CVEs

378,491 total · page 7351 of 7,570

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2005-0475	PaFAQ paFAQ		0.03	—	0.01	Mar 30, 2005	SQL injection vulnerability in paFAQ Beta4, and possibly other versions, allows remote attackers to execute arbitrary SQL code via the (1) offset, (2) limit, (3) order, or (4) orderby parameter to question.php, (5) offset parameter to answer.php, (6) search_item parameter to…
CVE-2005-0476	Hpm Guestbook.cgi Hpm Guestbook.cgi		0.00	—	0.01	Mar 30, 2005	Cross-site scripting (XSS) vulnerability in hpm_guestbook.cgi allows remote attackers to inject arbitrary web script or HTML by posting a message.
CVE-2005-0477	Invision Power Services Power Board		0.03	—	0.02	Mar 30, 2005	Cross-site scripting (XSS) vulnerability in the SML code for Invision Power Board 1.3.1 FINAL allows remote attackers to inject arbitrary web script via (1) a signature file or (2) a message post containing an IMG tag within a COLOR tag whose style is set to background:url.
CVE-2005-0478	Trackercam Trackercam		0.08	—	0.66	Mar 30, 2005	Multiple buffer overflows in TrackerCam 5.12 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) an HTTP request with a long User-Agent header or (2) a long argument to an arbitrary PHP script.
CVE-2005-0479	Trackercam Trackercam		0.03	—	0.03	Mar 30, 2005	Directory traversal vulnerability in ComGetLogFile.php3 for TrackerCam 5.12 and earlier allows remote attackers to read arbitrary files via ".." sequences and (1) "/" slash), (2) "\" (backslash), or (3) hex-encoded characters in the fn parameter.
CVE-2005-0480	Trackercam Trackercam		0.00	—	0.01	Mar 30, 2005	Cross-site scripting (XSS) vulnerability in TrackerCam 5.12 and earlier allows remote attackers to inject arbitrary HTML or web script via the login request, which is recorded in a log file but not properly handled when the administrator views the log file.
CVE-2005-0481	Trackercam Trackercam		0.00	—	0.02	Mar 30, 2005	TrackerCam 5.12 and earlier allows remote attackers to read log files via the fn parameter in a direct request to the ComGetLogFile.php3 script.
CVE-2005-0482	Trackercam Trackercam		0.00	—	0.02	Mar 30, 2005	TrackerCam 5.12 and earlier allows remote attackers to cause a denial of service (crash) via (1) a large number of connections with a negative Content-Length header, possibly triggering an integer signedness error, or (2) a large amount of data.
CVE-2005-0483	Glftpd Glftpd		0.00	—	0.02	Mar 30, 2005	Multiple directory traversal vulnerabilities in sitenfo.sh, sitezipchk.sh, and siteziplist.sh in Glftpd 1.26 to 2.00 allow remote authenticated users to (1) determine the existence of arbitrary files, (2) list files in restricted directories, or (3) read arbitrary files from…
CVE-2005-0484	Gproftpd Gproftpd		0.01	—	0.11	Mar 30, 2005	Format string vulnerability in gprostats for GProFTPD before 8.1.9 may allow remote attackers to execute arbitrary code via an FTP transfer with a crafted filename that causes format string specifiers to be inserted into the ProFTPD transfer log.
CVE-2005-0485	PHP Arena Panews		0.00	—	0.02	Mar 30, 2005	Cross-site scripting (XSS) vulnerability in comment.php for paNews 2.0b4 for PHP Arena allows remote attackers to inject arbitrary HTML and web script via the showpost parameter.
CVE-2005-0486	Tarantella Tarantella Enterprise		0.00	—	0.01	Mar 30, 2005	Tarantella Secure Global Desktop Enterprise Edition 4.00 and 3.42, and Tarantella Enterprise 3 3.40 and 3.30, when using RSA SecurID and multiple users have the same username, reveals sensitive information during authentication, which allows remote attackers to identify valid…
CVE-2005-0487	Kayako Esupport		0.00	—	0.01	Mar 30, 2005	Cross-site scripting (XSS) vulnerability in index.php for Kayako ESupport 2.3.1, and possibly other versions, allows remote attackers to inject arbitrary HTML and web script via the nav parameter.
CVE-2005-0943	Cisco Systems, Inc. VPN 3030 Concentator		0.00	—	0.02	Mar 30, 2005	Cisco VPN 3000 series Concentrator running firmware 4.1.7.A and earlier allows remote attackers to cause a denial of service (device reload or drop user connection) via a crafted HTTPS packet.
CVE-2005-0919	Adventia Adventia Chat		0.00	—	0.01	Mar 29, 2005	Adventia Chat 3.1 and Server Pro 3.0 allows remote attackers to inject arbitrary web script or HTML into the chat space, which leaves other users vulnerable to cross-site scripting (XSS) attacks.
CVE-2005-0924	Adventia E Data		0.00	—	0.01	Mar 29, 2005	Cross-site scripting (XSS) vulnerability in Adventia E-Data 2.0 allows remote attackers to inject arbitrary web script or HTML via a query keyword.
CVE-2005-0931	Jimmy The Includer		0.03	—	0.02	Mar 29, 2005	PHP remote file inclusion vulnerability in The Includer 1.0 and 1.1 allows remote attackers to execute arbitrary PHP code.
CVE-2005-0946	Coinsoft Technologies Phpcoin		0.00	—	0.01	Mar 29, 2005	SQL injection vulnerability in phpCoin 1.2.1b and earlier allows remote attackers to execute arbitrary SQL commands via the (1) term/keywords field on the search page, (2) username or (3) e-mail field on the forgot password page, or (4) domain name on the ordering new package…
CVE-2005-0950	Faststone 4in1 Browser		0.03	—	0.04	Mar 29, 2005	Directory traversal vulnerability in FastStone 4in1 Browser 1.2 allows remote attackers to read arbitrary files via a (1) ... (triple dot) or (2) ..\ (dot dot backslash) in the URL.
CVE-2005-0892	Smail Smail		0.04	—	0.09	Mar 28, 2005	Buffer overflow in smail 3.2.0.120 allows remote attackers or local users to execute arbitrary code via a long string in the MAIL FROM command and possibly other SMTP commands.
CVE-2005-0908	Valdersoft Shopping Cart		0.00	—	0.01	Mar 28, 2005	Multiple cross-site scripting (XSS) vulnerabilities in Valdersoft Shopping Cart 3.0 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter to index.php or (2) the searchTopCategoryID parameter to search_result.php.
CVE-2005-0911	Exoops Exoops		0.00	—	0.01	Mar 28, 2005	Multiple SQL injection vulnerabilities in exoops may allow remote attackers to execute arbitrary SQL commands via (1) the viewcat parameter to index.php or (2) the artid parameter in the viewarticle action for index.php.
CVE-2005-0750	Linux Kernel		0.03	—	0.01	Mar 27, 2005	The bluez_sock_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges via (1) socket or (2) socketpair call with a negative protocol value.
CVE-2005-0898	Magicscripts E Store Kit 2		0.00	—	0.01	Mar 26, 2005	Cross-site scripting (XSS) vulnerability in downloadform.php in E-Store Kit-2 PayPal Edition allows remote attackers to inject arbitrary web script or HTML via the txn_id parameter.
CVE-2005-0900	Nukebookmarks Nukebookmarks		0.00	—	0.01	Mar 26, 2005	marks.php in NukeBookmarks 0.6 for PHP-Nuke allows remote attackers to obtain sensitive information via an invalid (1) file or (2) category parameter, which reveal the path in an error message.
CVE-2005-0914	Dragonflydb Dragonfly		0.00	—	0.01	Mar 26, 2005	Multiple cross-site scripting (XSS) vulnerabilities in CPG Dragonfly 9.0.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) the profile parameter to index.php or (2) the cat parameter.
CVE-2005-0585	Mozilla Corporation Mozilla		0.00	—	0.02	Mar 25, 2005	Firefox before 1.0.1 and Mozilla before 1.7.6 truncates long sub-domains or paths for display, which may allow remote malicious web sites to spoof legitimate sites and facilitate phishing attacks.
CVE-2005-0587	Mozilla Corporation Mozilla	Med	0.42	6.5	0.01	Mar 25, 2005	Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which overwrites the file that was referenced in the first .LNK file.
CVE-2005-0592	Mozilla Corporation Mozilla		0.00	—	0.04	Mar 25, 2005	Heap-based buffer overflow in the UTF8ToNewUnicode function for Firefox before 1.0.1 and Mozilla before 1.7.6 might allow remote attackers to cause a denial of service (crash) or execute arbitrary code via invalid sequences in a UTF8 encoded string that result in a zero length…
CVE-2005-0887	Michael Dean Double Choco Latte		0.03	—	0.03	Mar 24, 2005	Eval injection vulnerability in Double Choco Latte before 0.9.4.3 allows remote attackers to execute arbitrary PHP code via the menuAction variable in (1) functions.inc.php or (2) main.php, which causes code to be injected into an eval statement.
CVE-2005-0889	Dream4 Koobi CMS		0.03	—	0.01	Mar 24, 2005	Cross-site scripting (XSS) vulnerability in index.php for Dream4 Koobi CMS 4.2.3 allows remote attackers to inject arbitrary web script or HTML via the area parameter.
CVE-2005-0912	Deplate Deplate		0.00	—	0.01	Mar 24, 2005	Unknown vulnerabilities in deplate before 0.7.2 have unknown impact, possibly involving elements.rb.
CVE-2005-0143	Mozilla Corporation Mozilla		0.00	—	0.01	Mar 23, 2005	Firefox before 1.0 and Mozilla before 1.7.5 display the SSL lock icon when an insecure page loads a binary file from a trusted site, which could facilitate phishing attacks.
CVE-2005-0759	ImageMagick Imagemagick		0.00	—	0.02	Mar 23, 2005	ImageMagick before 6.0 allows remote attackers to cause a denial of service (application crash) via a TIFF image with an invalid tag.
CVE-2005-0761	ImageMagick Imagemagick		0.00	—	0.02	Mar 23, 2005	Unknown vulnerability in ImageMagick before 6.1.8 allows remote attackers to cause a denial of service (application crash) via a crafted PSD file.
CVE-2005-0878	Mercuryboard Mercuryboard		0.00	—	0.01	Mar 23, 2005	Cross-site scripting (XSS) vulnerability in MercuryBoard before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the title field of a PM (private message).
CVE-2005-0881	Interspire Articlelive		0.03	—	0.04	Mar 23, 2005	Cross-site scripting (XSS) vulnerability in articles.newcomment for Interspire ArticleLive 2005 allows remote attackers to inject arbitrary web script or HTML via the Articleld parameter.
CVE-2005-0883	Digitalhive Digitalhive		0.03	—	0.02	Mar 23, 2005	Multiple cross-site scripting (XSS) vulnerabilities in base.php for DigitalHive 2.0 allow remote attackers to inject arbitrary web script or HTML via (1) the mt parameter to the membres.php page or (2) the -afs-1- query string to the msg.php page.
CVE-2005-0713	Apple Inc. Mac OS X		0.03	—	0.01	Mar 21, 2005	The Bluetooth Setup Assistant for Mac OS X before 10.3.8 can be launched without a keyboard or Bluetooth device, which allows local users to bypass access restrictions and gain privileges.
CVE-2005-0715	Apple Inc. Mac OS X		0.00	—	0.00	Mar 21, 2005	AFP Server in Mac OS X before 10.3.8 uses insecure permissions for "Drop Boxes," which allows local users to read the contents of a Drop Box.
CVE-2005-0716	Apple Inc. Mac OS X		0.03	—	0.01	Mar 21, 2005	Stack-based buffer overflow in the Core Foundation Library in Mac OS X 10.3.5 and 10.3.6, and possibly earlier versions, allows local users to execute arbitrary code via a long CF_CHARSET_PATH environment variable.
CVE-2005-0352	Woodstone Servers Alive		0.00	—	0.00	Mar 16, 2005	Servers Alive 4.1 and 5.0, when running as a service, does not drop SYSTEM privileges before loading local manual under the help menu, which allows local users to gain privileges.
CVE-2005-0384	Linux Kernel		0.00	—	0.04	Mar 15, 2005	Unknown vulnerability in the PPP driver for the Linux kernel 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) via a pppd client.
CVE-2005-0767	Linux Kernel		0.00	—	0.00	Mar 15, 2005	Race condition in the Radeon DRI driver for Linux kernel 2.6.8.1 allows local users with DRI privileges to execute arbitrary code as root.
CVE-2005-0792	Zpanel Zpanel		0.03	—	0.01	Mar 15, 2005	SQL injection vulnerability in ZPanel 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) uname parameter to index.php or (2) page parameter to zpanel.php.
CVE-2005-0793	Zpanel Zpanel		0.00	—	0.01	Mar 15, 2005	PHP remote file inclusion vulnerability in zpanel.php in ZPanel allows remote attackers to (1) execute arbitrary PHP code in ZPanel 2.0 or (2) include local files in ZPanel 2.5 beta 10 and earlier by modifying the page parameter.
CVE-2005-0794	Zpanel Zpanel		0.00	—	0.02	Mar 15, 2005	ZPanel 2.0 and 2.5 beta 10 does not remove or protect installation scripts after they have been used, which allows remote attackers to reinstall the software and possibly cause a denial of service via a direct request to install.php.
CVE-2005-0797	Novell iChain Mini FTP Server		0.00	—	0.01	Mar 15, 2005	Novell iChain Mini FTP Server 2.3 displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.
CVE-2005-0798	Novell Ichain		0.00	—	0.02	Mar 15, 2005	Novell iChain Mini FTP Server 2.3, and possibly earlier versions, does not limit the number of incorrect logins, which makes it easier for remote attackers to conduct brute force login attacks.
CVE-2005-0799	MySQL MySQL		0.00	—	0.03	Mar 15, 2005	MySQL 4.1.9, and possibly earlier versions, allows remote attackers with certain privileges to cause a denial of service (application crash) via a use command followed by an MS-DOS device name such as (1) LPT1 or (2) PRN.

CVE-2005-0475Mar 30, 2005
PaFAQ
paFAQ
risk 0.03cvss —epss 0.01
SQL injection vulnerability in paFAQ Beta4, and possibly other versions, allows remote attackers to execute arbitrary SQL code via the (1) offset, (2) limit, (3) order, or (4) orderby parameter to question.php, (5) offset parameter to answer.php, (6) search_item parameter to…
CVE-2005-0476Mar 30, 2005
Hpm Guestbook.cgi
Hpm Guestbook.cgi
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in hpm_guestbook.cgi allows remote attackers to inject arbitrary web script or HTML by posting a message.
CVE-2005-0477Mar 30, 2005
Invision Power Services
Power Board
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the SML code for Invision Power Board 1.3.1 FINAL allows remote attackers to inject arbitrary web script via (1) a signature file or (2) a message post containing an IMG tag within a COLOR tag whose style is set to background:url.
CVE-2005-0478Mar 30, 2005
Trackercam
Trackercam
risk 0.08cvss —epss 0.66
Multiple buffer overflows in TrackerCam 5.12 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) an HTTP request with a long User-Agent header or (2) a long argument to an arbitrary PHP script.
CVE-2005-0479Mar 30, 2005
Trackercam
Trackercam
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in ComGetLogFile.php3 for TrackerCam 5.12 and earlier allows remote attackers to read arbitrary files via ".." sequences and (1) "/" slash), (2) "\" (backslash), or (3) hex-encoded characters in the fn parameter.
CVE-2005-0480Mar 30, 2005
Trackercam
Trackercam
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in TrackerCam 5.12 and earlier allows remote attackers to inject arbitrary HTML or web script via the login request, which is recorded in a log file but not properly handled when the administrator views the log file.
CVE-2005-0481Mar 30, 2005
Trackercam
Trackercam
risk 0.00cvss —epss 0.02
TrackerCam 5.12 and earlier allows remote attackers to read log files via the fn parameter in a direct request to the ComGetLogFile.php3 script.
CVE-2005-0482Mar 30, 2005
Trackercam
Trackercam
risk 0.00cvss —epss 0.02
TrackerCam 5.12 and earlier allows remote attackers to cause a denial of service (crash) via (1) a large number of connections with a negative Content-Length header, possibly triggering an integer signedness error, or (2) a large amount of data.
CVE-2005-0483Mar 30, 2005
Glftpd
Glftpd
risk 0.00cvss —epss 0.02
Multiple directory traversal vulnerabilities in sitenfo.sh, sitezipchk.sh, and siteziplist.sh in Glftpd 1.26 to 2.00 allow remote authenticated users to (1) determine the existence of arbitrary files, (2) list files in restricted directories, or (3) read arbitrary files from…
CVE-2005-0484Mar 30, 2005
Gproftpd
Gproftpd
risk 0.01cvss —epss 0.11
Format string vulnerability in gprostats for GProFTPD before 8.1.9 may allow remote attackers to execute arbitrary code via an FTP transfer with a crafted filename that causes format string specifiers to be inserted into the ProFTPD transfer log.
CVE-2005-0485Mar 30, 2005
PHP Arena
Panews
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in comment.php for paNews 2.0b4 for PHP Arena allows remote attackers to inject arbitrary HTML and web script via the showpost parameter.
CVE-2005-0486Mar 30, 2005
Tarantella
Tarantella Enterprise
risk 0.00cvss —epss 0.01
Tarantella Secure Global Desktop Enterprise Edition 4.00 and 3.42, and Tarantella Enterprise 3 3.40 and 3.30, when using RSA SecurID and multiple users have the same username, reveals sensitive information during authentication, which allows remote attackers to identify valid…
CVE-2005-0487Mar 30, 2005
Kayako
Esupport
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in index.php for Kayako ESupport 2.3.1, and possibly other versions, allows remote attackers to inject arbitrary HTML and web script via the nav parameter.
CVE-2005-0943Mar 30, 2005
Cisco Systems, Inc.
VPN 3030 Concentator
risk 0.00cvss —epss 0.02
Cisco VPN 3000 series Concentrator running firmware 4.1.7.A and earlier allows remote attackers to cause a denial of service (device reload or drop user connection) via a crafted HTTPS packet.
CVE-2005-0919Mar 29, 2005
Adventia
Adventia Chat
risk 0.00cvss —epss 0.01
Adventia Chat 3.1 and Server Pro 3.0 allows remote attackers to inject arbitrary web script or HTML into the chat space, which leaves other users vulnerable to cross-site scripting (XSS) attacks.
CVE-2005-0924Mar 29, 2005
Adventia
E Data
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Adventia E-Data 2.0 allows remote attackers to inject arbitrary web script or HTML via a query keyword.
CVE-2005-0931Mar 29, 2005
Jimmy
The Includer
risk 0.03cvss —epss 0.02
PHP remote file inclusion vulnerability in The Includer 1.0 and 1.1 allows remote attackers to execute arbitrary PHP code.
CVE-2005-0946Mar 29, 2005
Coinsoft Technologies
Phpcoin
risk 0.00cvss —epss 0.01
SQL injection vulnerability in phpCoin 1.2.1b and earlier allows remote attackers to execute arbitrary SQL commands via the (1) term/keywords field on the search page, (2) username or (3) e-mail field on the forgot password page, or (4) domain name on the ordering new package…
CVE-2005-0950Mar 29, 2005
Faststone
4in1 Browser
risk 0.03cvss —epss 0.04
Directory traversal vulnerability in FastStone 4in1 Browser 1.2 allows remote attackers to read arbitrary files via a (1) ... (triple dot) or (2) ..\ (dot dot backslash) in the URL.
CVE-2005-0892Mar 28, 2005
Smail
Smail
risk 0.04cvss —epss 0.09
Buffer overflow in smail 3.2.0.120 allows remote attackers or local users to execute arbitrary code via a long string in the MAIL FROM command and possibly other SMTP commands.
CVE-2005-0908Mar 28, 2005
Valdersoft
Shopping Cart
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Valdersoft Shopping Cart 3.0 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter to index.php or (2) the searchTopCategoryID parameter to search_result.php.
CVE-2005-0911Mar 28, 2005
Exoops
Exoops
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in exoops may allow remote attackers to execute arbitrary SQL commands via (1) the viewcat parameter to index.php or (2) the artid parameter in the viewarticle action for index.php.
CVE-2005-0750Mar 27, 2005
Linux
Kernel
risk 0.03cvss —epss 0.01
The bluez_sock_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges via (1) socket or (2) socketpair call with a negative protocol value.
CVE-2005-0898Mar 26, 2005
Magicscripts
E Store Kit 2
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in downloadform.php in E-Store Kit-2 PayPal Edition allows remote attackers to inject arbitrary web script or HTML via the txn_id parameter.
CVE-2005-0900Mar 26, 2005
Nukebookmarks
Nukebookmarks
risk 0.00cvss —epss 0.01
marks.php in NukeBookmarks 0.6 for PHP-Nuke allows remote attackers to obtain sensitive information via an invalid (1) file or (2) category parameter, which reveal the path in an error message.
CVE-2005-0914Mar 26, 2005
Dragonflydb
Dragonfly
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in CPG Dragonfly 9.0.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) the profile parameter to index.php or (2) the cat parameter.
CVE-2005-0585Mar 25, 2005
Mozilla Corporation
Mozilla
risk 0.00cvss —epss 0.02
Firefox before 1.0.1 and Mozilla before 1.7.6 truncates long sub-domains or paths for display, which may allow remote malicious web sites to spoof legitimate sites and facilitate phishing attacks.
CVE-2005-0587MedMar 25, 2005
Mozilla Corporation
Mozilla
risk 0.42cvss 6.5epss 0.01
Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which overwrites the file that was referenced in the first .LNK file.
CVE-2005-0592Mar 25, 2005
Mozilla Corporation
Mozilla
risk 0.00cvss —epss 0.04
Heap-based buffer overflow in the UTF8ToNewUnicode function for Firefox before 1.0.1 and Mozilla before 1.7.6 might allow remote attackers to cause a denial of service (crash) or execute arbitrary code via invalid sequences in a UTF8 encoded string that result in a zero length…
CVE-2005-0887Mar 24, 2005
Michael Dean
Double Choco Latte
risk 0.03cvss —epss 0.03
Eval injection vulnerability in Double Choco Latte before 0.9.4.3 allows remote attackers to execute arbitrary PHP code via the menuAction variable in (1) functions.inc.php or (2) main.php, which causes code to be injected into an eval statement.
CVE-2005-0889Mar 24, 2005
Dream4
Koobi CMS
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in index.php for Dream4 Koobi CMS 4.2.3 allows remote attackers to inject arbitrary web script or HTML via the area parameter.
CVE-2005-0912Mar 24, 2005
Deplate
Deplate
risk 0.00cvss —epss 0.01
Unknown vulnerabilities in deplate before 0.7.2 have unknown impact, possibly involving elements.rb.
CVE-2005-0143Mar 23, 2005
Mozilla Corporation
Mozilla
risk 0.00cvss —epss 0.01
Firefox before 1.0 and Mozilla before 1.7.5 display the SSL lock icon when an insecure page loads a binary file from a trusted site, which could facilitate phishing attacks.
CVE-2005-0759Mar 23, 2005
ImageMagick
Imagemagick
risk 0.00cvss —epss 0.02
ImageMagick before 6.0 allows remote attackers to cause a denial of service (application crash) via a TIFF image with an invalid tag.
CVE-2005-0761Mar 23, 2005
ImageMagick
Imagemagick
risk 0.00cvss —epss 0.02
Unknown vulnerability in ImageMagick before 6.1.8 allows remote attackers to cause a denial of service (application crash) via a crafted PSD file.
CVE-2005-0878Mar 23, 2005
Mercuryboard
Mercuryboard
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in MercuryBoard before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the title field of a PM (private message).
CVE-2005-0881Mar 23, 2005
Interspire
Articlelive
risk 0.03cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in articles.newcomment for Interspire ArticleLive 2005 allows remote attackers to inject arbitrary web script or HTML via the Articleld parameter.
CVE-2005-0883Mar 23, 2005
Digitalhive
Digitalhive
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in base.php for DigitalHive 2.0 allow remote attackers to inject arbitrary web script or HTML via (1) the mt parameter to the membres.php page or (2) the -afs-1- query string to the msg.php page.
CVE-2005-0713Mar 21, 2005
Apple Inc.
Mac OS X
risk 0.03cvss —epss 0.01
The Bluetooth Setup Assistant for Mac OS X before 10.3.8 can be launched without a keyboard or Bluetooth device, which allows local users to bypass access restrictions and gain privileges.
CVE-2005-0715Mar 21, 2005
Apple Inc.
Mac OS X
risk 0.00cvss —epss 0.00
AFP Server in Mac OS X before 10.3.8 uses insecure permissions for "Drop Boxes," which allows local users to read the contents of a Drop Box.
CVE-2005-0716Mar 21, 2005
Apple Inc.
Mac OS X
risk 0.03cvss —epss 0.01
Stack-based buffer overflow in the Core Foundation Library in Mac OS X 10.3.5 and 10.3.6, and possibly earlier versions, allows local users to execute arbitrary code via a long CF_CHARSET_PATH environment variable.
CVE-2005-0352Mar 16, 2005
Woodstone
Servers Alive
risk 0.00cvss —epss 0.00
Servers Alive 4.1 and 5.0, when running as a service, does not drop SYSTEM privileges before loading local manual under the help menu, which allows local users to gain privileges.
CVE-2005-0384Mar 15, 2005
Linux
Kernel
risk 0.00cvss —epss 0.04
Unknown vulnerability in the PPP driver for the Linux kernel 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) via a pppd client.
CVE-2005-0767Mar 15, 2005
Linux
Kernel
risk 0.00cvss —epss 0.00
Race condition in the Radeon DRI driver for Linux kernel 2.6.8.1 allows local users with DRI privileges to execute arbitrary code as root.
CVE-2005-0792Mar 15, 2005
Zpanel
Zpanel
risk 0.03cvss —epss 0.01
SQL injection vulnerability in ZPanel 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) uname parameter to index.php or (2) page parameter to zpanel.php.
CVE-2005-0793Mar 15, 2005
Zpanel
Zpanel
risk 0.00cvss —epss 0.01
PHP remote file inclusion vulnerability in zpanel.php in ZPanel allows remote attackers to (1) execute arbitrary PHP code in ZPanel 2.0 or (2) include local files in ZPanel 2.5 beta 10 and earlier by modifying the page parameter.
CVE-2005-0794Mar 15, 2005
Zpanel
Zpanel
risk 0.00cvss —epss 0.02
ZPanel 2.0 and 2.5 beta 10 does not remove or protect installation scripts after they have been used, which allows remote attackers to reinstall the software and possibly cause a denial of service via a direct request to install.php.
CVE-2005-0797Mar 15, 2005
Novell
iChain Mini FTP Server
risk 0.00cvss —epss 0.01
Novell iChain Mini FTP Server 2.3 displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.
CVE-2005-0798Mar 15, 2005
Novell
Ichain
risk 0.00cvss —epss 0.02
Novell iChain Mini FTP Server 2.3, and possibly earlier versions, does not limit the number of incorrect logins, which makes it easier for remote attackers to conduct brute force login attacks.
CVE-2005-0799Mar 15, 2005
MySQL
MySQL
risk 0.00cvss —epss 0.03
MySQL 4.1.9, and possibly earlier versions, allows remote attackers with certain privileges to cause a denial of service (application crash) via a use command followed by an MS-DOS device name such as (1) LPT1 or (2) PRN.