CVE-2005-3895

Open Ticket Request System OTRS 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, when AttachmentDownloadType is set to inline, renders text/html e-mail attachments as HTML in the browser when the queue moderator attempts to download the attachment, which allows remote attackers to execute arbitrary w...

CVE-2005-3893

Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System OTRS 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the 1 user parameter in the Login action, and remote authenticated users via the...

CVE-2005-3890

CVE-2005-3890 affects Gadu-Gadu version 7.20. A remote attacker can cause a denial of service (crash and configuration loss) by loading a page containing a large number of gg: URIs. The available sources identify the affected product and the impact (DoS), but do not provide exploitable details be...

CVE-2006-0018

Summary: CVE-2005-3899 (Google Talk) describes a vulnerability in the automatic update feature where remote attackers can poison a target's DNS cache and cause a large update file to be sent, triggering CPU and memory exhaustion during signature verification (BenjiBug). The related entry CVE-2006...

CVE-2005-3894

Open Ticket Request System (OTRS) is affected by CVE-2005-3894 and related CVEs. The vulnerabilities are cross-site scripting (XSS) in index.pl that allow remote authenticated users to inject arbitrary script or HTML via hex-encoded values in the QueueID parameter and via Action parameters. Affec...

CVE-2005-3891

CVE-2005-3891 affects Gadu-Gadu 7.20. The issue is a stack-based buffer overflow in handling image filenames when the name length is between 192 and 200 characters, not accounting for the appended "imgcache" string, which can crash the application and enable a denial-of-service. Public sources (N...

CVE-2005-3899

CVE-2005-3899 concerns Google Talk’s automatic update mechanism. The vulnerability allows remote attackers to trigger a denial of service by poisoning a target’s DNS cache and forcing a large update file to be processed, which consumes CPU and memory during signature verification. The provided do...

CVE-2005-3896

The CVE-2005-3896 entry details a remote DoS condition in Mozilla where a Javascript BODY onload event calls the window function, causing CPU consumption. Supported sources (NVD, Ubuntu, Debian, CVE lists) confirm the vulnerability description and impact as a CPU-based denial of service. Affected...

CVE-2005-3888

CVE-2005-3888 affects Gadu-Gadu 7.20. A memory leak occurs in handling DCC packets: when a packet has a code other than 2 and a large size field, memory is allocated but not freed after the packet is dropped, enabling remote denial of service. Affected product: Gadu-Gadu 7.20. Root cause: memory ...

CVE-2005-3898

...

CVE-2005-3895

OTRS vulnerability CVE-2005-3895 affects Open Ticket Request System versions 1.0.0–1.3.2 and 2.0.0–2.0.3. When AttachmentDownloadType is inline, text/html email attachments are rendered as HTML in the browser by the queue moderator during download, enabling remote execution of script/HTML (XSS). ...

CVE-2005-3898

CVE-2005-3898 is a reservation duplicate of CVE-2005-3567 and should reference CVE-2005-3567 instead. Connected records provide concrete details for CVE-2005-3567: the affected component is the slapd daemon in IBM Tivoli Directory Server (ITDS) versions 5.2.0 and 6.0.0. The vulnerability involves...

CVE-2005-2123

CVE-2005-2123 affects the Windows GDI32.DLL Graphics Rendering Engine, with heap-based buffer overflows triggered by crafted WMF/EMF image data. Affected systems include Windows 2000 SP4, XP SP1/SP2, and Server 2003 SP1. Root cause is overflow/unchecked size handling in image rendering, enabling ...

CVE-2005-3897

CVE-2005-3897 affects Apple Safari 2.0.2. The vulnerability enables a remote attacker to cause a denial of service (system slowdown) by triggering a Javascript BODY onload event that calls the window function. The description in the provided sources assigns a CVSS v2 base score of 7.8 (HIGH) with...

CVE-2005-3887

CVE-2005-3887 affects Gadu-Gadu 7.20. The vulnerability arises from improper handling of MS-DOS device names in filenames, enabling a remote attacker to cause a denial of service (hang) with an image filename like AUX: and potentially write to the LPT1 port using a filename such as "LPT1:". The c...

CVE-2005-3893

OTRS Open Ticket Request System (version 1.0.0–1.3.2 and 2.0.0–2.0.3) contains SQL injection vulnerabilities in index.pl, affecting the Login action (user parameter) and AgentTicketPlain action (TicketID/ArticleID). Exploitation can lead to remote SQL execution and possible authentication bypass;...

CVE-2005-3885

The ps2epsi extension shell script ps2epsi.sh in Inkscape before 0.41 allows local users to overwrite arbitrary files via a symlink attack on the tmpepsifile.epsi temporary file...

[SECURITY] [DSA 911-1] New gtk+2.0 packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 911-1 [email protected] http://www.debian.org/security/ Martin Schulze November 29th, 2005 http://www.debian.org/security/faq -...

CVE-2005-3871

Multiple SQL injection vulnerabilities in Joels Bulletin board JBB 0.9.9rc3 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 nr parameter in topiczeigen.php, 2 forum and 3 zeigeseite parameters in showforum.php, 4 forum parameter in newtopic.php, and 5 tidnr paramete...

CVE-2005-3877

Multiple SQL injection vulnerabilities in Simple Document Management System SDMS 2.0-CVS and earlier allow remote attackers to execute arbitrary SQL commands via the 1 folderid parameter in list.php and 2 mid parameter in a view action to messages.php...