CVE-2005-2724

CVE-2005-2724 is a cross-site scripting (XSS) vulnerability in SqWebmail: the vulnerability arises from missing input sanitising in the handling of file attachments, allowing an attacker to inject arbitrary script/HTML via the Display feature. The initial description notes SqWebMail 5.0.4 as affe...

CVE-2005-1855

CVE-2005-1855 affects the Backup Manager (backup-manager) prior to version 0.5.8. The issue arises because backup files are created with world-readable default permissions, allowing local users to access potentially sensitive information. The Debian OpenVAS/NVD entries confirm the same behavior. ...

CVE-2005-2718

The CVE-2005-2718 flaw is a buffer/heap overflow in ad_pcm.c of MPlayer 1.0pre7 and earlier that can be triggered by crafted PCM data in a strf chunk, allowing remote code execution. Impact is described as running arbitrary code under the user’s privileges when opening affected media. Affected ve...

CVE-2005-2722

The CVE-2005-2722 entry concerns Foojan PHP Weblog, which exposes information leakage via two pathways: (1) a direct request to /daylinks/index.php and (2) a negative value in the daylinkspage parameter to index.php. The underlying issue is that error messages reveal the internal path, enabling a...

CVE-2005-2731

CVE-2005-2731: Directory traversal in Astaro Security Linux 6.0 when Webmin is used. Remote authenticated Webmin users could read arbitrary files via a .. sequence in the wfe_download parameter to index.fpl. NVD lists a LOW base score (2.1). No remediation details are provided in the supplied doc...

CVE-2005-2717

The CVE-2005-2717 issue affects WebCalendar (pre-1.0.1) with a remote file inclusion vulnerability that lets an attacker execute arbitrary PHP code via settings.php or related scripts (e.g., send_reminders.php). Public sources describe a trivially-exploitable bug granting code execution with the ...

CVE-2005-2727

CVE-2005-2727 affects Home Ftp Server 1.0.7. The issue arises because sensitive user and server information are stored in the same directory as the user’s home directory, enabling remote authenticated users to retrieve sensitive data by accessing ftpmembers.lst and ftpsettings.lst. The available ...

CVE-2005-2729

The CVE-2005-2729 entry describes a vulnerability in the HTTP proxy of Astaro Security Linux 6.0 where HTTP CONNECT requests to localhost are not properly filtered, allowing remote attackers to bypass firewall rules and access local services. The issue is a network‑level exposure with low attack ...

CVE-2005-2726

CVE-2005-2726 describes a directory traversal vulnerability in Home Ftp Server 1.0.7 that allows remote authenticated users to read arbitrary files by supplying Windows drive-letter paths such as “C:\” in commands like LIST or RETR. The condition is authenticated access; impact is partial disclos...

CVE-2005-2716

The CVE-2005-2716 issue concerns Nokia Affix (btsrv daemon) versions 2.1.2 and 3.2.0, where event_pin_code_request in btsrv.c allows remote command execution by supplying a Bluetooth device name containing shell metacharacters. Public advisories cite remote code execution via unsafe use of popen ...

CVE-2005-2736

CVE-2005-2736 describes a cross-site scripting (XSS) vulnerability in the web gallery application YaPiG (versions ≤ 0.95). The flaw arises from processing EXIF data (e.g., the Camera Model Tag) without sufficient sanitization, allowing an attacker to inject arbitrary web script or HTML that can b...

CVE-2005-2725

The CVE-2005-2725 entry concerns QNX RTOS: vulnerable component is the inputtrap utility, affected in versions including 6.1.0 and 6.3 (possibly earlier). The root cause is improper permission checks when the -t flag is used, enabling local users to read arbitrary files. Impact is limited to loca...

CVE-2005-2737

Cross-site scripting XSS vulnerability in PhotoPost PHP Pro 5.1 allows remote attackers to inject arbitrary web script or HTML via EXIF data, such as the Camera Model Tag...

Simple PHP Blog <= 0.4.0 Multiple Vulnerabilities

The version of Simple PHP Blog installed on the remote host allows authenticated attackers to upload files containing arbitrary code to be executed with the privileges of the web server userid. In addition, it likely lets anyone retrieve its configuration file as well as the user list and to dele...

CVE-2005-2693

cvsbug in CVS 1.12.12 and earlier creates temporary files insecurely, which allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack...

[SECURITY] [DSA 786-1] New simpleproxy packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 786-1 [email protected] http://www.debian.org/security/ Martin Schulze August 26th, 2005 http://www.debian.org/security/faq -...

DSA-787-1 backup-manager - insecure permissions and tempfile

Bulletin has no description...

[SECURITY] [DSA 785-1] New libpam-ldap packages fix authentication bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 785-1 [email protected] http://www.debian.org/security/ Martin Schulze August 25th, 2005 http://www.debian.org/security/faq -...

[Full-disclosure] [SECURITY] [DSA 786-1] New simpleproxy packages fix arbitrary code execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 786-1 [email protected] http://www.debian.org/security/ Martin Schulze August 26th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 785-1] New libpam-ldap packages fix authentication bypass

-------------------------------------------------------------------------- Debian Security Advisory DSA 785-1 [email protected] http://www.debian.org/security/ Martin Schulze August 25th, 2005 http://www.debian.org/security/faq -...