10533 matches found
CVE-2005-4406
The vulnerability CVE-2005-4406 affects Mercury CMS 4.0 and earlier, with an SQL injection in index.cfm via the page parameter. The underlying issue is improper input handling allowing remote attackers to inject arbitrary SQL commands. Impact is described as potentially partial confidentiality, i...
CVE-2005-4393
CVE-2005-4393 describes a cross-site scripting (XSS) vulnerability in the show.cfm component of the e-publish CMS, version 2.0 and earlier. The underlying issue allows remote attackers to inject arbitrary web script or HTML by supplying the parameters (1) obcatid and (2) comid). Affected product:...
CVE-2005-4406
SQL injection vulnerability in index.cfm in Mercury CMS 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter...
CVE-2005-4394
EPiX 3.1.2 and earlier versions are affected by a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via unspecified search query parameters. The connected documents confirm the affected product and the general class of flaw but do not pro...
CVE-2005-4405
CVE-2005-4405 affects Red Queen 1.02 and earlier. The vulnerability arises in redqueen.cgi where remote attackers can trigger leakage of the full server path via invalid parameters (yellowpage_id, skin_id, supplier_id, module), disclosed in an error message. This is a path disclosure vulnerabilit...
CVE-2005-4419
CVE-2005-4419 affects Honeycomb Archive and Honeycomb Archive Enterprise 3.0. Vulnerable through CategoryResults.cfm where SQL injection can be triggered via the parameters (1) series, (2) cat_parent, (3) cat, and (4) div, allowing remote arbitrary SQL execution. The NVD entry identifies the vuln...
CVE-2005-4408
Multiple SQL injection vulnerabilities in Miraserver 1.0 RC4 and earlier allow remote attackers to execute arbitrary SQL commands via user-supplied input in three vectors: the page parameter to index.php, the id parameter to newsitem.php, and the cat parameter to article.php. The root cause is un...
CVE-2005-4423
CVE-2005-4423 affects PHPFM older than 0.2.3. The issue is an unrestricted file upload vulnerability that lets remote authenticated users upload a file with an executable extension (e.g., .php ) to an accessible directory and thereby execute arbitrary code under the web server's privileges. Explo...
CVE-2005-4399
CVE-2005-4399 concerns a cross-site scripting (XSS) vulnerability in Libertas Enterprise CMS, versions 3.0 and earlier. The flaw is in the search/index.php handler and allows remote attackers to inject arbitrary web script or HTML via the page_search parameter. The information available does not ...
CVE-2005-4400
CVE-2005-4400 is a documented cross-site scripting (XSS) vulnerability in Liferay Portal Enterprise (versions up to 3.6.1). The flaw affects the downloads/portal_ent component and can be exploited via the parameters _77_struts_action, p_p_mode, and p_p_state to inject arbitrary script/HTML. The i...
CVE-2005-4426
CVE-2005-4426 involves YaBB before 2.1 where an interpretation conflict allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF extension, causing the HTML to execute in Internet Explorer (as described for CVE-2005-3312). The issue is tied to YaBB’s ...
CVE-2005-4407
CVE-2005-4407 describes a cross-site scripting (XSS) vulnerability in Mercury CMS versions up to 4.0, where the index.cfm script is vulnerable. The issue arises from unsafely handling the 1) content and 2) criteria parameters, allowing remote attackers to inject arbitrary web script or HTML. Expl...
CVE-2005-4424
CVE-2005-4424 affects PHP-Kit up to version 1.6.1 R2. The vulnerability is a directory-traversal flaw in the path parameter that, combined with a %00 (null byte) at the end of a filename (e.g., avatar.png%00), enables remote authenticated users to execute arbitrary PHP code. Documented impact ind...
CVE-2005-4417
The CVE-2005-4417 issue affects Widcomm Bluetooth for Windows (BTW) 4.0.1.1500 and earlier, as installed with Belkin Bluetooth Software 1.4.2 Build 10 and ANYCOM Blue USB-130-250 Software 4.0.1.1500. The default configuration leaves Authentication and Authorization values null, enabling remote at...
CVE-2005-4372
Cross-site scripting XSS vulnerability in account.html in Adaptive Website Framework AWF 2.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter...
CVE-2005-4369
CVE-2005-4369 describes a cross-site scripting (XSS) vulnerability in Acuity CMS 2.6.2. The issue allows remote attackers to inject arbitrary web script or HTML through unspecified search parameters, potentially via strSearchKeywords to browse.asp. The NVD data lists a CVSS v2 base score of 4.3 (...
CVE-2005-4372
Cross-site scripting XSS vulnerability in account.html in Adaptive Website Framework AWF 2.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter...
CVE-2005-4377
CVE-2005-4377 describes a cross-site scripting (XSS) vulnerability in the Page.asp component of Baseline CMS (version 1.95 and earlier). The vulnerability allows remote attackers to inject arbitrary web script or HTML via the PageID or SiteNodeID parameters. The available records indicate an XSS ...
CVE-2005-4372
The CVE-2005-4372 entry describes a Cross-site scripting (XSS) vulnerability in Adaptive Website Framework (AWF) prior to or including version 2.10, exploitable via the page parameter in account.html. The underlying issue is improper handling of the page value, allowing remote attackers to inject...