CVEs

379,380 total · page 7313 of 7,588

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2005-3247	Ethereal Group Ethereal	0.00	—	0.04	Oct 27, 2005	The SigComp UDVM in Ethereal 0.10.12 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.
CVE-2005-3248	Ethereal Group Ethereal	0.00	—	0.03	Oct 27, 2005	Unspecified vulnerability in the X11 dissector in Ethereal 0.10.12 and earlier allows remote attackers to cause a denial of service (divide-by-zero) via unknown vectors.
CVE-2005-3249	Ethereal Group Ethereal	0.00	—	0.03	Oct 27, 2005	Unspecified vulnerability in the WSP dissector in Ethereal 0.10.1 to 0.10.12 allows remote attackers to cause a denial of service or corrupt memory via unknown vectors that cause Ethereal to free an invalid pointer.
CVE-2005-3265	Skype Technologies Skype	0.00	—	0.06	Oct 27, 2005	Buffer overflow in Skype for Windows 1.1.x.0 through 1.4.x.83 allows remote attackers to execute arbitrary code via (1) callto:// and (2) skype:// links, or (3) a non-standard VCARD, possibly due to an underlying error in the SysUtils.WideFmtStr Delphi routine.
CVE-2005-3267	Skype Technologies Skype	0.01	—	0.07	Oct 27, 2005	Integer overflow in Skype client before 1.4.x.84 on Windows, before 1.3.x.17 on Mac OS, before 1.2.x.18 on Linux, and 1.1.x.6 and earlier allows remote attackers to cause a denial of service (crash) via crafted network data with a large Object Counter value, which leads to a…
CVE-2005-3316	Symantec Discovery	0.00	—	0.01	Oct 27, 2005	The installation of ON Symantec Discovery 4.5.x and Symantec Discovery 6.0 creates the (1) DiscoveryWeb and (2) DiscoveryRO database accounts with null passwords, which could allow attackers to gain privileges or prevent Discovery from running by setting another password.
CVE-2005-3317	Zipgenius Zipgenius	0.00	—	0.06	Oct 27, 2005	Multiple stack-based buffer overflows in ZipGenius 5.5.1.468 and 6.0.2.1041, and other versions before 6.0.2.1050, allow remote attackers to execute arbitrary code via (1) a ZIP archive that contains a file with a long filename, which is not properly handled by (a)…
CVE-2005-3318	Chmlib Chmlib	0.00	—	0.04	Oct 27, 2005	Buffer overflow in the _chm_decompress_block function in CHM lib (chmlib) before 0.37, as used in products such as KchmViewer, allows attackers to execute arbitrary code, a different vulnerability than CVE-2005-2930.
CVE-2005-3319	PHP PHP	0.00	—	0.01	Oct 27, 2005	The apache2handler SAPI (sapi_apache2.c) in the Apache module (mod_php) for PHP 5.x before 5.1.0 final and 4.4 before 4.4.1 final allows attackers to cause a denial of service (segmentation fault) via the session.save_path option in a .htaccess file or VirtualHost.
CVE-2005-3320	Siteturn Domain Manager Pro	0.03	—	0.02	Oct 27, 2005	Cross-site scripting (XSS) vulnerability in SiteTurn Domain Manager Pro allows remote attackers to inject arbitrary web script or HTML via the err parameter in the panel script.
CVE-2005-3321	Novell Suse Linux	0.00	—	0.00	Oct 27, 2005	chkstat in SuSE Linux 9.0 through 10.0 allows local users to modify permissions of files by creating a hardlink to a file from a world-writable directory, which can cause the link count to drop to 1 when the file is deleted or replaced, which is then modified by chkstat to use…
CVE-2005-3322	Squid Cache Squid	0.00	—	0.03	Oct 27, 2005	Unspecified vulnerability in Squid on SUSE Linux 9.0 allows remote attackers to cause a denial of service (crash) via HTTPs (SSL).
CVE-2005-3323	Zope Zope	0.00	—	0.03	Oct 27, 2005	docutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in RestructuredText functionality.
CVE-2005-3324	Appindex Mwchat	0.03	—	0.02	Oct 27, 2005	SQL injection vulnerability in chat.php in MWChat 6.8 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVE-2005-3325	Basic Analysis And Security Engine Base	0.03	—	0.03	Oct 27, 2005	Multiple SQL injection vulnerabilities in (1) acid_qry_main.php in Analysis Console for Intrusion Databases (ACID) 0.9.6b20 and (2) base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.2, and unspecified other console scripts in these products, allow remote attackers…
CVE-2005-3326	MyBB Mybb	0.03	—	0.02	Oct 27, 2005	SQL injection vulnerability in usercp.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the awayday parameter.
CVE-2005-3327	Network Appliance Data Ontap	0.00	—	0.02	Oct 27, 2005	Network Appliance Data ONTAP 7.0 and earlier allows iSCSI Initiators to bypass iSCSI authentication via a modified client that skips the Security (Start) mode, as required by the Login Negotiation protocol, and uses Operational mode without proving identity.
CVE-2005-3328	Punbb Punbb	0.00	—	0.03	Oct 27, 2005	PHP remote file inclusion vulnerability in common.php in PunBB 1.1.2 through 1.1.5 allows remote attackers to execute arbitrary code via the pun_root parameter.
CVE-2005-3329	Rsa Authentication Agent For Web	0.03	—	0.02	Oct 27, 2005	Cross-site scripting (XSS) vulnerability in RSA Authentication Agent for Web 5.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the image parameter in a GetPic operation.
CVE-2005-3330	Snoopy Snoopy	0.04	—	0.17	Oct 27, 2005	The _httpsrequest function in Snoopy 1.2, as used in products such as (1) MagpieRSS, (2) WordPress, (3) Ampache, and (4) Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL to an SSL protected web page, which is not properly…
CVE-2005-3331	Mgdiff mgdiff	0.00	—	0.00	Oct 27, 2005	viewpatch in mgdiff 1.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVE-2005-3332	Belchior Foundry Vcard	0.03	—	0.02	Oct 27, 2005	PHP remote file include vulnerability in admin/define.inc.php in Belchior Foundry vCard 2.9 allows remote attackers to execute arbitrary PHP code via the match parameter.
CVE-2005-3333	Ebase Ebaseweb	0.00	—	0.01	Oct 27, 2005	SQL injection vulnerability in eBASEweb 3.0 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVE-2005-3334	Flyspray Flyspray	0.03	—	0.05	Oct 27, 2005	Cross-site scripting (XSS) vulnerability in index.php in Flyspray 0.9.7 through 0.9.8 (devel) allows remote attackers to inject arbitrary web script or HTML via the (1) PHPSESSID, (2) task, (3) string, (4) type, (5) serv, (6) due, (7) dev, and (8) sort2 parameters.
CVE-2005-3335	Mantisbt Mantis	0.01	—	0.07	Oct 27, 2005	PHP file inclusion vulnerability in bug_sponsorship_list_view_inc.php in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the t_core_path parameter.
CVE-2005-3336	Mantisbt Mantis	0.00	—	0.02	Oct 27, 2005	SQL injection vulnerability in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVE-2005-3337	Mantisbt Mantis	0.00	—	0.01	Oct 27, 2005	Multiple cross-site scripting (XSS) vulnerabilities in Mantis before 0.19.3 allow remote attackers to inject arbitrary web script or HTML via (1) unknown vectors involving Javascript and (2) mantis/view_all_set.php.
CVE-2005-3338	Mantisbt Mantis	0.00	—	0.01	Oct 27, 2005	Unspecified vulnerability in Mantis before 0.19.3, when using reminders, causes Mantis to display the real email addresses of users.
CVE-2005-3339	Mantisbt Mantis	0.00	—	0.00	Oct 27, 2005	Mantis before 0.19.3 caches the User ID longer than necessary, which has unknown impact and attack vectors.
CVE-2005-2338	XOOPS Xoops	0.00	—	0.02	Oct 27, 2005	Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.12 JP and earlier, XOOPS 2.0.13.1 and earlier, and 2.2.x up to 2.2.3 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) modules that use "XOOPS Code" and (2) newbb in the forum module.
CVE-2005-3312	Microsoft Internet Explorer	0.01	—	0.12	Oct 26, 2005	The HTML rendering engine in Microsoft Internet Explorer 6.0 allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML in corrupted images and other files such as .GIF, JPG, and WAV, which is rendered as HTML when the user clicks on the link, even though the…
CVE-2005-3304	PHP-Nuke PHP Nuke	0.03	—	0.06	Oct 26, 2005	Multiple SQL injection vulnerabilities in PHP-Nuke 7.8 allow remote attackers to modify SQL queries and execute arbitrary PHP code via (1) the username parameter in the Your Account page, (2) the url parameter in the Downloads module, and (3) the description parameter in the…
CVE-2005-3305	Nuked Klan Nuked Klan	0.03	—	0.02	Oct 26, 2005	Multiple SQL injection vulnerabilities in Nuked Klan 1.7 allow remote attackers to execute arbitrary SQL commands via the (1) forum_id or (2) thread_id parameter in the Forum file, (3) the link_id in the Links file, (4) the artid parameter in the Sections file, and (5) the dl_id…
CVE-2005-3306	Flatnuke Flatnuke	0.00	—	0.01	Oct 26, 2005	Cross-site scripting (XSS) vulnerability in index.php for FlatNuke 2.5.6 allows remote attackers to inject arbitrary web script or HTML via the user parameter in a profile operation, a different vulnerability than CVE-2005-2814. NOTE: it is possible that this XSS is a resultant…
CVE-2005-3307	Flatnuke Flatnuke	0.03	—	0.03	Oct 26, 2005	Directory traversal vulnerability in index.php for FlatNuke 2.5.6 allows remote attackers to read arbitrary files via ".." sequences in the (1) user parameter in a profile operation or (2) quale parameter in a newtopic operation.
CVE-2005-3308	Zomplog Zomplog	0.03	—	0.02	Oct 26, 2005	Multiple cross-site scripting (XSS) vulnerabilities in Zomplog 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) comment parameter in detail.php, (3) the username parameter in get.php, and (4) the search parameter in index.php.
CVE-2005-3309	Zomplog Zomplog	0.00	—	0.01	Oct 26, 2005	Multiple SQL injection vulnerabilities in Zomplog 3.4 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in detail.php and the catid parameter in (2) get.php and (3) index.php.
CVE-2005-3310	PhpBB phpBB	0.00	—	0.01	Oct 26, 2005	Interpretation conflict in phpBB 2.0.17, with remote avatars and avatar uploading enabled, allows remote authenticated users to inject arbitrary web script or HTML via an HTML file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the…
CVE-2005-3311	BMC Software Software Control M Agent	0.00	—	0.00	Oct 26, 2005	BMC Software Control-M 6.1.03 for Solaris, and possibly other platforms, allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVE-2005-2524	Apple Inc. Mac OS X	0.00	—	0.01	Oct 26, 2005	Safari after 2.0 in Apple Mac OS X 10.3.9 allows remote attackers to bypass domain restrictions via crafted web archives that cause Safari to render them as if they came from a different site.
CVE-2005-2741	Apple Inc. Mac OS X	0.00	—	0.00	Oct 26, 2005	Authorization Services in securityd for Apple Mac OS X 10.3.9 allows local users to gain privileges by granting themselves certain rights that should be restricted to administrators.
CVE-2005-2742	Apple Inc. Mac OS X	0.00	—	0.00	Oct 26, 2005	SecurityAgent in Apple Mac OS X 10.4.2, under certain circumstances, can cause the "Switch User..." button to appear even though the "Enable fast user switching" setting is disabled, which can allow attackers with physical access to gain access to the desktop and bypass the…
CVE-2005-2743	Apple Inc. Mac OS X	0.00	—	0.05	Oct 26, 2005	The Java extensions for QuickTime 6.52 and earlier in Apple Mac OS X 10.3.9 allow untrusted applets to call arbitrary functions in system libraries, which allows remote attackers to execute arbitrary code.
CVE-2005-2745	Apple Inc. Mac OS X	0.00	—	0.01	Oct 26, 2005	Mail.app in Mail for Apple Mac OS X 10.3.9, when using Kerberos 5 for SMTP authentication, can include uninitialized memory in a message, which might allow remote attackers to obtain sensitive information.
CVE-2005-2746	Apple Inc. Mac OS X	0.00	—	0.01	Oct 26, 2005	Mail.app in Mail for Apple Mac OS X 10.3.9 and 10.4.2 includes message contents when using auto-reply rules, which could cause Mail.app to include decrypted message contents for encrypted messages.
CVE-2005-2744	Apple Inc. QuickDraw Manager	0.00	—	0.04	Oct 25, 2005	Buffer overflow in QuickDraw Manager for Apple OS X 10.3.9 and 10.4.2, as used by applications such as Safari, Mail, and Finder, allows remote attackers to execute arbitrary code via a crafted PICT file.
CVE-2005-2747	Apple Inc. Mac OS X	0.00	—	0.05	Oct 25, 2005	Buffer overflow in ImageIO for Apple Mac OS X 10.4.2, as used by applications such as WebCore and Safari, allows remote attackers to execute arbitrary code via a crafted GIF file.
CVE-2005-2748	Apple Inc. Mac OS X	0.00	—	0.00	Oct 25, 2005	The malloc function in the libSystem library in Apple Mac OS X 10.3.9 and 10.4.2 allows local users to overwrite arbitrary files by setting the MallocLogFile environment variable to the target file before running a setuid application.
CVE-2005-2708	Linux Kernel	0.00	—	0.01	Oct 25, 2005	The search_binary_handler function in exec.c in Linux 2.4 kernel on 64-bit x86 architectures does not check a return code for a particular function call when virtual memory is low, which allows local users to cause a denial of service (panic), as demonstrated by running a…
CVE-2005-2100	Linux Kernel	0.00	—	0.00	Oct 25, 2005	The rw_vm function in usercopy.c in the 4GB split patch for the Linux kernel in Red Hat Enterprise Linux 4 does not perform proper bounds checking, which allows local users to cause a denial of service (crash).

CVE-2005-3247Oct 27, 2005
Ethereal Group
Ethereal
risk 0.00cvss —epss 0.04
The SigComp UDVM in Ethereal 0.10.12 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.
CVE-2005-3248Oct 27, 2005
Ethereal Group
Ethereal
risk 0.00cvss —epss 0.03
Unspecified vulnerability in the X11 dissector in Ethereal 0.10.12 and earlier allows remote attackers to cause a denial of service (divide-by-zero) via unknown vectors.
CVE-2005-3249Oct 27, 2005
Ethereal Group
Ethereal
risk 0.00cvss —epss 0.03
Unspecified vulnerability in the WSP dissector in Ethereal 0.10.1 to 0.10.12 allows remote attackers to cause a denial of service or corrupt memory via unknown vectors that cause Ethereal to free an invalid pointer.
CVE-2005-3265Oct 27, 2005
Skype Technologies
Skype
risk 0.00cvss —epss 0.06
Buffer overflow in Skype for Windows 1.1.x.0 through 1.4.x.83 allows remote attackers to execute arbitrary code via (1) callto:// and (2) skype:// links, or (3) a non-standard VCARD, possibly due to an underlying error in the SysUtils.WideFmtStr Delphi routine.
CVE-2005-3267Oct 27, 2005
Skype Technologies
Skype
risk 0.01cvss —epss 0.07
Integer overflow in Skype client before 1.4.x.84 on Windows, before 1.3.x.17 on Mac OS, before 1.2.x.18 on Linux, and 1.1.x.6 and earlier allows remote attackers to cause a denial of service (crash) via crafted network data with a large Object Counter value, which leads to a…
CVE-2005-3316Oct 27, 2005
Symantec
Discovery
risk 0.00cvss —epss 0.01
The installation of ON Symantec Discovery 4.5.x and Symantec Discovery 6.0 creates the (1) DiscoveryWeb and (2) DiscoveryRO database accounts with null passwords, which could allow attackers to gain privileges or prevent Discovery from running by setting another password.
CVE-2005-3317Oct 27, 2005
Zipgenius
Zipgenius
risk 0.00cvss —epss 0.06
Multiple stack-based buffer overflows in ZipGenius 5.5.1.468 and 6.0.2.1041, and other versions before 6.0.2.1050, allow remote attackers to execute arbitrary code via (1) a ZIP archive that contains a file with a long filename, which is not properly handled by (a)…
CVE-2005-3318Oct 27, 2005
Chmlib
Chmlib
risk 0.00cvss —epss 0.04
Buffer overflow in the _chm_decompress_block function in CHM lib (chmlib) before 0.37, as used in products such as KchmViewer, allows attackers to execute arbitrary code, a different vulnerability than CVE-2005-2930.
CVE-2005-3319Oct 27, 2005
PHP
PHP
risk 0.00cvss —epss 0.01
The apache2handler SAPI (sapi_apache2.c) in the Apache module (mod_php) for PHP 5.x before 5.1.0 final and 4.4 before 4.4.1 final allows attackers to cause a denial of service (segmentation fault) via the session.save_path option in a .htaccess file or VirtualHost.
CVE-2005-3320Oct 27, 2005
Siteturn
Domain Manager Pro
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in SiteTurn Domain Manager Pro allows remote attackers to inject arbitrary web script or HTML via the err parameter in the panel script.
CVE-2005-3321Oct 27, 2005
Novell
Suse Linux
risk 0.00cvss —epss 0.00
chkstat in SuSE Linux 9.0 through 10.0 allows local users to modify permissions of files by creating a hardlink to a file from a world-writable directory, which can cause the link count to drop to 1 when the file is deleted or replaced, which is then modified by chkstat to use…
CVE-2005-3322Oct 27, 2005
Squid Cache
Squid
risk 0.00cvss —epss 0.03
Unspecified vulnerability in Squid on SUSE Linux 9.0 allows remote attackers to cause a denial of service (crash) via HTTPs (SSL).
CVE-2005-3323Oct 27, 2005
Zope
Zope
risk 0.00cvss —epss 0.03
docutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in RestructuredText functionality.
CVE-2005-3324Oct 27, 2005
Appindex
Mwchat
risk 0.03cvss —epss 0.02
SQL injection vulnerability in chat.php in MWChat 6.8 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVE-2005-3325Oct 27, 2005
Basic Analysis And Security Engine
Base
risk 0.03cvss —epss 0.03
Multiple SQL injection vulnerabilities in (1) acid_qry_main.php in Analysis Console for Intrusion Databases (ACID) 0.9.6b20 and (2) base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.2, and unspecified other console scripts in these products, allow remote attackers…
CVE-2005-3326Oct 27, 2005
MyBB
Mybb
risk 0.03cvss —epss 0.02
SQL injection vulnerability in usercp.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the awayday parameter.
CVE-2005-3327Oct 27, 2005
Network Appliance
Data Ontap
risk 0.00cvss —epss 0.02
Network Appliance Data ONTAP 7.0 and earlier allows iSCSI Initiators to bypass iSCSI authentication via a modified client that skips the Security (Start) mode, as required by the Login Negotiation protocol, and uses Operational mode without proving identity.
CVE-2005-3328Oct 27, 2005
Punbb
Punbb
risk 0.00cvss —epss 0.03
PHP remote file inclusion vulnerability in common.php in PunBB 1.1.2 through 1.1.5 allows remote attackers to execute arbitrary code via the pun_root parameter.
CVE-2005-3329Oct 27, 2005
Rsa
Authentication Agent For Web
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in RSA Authentication Agent for Web 5.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the image parameter in a GetPic operation.
CVE-2005-3330Oct 27, 2005
Snoopy
Snoopy
risk 0.04cvss —epss 0.17
The _httpsrequest function in Snoopy 1.2, as used in products such as (1) MagpieRSS, (2) WordPress, (3) Ampache, and (4) Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL to an SSL protected web page, which is not properly…
CVE-2005-3331Oct 27, 2005
Mgdiff
mgdiff
risk 0.00cvss —epss 0.00
viewpatch in mgdiff 1.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVE-2005-3332Oct 27, 2005
Belchior Foundry
Vcard
risk 0.03cvss —epss 0.02
PHP remote file include vulnerability in admin/define.inc.php in Belchior Foundry vCard 2.9 allows remote attackers to execute arbitrary PHP code via the match parameter.
CVE-2005-3333Oct 27, 2005
Ebase
Ebaseweb
risk 0.00cvss —epss 0.01
SQL injection vulnerability in eBASEweb 3.0 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVE-2005-3334Oct 27, 2005
Flyspray
Flyspray
risk 0.03cvss —epss 0.05
Cross-site scripting (XSS) vulnerability in index.php in Flyspray 0.9.7 through 0.9.8 (devel) allows remote attackers to inject arbitrary web script or HTML via the (1) PHPSESSID, (2) task, (3) string, (4) type, (5) serv, (6) due, (7) dev, and (8) sort2 parameters.
CVE-2005-3335Oct 27, 2005
Mantisbt
Mantis
risk 0.01cvss —epss 0.07
PHP file inclusion vulnerability in bug_sponsorship_list_view_inc.php in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the t_core_path parameter.
CVE-2005-3336Oct 27, 2005
Mantisbt
Mantis
risk 0.00cvss —epss 0.02
SQL injection vulnerability in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVE-2005-3337Oct 27, 2005
Mantisbt
Mantis
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Mantis before 0.19.3 allow remote attackers to inject arbitrary web script or HTML via (1) unknown vectors involving Javascript and (2) mantis/view_all_set.php.
CVE-2005-3338Oct 27, 2005
Mantisbt
Mantis
risk 0.00cvss —epss 0.01
Unspecified vulnerability in Mantis before 0.19.3, when using reminders, causes Mantis to display the real email addresses of users.
CVE-2005-3339Oct 27, 2005
Mantisbt
Mantis
risk 0.00cvss —epss 0.00
Mantis before 0.19.3 caches the User ID longer than necessary, which has unknown impact and attack vectors.
CVE-2005-2338Oct 27, 2005
XOOPS
Xoops
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.12 JP and earlier, XOOPS 2.0.13.1 and earlier, and 2.2.x up to 2.2.3 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) modules that use "XOOPS Code" and (2) newbb in the forum module.
CVE-2005-3312Oct 26, 2005
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.12
The HTML rendering engine in Microsoft Internet Explorer 6.0 allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML in corrupted images and other files such as .GIF, JPG, and WAV, which is rendered as HTML when the user clicks on the link, even though the…
CVE-2005-3304Oct 26, 2005
PHP-Nuke
PHP Nuke
risk 0.03cvss —epss 0.06
Multiple SQL injection vulnerabilities in PHP-Nuke 7.8 allow remote attackers to modify SQL queries and execute arbitrary PHP code via (1) the username parameter in the Your Account page, (2) the url parameter in the Downloads module, and (3) the description parameter in the…
CVE-2005-3305Oct 26, 2005
Nuked Klan
Nuked Klan
risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in Nuked Klan 1.7 allow remote attackers to execute arbitrary SQL commands via the (1) forum_id or (2) thread_id parameter in the Forum file, (3) the link_id in the Links file, (4) the artid parameter in the Sections file, and (5) the dl_id…
CVE-2005-3306Oct 26, 2005
Flatnuke
Flatnuke
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in index.php for FlatNuke 2.5.6 allows remote attackers to inject arbitrary web script or HTML via the user parameter in a profile operation, a different vulnerability than CVE-2005-2814. NOTE: it is possible that this XSS is a resultant…
CVE-2005-3307Oct 26, 2005
Flatnuke
Flatnuke
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in index.php for FlatNuke 2.5.6 allows remote attackers to read arbitrary files via ".." sequences in the (1) user parameter in a profile operation or (2) quale parameter in a newtopic operation.
CVE-2005-3308Oct 26, 2005
Zomplog
Zomplog
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Zomplog 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) comment parameter in detail.php, (3) the username parameter in get.php, and (4) the search parameter in index.php.
CVE-2005-3309Oct 26, 2005
Zomplog
Zomplog
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in Zomplog 3.4 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in detail.php and the catid parameter in (2) get.php and (3) index.php.
CVE-2005-3310Oct 26, 2005
PhpBB
phpBB
risk 0.00cvss —epss 0.01
Interpretation conflict in phpBB 2.0.17, with remote avatars and avatar uploading enabled, allows remote authenticated users to inject arbitrary web script or HTML via an HTML file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the…
CVE-2005-3311Oct 26, 2005
BMC Software
Software Control M Agent
risk 0.00cvss —epss 0.00
BMC Software Control-M 6.1.03 for Solaris, and possibly other platforms, allows local users to overwrite arbitrary files via a symlink attack on temporary files.
CVE-2005-2524Oct 26, 2005
Apple Inc.
Mac OS X
risk 0.00cvss —epss 0.01
Safari after 2.0 in Apple Mac OS X 10.3.9 allows remote attackers to bypass domain restrictions via crafted web archives that cause Safari to render them as if they came from a different site.
CVE-2005-2741Oct 26, 2005
Apple Inc.
Mac OS X
risk 0.00cvss —epss 0.00
Authorization Services in securityd for Apple Mac OS X 10.3.9 allows local users to gain privileges by granting themselves certain rights that should be restricted to administrators.
CVE-2005-2742Oct 26, 2005
Apple Inc.
Mac OS X
risk 0.00cvss —epss 0.00
SecurityAgent in Apple Mac OS X 10.4.2, under certain circumstances, can cause the "Switch User..." button to appear even though the "Enable fast user switching" setting is disabled, which can allow attackers with physical access to gain access to the desktop and bypass the…
CVE-2005-2743Oct 26, 2005
Apple Inc.
Mac OS X
risk 0.00cvss —epss 0.05
The Java extensions for QuickTime 6.52 and earlier in Apple Mac OS X 10.3.9 allow untrusted applets to call arbitrary functions in system libraries, which allows remote attackers to execute arbitrary code.
CVE-2005-2745Oct 26, 2005
Apple Inc.
Mac OS X
risk 0.00cvss —epss 0.01
Mail.app in Mail for Apple Mac OS X 10.3.9, when using Kerberos 5 for SMTP authentication, can include uninitialized memory in a message, which might allow remote attackers to obtain sensitive information.
CVE-2005-2746Oct 26, 2005
Apple Inc.
Mac OS X
risk 0.00cvss —epss 0.01
Mail.app in Mail for Apple Mac OS X 10.3.9 and 10.4.2 includes message contents when using auto-reply rules, which could cause Mail.app to include decrypted message contents for encrypted messages.
CVE-2005-2744Oct 25, 2005
Apple Inc.
QuickDraw Manager
risk 0.00cvss —epss 0.04
Buffer overflow in QuickDraw Manager for Apple OS X 10.3.9 and 10.4.2, as used by applications such as Safari, Mail, and Finder, allows remote attackers to execute arbitrary code via a crafted PICT file.
CVE-2005-2747Oct 25, 2005
Apple Inc.
Mac OS X
risk 0.00cvss —epss 0.05
Buffer overflow in ImageIO for Apple Mac OS X 10.4.2, as used by applications such as WebCore and Safari, allows remote attackers to execute arbitrary code via a crafted GIF file.
CVE-2005-2748Oct 25, 2005
Apple Inc.
Mac OS X
risk 0.00cvss —epss 0.00
The malloc function in the libSystem library in Apple Mac OS X 10.3.9 and 10.4.2 allows local users to overwrite arbitrary files by setting the MallocLogFile environment variable to the target file before running a setuid application.
CVE-2005-2708Oct 25, 2005
Linux
Kernel
risk 0.00cvss —epss 0.01
The search_binary_handler function in exec.c in Linux 2.4 kernel on 64-bit x86 architectures does not check a return code for a particular function call when virtual memory is low, which allows local users to cause a denial of service (panic), as demonstrated by running a…
CVE-2005-2100Oct 25, 2005
Linux
Kernel
risk 0.00cvss —epss 0.00
The rw_vm function in usercopy.c in the 4GB split patch for the Linux kernel in Red Hat Enterprise Linux 4 does not perform proper bounds checking, which allows local users to cause a denial of service (crash).