10533 matches found
CVE-2005-2704
CVE-2005-2704 affects Firefox up to 1.0.6 and Mozilla Suite up to 1.7.11/12, where an XBL control implementing an internal XPCOM interface can enable remote spoofing of DOM objects. The vulnerability enables a attacker-controlled DOM objects to impersonate or misrepresent elements, aiding phishin...
CVE-2005-3048
CVE-2005-3048 affects PhpMyFAQ 1.5.1, where a directory traversal via LANGCODE in index.php can cause reading of arbitrary files or including arbitrary PHP files, enabling remote code execution via the request data (notably the User Agent field) and referencing the user tracking data file. The Op...
CVE-2005-3049
CVE-2005-3049 affects phpMyFAQ 1.5.1, where data files are stored under the web document root with insufficient access control and predictable filenames. This allows remote attackers to obtain sensitive information via a direct request to data/tracking[DATE]. The NVD entry assigns a base score of...
CVE-2005-2705
CVE-2005-2705 is a real vulnerability affecting the JavaScript engine in Firefox prior to 1.0.7 and Mozilla Suite prior to 1.7.12. The root cause is an integer overflow in the JavaScript engine that could allow a remote attacker to execute arbitrary code. The impact is remote code execution with ...
CVE-2005-2701
CVE-2005-2701 is a heap-based buffer overflow in the XBM image handling of Mozilla Firefox (pre-1.0.7) and Mozilla Suite (pre-1.7.12). Exploitation path involves a specially crafted XBM image that ends with many spaces instead of the proper end tag, enabling remote code execution under the user’s...
CVE-2005-3047
CVE-2005-3047 describes multiple cross-site scripting (XSS) vulnerabilities in PhpMyFaq 1.5.1. The flaws allow remote attackers to inject arbitrary web script or HTML via two parameters: PMF_CONF[version] in footer.php and PMF_LANG[metaLanguage] in header.php. Documents consistently reference Php...
CVE-2005-3050
PhpMyFaq 1.5.1 is affected by CVE-2005-3050, enabling remote attackers to disclose sensitive information through a non-existent LANGCODE parameter that reveals file paths in error messages. The NVD entry assigns a base score of 5.0 (Medium) with network access, low attack complexity, and partial ...
CVE-2005-3051
The CVE-2005-3051 entry concerns a stack-based buffer overflow in the ARJ plugin (arj.dll) 3.9.2.0 for 7-Zip 3.13, 4.23, and 4.26 BETA used by products such as Turbo Searcher. A crafted large ARJ block can trigger arbitrary code execution on a remote host. Connected advisories consistently descri...
CVE-2005-3045
CVE-2005-3045 affects My Little Forum 1.5 and 1.6 beta, where the vulnerability resides in the search.php component. The underlying issue is a SQL injection via the phrase field, allowing remote attackers to alter the database by injecting arbitrary SQL commands. Documents consistently describe t...
CVE-2005-3046
CVE-2005-3046 affects PhpMyFaq 1.5.1. The vulnerability is a SQL injection in password.php via the user field, enabling remote attackers to modify SQL queries and gain administrator privileges. Connected sources corroborate the issue and its impact; exploitation specifics are not provided beyond ...
Mac OS X Multiple Vulnerabilities (Security Update 2005-008)
The remote host is running Apple Mac OS X, but lacks Security Update 2005-008. This security update contains fixes for the following applications : - ImageIO - LibSystem - Mail - QuickDraw - Ruby - SecurityAgent - securityd C Tenable Network Security, Inc. include"compat.inc"; if description...
[SECURITY] [DSA 818-1] New kdeedu packages fix insecure temporary files
-------------------------------------------------------------------------- Debian Security Advisory DSA 818-1 [email protected] http://www.debian.org/security/ Martin Schulze September 22nd, 2005 http://www.debian.org/security/faq -...
CVE-2005-3031
Buffer overflow in vxFtpSrv 0.9.7 allows remote attackers to execute arbitrary code via a long USER name...
CVE-2005-3042
miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters line feed or carriage return...
[SECURITY] [DSA 817-1] New python2.2 packages fix arbitrary code execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 817-1 [email protected] http://www.debian.org/security/ Martin Schulze September 22nd, 2005 http://www.debian.org/security/faq -...
CVE-2005-3039
CVE-2005-3039 describes an SQL injection in Mall23 eCommerce where the infopage.asp script processes the idPage parameter, enabling remote arbitrary SQL execution. The issue arises from improper handling of user-supplied input in the SQL query, consistent with the CVSS data indicating network acc...
CVE-2005-3033
CVE-2005-3033 involves a stack-based buffer overflow in vxWeb 1.1.4. The overflow can be triggered by a long HTTP GET request, allowing remote attackers to cause a denial of service (crash) and potentially execute arbitrary code. This vulnerability is documented in multiple sources (NVD, Red Hat,...
CVE-2005-3036
CVE-2005-3036 affects File Transfer Anywhere 3.01, where a sensitive password is stored in plaintext in the PASS value of the program’s registry key. The root cause is plaintext credential storage in the registry, enabling local users to gain privileges. Impact: local privilege escalation as desc...
CVE-2005-3037
CVE-2005-3037 is an XSS vulnerability in Handy Address Book Server 1.1. The issue allows remote attackers to inject arbitrary script or HTML via the SEARCHTEXT parameter in a demos URL, indicating improper input handling in the web interface. The connected documents provide the vulnerability desc...
