CVE-2005-3138

CVE-2005-3138 affects Bugzilla 2.18rc1–2.18.3, 2.19–2.20rc2, and 2.21. An unauthorized remote attacker can retrieve sensitive information (e.g., the list of installed products) through the config.cgi endpoint, which remains accessible even when the requirelogin parameter is set. The underlying is...

CVE-2005-2960

Removed by vendor...

CVE-2005-3144

CVE-2005-3144 affects httpAdapter.c in sblim-sfcb versions before 0.9.2, where long HTTP headers can trigger a remote denial of service. The vulnerability is documented in NVD CVE and CVE records; impact is limited to availability (partial), with network access and no authentication required. Rem...

CVE-2005-3149

CVE-2005-3149 affects uim, specifically 0.4.x (before 0.4.9.1) and 0.5.0 and earlier, where LIBUIM_VANILLA is not handled correctly when linked into suid/sgid apps (e.g., immodule for Qt), enabling local privilege escalation. Public advisories from Debian (DSA-895-1), Gentoo GLSA 200510-03, Mandr...

CVE-2005-3146

CVE-2005-3146 affects the backup utility StoreBackup. The issue arises from how StoreBackup creates temporary files, enabling a local attacker to perform unauthorized operations on arbitrary files via a symlink attack. Multiple connected sources (e.g., Debian DSA-1022-1, SUSE/Security notes, OSV ...

CVE-2005-3153

Affected software: myBloggie 2.1.3 beta and earlier. Vulnerable component: login.php. Root cause / vector: remote attackers can bypass a whitelist regular expression and perform SQL injection via the username parameter when a null character is present, allowing injection into the query string. Th...

CVE-2005-0023

gnome-pty-helper in GNOME libzvt2 and libvte4 allows local users to spoof the logon hostname via a modified DISPLAY environment variable. NOTE: the severity of this issue has been disputed...

CVE-2005-3151

Buffer overflow in blenderplay in Blender Player 2.37a allows attackers to execute arbitrary code via a long command line argument...

CVE-2005-0023

CVE-2005-0023 affects gnome-pty-helper within GNOME libzvt2 and libvte4. The root cause is a vulnerability where a modified DISPLAY environment variable allows local users to spoof the logon hostname. Implications are limited to local access with partial confidentiality/availability impact as des...

CVE-2005-3146

StoreBackup before 1.19 allows local users to perform unauthorized operations on arbitrary files via a symlink attack on temporary files...

CVE-2005-2758

CVE-2005-2758 affects Symantec AntiVirus Scan Engine (administrative web interface). The vulnerability is a buffer overflow caused by insufficient validation of HTTP header input, allowing remote code execution when a crafted request is sent to the web service port (default 8004) on affected vers...

CVE-2005-3150

CVE-2005-3150 affects Weex, a non-interactive FTP client used for updating web pages. The vulnerability is a format string bug in Weex that could allow remote code execution when processing filenames, as described in multiple sources. Debian and Gentoo advisories cite fixes in older branches and ...

Solaris 9 (sparc) : 119211-36

NSSNSPRJSS 3.30.2: NSPR 4.15 / NSS 3.30.2 / JSS 4.3.2. Date this patch was last updated by Sun : Nov/09/17 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

RHEL 3 : net-snmp (RHSA-2005:373)

Updated net-snmp packages that fix two security issues and various bugs are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. SNMP Simple Network Management Protocol is a protocol used for network management. A denial of service bug was...

Debian DSA-834-1 : prozilla - buffer overflow

Tavis Ormandy discovered a buffer overflow in prozilla, a multi-threaded download accelerator, which may be exploited to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

Debian DSA-843-1 : arc - insecure temporary file

Two vulnerabilities have been discovered in the ARC archive program under Unix. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2005-2945 Eric Romang discovered that the ARC archive program under Unix creates a temporary file with insecure permissions...

SUSE-SA:2005:053: squid

The remote host is missing the patch for the advisory SUSE-SA:2005:053 squid. This update of the Squid web-proxy fixes two remotely exploitable denial of service vulnerabilities. One can be triggered by aborting a request CVE-2005-2794 due to a faulty assertion. The other one occurs in...

GLSA-200509-11 : Mozilla Suite, Mozilla Firefox: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200509-11 Mozilla Suite, Mozilla Firefox: Multiple vulnerabilities The Mozilla Suite and Firefox are both vulnerable to the following issues: Tom Ferris reported a heap overflow in IDN-enabled browsers with malicious Host: headers...

Fedora Core 4 : kernel-2.6.12-1.1456_FC4 (2005-906)

Thu Sep 22 2005 Dave Jones 2.6.12-1.1456FC4 - Disable crash driver on Xen kernels. - Wed Sep 14 2005 Dave Jones 2.6.12-1.1455FC4 - Fixes for CVE-2005-2490 and CVE-2005-2492 - Thu Sep 8 2005 Rik van Riel - upgrade to a newer Xen snapshot - exclude Xen TPM bits, since those conflict with 2.6.12.5 -...

Mandrake Linux Security Advisory : apache (MDKSA-2005:130)

Watchfire reported a flaw that occured when using the Apache server as a HTTP proxy. A remote attacker could send an HTTP request with both a 'Transfer-Encoding: chunked' header and a 'Content-Length' header which would cause Apache to incorrectly handle and forward the body of the request in a w...