CVE-2005-3416

CVE-2005-3416 affects phpBB up to version 2.0.17 (and earlier) where, if register_globals is enabled and session handling omits a call to session_start, an attacker can bypass security checks by assigning strings to $_SESSION and $HTTP_SESSION_VARS, which causes an array_merge to fail. OpenVAS/De...

CVE-2005-3417

The issue concerns phpBB 2.0.x (2.0.17 and earlier). CVE-2005-3417 is documented as allowing remote attackers to modify global variables and bypass security when certain PHP globals behavior is altered. OpenVAS and Debian/FreeBSD advisories confirm a set of related flaws (CVE-2005-3310, 3415, 341...

CVE-2005-3422

The CVE-2005-3422 entry describes a Cross-site Scripting (XSS) vulnerability in ASP Fast Forum’s error.asp, exploitable by remote attackers via the error parameter to inject arbitrary scripts/HTML. The NVD entry lists a CVSS v2 base score of 4.3 (Medium), with attack vector Network, authenticatio...

CVE-2005-3420

CVE-2005-3420 affects phpBB 2.0.x (notably phpBB 2.0.17) via the signature_bbcode_uid parameter in usercp_register.php, allowing remote attackers to modify regular expressions and execute PHP code. Debian and OpenVAS advisories group this with multiple phpBB vulnerabilities; Debian fixes upgrade ...

CVE-2005-3418

CVE-2005-3418 affects phpBB 2.0.17 and earlier: multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web scripts via (1) error_msg in usercp_register.php, (2) forward_page in login.php, or (3) list_cat in search.php—globals not initialized as variabl...

CVE-2005-3421

estcmd in Hyper Estraier 1.0.1 on Windows systems allows remote attackers to read unauthorized files via a crafted search request for a filename that contains Unicode characters...

CVE-2005-3421

Hyper Estraier 1.0.1 (estcmd) on Windows is affected. A remote attacker can read unauthorized files by sending a crafted search request where the filename contains Unicode characters. Affected component appears to be estcmd within Hyper Estraier; the vulnerability arises during a search/indexing ...

CVE-2005-3415

CVE-2005-3415 affects phpBB 2.0.17 and earlier, where remote attackers can bypass protection by setting a GET/POST/COOKIE variable and a GLOBALS[] variable with the same name, causing GLOBALS[] to be unset while the GPC variable remains. This can manipulate phpBB behavior. The OpenVAS and Debian ...

CVE-2005-3419

CVE-2005-3419 is a SQL injection vulnerability in phpBB2 (phpBB 2.0.x). The Debian advisory DSA-925-1 and OpenVAS entries enumerate that phpBB2 could be affected via the signature_bbcode_uid parameter, enabling remote attackers to execute arbitrary SQL commands. The issue is listed among multiple...

CVE-2005-3420

usercpregister.php in phpBB 2.0.17 allows remote attackers to modify regular expressions and execute PHP code via the signaturebbcodeuid parameter, as demonstrated by injecting an "e" modifier into a pregreplace statement...

CVE-2005-3414

eyeOS 0.8.4 stores usrinfo.xml under the web document root with insufficient access control, which allows remote attackers to obtain user credentials...

CVE-2005-3411

Cross-site scripting XSS vulnerability in post.asp in Snitz Forums 2000 3.4.05 allows remote attackers to inject arbitrary web script or HTML via the type parameter in a Topic method...

CVE-2005-3413

Cross-site scripting XSS vulnerability in desktop.php in eyeOS 0.8.4 allows remote attackers to inject arbitrary web script or HTML via the motd parameter...

CVE-2005-3412

CVE-2005-3412 describes an XSS vulnerability in Elite Forum 1.0.0.0 that allows remote attackers to inject arbitrary script by posting a reply containing a javascript: URL inside an tag. The provided description identifies the vulnerable vector and affected product. No further exploitation detai...

CVE-2005-3413

Cross-site scripting XSS vulnerability in desktop.php in eyeOS 0.8.4 allows remote attackers to inject arbitrary web script or HTML via the motd parameter...

CVE-2005-3412

Cross-site scripting XSS vulnerability in Elite Forum 1.0.0.0 allows remote attackers to inject arbitrary web script or HTML via a Post Reply to a topic, in which the reply contains a javascript: URL in an tag...

CVE-2005-3413

EyeOS 0.8.4 contains a Cross-site scripting (XSS) vulnerability in desktop.php where the motd parameter is not properly sanitized, allowing remote attackers to inject arbitrary script or HTML. This could lead to user’s browser executing malicious code in the context of the affected eyeOS session....

CVE-2005-3411

CVE-2005-3411 concerns a cross-site scripting (XSS) vulnerability in Snitz Forums 2000, specifically in the post.asp script used to render Topic content. The vulnerability arises from unsanitized handling of the Type parameter when generating dynamic content, enabling an attacker to inject arbitr...

CVE-2005-3414

CVE-2005-3414 affects eyeOS 0.8.4. The issue arises from storing usrinfo.xml in the web document root with insufficient access control, allowing remote attackers to obtain user credentials. The available connected documents confirm eyeOS 0.8.4 and the credential exposure risk, but do not provide ...

CVE-2005-3389

The parsestr function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when called with only one parameter, allows remote attackers to enable the registerglobals directive via inputs that cause a request to be terminated due to the memorylimit setting, which causes PHP to set an internal flag that...