web Content Management News System allows remote attackers to inject arbitrary web script or HTML via (1) the strRootpath parameter to validsession.php or (2) the strTable parameter to Admin/News/List.php.
- CVE-2005-2489Aug 7, 2005risk 0.00cvss —epss 0.02
Web Content Management News System allows remote attackers to create arbitrary accounts and gain privileges via a direct request to Admin/Users/AddModifyInput.php.
- CVE-2005-1268Aug 5, 2005risk 0.00cvss —epss 0.08
Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte.
- CVE-2005-1272Aug 5, 2005risk 0.09cvss —epss 0.66
Stack-based buffer overflow in the Backup Agent for Microsoft SQL Server in BrightStor ARCserve Backup Agent for SQL Server 11.0 allows remote attackers to execute arbitrary code via a long string sent to port (1) 6070 or (2) 6050.
- CVE-2005-1761Aug 5, 2005risk 0.00cvss —epss 0.00
Linux kernel 2.6 and 2.4 on the IA64 architecture allows local users to cause a denial of service (kernel crash) via ptrace and the restore_sigcontext function.
- CVE-2005-1767Aug 5, 2005risk 0.00cvss —epss 0.00
traps.c in the Linux kernel 2.6.x and 2.4.x executes stack segment faults on an exception stack, which allows local users to cause a denial of service (oops and stack fault exception).
- CVE-2005-1854Aug 5, 2005risk 0.00cvss —epss 0.02
Unknown vulnerability in apt-cacher in Debian 3.1, related to "missing input sanitising," allows remote attackers to execute arbitrary commands on the caching server.
- CVE-2005-2353Aug 5, 2005risk 0.00cvss —epss 0.00
run-mozilla.sh in Thunderbird, with debugging enabled, allows local users to create or overwrite arbitrary files via a symlink attack on temporary files.
- CVE-2005-2359Aug 5, 2005risk 0.00cvss —epss 0.01
The AES-XCBC-MAC algorithm in IPsec in FreeBSD 5.3 and 5.4, when used for authentication without other encryption, uses a constant key instead of the one that was assigned by the system administrator, which can allow remote attackers to spoof packets to establish an IPsec…
- CVE-2005-2471Aug 5, 2005risk 0.00cvss —epss 0.04
pstopnm in netpbm does not properly use the "-dSAFER" option when calling Ghostscript to convert a PostScript file into a (1) PBM, (2) PGM, or (3) PNM file, which allows external user-assisted attackers to execute arbitrary commands.
- CVE-2005-2472Aug 5, 2005risk 0.05cvss —epss 0.05
Multiple buffer overflows in BusinessMail 4.60.00 allow remote attackers to cause a denial of service (application crash) via a long string to SMTP (1) HELO or (2) MAIL FROM commands.
- CVE-2005-2473Aug 5, 2005risk 0.00cvss —epss 0.02
Multiple SQL injection vulnerabilities in ChurchInfo allow remote attackers to execute arbitrary SQL commands via the PersonID parameter to (1) PersonView.php, (2) MemberRoleChange.php, (3) PropertyAssign.php, (4) WhyCameEditor.php, (5) GroupPropsEditor.php, (6)…
- CVE-2005-2474Aug 5, 2005risk 0.00cvss —epss 0.02
ChurchInfo allows remote attackers to execute obtain sensitive information via the PersonID parameter to (1) PersonView.php, (2) MemberRoleChange.php, (3) PropertyAssign.php, (4) WhyCameEditor.php, (5) GroupPropsEditor.php, (6) Reports/PDFLabel.php, or (7) UserDelete.php, an…
- CVE-2005-2475Aug 5, 2005risk 0.00cvss —epss 0.00
Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.
- CVE-2005-2476Aug 5, 2005risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in lost_passowrd.php in Naxtor Shopping Cart 1.0 allows remote attackers to inject arbitrary web script or HTML via the email parameter.
- CVE-2005-2477Aug 5, 2005risk 0.00cvss —epss 0.01
shop_display_products.php in Naxtor Shopping Cart 1.0 allows remote attackers to obtain sensitive information via a cat_id with a "'" (single quote), which reveals the path in an error message, possibly due to an SQL injection vulnerability.
- CVE-2005-2478Aug 5, 2005risk 0.00cvss —epss 0.02
SQL injection vulnerability in SilverNews 2.0.3 allows remote attackers to execute arbitrary SQL commands via the user field on the login page in the Admin control panel.
- CVE-2005-2479Aug 5, 2005risk 0.03cvss —epss 0.04
Quick 'n Easy FTP Server 3.0 allows remote attackers to cause a denial of service (application crash or CPU consumption) via a long USER command.
- CVE-2005-2480Aug 5, 2005risk 0.03cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in ColdFusion Fusebox 4.1.0 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter, which is not quoted in an error page, as demonstrated using index.cfm.
- CVE-2005-2481Aug 5, 2005risk 0.00cvss —epss 0.01
ColdFusion Fusebox 4.1.0 allows remote attackers to obtain sensitive information via an invalid fuseaction parameter, which leaks the full server path in an error message, as demonstrated using the "?" (question mark) character.
- CVE-2005-2453Aug 4, 2005risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in NetworkActiv Web Server 1.0, 2.0.0.6, 3.0.1.1, and 3.5.13, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the query string.
- CVE-2005-2455Aug 4, 2005risk 0.04cvss —epss 0.09
Greasemonkey before 0.3.5 allows remote web servers to (1) read arbitrary files via a GET request to a file:// URL in the GM_xmlhttpRequest API function, (2) list installed scripts using GM_scripts, or obtain sensitive information via (3) GM_setValue and GM_getValue.
- risk 0.36cvss 5.5epss 0.00
Array index overflow in the xfrm_sk_policy_insert function in xfrm_user.c in Linux kernel 2.6 allows local users to cause a denial of service (oops or deadlock) and possibly execute arbitrary code via a p->dir value that is larger than XFRM_POLICY_OUT, which is used as an index…
- CVE-2005-1853Aug 3, 2005risk 0.00cvss —epss 0.01
gopher.c in the Gopher client 3.0.5 does not properly create temporary files, which allows local users to gain privileges.
- CVE-2005-2132Aug 3, 2005risk 0.00cvss —epss 0.01
RPC portmapper (rpcbind) in SCO UnixWare 7.1.1 m5, 7.1.3 mp5, and 7.1.4 mp2 allows remote attackers or local users to cause a denial of service (lack of response) via multiple invalid portmap requests.
- CVE-2005-2346Aug 3, 2005risk 0.00cvss —epss 0.03
Buffer overflow in Novell GroupWise 6.5 Client allows remote attackers to execute arbitrary code via a GWVW02xx.INI language file with a long entry, as demonstrated using a long ES02TKS.VEW value in the Group Task section.
- CVE-2005-2412Aug 3, 2005risk 0.03cvss —epss 0.03
PHP remote file inclusion vulnerability in block.php in PHP FirstPost allows remote attackers to execute arbitrary PHP code via the Include parameter.
- CVE-2005-2413Aug 3, 2005risk 0.00cvss —epss 0.02
PHP remote file inclusion vulnerability in apa_phpinclude.inc.php in Atomic Photo Album (APA) allows remote attackers to execute arbitrary PHP code via the apa_module_basedir parameter.
- CVE-2005-2414Aug 3, 2005risk 0.03cvss —epss 0.03
Race condition in the xpcom library, as used by web browsers such as Firefox, Mozilla, Netscape, and Galeon, allows remote attackers to cause a denial of service (application crash) via a large HTML file that loads a DOM call from within nested DIV tags, which causes part of the…
- CVE-2005-2415Aug 3, 2005risk 0.00cvss —epss 0.02
Multiple SQL injection vulnerabilities in Contrexx before 1.0.5 allow remote attackers to execute arbitrary SQL commands via the (1) value parameter to the poll module or (2) pId parameter to the gallery module.
- CVE-2005-2416Aug 3, 2005risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Contrexx before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) term parameter to the search module or (2) title in the blog aggregation module.
- CVE-2005-2417Aug 3, 2005risk 0.00cvss —epss 0.02
Contrexx before 1.0.5 allows remote attackers to obtain sensitive information via a direct request to /config/version.xml.
- CVE-2005-2419Aug 3, 2005risk 0.00cvss —epss 0.02
B-FOCuS Router 312+ allows remote attackers to bypass authentication and gain unauthorized access via a direct request to firmwarecfg.
- CVE-2005-2420Aug 3, 2005risk 0.04cvss —epss 0.06
flsearch.pl in FtpLocate 2.02 allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP GET request.
- CVE-2005-2421Aug 3, 2005risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in index.php and other pages in Beehive Forum allow remote attackers to execute arbitrary SQL commands via the webtag parameter.
- CVE-2005-2422Aug 3, 2005risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in index.php in Beehive Forum allows remote attackers to inject arbitrary web script or HTML via the webtag parameter.