RHEL 4 : Evolution (RHSA-2005:267)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:267 advisory. Evolution is the GNOME collection of personal information management PIM tools. A format string bug was found in Evolution. If a user tries t...

CVE-2005-2717

PHP remote file inclusion vulnerability in WebCalendar before 1.0.1 allows remote attackers to execute arbitrary PHP code when opening settings.php, possibly via sendreminders.php or other scripts...

CVE-2005-2716

The eventpincoderequest function in the btsrv daemon btsrv.c in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a Bluetooth device name...

evolution security update

CentOS Errata and Security Advisory CESA-2005:267 Updated evolution packages that fix a format string issue are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. Evolution is the GNOME collection of personal information management...

CVE-2005-2735

CVE-2005-2735 describes a cross-site scripting (XSS) vulnerability in phpGraphy 0.9.9a and earlier . The flaw allows remote attackers to inject arbitrary web script or HTML via EXIF data (e.g., Camera Model Tag) . Documented impact indicates that the vulnerability can be triggered through crafted...

CVE-2005-2737

CVE-2005-2737 describes a cross-site scripting (XSS) vulnerability in PhotoPost PHP Pro 5.1. The flaw allows remote attackers to inject arbitrary web script or HTML via EXIF data, such as the Camera Model Tag, which could be rendered in victims’ browsers. The provided sources identify the affecte...

CVE-2005-2716

The eventpincoderequest function in the btsrv daemon btsrv.c in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a Bluetooth device name...

CVE-2005-2733

uploadimgcgi.php in Simple PHP Blog SPHPBlog does not properly restrict file extensions of uploaded files, which could allow remote attackers to execute arbitrary code...

CVE-2005-2728

Apache httpd is affected by CVE-2005-2728 due to a flaw in the byte-range filter that can cause memory exhaustion and denial of service when handling HTTP requests with a large Range header, as described in multiple connected advisories. The issue affects Apache httpd 2.0.x before 2.0.54 (and var...

CVE-2005-2717

PHP remote file inclusion vulnerability in WebCalendar before 1.0.1 allows remote attackers to execute arbitrary PHP code when opening settings.php, possibly via sendreminders.php or other scripts...

CVE-2005-2734

Gallery: XSS via EXIF data (CVE-2005-2734) affects Gallery 1.5.1-RC2 and earlier. An attacker can inject script/HTML through EXIF fields (e.g., Camera Model Tag). Debian/DSA-1148 and OpenVAS references indicate remote, pre-patch exposure; remediation is upgrading to fixed Gallery packages (e.g., ...

CVE-2005-2017

CVE-2005-2017 is a local privilege-escalation flaw in Symantec AntiVirus Corporate Edition (9.x) . A non-privileged user can gain SYSTEM privileges by using the Scan for viruses option to open an HTML help window, then use the window’s toolbar to open a local file via the Jump to URL path, effect...

CVE-2005-2721

Foojan PHP Weblog is affected by multiple XSS vulnerabilities in index.php and admin.php, exploitable via the Referer header in HTTP requests. The issue enables remote attackers to inject arbitrary script/HTML and has a CVSSv2 base score of 4.3 (Medium) with network attack vector, medium complexi...

CVE-2005-1856

CVE-2005-1856 affects backup-manager

CVE-2005-2723

CVE-2005-2723 refers to a SQL injection in PaFileDB 3.1’s auth.php when authmethod is configured to cookies, exploitable via the pafiledbcookie cookie username value. Multiple sources confirm the issue and indicate the remote attacker could potentially manipulate SQL commands, with at least one N...

CVE-2005-2719

Vulnerability CVE-2005-2719 affects Ventrilo server versions 2.1.2 through 2.3.0. A remote attacker can crash the server by sending a malformed status packet to UDP port 3784, due to handling of status queries with data shorter than the header specifies. CVSS base score reported as 5.0 (MEDIUM) w...

CVE-2005-2731

Directory traversal vulnerability in Astaro Security Linux 6.0, when using Webmin, allows remote authenticated webmin users to read arbitrary files via a .. dot dot in the wfedownload parameter to index.fpl...

CVE-2005-2730

The CVE-2005-2730 entry concerns the HTTP proxy in Astaro Security Linux 6.0. The issue arises from handling an invalid request, which can cause the proxy to disclose a Proxy-Authorization string in an error message. This is a remote-attack scenario with potential exposure of credentials, as indi...

CVE-2005-2724

CVE-2005-2724 is a cross-site scripting (XSS) vulnerability in SqWebmail: the vulnerability arises from missing input sanitising in the handling of file attachments, allowing an attacker to inject arbitrary script/HTML via the Display feature. The initial description notes SqWebMail 5.0.4 as affe...

CVE-2005-1855

CVE-2005-1855 affects the Backup Manager (backup-manager) prior to version 0.5.8. The issue arises because backup files are created with world-readable default permissions, allowing local users to access potentially sensitive information. The Debian OpenVAS/NVD entries confirm the same behavior. ...