10527 matches found
CVE-2005-2465
CVE-2005-2465 is an XSS vulnerability affecting the pm.php component in PCXP/TOPPE CMS, exploitable by supplying crafted content to the msg variable. The available connected documents confirm the vulnerability exists but do not provide concrete remediation steps or version-specific scope (e.g., a...
CVE-2005-2463
Kayako LiveResponse 2.x vulnerability (CVE-2005-2463) lets remote attackers obtain sensitive information by directly requesting addressbook.php and other include scripts, with the path exposed in an error message. Affected software: Kayako LiveResponse 2.x. Impact: information disclosure with par...
CVE-2005-2462
Kayako LiveResponse 2.x is affected by a vulnerability where, during user login, the password is recorded in plaintext in the URL. This enables local users and possibly remote attackers to gain privileges and access sensitive information. The issue is discussed across multiple sources, and relate...
CVE-2005-2466
OpenBook 1.2.2 is affected by multiple SQL injection vulnerabilities in the auth_user function of admin.php, allowing remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter. The vulnerability is detailed in CVE-2005-2466 with a NVD base score of 6.4 (MED...
CVE-2005-2462
Kayako liveResponse 2.x, when logging in a user, records the password in plaintext in the URL, which allows local users and possibly remote attackers to gain privileges...
CVE-2005-2461
CVE-2005-2461 concerns Kayako LiveResponse 2.x, where the calendar feature exposes multiple SQL injection flaws exploitable via the (1) year or (2) date parameters. The NVD entry notes remote, unauthenticated access with network vector and low attack complexity, leading to potentially partial con...
CVE-2005-2464
CVE-2005-2464 affects PCXP/TOPPE CMS. The issue allows remote attackers to bypass authentication and gain privileges by modifying the user’s cookie to match the target userid, enabling partial confidentiality/integrity/availability impact per CVSS. The provided documents do not specify affected v...
CVE-2005-2468
The CVE-2005-2468 entry describes multiple SQL injection vulnerabilities in MySQL Eventum 1.5.5 and earlier that allow remote attackers to execute arbitrary SQL commands. Affected functions include isCorrectPassword and userExist in class.auth.php, getCustomFieldReport in custom_fields.php, (5) c...
CVE-2005-1976
Novell NetMail 3.5.2a, 3.5.2b, and 3.5.2c running on Linux reportedly set the owner and group of certain files to 500, which could allow users or groups with that ID to modify those files and potentially execute arbitrary code or cause a denial of service. The Red Hat advisory confirms this behav...
Internet Explorer Javaprxy.dll heap overflow
Added: 06/05/2006 CVE: CVE-2005-2087 BID: 14087 OSVDB: 17680 Background Windows operating systems use the Component Object Model COM to allow various program components to be run within different applications. One such object, the JView Profiler Javaprxy.dll, is a debugger interface for Microsoft...
[SECURITY] [DSA 1088-1] New centericq packages fix arbitrary code execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 1088-1 [email protected] http://www.debian.org/security/ Martin Schulze June 3rd, 2006 http://www.debian.org/security/faq -...
CVE-2005-3619
Cross-site scripting XSS vulnerability in the management interface for VMware ESX 2.5.x before 2.5.2 upgrade patch 2, 2.1.x before 2.1.2 upgrade patch 6, and 2.0.x before 2.0.1 upgrade patch 6 allows remote attackers to inject arbitrary web script or HTML via messages that are not sanitized when...
CVE-2005-3619
CVE-2005-3619 affects VMware ESX Server management interface. The issue is a cross-site scripting (XSS) vulnerability in the web-based syslog viewer, where messages displayed without proper sanitization can inject arbitrary script/HTML. Affected versions include ESX 2.5.x prior to 2.5.2 upgrade p...
CVE-2006-2758
CVE-2006-2758 is a directory traversal vulnerability in Jetty 6.0.x (jetty6) beta16. A remote attacker can read arbitrary files by using an encoded path like %2e%2e%5c (../) in the URL, potentially impacting confidentiality. The issue is noted to possibly be the same as CVE-2005-3747. The connect...
Corsaire Security Advisory - VMware ESX Server Cross Site Scripting issue
-- Corsaire Security Advisory -- Title: VMware ESX Server Cross Site Scripting issue Date: 14.11.05 Application: VMware ESX prior to 2.5.2 upgrade patch 2 VMware ESX prior to 2.1.2 upgrade patch 6 VMware ESX prior to 2.0.1 upgrade patch 6 Environment: VMware ESX Author: Stephen de Vries...
[SECURITY] [DSA 1085-1] New lynx-cur packages fix several vulnerabilities
-------------------------------------------------------------------------- Debian Security Advisory DSA 1085-1 [email protected] http://www.debian.org/security/ Martin Schulze June 1st, 2006 http://www.debian.org/security/faq -...
PLUGINSPAGE privileged JavaScript execution II — Mozilla
Paul Nickerson reports that the fix for MFSA 2005-34 can be bypassed using nested javascript: URLs, again allowing the attacker to execute privileged code. The attacker must first convince the user to first click on the missing-plugin icon in the page or the "Install Missing Plugins..." button in...
