CVE-2005-4484

CVE-2005-4484 affects IntranetApp version 3.3 and earlier. The vulnerability is a set of cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML via (1) the ret_page parameter to login.asp, and (2) the do_search and (3) search parameters to content.asp....

CVE-2005-4482

The CVE-2005-4482 entry describes a Cross-site Scripting (XSS) vulnerability in PortalApp 3.3 and earlier, exploitable via the ret_page parameter in login.asp. Affected component: login.asp within PortalApp; root cause: improper handling of the ret_page input enables injection of arbitrary script...

CVE-2005-4476

The CVE-2005-4476 entry documents a Cross-site scripting (XSS) vulnerability in OpenEdit 4.0 and earlier, specifically in store/search/results.html, exploitable via the oe-action and page HTTP parameters. The issue allows remote attackers to inject arbitrary web script or HTML. Affected product i...

CVE-2005-4499

The Downloadable RADIUS ACLs feature in Cisco PIX and VPN 3000 concentrators, when creating an ACL on the Cisco Secure Access Control Server CS ACS, generates a random internal name for an ACL that is also used as a hidden user name and password, which allows remote attackers to gain privileges b...

CVE-2005-4494

SPIP 1.8.2 and earlier exposes a cross-site scripting (XSS) vulnerability. According to the CVE record, remote attackers can inject arbitrary web script or HTML via unspecified parameters to spip_login.php3 and spip_pass.php3. The affected software is SPIP (content management system), but the des...

CVE-2005-4480

CVE-2005-4480 : A cross-site scripting (XSS) vulnerability affects Plexcor CMS 4.0 and earlier, allowing remote attackers to inject arbitrary web script or HTML via unspecified search parameters. Documents do not specify the exact vulnerable component/version beyond the CMS family, nor provide co...

CVE-2005-4481

Polopoly 9 and earlier are affected by an XSS vulnerability described as allowing remote attackers to inject arbitrary web script or HTML via unspecified search parameters. The vendor disputes the issue, stating the XSS flaw was part of a custom site implementation. Public records do not provide ...

CVE-2005-4491

Affected software: Sitekit CMS 6.6 and earlier. Vulnerability: Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML via several parameters (1) query string, (2) textonly, (3) locID, (4) lang to Default.aspx, and the (6) ClickFrom parame...

CVE-2005-4489

CVE-2005-4489 describes a Cross-site Scripting (XSS) vulnerability in Scoop 1.1 RC1 and earlier, where remote attackers can inject arbitrary web script or HTML via the (1) type, (2) count parameters, and (3) the query string in a story. Affected product is Scoop (version 1.1 RC1 and earlier); und...

CVE-2005-4490

CVE-2005-4490 affects SCOOP! 2.3 and earlier, with multiple XSS vulnerabilities. An attacker can inject arbitrary script/HTML via parameters to articleSearch.asp (keyword, invalid parameter); lostPassword.asp (username, invalid parameter); account_login.asp (Username, Password, invalid parameter)...

CVE-2005-4496

CVE-2005-4496 is an XSS vulnerability in SyntaxCMS 1.2.1 and earlier, exploitable via the search_query parameter to inject arbitrary script or HTML. Affected: SyntaxCMS versions up to 1.2.1 (and earlier). Impact: remote script/HTML execution as an attacker-provided payload; details on exploit vec...

CVE-2005-4484

Multiple cross-site scripting XSS vulnerabilities in IntranetApp 3.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 retpage parameter to login.asp or the 2 dosearch and 3 search parameters to content.asp...

CVE-2005-4486

CVE-2005-4486 concerns SQL injection in Quantum Art QP7.Enterprise (formerly Q-Publishing). The vulnerability allows remote attackers to manipulate SQL via the p_news_id parameter on endpoints such as news_and_events_new.asp and news.asp . The vendor disputed the report’s accuracy in 2006, noting...

CVE-2005-4495

The advisory concerns SpireMedia mx7, specifically the index.cfm script, where the cid parameter is vulnerable to SQL injection. The root cause is untrusted input used in SQL queries, enabling remote attackers to potentially run arbitrary SQL commands. Some sources also suggest this may illuminat...

CVE-2005-4493

CVE-2005-4493 describes a cross-site scripting (XSS) vulnerability in SpearTek 6.0 and earlier . The issue allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters . CVSS v2 base score reported as 6.8 (Medium) with network attack vector, no authentication, ...

CVE-2005-4474

The CVE-2005-4474 entry concerns WinRAR 3.51 with a buffer overflow in the “Add to archive” command. The described issue arises when a user is tricked into adding a file whose filename contains non-default code page and non-ANSI characters (e.g., Chinese filenames). The root cause is described as...

xpdf security update

CentOS Errata and Security Advisory CESA-2005:840-02 An updated xpdf package that fixes several security issues is now available. This update has been rated as having important security impact by the Red Hat Security Response Team. Updated 20 Dec 2005 The initial fix for these issues was...

CVE-2005-4465

The Internet Key Exchange version 1 IKEv1 implementation in NEC UNIVERGE IX1000, IX2000, and IX3000 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of...

WebDB SQL inj vuln.

WebDB SQL inj vuln. Vuln. discovered by : r0t Date: 22 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/webdb-sql-inj-vuln.html vendor:http://www.loissoftware.com affected version:1.1 and prior Product Description: WebDB is the totally generic, instant online database system - It is...

CVE-2005-4471

CVE-2005-4471 concerns the POP3 service in Avaya Modular Messaging Message Storage Server (MSS) 2.0 SP4 and earlier. The vulnerability allows remote attackers to cause a denial-of-service (infinite loop) by sending crafted packets over the network. The available records explicitly identify the af...