CVE-2005-2492

CVE-2005-2492 affects the Linux kernel 2.6 series prior to 2.6.13.1. The raw_sendmsg function can be exploited by a local user to cause a denial of service (change hardware state) or read from arbitrary memory via crafted input. Documented in multiple advisories (e.g., Mandriva MDKSA-2005:235; SU...

CVE-2005-2897

In CVE-2005-2897, WEB//NEWS 1.4 is vulnerable to information disclosure: remote attackers can obtain sensitive information by directly requesting files in the actions directory, with the error message revealing the file path (illustrated by cat.add.php). NVD lists a base score of 5.0 (Medium) wit...

CVE-2005-2903

The CVE-2005-2903 entry concerns a heap-based buffer overflow in NOD32 Anti-Virus 2.5 (nod32.002 1.033 build 1127) when scanning ARJ archives with long filenames, with active scanning enabled. The vulnerability allows remote attackers to execute arbitrary code by delivering a crafted ARJ file, as...

CVE-2005-2913

...

CVE-2005-2912

CVE-2005-2912 affects Linksys WRT54G Wireless Router. The vulnerability is a denial-of-service condition caused by sending an HTTP POST request with a negative Content-Length, leading to CPU consumption and the web server hanging. Devices running affected firmware are prone to this DoS. The provi...

CVE-2005-2880

CVE-2005-2880 concerns multiple SQL injection vulnerabilities in phpCommunityCalendar 4.0.3 (and possibly earlier). The flaws allow remote attackers to execute arbitrary SQL commands via (1) the login field in login.php or (2) the LocationID parameter to week.php. The affected component is phpCom...

CVE-2005-2891

WebArchiveX.dll 5.5.0.76 (pre-Sept 6, 2005) exposes a scripting-unsafe default state that allows remote attackers to read or write arbitrary files via the MakeArchive and MakeArchiveStr methods. Affected component is WebArchiveX.dll; vulnerability arises because the component was marked safe for ...

CVE-2005-2893

CVE-2005-2893 affects PBLang 4.65 (and possibly earlier). The vulnerability is a direct static code injection in setcookie.php where the username parameter (u) is directly injected into a file that is later executed upon login, enabling remote code execution. The available sources identify the vu...

CVE-2005-2900

The CVE-2005-2900 entry concerns a Cross-site scripting (XSS) flaw in top.php of CjLinkOut 1.0, where an attacker can inject arbitrary script/HTML through the 123 parameter. The affected component is top.php (part of CjLinkOut 1.0); the underlying cause is an XSS vulnerability in that script. The...

CVE-2005-2902

CVE-2005-2902 describes an SQL injection vulnerability in class-1 Forum Software 0.24.4 . The issue allows remote attackers to execute arbitrary SQL and bypass the file extension check by injecting SQL code into the uploaded file’s extension. This is the explicit vulnerability described in multip...

CVE-2005-1913

CVE-2005-1913 affects the Linux kernel up to version 2.6.12.1. The vulnerability occurs when a non group-leader thread executes a different program while an itimer is pending; the expiry signal is delivered to the old group-leader task, which no longer exists, causing a kernel panic (local DoS). ...

CVE-2005-2898

FileZilla vulnerability CVE-2005-2898 affects versions 2.2.14b–2.2.15 (and possibly earlier) where, if “Use secure mode” is disabled, passwords are stored using a weak encryption scheme in the configuration file. This allows local users to obtain sensitive information. The issue is disputed by th...

CVE-2005-2896

CVE-2005-2896 describes an SQL injection vulnerability affecting WEB//NEWS 1.4. The vulnerability arises from unsafely handling user-controlled input in multiple parameters: wn_userpw in startup.php, and cat, id, or stof in news.php, as well as id in print.php. Successful exploitation could allow...

CVE-2005-2890

CVE-2005-2890 affects SecureOL VE2 1.05.1008. The issue is improper restriction of public access to physical memory via the PhysicalMemory device, allowing local users to bypass restrictions and gain access to the secured environment. Documented CVSSv2 base metrics: AV:L/AC:L/Au:N/C:P/I:P/A:P (ba...

CVE-2005-2886

CVE-2005-2886 affects MAXdev MD-Pro 1.0.73 (and possibly earlier) with multiple XSS vulnerabilities. The issue allows remote attackers to inject arbitrary web script or HTML via: (1) the print parameter to the print module, (2) the sitename parameter to the bb_smilies module, (3) the sitename par...

CVE-2005-2881

CVE-2005-2881 affects phpCommunityCalendar 4.0.3. Remote attackers can bypass authentication via a direct request to the admin directory. NVD CVSS v2 base score 7.5 (HIGH): NETWORK vector, low attack complexity, no authentication required; confidentiality, integrity, and availability are partiall...

CVE-2005-2915

The CVE-2005-2915 entry involves the Linksys WRT54G router (various 3.x releases) using a weak XOR-based encoding with a fixed mask for configuration data. This flaw could let an attacker decrypt configuration information and, in conjunction with CVE-2005-2914, potentially re-encrypt it. Connecte...

CVE-2005-2883

...

CVE-2005-2899

CVE-2005-2899 corresponds to multiple XSS vulnerabilities in details.php of CjTagBoard 3.0. The flaw allows remote attackers to inject arbitrary web script or HTML by supplying one of the parameters (date, time, name, ip, agent, or msg). The connected sources confirm the affected component and vu...

CVE-2005-2883

CVE-2005-2883 is a duplicate of CVE-2005-2855 and has been deprecated; the connected record CVE-2005-2855 describes a Cross-site scripting (XSS) vulnerability in Unclassified NewsBoard 1.5.3. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the description fiel...