CVE-2005-4531

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-3345. Reason: This candidate is a duplicate of CVE-2005-3345. CVE-2005-3345 had already been assigned, but not published, before this candidate was created. Notes: All CVE users should reference CVE-2005-3345 instead of this...

CVE-2005-4525

CVE-2005-4525 affects the Sygate Protection Agent 5.0, build 6144, via the SmcGui.exe component. The described flaw is that a local user can trigger the privileged management GUI by launching SmcGui.exe and then terminating the process, which causes the high-privilege management interface to appe...

CVE-2005-4521

CVE-2005-4521 is a CRLF injection vulnerability in Mantis (affected: 1.0.0rc3 and earlier) that lets remote attackers modify HTTP headers and perform HTTP response splitting via the login_cookie_test.php return parameter and the login_select_proj_page.php ref parameter. The issue is documented in...

CVE-2005-4519

CVE-2005-4519 covers multiple SQL injection vulnerabilities in MantisBT (manage_user_page.php and related pages) that allow remote attackers to execute arbitrary SQL commands via parameters such as (1) prefix, (2) sort on manage_user_page.php, or (3) sort on view_all_set.php. Connected sources al...

CVE-2005-4518

CVE-2005-4518 affects Mantis before 0.19.4. An attacker can bypass the file upload size restriction by altering max_file_size in bug_file_add.php, bug_report.php, bug_report_advanced_page.php, or proj_doc_add_page.php. Public advisories (Debian GLSA/DSA, Gentoo GLSA) document fixed versions (e.g....

CVE-2005-4529

The CVE-2005-4529 entry concerns the Chatspot 2.0.0a7 module for phpBB. Affects the module by enabling remote attackers to impersonate other users via unknown vectors. The available data assigns a Network attack vector, no authentication, and partial impact on confidentiality, integrity, and avai...

CVE-2005-4522

CVE-2005-4522 describes cross-site scripting (XSS) in Mantis before or at 1.0.0rc3, in the view_filters_page.php filters script. The vulnerabilities allow remote attackers to inject arbitrary script or HTML via the (1) view_type and (2) target_field parameters. The CVSSv2 base score is 4.3 (Mediu...

CVE-2005-4532

CVE-2005-4532 affects scponly versions 4.1 and earlier. The root cause is a design/implementation flaw in scponlyc that can be exploited when LD_PRELOAD is available: an unprivileged user can create a chroot directory in their home, hard-link to a system setuid application, and override expected ...

CVE-2005-4527

CVE-2005-4527 involves Direct News 4.9 with multiple SQL injection vulnerabilities. The issues allow remote attackers to execute arbitrary SQL via (1) the setLang parameter in index.php and (2) unspecified search module parameters. NVD reports a base score of 7.5 (HIGH) with Network attack vector...

CVE-2005-4526

CVE-2005-4526 affects Clearswift MIMEsweeper For Web (WEBsweeper) versions 4.0–5.1. The vulnerability allows remote attackers to bypass content filtering by using a URL that does not contain a ".exe" extension but returns an executable file. The connected PT-Security entry notes the affected vers...

CVE-2005-4533

CVE-2005-4533 affects scponly (scponly 4.1 and earlier) when both scp and rsync compatibility are enabled. The vulnerability arises from unfiltered getopt-style arguments in scponlyc, allowing local users to execute arbitrary applications. Impact is local user space compromise with potential priv...

CVE-2005-4530

CVE-2005-4530 : Affected product is AlstraSoft EPay Enterprise 3.0 (formerly DoPays). The issue is multiple cross-site scripting (XSS) vulnerabilities in pages such as profile.htm, card.htm, bank.htm, subscriptions.htm, send.htm, request.htm, forgot.htm, escrow.htm, donations.htm, and products.ht...

CVE-2005-4517

CVE-2005-4517 concerns a SQL injection vulnerability in PHP-Fusion versions 6.00.200 through 6.00.300. The flaw allows remote attackers to execute arbitrary SQL commands via the ratings parameter in multiple scripts (e.g., ratings_include.php). The vulnerability is exploitable through standard we...

CVE-2005-4531

CVE-2005-4531 is rejected/not used; consult CVE-2005-3345 for the authoritative entry.

CVE-2005-4523

CVE-2005-4523 affects Mantis (MantisBT) 1.0.0rc3 and earlier. Root cause: private bugs are disclosed via public RSS feeds, enabling remote attackers to obtain sensitive information. Impact: information disclosure of private bugs. Mitigation: upgrade to fixed Mantis versions as referenced in Debia...

CVE-2005-4524

CVE-2005-4524 affects Mantis 1.0.0rc3 and covers improper handling of the "Make note private" action during bug resolution, with unknown impact and potential information leakage. Public sources (Debian DSA-944-1, Ubuntu CVE page, NVD) corroborate the issue as one of several Mantis vulnerabilities...

CVE-2005-4520

Mantis (web-based bug tracker) is affected by CVE-2005-4520 as part of a set of vulnerabilities identified in Mantis up to version 0.19.x. The issue is described as unspecified "port injection" vulnerabilities in filters, with unclear impact and attack vectors in the initial entry. Public advisor...

phpBB viewtopic.php highlight parameter vulnerability

Added: 12/28/2005 CVE: CVE-2005-2086 BID: 14086 OSVDB: 17613 Background phpBB is an open-source bulletin board package written in PHP. Problem This is a variant of an older vulnerability which allows remote command execution by requesting viewtopic.php with a specially crafted highlight parameter...

phpBB viewtopic.php highlight parameter vulnerability

Added: 12/28/2005 CVE: CVE-2005-2086 BID: 14086 OSVDB: 17613 Background phpBB is an open-source bulletin board package written in PHP. Problem This is a variant of an older vulnerability which allows remote command execution by requesting viewtopic.php with a specially crafted highlight parameter...

phpBB viewtopic.php highlight parameter vulnerability

Added: 12/28/2005 CVE: CVE-2005-2086 BID: 14086 OSVDB: 17613 Background phpBB is an open-source bulletin board package written in PHP. Problem This is a variant of an older vulnerability which allows remote command execution by requesting viewtopic.php with a specially crafted highlight parameter...