CVE-2005-3397

Cross-site scripting XSS vulnerability in Comersus BackOffice allows remote attackers to inject arbitrary web script or HTML via the error parameter to comersusbackofficesupportError.asp. NOTE: the comersusbackofficemessage.asp/message vector is already covered by CVE-2005-2191 item 2...

CVE-2005-3401

Multiple interpretation error in TheHacker 5.8.4.128 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a...

CVE-2005-3406

Cross-site scripting XSS vulnerability in phpESP 1.7.5 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

BELL-CVE-2005-3388 CVE-2005-3388 does not affect BellSoft software

Bulletin has no description...

CVE-2005-3393

Format string vulnerability in the foreignoption function in options.c for OpenVPN 2.0.x allows remote clients to execute arbitrary code via format string specifiers in a push of the dhcp-option command option...

CVE-2005-3389

The parsestr function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when called with only one parameter, allows remote attackers to enable the registerglobals directive via inputs that cause a request to be terminated due to the memorylimit setting, which causes PHP to set an internal flag that...

CVE-2005-3313

The IRC protocol dissector in Ethereal 0.10.13 allows remote attackers to cause a denial of service infinite loop...

CVE-2005-2751

memberd in Mac OS X 10.4 up to 10.4.2, in certain situations, does not quickly synchronize access control checks with changes in group membership, which could allow users to access files and other resources after they have been removed from a group...

CVE-2005-3401

CVE-2005-3401 describes a vulnerability in TheHacker 5.8.4.128 where a multiple interpretation error permits a remote bypass of virus scanning by crafted files (e.g., BAT, HTML, EML) that carry an explicit MZ (EXE) byte sequence. The content can be treated as a safe type while still being executa...

CVE-2005-3406

CVE-2005-3406 is a Cross-site scripting (XSS) vulnerability in phpESP 1.7.5 and earlier, allowing remote attackers to inject arbitrary web script or HTML via unknown vectors. Connected sources confirm the affected software and nature of the flaw; no exploit details or fixes are provided in the su...

CVE-2005-3407

SQL injection vulnerability in phpESP 1.7.5 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors...

CVE-2005-3403

ATutor

CVE-2005-3398

CVE-2005-3398 relates to the Solaris Management Console web server in Solaris 8/9/10 where the HTTP TRACE method is enabled by default. The effect is potential cross-site tracing information leakage (e.g., cookies or headers) through TRACE requests. Connected docs confirm the TRACE issue as a rec...

CVE-2005-3396

CVE-2005-3396 : The issue is in IBM AIX 5.2 and 5.3, affecting the chcons (chcon) command. The root cause is a buffer overflow when DEBUG MALLOC is enabled, which could allow an attacker to execute arbitrary code via a long command line argument. The connected documents (NVD entry and related adv...

CVE-2005-3402

CVE-2005-3402 affects Mozilla Thunderbird SMTP client (notably 1.0.5 BETA and 1.0.7). The issue is that Thunderbird does not notify users when it cannot establish a secure channel with the SMTP server, enabling a MITM to obtain authentication information by bypassing TLS or downgrading CRAM-MD5 t...

CVE-2005-3395

CVE-2005-3395: SQL injection in Invision Gallery 2.0.3 allows remote attackers to execute arbitrary SQL via the st parameter in index.php. The underlying flaw is improper sanitization of user input used in database queries, leading to potential data exposure or modification. Exploitation details ...

CVE-2005-2749

CVE-2005-2749 describes an issue in Mac OS X Finder Get Info window where file and group ownership information could be misrepresented on Mac OS X 10.4.2 and earlier. The Apple security advisory for Mac OS X v10.4.3 (and related updates) documents fixes across Finder, including synchronizing disp...

CVE-2005-2751

CVE-2005-2751 affects Mac OS X 10.4.x (up to 10.4.2) and Mac OS X Server 10.4.2. The issue is delayed synchronization of group membership changes in memberd, allowing an authenticated user to access files/resources after removal from a group. Apple’s advisory for 10.4.3 fixes includes invalidatin...

CVE-2005-3397

CVE-2005-3397 describes a cross-site scripting (XSS) vulnerability in the Comersus BackOffice. The issue is exploitable via the error parameter to the script comersus_backoffice_supportError.asp , allowing remote attackers to inject arbitrary web script or HTML. The description notes that the rel...

CVE-2005-3394

/* CVE-2005-3394 */ Summary: Multiple SQL injection vulnerabilities affect the oaboard forum 1.0 in the file/forum logic (forum.php). The two vulnerable parameters are the (1) channel parameter in the topics module and (2) the topic parameter in the posting module. What is affected: oaboard forum...