CVE-2005-2791

BFCommand & Control Server Manager BFCC 1.22_A and earlier, and BFVCC 2.14_B and earlier, are affected by CVE-2005-2791. The vulnerability allows remote attackers to cause a denial of service by opening and closing a sequence of connections without sending the login command, leading to refused ne...

CVE-2005-2768

The CVE-2005-2768 entry has concrete details in connected advisories: Sophos Anti-Virus contains a heap-based buffer overflow in the Visio file parsing/handling code of the Visio scanner component. The vulnerability arises from insufficient boundary verification of user-supplied data, allowing a ...

CVE-2005-1915

The vulnerability CVE-2005-1915 affects log4sh up to version 1.2.5, where the log4sh_readProperties function is exploitable. The root cause is a symlink attack on predictable log4sh.$$ filenames, enabling local attackers to overwrite arbitrary files. The CVSS-derived impact is low base score with...

CVE-2005-2779

The CVE-2005-2779 entry concerns the iTAN Online-Banking Security System. According to the provided documents, remote attackers can obtain TAN numbers through a man-in-the-middle (MITM) during a transaction, facilitating a phishing-style attack. The NVD description confirms the vulnerability exis...

CVE-2005-2773

CVE-2005-2773 affects HP OpenView Network Node Manager 6.2 through 7.50. The vulnerability enables remote attackers to execute arbitrary commands by injecting shell metacharacters into parameters handled by CGI scripts (connectedNodes.ovpl, cdpView.ovpl, freeIPaddrs.ovpl, ecscmg.ovpl). Public wri...

CVE-2005-2775

phpapi.php in phpWebNotes 2.0.0 uses the extract function to modify key variables such as $tpathcore, which leads to a PHP file inclusion vulnerability that allows remote attackers to execute arbitrary PHP code via the tpathcore parameter...

CVE-2005-2773

HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 node parameter to connectedNodes.ovpl, 2 cdpView.ovpl, 3 freeIPaddrs.ovpl, and 4 ecscmg.ovpl...

CVE-2005-2772

This CVE concerns the University of Minnesota gopher client 3.0.9, where multiple stack-based buffer overflows allow a remote attacker (via a malicious Gopher server) to execute arbitrary code. The flaws include an overflow in handling a long "+VIEWS:" reply in VIfromLine and issues in FIOgetargv...

CVE-2005-2790

BFCommand & Control Server Manager BFCC 1.22A and earlier, and BFVCC 2.14B and earlier, relies on the client to enforce permissions and perform actions such as disconnections, which allows remote attackers to bypass administrative restrictions via a modified client...

CVE-2005-2791

BFCommand & Control Server Manager BFCC 1.22A and earlier, and BFVCC 2.14B and earlier, allows remote attackers to cause a denial of service refused new connections via a series of connections and disconnections without sending the login command...

CVE-2005-2793

CVE-2005-2793 : phpLDAPadmin versions 0.9.6 and 0.9.7 contain a PHP remote file inclusion in welcome.php, exploitable via the custom_welcome_page parameter to execute arbitrary PHP code. The connected documents confirm the vulnerable component and the root cause (remote file inclusion) and vulner...

CVE-2005-2771

CVE-2005-2771 affects AttachmateWRQ Reflection for Secure IT Server (Windows) prior to 6.0 Build 24. The issue arises because access/deny lists are evaluated case-sensitively in vulnerable versions, whereas earlier versions were case-insensitive, potentially allowing login to accounts that should...

CVE-2005-2766

The CVE affects Symantec AntiVirus Corporate Edition 9.0.1.x and 9.0.4.x (and possibly other versions) where, during updates from an internal LiveUpdate server, the Log.Liveupdate file stores the LiveUpdate username and password in cleartext. This plaintext credential exposure could allow an atta...

CVE-2005-2769

Cross-site scripting XSS vulnerability in SqWebMail 5.0.4 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via an HTML e-mail containing tags with strings that contain "" or other special characters, which is not properly sanitized by SqWebMail...

CVE-2005-2783

CVE-2005-2783 is a cross-site scripting (XSS) vulnerability in PHP-Fusion versions up to 6.00.107 (and earlier). The issue arises from insufficient sanitization of nested, malformed URL BBCode tags, allowing remote attackers to inject arbitrary script/HTML when a user views a post containing the ...

[SECURITY] [DSA 797-1] New zsync packages fix DOS

-------------------------------------------------------------------------- Debian Security Advisory DSA 797-1 [email protected] http://www.debian.org/security/ Michael Stone September 1st, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 795-1] New proftpd packages fix format string vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 795-1 [email protected] http://www.debian.org/security/ Michael Stone September 1st, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 795-1] New proftpd packages fix format string vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 795-1 [email protected] http://www.debian.org/security/ Michael Stone September 1st, 2005 http://www.debian.org/security/faq -...

iDEFENSE Security Advisory 09.01.05: Novell NetMail IMAPD Command Continuation Request Heap Overflow

Novell NetMail IMAPD Command Continuation Request Heap Overflow iDEFENSE Security Advisory 09.01.05 www.idefense.com/application/poi/display?id=301&type=vulnerabilities September 1, 2005 I. BACKGROUND Novell NetMail is an e-mail and calendaring system that is based on Internet-standard messaging...

[SECURITY] [DSA 794-1] New polygen packages fix denial of service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ -- Debian Security Advisory DSA 794-1 security at debian dot org email concealed http://www.debian.org/security/ Martin Schulze September 1st, 2005...