CVE-2005-3912

Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, allows remote attackers to cause a denial of service crash or memory consumption and possibly execute arbitrary code via format string specifiers in the usernam...

CVE-2005-3914

Multiple SQL injection vulnerabilities in AFFcommerce 1.1.4 allow remote attackers to execute arbitrary SQL commands via 1 the cl parameter to SubCategory.php and the itemid parameter in 2 ItemInfo.php and 3 ItemReview.php...

CVE-2005-3907

The CVE affects the Sun/Oracle Java Runtime Environment and JDK/JRE 5.0 Update 3 and earlier, where an untrusted Java applet may bypass security restrictions to access system resources and execute arbitrary code remotely. The root cause is an unspecified vulnerability in Java applets that can esc...

CVE-2005-3914

AFFcommerce 1.1.4 is affected by multiple SQL injection vulnerabilities (CVE-2005-3914). The flaws allow remote attackers to inject arbitrary SQL via (1) cl parameter to SubCategory.php and (2) item_id parameter in ItemInfo.php and (3) ItemReview.php. The connected documents confirm the affected ...

CVE-2005-3924

CVE-2005-3924 is a SQL injection vulnerability in Randshop, specifically in themes/kategorie/index.php. The issue allows remote attackers to execute arbitrary SQL commands through the kategorieid and katid parameters. NVD lists a CVSS v2 base score of 7.5 (HIGH) with network attack vector, low co...

CVE-2005-3929

The CVE-2005-3929 entry covers a directory traversal in Xaraya 1.0. The vulnerable component is the create function path in xarMLSXML2PHPBackend.php and the index.php module parameter handling. Due to insufficient input sanitization, an unauthenticated, remote attacker can craft a request that us...

CVE-2005-3918

CVE-2005-3918 affects OvBB 0.08a with SQL injection vulnerabilities exposed via the threadid parameter to thread.php and the userid parameter to profile.php. The connected PT-2005-4658 entry provides concrete details: attackers can remotely execute arbitrary SQL commands due to these input vector...

CVE-2005-3920

CVE-2005-3920 describes an SQL injection vulnerability in Babe Logger 2. The vulnerability allows remote attackers to execute arbitrary SQL commands via the gal parameter to index.php or the id parameter to comments.php. The public details identify the affected software (Babe Logger 2) and the sp...

CVE-2005-3912

CVE-2005-3912: Webmin/miniserv.pl format-string vulnerability (username in login form) can crash or exhaust resources and potentially allow remote code execution when syslog logging is enabled. Affected: Webmin < 1.250 and Usermin

CVE-2005-3919

PBLang 4.65 is affected by a cross-site scripting (XSS) vulnerability in UCP.php and SendPm.php. The issue allows remote attackers to inject arbitrary web script or HTML via multiple fields, enabling potential theft or manipulation of user data as described in CVE-2005-3919. No remediation detail...

CVE-2005-3923

NetObjects Fusion 9 NOF9 allows remote attackers to obtain sensitive information, including passwords, by downloading the versioningrepository/rollbacklog.xml file, then using it to download and modify the associated ZIP file to edit and republish the site...

CVE-2005-3917

The CVE-2005-3917 entry affects CommodityRentals 2.0 Online Rental Business Creator script. It is a SQL injection vulnerability in the usersession function exploitable via the user_id parameter, enabling remote execution of arbitrary SQL commands. Impact per CVSS: Confidentiality/Integrity/Availa...

CVE-2005-3928

The CVE-2005-3928 issue affects QNX 6.2.1 and 6.3.0, where a buffer overflow in the phgrafx component is triggered by a long command line argument, allowing a local user to execute arbitrary code. The NVD entry lists a base score of 4.6 (MEDIUM) with local attack vector and no authentication. No ...

CVE-2005-3929

Directory traversal vulnerability in the create function in xarMLSXML2PHPBackend.php in Xaraya 1.0 allows remote attackers to create directories and overwrite arbitrary files via ".." sequences in the module parameter to index.php...

CVE-2005-3913

The CVE-2005-3913 entry concerns VHCS (Virtual Hosting Control System) 2.4.6.2. The vulnerability affects the domain alias management feature, specifically the creation and deletion of forwards for domain aliases, which enables a user to hijack the forwardings of other users. The provided sources...

CVE-2005-3925

CVE-2005-3925 describes multiple SQL injection vulnerabilities in Central Manchester CLC Helpdesk Issue Manager 0.9 and earlier. The flaws allow remote attackers to execute arbitrary SQL commands through the following inputs: (1) detail[] (2) orderdir (3) orderby to find.php, and (4) id to issue....

CVE-2005-3923

NetObjects Fusion 9 (NOF9) is affected. The vulnerability lets a remote attacker obtain sensitive information (including passwords) by downloading the versioning_repository /rollbacklog.xml and using it to retrieve and modify the related ZIP file to edit and republish the site. No remediation det...

CVE-2005-3910

merchants/index.php in Post Affiliate Pro 2.0.4 and earlier, with magicquotesgpc disabled, allows remote attackers to include arbitrary local files via the md parameter, possibly due to a directory traversal vulnerability...

CVE-2005-3910

The CVE-2005-3910 entry affects Post Affiliate Pro (merchants/index.php) in version 2.0.4 and earlier. When magic_quotes_gpc is disabled, remote attackers can trigger a local file inclusion via the md parameter, likely due to a directory traversal vulnerability. Documented impact is arbitrary loc...

CVE-2005-3922

CVE-2005-3922 describes a heap-based buffer overflow in Panda Software Antivirus library (pskcmp.dll) when scanning ZOO archives. The root cause is a boundary/size handling error while decompressing user-supplied archives, potentially enabling arbitrary code execution with the target’s privileges...