CVE-2005-3332

Vulnerability (CVE-2005-3332) in Belchior Foundry’s vCard 2.9: PHP remote file include in admin/define.inc.php allows an attacker to execute arbitrary PHP code via the match parameter. Multiple sources (NVD, Red Hat advisory, Nessus plugin) corroborate the flaw and impact. Affected software is th...

CVE-2005-3335

PHP file inclusion vulnerability in bugsponsorshiplistviewinc.php in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the tcorepath parameter...

CVE-2005-3338

CVE-2005-3338 affects MantisBT prior to version 0.19.3. The vulnerability occurs when using reminders, which causes the system to display the real, non-hidden email addresses of users, exposing confidential contact information. The disclosed information is limited to email addresses (partial conf...

CVE-2005-3247

CVE-2005-3247 refers to a vulnerability in Ethereal (0.10.x) where the SigComp UDVM could loop indefinitely, enabling a remote attacker to cause a denial of service. Connected sources confirm multiple issues across Ethereal dissectors in versions prior to 0.10.13, including an infinite loop in th...

CVE-2005-3339

CVE-2005-3339 affects MantisBT (Mantis) prior to version 0.19.3, where the User ID was cached longer than necessary. The connected OpenVAS and Debian/Gentoo advisories confirm that this CVE is part of a set of multiple vulnerabilities in Mantis and reference 0.19.3 as the fix version, but the pro...

CVE-2005-3331

CVE-2005-3331 concerns the mgdiff 1.0 tool, where the function viewpatch enables a local user to overwrite arbitrary files by exploiting a symlink attack on temporary files. Root cause: inadequate handling of temporary file symlinks during viewpatch. Impact: local users could modify files they sh...

CVE-2005-3265

The CVE-2005-3265 issue is a buffer overflow in Skype for Windows 1.1.x.0–1.4.x.83 that can be triggered via callto://, skype://, or a malformed VCARD. The underlying fault is described as an error in the Delphi routine SysUtils.WideFmtStr, potentially leading to remote code execution in the cont...

CVE-2005-3334

CVE-2005-3334 concerns Flyspray, a lightweight bug-tracking web app. The vulnerability affects Flyspray 0.9.7 through 0.9.8 (devel) and is a cross-site scripting (XSS) flaw in the index.php page. An attacker can inject arbitrary web script or HTML via multiple parameters (PHPSESSID, task, string,...

CVE-2005-3328

CVE-2005-3328 relates to a PHP remote file inclusion in PunBB, specifically in common.php where the pun_root parameter enables an attacker to execute arbitrary code. Affected software: PunBB 1.1.2 through 1.1.5. Underlying issue: remote code execution via user-supplied pun_root. Impact per the en...

CVE-2005-3248

CVE-2005-3248 affects Ethereal (Wireshark) X11 dissector. The vulnerability allows remote causes of denial-of-service via division by zero in the X11 dissector. Reported in Debian DSA-1171-1 and mirrored in OpenVAS entries for Ethereal, these documents confirm the issue existed in Ethereal 0.10.1...

CVE-2005-3088

CVE-2005-3088 affects fetchmail and its fetchmailconf component. The advisory describes that, in versions prior to the fixes noted in references, configuration files are created with insecure world-readable permissions, allowing local users to read sensitive data such as passwords. OpenVAS and di...

PHP-Nuke Cross-Site Scripting Vulnerability

i am sorry but i had a little problem with my old e-mail address , my new one is [email protected] the mail: PHP-Nuke Search Cross-Site Scripting Vulnerability Vulnerable: i think all ver. data:2005-09-5 The search field at modules.php?name=SearchEnhanced is vulnerable to html injection attacks...

Low: Red Hat Security Advisory: fetchmail security update

Updated fetchmail packages that fix insecure configuration file creation is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility. A bug was found in the way the fetchmailconf...

Low: Red Hat Security Advisory: pam security update

An updated pam package that fixes a security weakness is now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team. PAM Pluggable Authentication Modules is a system security tool that allows system administrators t...

CVE-2005-2338

XOOPS XSS vulnerabilities (CVE-2005-2338) affect XOOPS 2.0.12 JP and earlier, 2.0.13.1 and earlier, and 2.2.x up to 2.2.3 RC1. The issues enable remote attackers to inject arbitrary web script or HTML via (1) modules that use the XOOPS Code and (2) the newbb forum module. Root cause is cross-site...

CVE-2005-3307

Directory traversal vulnerability in index.php for FlatNuke 2.5.6 allows remote attackers to read arbitrary files via ".." sequences in the 1 user parameter in a profile operation or 2 quale parameter in a newtopic operation...

Skype URI handling routine contains a buffer overflow

Overview A buffer overflow in Skype may allow a remote attacker to execute code on a vulnerable system. Description Skype software provides telephone service over IP networks. There is a buffer overflow in the routines that handle Skype-specific URIs callto:// or skype://. The buffer overflow may...

Skype < 1.4.0.84 Multiple Remote Overflows (credentialed check)

The remote host is running Skype, a peer-to-peer, voice-over-IP software. The remote version of this software is vulnerable to a heap overflow in the handling of its data structures. An attacker can exploit this flaw by sending a specially crafted network packet to UDP or TCP ports Skype is...

ethereal security update

CentOS Errata and Security Advisory CESA-2005:809 Updated Ethereal packages that fix various security vulnerabilities are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The ethereal package is a program for monitoring network...

CVE-2005-2970

Memory leak in the worker MPM worker.c for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service memory consumption via aborted connections, which prevents the memory for the transaction pool from being reused for other connections...