CVE-2005-4260

Interpretation conflict in includes/mainfile.php in PHP-Nuke 7.9 and later allows remote attackers to perform cross-site scripting XSS attacks by replacing the "" in the tag with a "", which bypasses the regular expressions that sanitize the data, but is automatically corrected by many web...

CVE-2005-4265

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-4209. Reason: This candidate is a duplicate of CVE-2005-4209. Notes: All CVE users should reference CVE-2005-4209 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2005-4265

...

CVE-2005-4254

DreamPoll 3.0 final (DreamLevels) contains a SQL injection vulnerability in view_Results.php, exploitable via the id parameter to execute arbitrary SQL. The issue is documented with a CVSS v2 base score of 7.5 (HIGH), affecting confidentiality, integrity, and availability (partial impact) with ne...

CVE-2005-4255

CVE-2005-4255 is a cross-site scripting (XSS) vulnerability in the TextSearch component of WikkaWiki 1.1.6.0 . The issue allows remote attackers to inject arbitrary web script or HTML via a hex-encoded phrase parameter. The published data indicates a CVSS v2 base score of 4.3 (Medium) with networ...

CVE-2005-4258

CVE-2005-4258 affects Cisco Catalyst Switches. A remote attacker can cause a device crash (DoS) by sending an IP packet where source and destination IPs/ports are identical and the SYN bit is set (LanD). The issue’s provenance is unknown and details originate from BIN/NVD entries. The NVD metrics...

CVE-2005-4248

CVE-2005-4248 : Multiple cross-site scripting (XSS) vulnerabilities in QuickPayPro 3.1 allow remote attackers to inject arbitrary web script or HTML via fields in (1) communication/subscribers.tracking.add.php, (2) support/tickets.add.php, and (3) mycompany/categories.php. The description across ...

CVE-2005-4249

ADP Forum 2.0–2.0.3 stores sensitive credentials in plaintext under the web document root, with insufficient access control. This allows remote attackers to obtain user credentials by requesting the forum/users directory. Connected sources (PT-2005-4937) confirm affected versions and a workaround...

CVE-2005-4265

CVE-2005-4265 is a duplicate of CVE-2005-4209. The connected CVE-2005-4209 documents a cross-site scripting (XSS) vulnerability in WorldClient webmail for Alt-N MDaemon 8.1.3, where script tags in the Subject header can block user access to the Inbox. No additional details for 4265 are provided i...

CVE-2005-4262

CVE-2005-4262 is described as a cross-site scripting (XSS) vulnerability in the Envolution News module. The issue allows remote attackers to inject arbitrary web script or HTML through the (1) startrow and (2) catid parameters. The description notes this issue may be related to an SQL injection p...

CVE-2005-4256

CVE-2005-4256 describes a cross-site scripting (XSS) vulnerability in ASP-DEV XM Forum RC3, specifically in forum.asp where the forum_title parameter can inject arbitrary script/HTML. Affected item is XM Forum RC3 (forum.asp handling). The core issue is an XSS in the forum_title parameter, enabli...

CVE-2005-4253

CVE-2005-4253 describes a Cross-site scripting (XSS) vulnerability in getdox.php of Torrential 1.2, allowing remote attackers to inject arbitrary scripts via the URL. The description notes possible relation to CVE-2005-4160 but provides no additional technical details in the available documents. ...

CVE-2005-4257

The CVE-2005-4257 issue affects Linksys WRT54GS and BEFW11S4 devices. The vulnerability is triggered by an IP packet with identical source and destination IPs and ports and the SYN flag set (LAND), which can cause the device to crash and result in a denial of service. The description notes that t...

CVE-2005-4266

The CVE-2005-4266 issue affects Alt-N MDaemon/WorldClient (WorldClient.dll) where WorldClient 8.1.3 trusts a Session parameter containing a randomly generated session ID linked to a username. This enables remote attackers to impersonate other users by guessing or sniffing the session value. Conne...

CVE-2005-4243

Multiple SQL injection vulnerabilities in QuickPayPro 3.1 allow remote attackers to execute arbitrary SQL commands via various parameters (popupid in popups.edit.php; so, sb, nr in customer.tickets.view.php; subrackingid in subscribers.tracking.edit.php; delete in design.php; trackingid in tracki...

CVE-2005-4253

Cross-site scripting XSS vulnerability in getdox.php in Torrential 1.2 allows remote attackers to inject arbitrary web script or HTML via the URL. NOTE: this might be resultant from CVE-2005-4160...

CVE-2005-4261

Technical details about CVE-2005-4261 (CP+ before 2.5.5) are not provided in the connected documents. The material references Perl-related issues (CVE-2005-3962) and general advisories, but there is no explicit information here on CP+, vendor, affected versions, root cause, impact, or fixes. Moni...

CVE-2005-4260

CVE-2005-4260 is an XSS vulnerability in PHP-Nuke 7.9 and later, where an interpretation conflict in includes/mainfile.php allows remote attackers to inject scripts by replacing the ">" with "

Fedora Core 4 : perl-5.8.6-22 (2005-1144)

o Updated upstream fix for sprintf integer overflow vulnerabilities CVE-2005-3962 and CVE-2005-3912, including new Sys::Syslog 0.08 o Updated fix for bug 136009 / MakeMaker LDRUNPATH issue: restore previous default Red Hat behavior of removing the MakeMaker generated LDRUNPATH setting from the li...

Fedora Core 4 : curl-7.13.1-5.fc4 (2005-1137)

This package fixes a security buffer overflow bug in URL authentication code of curl CVE-2005-4077, previous patch did not fix this problem completely. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempte...