10533 matches found
CVE-2005-4213
CVE-2005-4213 describes a SQL injection in mod.php of phpCOIN 1.2.2 exploitable via the phpcoinsessid cookie, allowing remote SQL commands. This affects phpCOIN 1.2.2 prior to any fixes; remediation is not detailed in the provided documents, but related Nessus entries reference a 1.2.2 fix releas...
CVE-2005-4224
CVE-2005-4224 affects e107 0.7 (and related entries) with multiple potential SQL injection paths. The vulnerabilities allow remote attackers to potentially execute arbitrary SQL through parameters in signup.php, subcontent.php, upload.php, and usersettings.php (e.g., email, hideemail, realname, s...
CVE-2005-4218
PHPWebThings 1.4 is affected by a SQL injection in forum.php via the msg parameter. The root cause is improper input sanitization in the forum.php handler, enabling an attacker to modify or exfiltrate data through crafted SQL. OpenVAS note indicates that remote attackers could potentially access ...
CVE-2005-4234
The CVE-2005-4234 entry describes a SQL injection vulnerability in EncapsGallery 1.0.0 and earlier , specifically in gallery.php via the id parameter. The underlying issue is improper handling of user-supplied input leading to arbitrary SQL execution by remote attackers. Documented sources confir...
CVE-2005-4219
CVE-2005-4219 affects Innovative CMS (ICMS, formerly Imoel-CMS). The setting.php page reportedly returns cleartext username and password information, potentially allowing an attacker to obtain credentials via a direct request. The NVD entry assigns a base CVSS v2 of 5.0 (Medium): Attack Vector Ne...
CVE-2005-4214
CVE-2005-4214 concerns phpCOIN 1.2.2. Affected component: installation/config flow via config.php. Root cause: the _CCFG['_PKG_PATH_DBSE'] variable is not defined, causing an error message that leaks the installation path to remote attackers. Impact: partial disclosure of information (installatio...
CVE-2005-2830
CVE-2005-2830 is an information-disclosure vulnerability in Microsoft Internet Explorer 5.01/5.5/6 when using an HTTPS proxy that requires Basic Authentication, causing URLs to be sent in cleartext. The issue is documented in the HTTPS Proxy Vulnerability (CAN-2005-2830) and is addressed by Micro...
CVE-2005-4231
The CVE-2005-4231 entry relates to a cross-site scripting (XSS) flaw in Link Up Gold 2.5 and earlier. The vulnerability arises from injectable input in multiple vectors: (1) the link parameter to tell_friend.php, (2) the phrase[] parameter to search.php in a search_links_advanced action, and (3)/...
CVE-2005-2827
The CVE-2005-2827 window kernel vulnerability affects Windows NT 4.0 and Windows 2000 (NTOSKRNL.EXE) where a terminating thread’s APC handling can lead to memory corruption and control of kernel execution. Root cause: during thread exit, the APC free loop in PspExitThread and related KiMoveApcSta...
MySQL Auction XSS vuln.
MySQL Auction XSS vuln. Vuln. dicovered by : r0t Date: 14 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/mysql-auction-xss-vuln.html vendor:mysqlauction.com affected version: 3.0 and prior Product Description: Full featured, MySQL database driven online auction software. Features...
US-CERT Technical Cyber Security Alert TA05-347A -- Microsoft Internet Explorer Vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Technical Cyber Security Alert TA05-347A Microsoft Internet Explorer Vulnerabilities Original release date: December 13, 2005 Last revised: -- Source: US-CERT Systems Affected Microsoft Windows Microsoft Internet Explorer For more complete information...
Computer Associates License Service GETCONFIG buffer overflow
Added: 12/14/2005 CVE: CVE-2005-0581 BID: 12705 OSVDB: 14389 Background The License service comes with most Computer Associates products and exchanges license information over ports 10202/tcp and 10203/tcp. Problem A buffer overflow vulnerability exists in the processing of GETCONFIG messages...
Computer Associates License Service GETCONFIG buffer overflow
Added: 12/14/2005 CVE: CVE-2005-0581 BID: 12705 OSVDB: 14389 Background The License service comes with most Computer Associates products and exchanges license information over ports 10202/tcp and 10203/tcp. Problem A buffer overflow vulnerability exists in the processing of GETCONFIG messages...
CVE-2005-3352
Cross-site scripting XSS vulnerability in the modimap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps...
CVE-2005-3352
Cross-site scripting XSS vulnerability in the modimap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps...
CVE-2005-3352
Cross-site scripting XSS vulnerability in the modimap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps...
CVE-2005-3352
The CVE-2005-3352 entry documents a cross-site scripting (XSS) vulnerability in the Apache httpd mod_imap (and mod_imagemap) module. The issue arises from improper handling of the Referer header when using image maps, allowing an attacker to inject arbitrary script or HTML. Affected software is A...
CVE-2005-3352
Cross-site scripting XSS vulnerability in the modimap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps...
[SECURITY] [DSA 920-1] New ethereal packages fix arbitrary code execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 920-1 [email protected] http://www.debian.org/security/ Martin Schulze December 13th, 2005 http://www.debian.org/security/faq -...