CVE-2005-2796

The sslConnectTimeout function in ssl.c for Squid 2.5.STABLE10 and earlier allows remote attackers to cause a denial of service segmentation fault via certain crafted requests...

CVE-2005-2812

man2web allows remote attackers to execute arbitrary commands via -P arguments...

DEBIAN-CVE-2005-2794

store.c in Squid 2.5.STABLE10 and earlier allows remote attackers to cause a denial of service crash via certain aborted requests that trigger an assert error related to STOREPENDING...

CVE-2005-2808

CVE-2005-2808 affects frox 0.7.16 and 0.7.17. A flaw in parsing Deny ACLs may let an attacker bypass restrictions and reach blocked hosts. Root cause: improper handling of Deny ACLs. CVSS details indicate network access, no authentication, low complexity, and partial impacts to confidentiality, i...

CVE-2005-2818

CVE-2005-2818 concerns a cross-site scripting (XSS) vulnerability in DownFile 1.3. The issue arises from unvalidated input in the id parameter passed to four PHP scripts (email.php, index.php, del.php, add_form.php), enabling remote attackers to inject arbitrary JavaScript/HTML. The available doc...

CVE-2005-2836

CVE-2005-2836 affects Phorum versions up to 5.0.17a. The vuln arises from cross-site scripting in two input points: (1) the username field in register.php and (2) a signed-in user’s signature shown in “My Control Center,” not properly sanitized by control.php. The result is remote injection of sc...

CVE-2005-2836

Multiple cross-site scripting XSS vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the username parameter to register.php or 2 a signature of a logged-in user in "My Control Center," which is not properly handled by control.php...

CVE-2005-2794

CVE-2005-2794 affects Squid (2.5.STABLE10 and earlier). The issue arises when certain aborted requests trigger an assert in STORE_PENDING, allowing remote attackers to cause a denial of service (crash). The connected OpenVAS entries reference Debian, Gentoo, SuSE and FreeBSD advisories documentin...

CVE-2005-2817

CVE-2005-2817 affects Simple Machines Forum (SMF) 1-0-5 and earlier. The issue arises from using URLs for avatar images, enabling a remote attacker to induce disclosure of sensitive visitor data (e.g., IP address, user agent) via a malicious avatar URL. The vulnerability is demonstrated via PHP o...

CVE-2005-2812

CVE-2005-2812 affects the man2web utility that converts UNIX man pages to HTML. The root cause is improper handling of -P arguments, allowing remote attackers to execute arbitrary shell commands on the affected host with the web server’s privileges. This is a network-exposed, unauthenticated comm...

CVE-2005-2812

man2web allows remote attackers to execute arbitrary commands via -P arguments...

CVE-2005-2807

CVE-2005-2807 affects frox 0.7.18. When running setuid root, it does not properly drop privileges while reading a configuration file, allowing local users to read portions of arbitrary files via the -f option. The linked Red Hat, Ubuntu, and NVD entries corroborate the local, file-read impact but...

CVE-2005-2814

The CVE-2005-2814 entry concerns FlatNuke 2.5.6 with a Cross-site scripting (XSS) flaw. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the usr parameter in a vis_reg operation to index.php. Affected component: the vis_reg flow in index.php; root cause: unsani...

CVE-2005-2820

Cross-site scripting XSS vulnerability in SqWebMail 5.0.4 allows remote attackers to inject arbitrary web script or HTML via an e-mail message containing Internet Explorer "Conditional Comments" such as "if" and "endif"...

CVE-2005-2796

CVE-2005-2796 affects Squid up to version 2.5.STABLE10 and earlier, with the sslConnectTimeout path in ssl.c being exploitable. The vulnerability allows remote attackers to trigger a denial of service (segmentation fault) by sending certain crafted requests. OpenVAS entries and advisories confirm...

CVE-2005-2818

Cross-site scripting XSS vulnerability in DownFile 1.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter to 1 email.php,2 index.php, 3 del.php, or 4 addform.php...

CVE-2005-2807

frox 0.7.18, when running setuid root, does not properly drop privileges when reading a configuration file, which allows local users to read portions of arbitrary files via the -f command line option...

CVE-2005-2820

CVE-2005-2820 is an XSS vulnerability in SqWebMail courier (Conditional Comments in Internet Explorer). The root cause is missing input sanitising in the courier/sqwebmail handling of HTML in emails, allowing remote attackers to inject script via crafted messages. Affected: SqWebMail courier depl...

CVE-2005-2819

CVE-2005-2819 affects DownFile 1.3. Remote attackers can gain administrator privileges through direct HTTP requests to update.php, del.php, and add_form.php. The provided materials describe the affected components and impact but do not specify the underlying root cause or a verified exploit metho...

CVE-2005-2813

CVE-2005-2813 concerns FlatNuke 2.5.6 (and possibly earlier) with a directory traversal in index.php reading via the id parameter (read mod), allowing an attacker to read arbitrary files using .. and %00. The connected Nessus/NVD entries confirm the vulnerability path and document that affected s...