CVE-2005-2776

CVE-2005-2776: Looking Glass 20040427 is affected by multiple XSS vulnerabilities due to unsanitized input in header.php and footer.php. Attackers can inject arbitrary script via parameters: (1) version[fullname], (2) version[homepage], (3) version[no] to footer.php; and (4) version[fullname], (5...

CVE-2005-2769

Cross-site scripting XSS vulnerability in SqWebMail 5.0.4 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via an HTML e-mail containing tags with strings that contain "" or other special characters, which is not properly sanitized by SqWebMail...

CVE-2005-2777

CVE-2005-2777 affects Looking Glass (Looking Glass 20040427). The issue is a remote command execution vulnerability: an attacker can craft shell metacharacters in the DNS lookup query field to run arbitrary commands, with the attacker able to execute code on the web server (per the description’s ...

CVE-2005-2788

Land Down Under

CVE-2005-2784

CVE-2005-2784 affects cosmoshop 8.10.78, where the login function of the administration panel is vulnerable to SQL injection. The underlying issue allows remote attackers to execute arbitrary SQL commands and bypass authentication via unspecified vectors. The NVD entry notes a high impact (base s...

CVE-2005-2790

The CVE-2005-2790 entry affects BFCommand & Control Server Manager BFCC 1.22_A and earlier, and BFVCC 2.14_B and earlier. The vulnerability arises because the system relies on the client to enforce permissions and perform actions (e.g., disconnections), allowing remote attackers to bypass adminis...

CVE-2005-2770

The issue CVE-2005-2770 affects AttachmateWRQ Reflection for Secure IT Server before 6.0 Build 24. The vulnerability stems from a Renamed Account Remote Login flaw where valid public keys continue to allow Administrator or Guest logins after those accounts have been renamed or disabled post-authe...

CVE-2005-2780

The CVE-2005-2780 entry relates to Land Down Under (LDU). The OpenVAS entries describe multiple remote vulnerabilities in the LDU PHP code, including XSS and SQL injection, arising from insufficient sanitization in PHP scripts (notably in the signature handling) and related forum-post signature h...

CVE-2005-2789

The CVE-2005-2789 entry affects BFCommand & Control Server Manager BFCC 1.22_A and earlier and BFVCC 2.14_B and earlier. The underlying issue is an authentication bypass that can be triggered by either an unknown attack vector or using a NULL (0x00) as the username. CVSS v2 base score is 7.5 (HIG...

CVE-2005-2496

CVE-2005-2496 affects the ntp (ntpd) daemon when run with the -u option and a group name string; it causes ntpd to use the user’s group ID instead of the specified group, leading to privilege differences. Affected product is ntp/ntpd prior to the patched releases (e.g., ntp updates cited in RHSA-...

CVE-2005-2793

PHP remote file inclusion vulnerability in welcome.php in phpLDAPadmin 0.9.6 and 0.9.7 allows remote attackers to execute arbitrary PHP code via the customwelcomepage parameter...

CVE-2005-1857

Format string vulnerability in simpleproxy before 3.4 allows remote malicious HTTP proxies to execute arbitrary code via format string specifiers in a reply...

CVE-2005-2774

CVE-2005-2774 affects Lithium II mod 1.24 for Quake 2. The vulnerability is a format string flaw in the nickname handling that can cause a server denial of service and may allow arbitrary code execution. Exploitation details are not provided in the available documents; no specific exploit vectors...

CVE-2005-2496

The xntpd ntp ntpd daemon before 4.2.0b, when run with the -u option and using a string to specify the group, uses the group ID of the user instead of the group, which causes xntpd to run with different privileges than intended...

CVE-2005-2778

The CVE-2005-2778 entry details a SQL injection in MyBulletinBoard (MyBB), specifically in member.php through the fid parameter. A remote attacker can craft input via fid to execute arbitrary SQL statements, with network access and no authentication required (low attack complexity). Affected soft...

CVE-2005-2769

CVE-2005-2769 is a cross-site scripting (XSS) flaw in SqWebMail 5.0.4 and possibly other versions. The vulnerability arises when processing HTML emails that contain tags with characters like “>” that are not properly sanitized, allowing remote attackers to inject arbitrary web script or HTML. ...

CVE-2005-2781

The CVE-2005-2781 entry concerns the Avatar upload feature in FUD Forum (phpgroupware) prior to 2.7.0, where uploaded files are not properly validated. This allows an attacker to craft a .php file that begins with image data and then PHP code, enabling remote arbitrary PHP code execution via the ...

CVE-2005-2775

CVE-2005-2775 affects phpWebNotes 2.0.0 where the t_path_core parameter is used in core/api.php with PHP’s extract(), enabling a PHP file inclusion vulnerability. This allows a remote attacker to execute arbitrary PHP code on the server and potentially view arbitrary files. The issue is documente...

CVE-2005-2785

CVE-2005-2785 concerns cosmoshop 8.10.78 and earlier, where passwords are stored in plaintext in the database. The underlying issue is insecure password storage, enabling local users to access sensitive information. The connected documents confirm the vulnerability description but do not provide ...

CVE-2005-1857

The CVE-2005-1857 issue affects simpleproxy prior to version 3.4, where a format string vulnerability in the proxy’s handling of HTTP replies can allow a remote attacker to execute arbitrary code. Public sources describe exploitation via replies from remote HTTP proxies, enabling code execution w...