CVE-2005-3974

Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3, when running on PHP5, does not correctly enforce user privileges, which allows remote attackers to bypass the "access user profiles" permission...

CVE-2005-3976

SQL injection vulnerability in type.asp, as used in multiple DUware products including 1 DUamazon 3.1, 2 DUarticle 1.1, 3 DUclassified 4.2, 4 DUdirectory 3.1 and DUdirectory Pro 3.0 and 3.0 SQL, 5 DUdownload 1.1, 6 DUgallery 3.3, 7 DUnews 1.1, and 8 DUpaypal 3.1 and DUpaypal Pro 3.0, allows remot...

CVE-2005-3979

relocateserver.php in Coppermine Photo Gallery CPG 1.4.2 and 1.4 beta is not removed after installation and does not use authentication, which allows remote attackers to obtain sensitive information, such as database configuration, via a direct request...

CVE-2005-3975

Interpretation conflict in file.inc in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the file in Internet...

CVE-2005-3974

Drupal 4.5.0–4.5.5 and 4.6.0–4.6.3 on PHP5 do not correctly enforce user privileges, allowing remote attackers to bypass the access user profiles permission (CVE-2005-3974). The advisories note a fix in 4.6.3 (and related Debian updates in DSA-958-1), with older fixed versions for sid/stable tree...

CVE-2005-3972

Cross-site scripting XSS vulnerability in extremesearch.php in Extreme Search Corporate Edition 6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter...

CVE-2005-3969

CVE-2005-3969 affects MXChange prior to 0.2.0-pre10 PL492, where an SQL injection vulnerability could allow remote attackers to execute arbitrary SQL via unknown vectors. The available documents confirm the affected software/versions and the underlying issue (SQL injection); no explicit remediati...

CVE-2005-3967

CVE-2005-3967 is an XSS vulnerability in Atlassian Confluence 2.0.1 Build 321. The issue affects the dosearchsite.action module, allowing remote attackers to inject arbitrary web script or HTML via the searchQuery.queryString parameter. The documented impact is partial integrity compromise with n...

CVE-2005-3979

CVE-2005-3979 affects Coppermine Photo Gallery (CPG) versions 1.4.2 and 1.4 beta. The file relocate_server.php is not removed after installation and does not require authentication, enabling remote attackers to obtain sensitive information (e.g., database configuration) via a direct request. The ...

CVE-2005-3973

Drupal v4.5.x (4.5.0–4.5.5) and v4.6.x (4.6.0–4.6.3) are affected by multiple cross-site scripting (XSS) vulnerabilities. The issue allows remote attackers to inject arbitrary web script or HTML via various HTML tags and values (examples include the legend tag and the value parameters in label an...

CVE-2005-3971

CVE-2005-3971 affects Citrix MetaFrame Secure Access Manager 2.0–2.2 and NFuse Elite 1.0. It is a cross-site scripting (XSS) vulnerability in the login form that allows remote attackers to inject arbitrary web script or HTML via the username field. The connected sources document this vulnerabilit...

CVE-2005-3966

CVE-2005-3966 concerns Cross-site Scripting (XSS) in Java Search Engine (JSE) 0.9.34. The vulnerability is triggered via the q parameter in search.jsp, allowing remote attackers to inject arbitrary web script or HTML. The NVD/CVE details show a MEDIUM severity (CVSS v2 base score 4.3) with networ...

CVE-2005-3968

SQL injection vulnerability in auth.inc.php in PHPX 3.5.9 and earlier allows remote attackers to execute arbitrary SQL commands, bypass authentication, and upload arbitrary PHP code via the username parameter...

CVE-2005-3970

MXChange prior to 0.2.0-pre10 PL492 contains a cross-site scripting (XSS) vulnerability that could allow remote attackers to inject arbitrary web script or HTML via unknown vectors. Affected component: MXChange software; vulnerability described in CVE-2005-3970 with CVSS v2 vector AV:N/AC:M/Au:N/...

CVE-2005-3976

SQL injection vulnerability in type.asp, as used in multiple DUware products including 1 DUamazon 3.1, 2 DUarticle 1.1, 3 DUclassified 4.2, 4 DUdirectory 3.1 and DUdirectory Pro 3.0 and 3.0 SQL, 5 DUdownload 1.1, 6 DUgallery 3.3, 7 DUnews 1.1, and 8 DUpaypal 3.1 and DUpaypal Pro 3.0, allows remot...

CVE-2005-3974

Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3, when running on PHP5, does not correctly enforce user privileges, which allows remote attackers to bypass the "access user profiles" permission...

CVE-2005-3972

The CVE-2005-3972 entry describes a Cross-site scripting (XSS) vulnerability in the Extrem e Search Corporate Edition 6.0 and earlier, specifically in extremesearch.php, where an attacker can inject arbitrary web script or HTML via the search parameter. Affected product: Extreme Search Corporate ...

CVE-2005-3976

CVE-2005-3976 describes a SQL injection in DUware products (DUamazon 3.1, DUarticle 1.1, DUclassified 4.2, DUdirectory 3.1/3.0, DUdownload 1.1, DUgallery 3.3, DUnews 1.1, DUpaypal 3.1/Pro 3.0) via the iType parameter in type.asp. The underlying issue is that user-supplied input is used to constru...

CVE-2005-3975

CVE-2005-3975 is an interpretation conflict in Drupal that allowed remote authenticated users to inject arbitrary web script or HTML via a file with a GIF/JPEG extension. Affected versions include Drupal 4.5.0–4.5.5 and 4.6.0–4.6.3. The issue could execute HTML in Internet Explorer (per CVE-2005-...

MailEnable IMAP W3C Logging Buffer Overflow

Added: 12/03/2005 CVE: CVE-2005-3155 BID: 15006 OSVDB: 19842 Background MailEnable is a mail server for Windows platforms. The standard edition supports the SMTP and POP3 protocols. MailEnable Professional and MailEnable Enterprise also support IMAP and HTTPMail. Problem MailEnable's IMAP service...