CVE-2005-2816

CVE-2005-2816 describes a Cross-Site Scripting (XSS) vulnerability in Greymatter (Greymatter gm.cgi). The issue occurs when a user submits a post comment that is logged and later read via the administrator’s View Control Panel Log, where the log handling fails to sanitize the injected script/HTML...

CVE-2005-2839

MAXdev MD‑Pro 1.0.72 is affected by multiple XSS vulnerabilities that allow remote attackers to inject arbitrary script/HTML via parameters in dl-search.php and wl-search.php. The root cause is unsanitized user input enabling script execution in the web context. Affected product/version: MAXdev M...

CVE-2005-2838

CVE-2005-2838 affects myBloggie 2.1.3-beta and earlier; login.php is vulnerable to SQL injection via the username parameter, enabling remote command execution. Affected component is login.php; root cause is unsafely constructed SQL from user input. Public documents confirm the vulnerability and d...

CVE-2005-2794

store.c in Squid 2.5.STABLE10 and earlier allows remote attackers to cause a denial of service crash via certain aborted requests that trigger an assert error related to STOREPENDING...

CVE-2005-2837

CVE-2005-2837 affects Plain Black Software WebGUI prior to 6.7.3. Multiple eval injection flaws in the modules Help.pm, International.pm, and WebGUI.pm allow remote attackers to execute arbitrary Perl code. This is a remote code execution risk on WebGUI installations exposed to an attacker; explo...

CVE-2005-2815

The CVE-2005-2815 entry describes a vulnerability in FlatNuke 2.5.6 where print.php can disclose path information on error or be abused to trigger a denial‑of‑service by supplying an MS‑DOS device name (AUX/CON/PRN/COM1/LPT1) in the news parameter. Affected product: FlatNuke 2.5.6; vulnerability ...

CVE-2005-2810

Urban (software) before version 1.5.3 contains multiple stack-based buffer overflows exploitable by a long HOME environment variable, enabling local users to escalate privileges through (1) config.cc, (2) game.cc, (3) highscor.cc, or (4) meny.cc. Root cause: improper handling of environment data ...

CVE-2005-2820

Cross-site scripting XSS vulnerability in SqWebMail 5.0.4 allows remote attackers to inject arbitrary web script or HTML via an e-mail message containing Internet Explorer "Conditional Comments" such as "if" and "endif"...

PHP-Nuke

PHP-Nuke Search Cross-Site Scripting Vulnerability Vulnerable: i think all ver. data:2005-09-5 exploit : openme.htm :: html form name=searchform method=post action=http://target/modules.php?op=modload&name=SearchEnhanced&file= index input type="text" name="query" size="15" value='script...

PBLang <= 4.65 Remote Command Execution Exploit (2)

No description provided by source. ?php | | | PBLang = 4.65 remote commands exec exploit | | tested on 4.65 | | coded by Pengo 2005 RST/GHC | | http://rst.void.ru | | http://ghc.ru | | | WARNING! This exploit is successfully work when magicquotesrpc off = D:\httpd\phpphp.exe ..\www\r57pblang465.p...

phpnukeXSS.txt

PHP-Nuke Search Cross-Site Scripting Vulnerability Vulnerable: i think all ver. data:2005-09-5 exploit : openme.htm :: ' document.searchform.sub.click thanks , BHFH. email : [email protected]...

PBLang <= 4.65 Remote Command Execution Exploit (2)

Exploit for unknown platform in category web applications =================================================== PBLang php.exe ..\www\r57pblang465.php localhost /pbl/ "pblcookie732128=Pe ng0; PBLsecid=a4c2f845c002ac54f5751440647f3c91;" Peng0 PrSrS $ARGV = $SERVER'argv'; global $ARGV; ifcount$ARGV =...

cvs security update

CentOS Errata and Security Advisory CESA-2005:756-01 An updated cvs package that fixes a security bug is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. CVS Concurrent Version System is a version control system. An insecure temporary...

CVE-2005-2494

kcheckpass in KDE 3.2.0 up to 3.4.2 allows local users to gain root access via a symlink attack on lock files...

CVE-2005-2700

sslenginekernel.c in modssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions...

CVE-2005-2336

Cross-site scripting XSS vulnerability in Hiki 0.8.0 to 0.8.2 allows remote attackers to inject arbitrary web script or HTML via "missing pages" in which the page name is not properly escaped, a different vulnerability than CVE-2005-2803...

CVE-2005-2336

Cross-site scripting XSS vulnerability in Hiki 0.8.0 to 0.8.2 allows remote attackers to inject arbitrary web script or HTML via "missing pages" in which the page name is not properly escaped, a different vulnerability than CVE-2005-2803...

DEBIAN-CVE-2005-2336

Cross-site scripting XSS vulnerability in Hiki 0.8.0 to 0.8.2 allows remote attackers to inject arbitrary web script or HTML via "missing pages" in which the page name is not properly escaped, a different vulnerability than CVE-2005-2803...

CVE-2005-2801

xattr.c in the ext2 and ext3 file system code for Linux kernel 2.6 does not properly compare the nameindex fields when sharing xattr blocks, which could prevent default ACLs from being applied...

CVE-2005-2797

Overview OpenSSH 4.0, and other versions before 4.2, does not properly handle dynamic port forwarding "-D" option when a listen address is not provided, which may cause OpenSSH to enable the GatewayPorts functionality. Remediation There is no fixed version for openssh. References - Mindrot.org...