CVE-2005-4337

The CVE-2005-4337 issue affects Blackboard Learning and Community Portal System on Academic Suite versions 6.3.1.424, 6.2.3.23, and earlier builds. The root cause is an authentication bypass via a modified user_id parameter and a "/" in the encoded_pw parameter, enabling remote attackers to gain ...

CVE-2005-4339

Cross-site scripting XSS vulnerability in Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to inject arbitrary web script or HTML via the context parameter to announcement.pl, which is reflected in the...

CVE-2005-4340

CVE-2005-4340 is a duplicate of CVE-2005-4206 and, per the linked records, the active vulnerability information is in CVE-2005-4206. The connected documents describe Blackboard Learning and Community Portal System in Academic Suite versions before 6 (e.g., 6.3.1.424, 6.2.3.23, and other pre-6 rel...

CVE-2005-4338

The CVE-2005-4338 entry affects Blackboard Learning and Community Portal System (Academic Suite) versions 6.3.1.424, 6.2.3.23, and earlier 6.x. The vulnerability, as described in multiple feeds, allows remote attackers to gain administrator privileges by setting the context parameter to "admin". ...

CVE-2005-4325

Multiple unspecified vulnerabilities in Driverse before 0.56b have unknown impact and attack vectors, related to 1 a "ptrace exploit" and 2 "some other potential security problems."...

CVE-2005-4317

Limbo CMS 1.0.4.2 and earlier, with registerglobals off, does not protect the $SERVER variable from external modification, which allows remote attackers to use the SERVERREMOTEADDR parameter to 1 conduct cross-site scripting XSS attacks in the stats module or 2 execute arbitrary code via an eval...

CVE-2005-4332

Cisco Clean Access 3.5.5 and earlier on the Secure Smart Manager allows remote attackers to bypass authentication and cause a denial of service or upload files via direct requests to obsolete JSP files including 1 admin/uploadclient.jsp, 2 applyfirmwareaction.jsp, and 3 file.jsp...

CVE-2005-4316

HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allows remote attackers to cause a denial of service via a "Rose Attack" that involves sending a subset of small IP fragments that do not form a complete, larger packet...

CVE-2005-4326

The CVE-2005-4326 entry concerns APC PowerChute Network Shutdown’s web interface, where all communication is performed in cleartext (base64-encoded). This design allows remote attackers to sniff authentication credentials. Public references confirm the issue and the metric suggests a network-base...

CVE-2005-4321

CVE-2005-4321 aggregates multiple IKEv1 vulnerabilities affecting various implementations of IPsec/IKE tooling (notably ipsec-tools racoon and related products) that were demonstrated via the PROTOS ISAKMP test suite and could lead to a denial of service. Connected advisories describe multiple CV...

CVE-2005-4336

CVE-2005-4336 describes a Cross-site scripting (XSS) vulnerability in ProjectForum 4.7.0 and earlier. The issue allows remote attackers to inject arbitrary web script or HTML via the parameters (1) fwd in admin/adminsignin.html and (2) originalpageid in admin/newpage.html, associated with a group...

CVE-2005-4319

CVE-2005-4319 : Limbo CMS (PHP)

CVE-2005-4332

Cisco Clean Access 3.5.5 and earlier on the Secure Smart Manager is affected by CVE-2005-4332. The issue allows remote attackers to bypass authentication and cause a denial of service or upload files via direct requests to obsolete JSP files, specifically admin/uploadclient.jsp, apply_firmware_ac...

CVE-2005-4336

Cross-site scripting XSS vulnerability in ProjectForum 4.7.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 fwd parameter in admin/adminsignin.html and 2 originalpageid parameter in admin/newpage.html associated with a group...

CVE-2005-4329

CVE-2005-4329 affects PHP Arena paFileDB Extreme Edition RC 5 and earlier . The vulnerability is a SQL injection in the file pafiledb.php , allowing remote attackers to execute arbitrary SQL commands via the (1) newsid and (2) id parameters. The initial details show a network attack vector with a...

CVE-2005-4335

ProjectForum 4.7.0 and earlier is affected by a denial-of-service vulnerability triggered by a crafted pageid parameter in admin/versions.html. The entry states remote attackers can crash the application, with CVSS v2 base score 7.8 (HIGH) and network-based vector (AV:N/AC:L/Au:N/C:N/I:N/A:C). Th...

CVE-2005-4325

CVE-2005-4325 relates to Driverse prior to version 0.56b. The connected sources indicate two issues: (1) a ptrace-based exploit and (2) other potential security problems. The documents describe unknown impact and attack vectors, with no explicit root-cause analysis, affected subcomponents, CVSS m...

CVE-2005-4318

CVE-2005-4318 is a SQL injection vulnerability in Limbo CMS 1.0.4.2 and earlier. The flaw allows remote attackers to execute arbitrary SQL commands through the _SERVER[REMOTE_ADDR] parameter, which alters the underlying $_SERVER variable when register_globals is off. Affected software is Limbo CM...

CVE-2005-4317

Limbo CMS (versions up to 1.0.4.2) is affected by multiple flaws. When register_globals is off and a MySQL backend is used, improper sanitization of _SERVER[REMOTE_ADDR] enables SQL injection. The same parameter can also enable cross-site scripting in the Stats module. Additionally, index2.php pe...

CVE-2005-4320

CVE-2005-4320 affects Limbo CMS versions 1.0.4.2 and earlier. The vulnerability allows remote attackers to obtain the installation path by requesting one of three files—doc.inc.php, element.inc.php, or node.inc.php—causing a path disclosure in an error message. OpenVAS/NASL details corroborate th...