CVEs

379,221 total · page 7328 of 7,585

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2005-2371	Oracle Corporation Reports	0.02	—	0.22	Jul 26, 2005	Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via (1) "..", (2) Windows drive letter (C:), and (3) absolute path sequences in the desname parameter. NOTE: this issue was probably fixed by REP06 in…
CVE-2005-2372	Oracle Corporation Forms	0.00	—	0.03	Jul 26, 2005	Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1)…
CVE-2005-2373	Whitsoft Development Slimftpd	0.07	—	0.46	Jul 26, 2005	Buffer overflow in SlimFTPd 3.15 and 3.16 allows remote authenticated users to execute arbitrary code via a long directory name to (1) LIST, (2) DELE or (3) RNFR commands.
CVE-2005-2374	Belkin 54g Wireless Router	0.00	—	0.02	Jul 26, 2005	Belkin 54g wireless routers do not properly set an administrative password, which allows remote attackers to gain access via the (1) Telnet or (2) web administration interfaces.
CVE-2005-2375	Codemasters Toca Race Driver	0.00	—	0.01	Jul 26, 2005	Format string vulnerability in Race Driver 1.20 and earlier allows remote attackers to cause a denial of service (application crash) via format string specifiers in a (1) nickname or (2) chat message.
CVE-2005-2376	Race Driver Race Driver	0.00	—	0.01	Jul 26, 2005	Buffer overflow in Race Driver 1.20 and earlier allows remote attackers to cause a denial of service (application crash) via a long (1) nickname or (2) chat message.
CVE-2005-2377	Mandriva nss_ldap	0.00	—	0.03	Jul 26, 2005	nss_ldap 181 to versions before 213, as used in Mandrake Corporate Server and Mandrake 10.0, and other operating systems, does not properly handle a SIGPIPE signal when sending a search request to an LDAP directory server, which might allow remote attackers to cause a denial of…
CVE-2005-2378	Oracle Corporation Reports	0.01	—	0.09	Jul 26, 2005	Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the (1) CUSTOMIZE or (2) desformat parameters to rwservlet. NOTE: vector 2 is probably the same as CVE-2006-0289, and fixed in Jan 2006 CPU.
CVE-2005-2379	Oracle Corporation Reports	0.00	—	0.04	Jul 26, 2005	Multiple cross-site scripting (XSS) vulnerabilities in Oracle Reports 9.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) debug parameter to showenv, (2) test parameter to parsequery, or (3) delimiter or (4) CELLWRAPPER parameter to rwservlet.
CVE-2005-2380	PHP Surveyor Phpsurveyor	0.00	—	0.01	Jul 26, 2005	Multiple cross-site scripting vulnerabilities in PHP Surveyor 0.98 allow remote attackers to inject arbitrary web script or HTML via the (1) sid, (2) start, and (3) id parameters to browse.php, or the sid parameter to (4) dataentry.php or (5) export.php.
CVE-2005-2381	PHP Surveyor Phpsurveyor	0.00	—	0.01	Jul 26, 2005	PHP Surveyor 0.98 allows remote attackers to obtain sensitive information via a direct request to (1) question.php, (2) survey.php, or (3) group.php in the root directory, a direct request to (4) database.php, (5) sessioncontrol.php, (6) html.php, (7) sessioncontrol.php, an…
CVE-2005-2382	Oray Peanuthull	0.00	—	0.01	Jul 26, 2005	Oray PeanutHull 3.0.1.0 and earlier does not properly drop SYSTEM privileges when launched from the system tray, which allows local users to gain privileges by accessing the Help functionality.
CVE-2005-2383	Phpnews Phpnews	0.03	—	0.01	Jul 26, 2005	SQL injection vulnerability in auth.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the user parameter in an HTTP POST request.
CVE-2005-2327	E107 E107	0.03	—	0.03	Jul 20, 2005	Cross-site scripting (XSS) vulnerability in e107 0.617 and earlier allows remote attackers to inject arbitrary web script or HTML via nested [url] BBCode tags.
CVE-2005-2328	Laffer Laffer	0.00	—	0.01	Jul 20, 2005	PHP remote file inclusion vulnerability in im.php in Laffer 0.3.2.6 and 0.3.2.7 allows remote attackers to execute arbitrary PHP code via the CFG_PATH variable.
CVE-2005-2329	MRV Communications In-Reach	0.00	—	0.01	Jul 20, 2005	MRV Communications In-Reach LX-8000S, LX-4000S, and LX-1000S 3.5.0, when using SSH public key authentication, does not properly restrict access to ports, which allows remote authenticated users to access the consoles of other users.
CVE-2005-2330	OsCommerce Oscommerce	0.04	—	0.10	Jul 20, 2005	Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via (1) .. sequences or (2) a full pathname in the readme_file parameter.
CVE-2005-2331	Moosegallery Moosegallery	0.00	—	0.01	Jul 20, 2005	PHP remote file inclusion vulnerability in display.php in MooseGallery allows remote attackers to execute arbitrary PHP code via the type parameter.
CVE-2005-2332	Php.warpedweb.net Phppageprotect	0.00	—	0.01	Jul 20, 2005	Cross-site scripting (XSS) vulnerability in PHPPageProtect 1.0.0a allows remote attackers to inject arbitrary web script or HTML via the username parameter to (1) admin.php or (2) login.php.
CVE-2005-2333	Seo Board Seo Board	0.00	—	0.01	Jul 20, 2005	Cross-site scripting (XSS) vulnerability in smilies_popup.php in SEO-Board 1.0 allows remote attackers to inject arbitrary web script or HTML via the doc parameter.
CVE-2005-2334	Y.sak Y.sak	0.00	—	0.03	Jul 20, 2005	Y.SAK allows remote attackers to execute arbitrary commands via shell metacharacters in the $no variable to (1) w_s3mbfm.cgi, (2) w_s3adix.cgi, or (3) w_s3sbfm.cgi.
CVE-2005-1530	Sophos Small Business Suite	0.00	—	0.06	Jul 19, 2005	Sophos Anti-Virus 5.0.1, with "Scan inside archive files" enabled, allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a Bzip2 archive with a large 'Extra field length' value.
CVE-2005-1850	Ekg Ekg	0.00	—	0.02	Jul 19, 2005	Certain contributed scripts for ekg Gadu Gadu client 1.5 and earlier create temporary files insecurely, with unknown impact and attack vectors, a different vulnerability than CVE-2005-1916.
CVE-2005-1851	Ekg Ekg	0.00	—	0.02	Jul 19, 2005	A certain contributed script for ekg Gadu Gadu client 1.5 and earlier allows attackers to execute shell commands via unknown attack vectors.
CVE-2005-2196	Apple Inc. AirPort	0.00	—	0.00	Jul 19, 2005	The Apple AirPort card uses a default WEP key when not connected to a known or trusted network, which can cause it to automatically connect to a malicious network.
CVE-2005-2297	Sybase Easerver	0.09	—	0.74	Jul 19, 2005	Stack-based buffer overflow in TreeAction.do in Sybase EAServer 4.2.5 through 5.2 allows remote authenticated users to execute arbitrary code via a large javascript parameter.
CVE-2005-2298	Bitdefender Bitdefender Engine	0.00	—	0.01	Jul 19, 2005	BitDefender Engine 1.6.1 and earlier does not properly scan all attachments, which allows remote attackers to bypass virus scanning via begin and end commands in the body of the e-mail, which BitDefender treats as a uuencoded attachment and stops scanning afterwards.
CVE-2005-2299	—	0.00	—	0.01	Jul 19, 2005	Multiple cross-site scripting (XSS) vulnerabilities in Simple Message Board Version 2.0 Beta 1 allow remote attackers to inject arbitrary web script or HTML via the (1) FID parameter to forum.cfm, (2) UID parameter to user.cfm, (3) TID parameter to thread.cfm, or (4) PostDate…
CVE-2005-2300	Skype Technologies Skype	0.00	—	0.00	Jul 19, 2005	Skype 1.1.0.20 and earlier allows local users to overwrite arbitrary files via a symlink attack on the skype_profile.jpg temporary file.
CVE-2005-2301	PowerDNS Powerdns	0.00	—	0.03	Jul 19, 2005	PowerDNS before 2.9.18, when running with an LDAP backend, does not properly escape LDAP queries, which allows remote attackers to cause a denial of service (failure to answer ldap questions) and possibly conduct an LDAP injection attack.
CVE-2005-2302	PowerDNS Powerdns	0.00	—	0.00	Jul 19, 2005	PowerDNS before 2.9.18, when allowing recursion to a restricted range of IP addresses, does not properly handle questions from clients that are denied recursion, which could cause a "blank out" of answers to those clients that are allowed to use recursion.
CVE-2005-2304	Microsoft Internet Explorer	0.01	—	0.09	Jul 19, 2005	Microsoft MSN Messenger 9.0 and Internet Explorer 6.0 allows remote attackers to cause a denial of service (crash) via an image with an ICC Profile with a large Tag Count.
CVE-2005-2305	Dg Remote Control Server	0.03	—	0.05	Jul 19, 2005	DG Remote Control Server 1.6.2 allows remote attackers to cause a denial of service (crash or CPU consumption) and possibly execute arbitrary code via a long message to TCP port 1071 or 1073, possibly due to a buffer overflow.
CVE-2005-2306	Macromedia Jrun	0.00	—	0.00	Jul 19, 2005	Race condition in Macromedia JRun 4.0, ColdFusion MX 6.1 and 7.0, when under heavy load, causes JRun to assign a duplicate authentication token to multiple sessions, which could allow authenticated users to gain privileges as other users.
CVE-2005-2307	Microsoft Windows Connections Manager Library	0.05	—	0.26	Jul 19, 2005	netman.dll in Microsoft Windows Connections Manager Library allows local users to cause a denial of service (Network Connections Service crash) via a large integer argument to a particular function, aka "Network Connection Manager Vulnerability."
CVE-2005-2308	Microsoft Internet Explorer	0.04	—	0.17	Jul 19, 2005	The JPEG decoder in Microsoft Internet Explorer allows remote attackers to cause a denial of service (CPU consumption or crash) and possibly execute arbitrary code via certain crafted JPEG images, as demonstrated using (1) mov_fencepost.jpg, (2) cmp_fencepost.jpg, (3)…
CVE-2005-2309	Opera Opera	0.00	—	0.03	Jul 19, 2005	Opera 8.01 allows remote attackers to cause a denial of service (CPU consumption) via a crafted JPEG image, as demonstrated using random.jpg.
CVE-2005-2310	Nullsoft Winamp	0.04	—	0.13	Jul 19, 2005	Buffer overflow in Winamp 5.03a, 5.09 and 5.091, and other versions before 5.094, allows remote attackers to execute arbitrary code via an MP3 file with a long ID3v2 tag such as (1) ARTIST or (2) TITLE.
CVE-2005-2311	Sms Sms	0.00	—	0.00	Jul 19, 2005	SMS 1.9.2m and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) request1 or (2) request2 temporary files.
CVE-2005-2312	Emilda Emilda	0.00	—	0.02	Jul 19, 2005	management.php in Realnode Emilda 1.2.2 and earlier allows remote attackers to perform actions as other users by modifying the user_id parameter.
CVE-2005-2313	Checkpoint SecuRemote	0.00	—	0.00	Jul 19, 2005	Check Point SecuRemote NG with Application Intelligence R54 allows attackers to obtain credentials and gain privileges via unknown attack vectors.
CVE-2005-2314	Psftp Phpsftpd	0.00	—	0.02	Jul 19, 2005	inc.login.php in PHPsFTPd 0.2 through 0.4 allows remote attackers to obtain the administrator's username and password by setting the do_login parameter and performing an edit action using user.php, which causes the login check to be bypassed and leaks the password in the…
CVE-2005-2317	Shorewall Shorewall	0.00	—	0.02	Jul 19, 2005	Shorewall 2.4.x before 2.4.1, 2.2.x before 2.2.5, and 2.0.x before 2.0.17, when MACLIST_TTL is greater than 0 or MACLIST_DISPOSITION is set to ACCEPT, allows remote attackers with an accepted MAC address to bypass other firewall rules or policies.
CVE-2005-2318	Dvbbs Dvbbs	0.03	—	0.01	Jul 19, 2005	Cross-site scripting (XSS) vulnerability in showerr.asp in DVBBS 7.1 SP2 allows remote attackers to inject arbitrary web script or HTML via the action parameter.
CVE-2005-2319	Yawp Yawp	0.00	—	0.01	Jul 19, 2005	PHP remote file include vulnerability in Yawp library 1.0.6 and earlier, as used in YaWiki and possibly other products, allows remote attackers to include arbitrary files via the _Yawp[conf_path] parameter.
CVE-2005-2320	Webcalendar Webcalendar	0.00	—	0.01	Jul 19, 2005	WebCalendar before 1.0.0 does not properly restrict access to assistant_edit.php, which allows remote attackers to gain privileges.
CVE-2005-2321	Calogic Calogic Calendars	0.00	—	0.03	Jul 19, 2005	PHP remote file inclusion vulnerability in CaLogic 1.2.2 allows remote attackers to execute arbitrary code via the CLPATH parameter to (1) cl_minical.php, (2) clmcpreload.php, (3) mcconfig.php, or (4) mcpi-demo.php.
CVE-2005-2322	Clever Copy Clever Copy	0.00	—	0.01	Jul 19, 2005	Cross-site scripting (XSS) vulnerability in Class-1 Forum 0.24.4 and 0.23.2, and Clever Copy with forums installed, allows remote attackers to inject arbitrary web script or HTML via the (1) viewuser_id or (2) group parameter to users.php.
CVE-2005-2323	Clever Copy Clever Copy	0.03	—	0.03	Jul 19, 2005	Multiple SQL injection vulnerabilities in Class-1 Forum 0.24.4 and 0.23.2, and Clever Copy with forums installed, allow remote attackers to modify SQL statements via the (1) id parameter to viewattach.php, (2) viewuser_id parameter to users.php, or the (3) id or (4) forum…
CVE-2005-2324	Clever Copy Clever Copy	0.03	—	0.03	Jul 19, 2005	Cross-site scripting (XSS) vulnerability in Clever Copy 2.0 and 2.0a allows remote attackers to inject arbitrary web script or HTML via the searchtype or searchterm parameters to (1) results.php or (2) categorysearch.php.

CVE-2005-2371Jul 26, 2005
Oracle Corporation
Reports
risk 0.02cvss —epss 0.22
Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via (1) "..", (2) Windows drive letter (C:), and (3) absolute path sequences in the desname parameter. NOTE: this issue was probably fixed by REP06 in…
CVE-2005-2372Jul 26, 2005
Oracle Corporation
Forms
risk 0.00cvss —epss 0.03
Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1)…
CVE-2005-2373Jul 26, 2005
Whitsoft Development
Slimftpd
risk 0.07cvss —epss 0.46
Buffer overflow in SlimFTPd 3.15 and 3.16 allows remote authenticated users to execute arbitrary code via a long directory name to (1) LIST, (2) DELE or (3) RNFR commands.
CVE-2005-2374Jul 26, 2005
Belkin
54g Wireless Router
risk 0.00cvss —epss 0.02
Belkin 54g wireless routers do not properly set an administrative password, which allows remote attackers to gain access via the (1) Telnet or (2) web administration interfaces.
CVE-2005-2375Jul 26, 2005
Codemasters
Toca Race Driver
risk 0.00cvss —epss 0.01
Format string vulnerability in Race Driver 1.20 and earlier allows remote attackers to cause a denial of service (application crash) via format string specifiers in a (1) nickname or (2) chat message.
CVE-2005-2376Jul 26, 2005
Race Driver
Race Driver
risk 0.00cvss —epss 0.01
Buffer overflow in Race Driver 1.20 and earlier allows remote attackers to cause a denial of service (application crash) via a long (1) nickname or (2) chat message.
CVE-2005-2377Jul 26, 2005
Mandriva
nss_ldap
risk 0.00cvss —epss 0.03
nss_ldap 181 to versions before 213, as used in Mandrake Corporate Server and Mandrake 10.0, and other operating systems, does not properly handle a SIGPIPE signal when sending a search request to an LDAP directory server, which might allow remote attackers to cause a denial of…
CVE-2005-2378Jul 26, 2005
Oracle Corporation
Reports
risk 0.01cvss —epss 0.09
Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the (1) CUSTOMIZE or (2) desformat parameters to rwservlet. NOTE: vector 2 is probably the same as CVE-2006-0289, and fixed in Jan 2006 CPU.
CVE-2005-2379Jul 26, 2005
Oracle Corporation
Reports
risk 0.00cvss —epss 0.04
Multiple cross-site scripting (XSS) vulnerabilities in Oracle Reports 9.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) debug parameter to showenv, (2) test parameter to parsequery, or (3) delimiter or (4) CELLWRAPPER parameter to rwservlet.
CVE-2005-2380Jul 26, 2005
PHP Surveyor
Phpsurveyor
risk 0.00cvss —epss 0.01
Multiple cross-site scripting vulnerabilities in PHP Surveyor 0.98 allow remote attackers to inject arbitrary web script or HTML via the (1) sid, (2) start, and (3) id parameters to browse.php, or the sid parameter to (4) dataentry.php or (5) export.php.
CVE-2005-2381Jul 26, 2005
PHP Surveyor
Phpsurveyor
risk 0.00cvss —epss 0.01
PHP Surveyor 0.98 allows remote attackers to obtain sensitive information via a direct request to (1) question.php, (2) survey.php, or (3) group.php in the root directory, a direct request to (4) database.php, (5) sessioncontrol.php, (6) html.php, (7) sessioncontrol.php, an…
CVE-2005-2382Jul 26, 2005
Oray
Peanuthull
risk 0.00cvss —epss 0.01
Oray PeanutHull 3.0.1.0 and earlier does not properly drop SYSTEM privileges when launched from the system tray, which allows local users to gain privileges by accessing the Help functionality.
CVE-2005-2383Jul 26, 2005
Phpnews
Phpnews
risk 0.03cvss —epss 0.01
SQL injection vulnerability in auth.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the user parameter in an HTTP POST request.
CVE-2005-2327Jul 20, 2005
E107
E107
risk 0.03cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in e107 0.617 and earlier allows remote attackers to inject arbitrary web script or HTML via nested [url] BBCode tags.
CVE-2005-2328Jul 20, 2005
Laffer
Laffer
risk 0.00cvss —epss 0.01
PHP remote file inclusion vulnerability in im.php in Laffer 0.3.2.6 and 0.3.2.7 allows remote attackers to execute arbitrary PHP code via the CFG_PATH variable.
CVE-2005-2329Jul 20, 2005
MRV Communications
In-Reach
risk 0.00cvss —epss 0.01
MRV Communications In-Reach LX-8000S, LX-4000S, and LX-1000S 3.5.0, when using SSH public key authentication, does not properly restrict access to ports, which allows remote authenticated users to access the consoles of other users.
CVE-2005-2330Jul 20, 2005
OsCommerce
Oscommerce
risk 0.04cvss —epss 0.10
Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via (1) .. sequences or (2) a full pathname in the readme_file parameter.
CVE-2005-2331Jul 20, 2005
Moosegallery
Moosegallery
risk 0.00cvss —epss 0.01
PHP remote file inclusion vulnerability in display.php in MooseGallery allows remote attackers to execute arbitrary PHP code via the type parameter.
CVE-2005-2332Jul 20, 2005
Php.warpedweb.net
Phppageprotect
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in PHPPageProtect 1.0.0a allows remote attackers to inject arbitrary web script or HTML via the username parameter to (1) admin.php or (2) login.php.
CVE-2005-2333Jul 20, 2005
Seo Board
Seo Board
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in smilies_popup.php in SEO-Board 1.0 allows remote attackers to inject arbitrary web script or HTML via the doc parameter.
CVE-2005-2334Jul 20, 2005
Y.sak
Y.sak
risk 0.00cvss —epss 0.03
Y.SAK allows remote attackers to execute arbitrary commands via shell metacharacters in the $no variable to (1) w_s3mbfm.cgi, (2) w_s3adix.cgi, or (3) w_s3sbfm.cgi.
CVE-2005-1530Jul 19, 2005
Sophos
Small Business Suite
risk 0.00cvss —epss 0.06
Sophos Anti-Virus 5.0.1, with "Scan inside archive files" enabled, allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a Bzip2 archive with a large 'Extra field length' value.
CVE-2005-1850Jul 19, 2005
Ekg
Ekg
risk 0.00cvss —epss 0.02
Certain contributed scripts for ekg Gadu Gadu client 1.5 and earlier create temporary files insecurely, with unknown impact and attack vectors, a different vulnerability than CVE-2005-1916.
CVE-2005-1851Jul 19, 2005
Ekg
Ekg
risk 0.00cvss —epss 0.02
A certain contributed script for ekg Gadu Gadu client 1.5 and earlier allows attackers to execute shell commands via unknown attack vectors.
CVE-2005-2196Jul 19, 2005
Apple Inc.
AirPort
risk 0.00cvss —epss 0.00
The Apple AirPort card uses a default WEP key when not connected to a known or trusted network, which can cause it to automatically connect to a malicious network.
CVE-2005-2297Jul 19, 2005
Sybase
Easerver
risk 0.09cvss —epss 0.74
Stack-based buffer overflow in TreeAction.do in Sybase EAServer 4.2.5 through 5.2 allows remote authenticated users to execute arbitrary code via a large javascript parameter.
CVE-2005-2298Jul 19, 2005
Bitdefender
Bitdefender Engine
risk 0.00cvss —epss 0.01
BitDefender Engine 1.6.1 and earlier does not properly scan all attachments, which allows remote attackers to bypass virus scanning via begin and end commands in the body of the e-mail, which BitDefender treats as a uuencoded attachment and stops scanning afterwards.
CVE-2005-2299Jul 19, 2005
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Simple Message Board Version 2.0 Beta 1 allow remote attackers to inject arbitrary web script or HTML via the (1) FID parameter to forum.cfm, (2) UID parameter to user.cfm, (3) TID parameter to thread.cfm, or (4) PostDate…
CVE-2005-2300Jul 19, 2005
Skype Technologies
Skype
risk 0.00cvss —epss 0.00
Skype 1.1.0.20 and earlier allows local users to overwrite arbitrary files via a symlink attack on the skype_profile.jpg temporary file.
CVE-2005-2301Jul 19, 2005
PowerDNS
Powerdns
risk 0.00cvss —epss 0.03
PowerDNS before 2.9.18, when running with an LDAP backend, does not properly escape LDAP queries, which allows remote attackers to cause a denial of service (failure to answer ldap questions) and possibly conduct an LDAP injection attack.
CVE-2005-2302Jul 19, 2005
PowerDNS
Powerdns
risk 0.00cvss —epss 0.00
PowerDNS before 2.9.18, when allowing recursion to a restricted range of IP addresses, does not properly handle questions from clients that are denied recursion, which could cause a "blank out" of answers to those clients that are allowed to use recursion.
CVE-2005-2304Jul 19, 2005
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.09
Microsoft MSN Messenger 9.0 and Internet Explorer 6.0 allows remote attackers to cause a denial of service (crash) via an image with an ICC Profile with a large Tag Count.
CVE-2005-2305Jul 19, 2005
Dg
Remote Control Server
risk 0.03cvss —epss 0.05
DG Remote Control Server 1.6.2 allows remote attackers to cause a denial of service (crash or CPU consumption) and possibly execute arbitrary code via a long message to TCP port 1071 or 1073, possibly due to a buffer overflow.
CVE-2005-2306Jul 19, 2005
Macromedia
Jrun
risk 0.00cvss —epss 0.00
Race condition in Macromedia JRun 4.0, ColdFusion MX 6.1 and 7.0, when under heavy load, causes JRun to assign a duplicate authentication token to multiple sessions, which could allow authenticated users to gain privileges as other users.
CVE-2005-2307Jul 19, 2005
Microsoft
Windows Connections Manager Library
risk 0.05cvss —epss 0.26
netman.dll in Microsoft Windows Connections Manager Library allows local users to cause a denial of service (Network Connections Service crash) via a large integer argument to a particular function, aka "Network Connection Manager Vulnerability."
CVE-2005-2308Jul 19, 2005
Microsoft
Internet Explorer
risk 0.04cvss —epss 0.17
The JPEG decoder in Microsoft Internet Explorer allows remote attackers to cause a denial of service (CPU consumption or crash) and possibly execute arbitrary code via certain crafted JPEG images, as demonstrated using (1) mov_fencepost.jpg, (2) cmp_fencepost.jpg, (3)…
CVE-2005-2309Jul 19, 2005
Opera
Opera
risk 0.00cvss —epss 0.03
Opera 8.01 allows remote attackers to cause a denial of service (CPU consumption) via a crafted JPEG image, as demonstrated using random.jpg.
CVE-2005-2310Jul 19, 2005
Nullsoft
Winamp
risk 0.04cvss —epss 0.13
Buffer overflow in Winamp 5.03a, 5.09 and 5.091, and other versions before 5.094, allows remote attackers to execute arbitrary code via an MP3 file with a long ID3v2 tag such as (1) ARTIST or (2) TITLE.
CVE-2005-2311Jul 19, 2005
Sms
Sms
risk 0.00cvss —epss 0.00
SMS 1.9.2m and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) request1 or (2) request2 temporary files.
CVE-2005-2312Jul 19, 2005
Emilda
Emilda
risk 0.00cvss —epss 0.02
management.php in Realnode Emilda 1.2.2 and earlier allows remote attackers to perform actions as other users by modifying the user_id parameter.
CVE-2005-2313Jul 19, 2005
Checkpoint
SecuRemote
risk 0.00cvss —epss 0.00
Check Point SecuRemote NG with Application Intelligence R54 allows attackers to obtain credentials and gain privileges via unknown attack vectors.
CVE-2005-2314Jul 19, 2005
Psftp
Phpsftpd
risk 0.00cvss —epss 0.02
inc.login.php in PHPsFTPd 0.2 through 0.4 allows remote attackers to obtain the administrator's username and password by setting the do_login parameter and performing an edit action using user.php, which causes the login check to be bypassed and leaks the password in the…
CVE-2005-2317Jul 19, 2005
Shorewall
Shorewall
risk 0.00cvss —epss 0.02
Shorewall 2.4.x before 2.4.1, 2.2.x before 2.2.5, and 2.0.x before 2.0.17, when MACLIST_TTL is greater than 0 or MACLIST_DISPOSITION is set to ACCEPT, allows remote attackers with an accepted MAC address to bypass other firewall rules or policies.
CVE-2005-2318Jul 19, 2005
Dvbbs
Dvbbs
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in showerr.asp in DVBBS 7.1 SP2 allows remote attackers to inject arbitrary web script or HTML via the action parameter.
CVE-2005-2319Jul 19, 2005
Yawp
Yawp
risk 0.00cvss —epss 0.01
PHP remote file include vulnerability in Yawp library 1.0.6 and earlier, as used in YaWiki and possibly other products, allows remote attackers to include arbitrary files via the _Yawp[conf_path] parameter.
CVE-2005-2320Jul 19, 2005
Webcalendar
Webcalendar
risk 0.00cvss —epss 0.01
WebCalendar before 1.0.0 does not properly restrict access to assistant_edit.php, which allows remote attackers to gain privileges.
CVE-2005-2321Jul 19, 2005
Calogic
Calogic Calendars
risk 0.00cvss —epss 0.03
PHP remote file inclusion vulnerability in CaLogic 1.2.2 allows remote attackers to execute arbitrary code via the CLPATH parameter to (1) cl_minical.php, (2) clmcpreload.php, (3) mcconfig.php, or (4) mcpi-demo.php.
CVE-2005-2322Jul 19, 2005
Clever Copy
Clever Copy
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Class-1 Forum 0.24.4 and 0.23.2, and Clever Copy with forums installed, allows remote attackers to inject arbitrary web script or HTML via the (1) viewuser_id or (2) group parameter to users.php.
CVE-2005-2323Jul 19, 2005
Clever Copy
Clever Copy
risk 0.03cvss —epss 0.03
Multiple SQL injection vulnerabilities in Class-1 Forum 0.24.4 and 0.23.2, and Clever Copy with forums installed, allow remote attackers to modify SQL statements via the (1) id parameter to viewattach.php, (2) viewuser_id parameter to users.php, or the (3) id or (4) forum…
CVE-2005-2324Jul 19, 2005
Clever Copy
Clever Copy
risk 0.03cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in Clever Copy 2.0 and 2.0a allows remote attackers to inject arbitrary web script or HTML via the searchtype or searchterm parameters to (1) results.php or (2) categorysearch.php.