10533 matches found
CVE-2005-2452
libtiff up to 3.7.0 allows remote attackers to cause a denial of service application crash via a TIFF image header with a zero "YCbCr subsampling" value, which causes a divide-by-zero error in 1 tifstrip.c and 2 tiftile.c, a different vulnerability than CVE-2004-0804...
CVE-2005-2435
CVE-2005-2435 affects Website Baker Project in browse.php, where the dir parameter is susceptible to cross-site scripting (XSS). The vulnerability arises from insufficient input handling/escaping of the dir parameter, allowing remote attackers to inject arbitrary web script or HTML. The existing ...
CVE-2005-2446
CVE-2005-2446 is rejected/not used per description; refer to CVE-2005-2369 for the active entry.
CVE-2005-2448
CVE-2005-2448 : Endianness errors in libgadu used by ekg (centericq) allow remote denial of service on big‑endian systems. Public records tie this to Debian advisories DSA-813-1 and DSA-1318‑1, which describe fixes in the ekg package. Exploit details are not provided in the sources. Remediation: ...
CVE-2005-2132
This CVE (CAN-2005-2132) affects SCO UnixWare 7.x (e.g., 7.1.1 m5, 7.1.3 mp5, 7.1.4 mp2) where the RPC portmapper (rpcbind) can be forced into a denial-of-service state by multiple invalid portmap requests, causing RPC services to fail to respond. OpenServer-related advisories (SCOSA-2005.43 for ...
CVE-2005-2449
CVE-2005-2449 describes a TOCTOU race condition in Gentoo’s sandbox prior to 1.2.11, enabling local users to create or overwrite arbitrary files via a symlink attack on sandboxpids.tmp. Connected advisories (Gentoo GLSA 200507-22) confirm a multiple TOCTOU issue in sandbox and give the remediatio...
CVE-2005-2414
CVE-2005-2414 describes a race condition in the xpcom library (used by Firefox, Mozilla, Netscape, Galeon) that can crash the target browser. An attacker could trigger a hard crash by rendering a large HTML file that loads a DOM call from within nested DIV tags, causing parts of the currently ren...
CVE-2005-2443
CVE-2005-2443 affects Kshout 2.x and 3.x, where settings.dat is stored under the web document root with inadequate access control. This misconfiguration allows remote access to sensitive data such as usernames and passwords. No patch or remediation details are provided in the supplied documents; ...
CVE-2005-2450
Multiple integer overflows in the 1 TNEF, 2 CHM, or 3 FSG file format processors in libclamav for Clam AntiVirus ClamAV 0.86.1 and earlier allow remote attackers to gain privileges via a crafted e-mail message...
CVE-2005-2431
The 1 lost password and 2 account pending features in GForge 4.5 do not properly set a limit on the number of e-mails sent to an e-mail address, which allows remote attackers to send a large number of messages to arbitrary e-mail addresses aka mail bomb...
CVE-2005-2446
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-2369. Reason: This candidate is a duplicate of CVE-2005-2369. Notes: All CVE users should reference CVE-2005-2369 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...
CVE-2005-2412
CVE-2005-2412 describes a PHP remote file inclusion vulnerability in PHP FirstPost’s block.php triggered via the Include parameter, allowing an attacker to execute arbitrary PHP code. The issue is network-exposed with low exploit complexity and no authentication required, resulting in partial int...
CVE-2005-2442
CVE-2005-2442 concerns a Cross-Application Scripting (XAS) vulnerability in SPI Dynamics WebInspect 5.0.196. The connected documents confirm the issue arises in WebInspect and enables remote attackers to inject Javascript from one application into another (XAS), with remote exploitation described...
CVE-2005-2415
Contrexx up to version 1.0.4 is affected by multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via the poll module (value parameter) or the gallery module (pId parameter). The underlying issue is input unsanitization in these parameters, enabling ...
CVE-2005-2417
CVE-2005-2417 affects Contrexx before 1.0.5. The vulnerability allows remote attackers to obtain sensitive information by issuing a direct request to /config/version.xml, exposing partial confidentiality. The available documents do not specify impacted versions beyond 1.0.5, nor provide remediati...
CVE-2005-2416
Contrexx prior to 1.0.5 contains client-side Cross-Site Scripting (XSS) vulnerabilities in two parameters: (1) term in the search module and (2) title in the blog aggregation module. These allow remote attackers to inject arbitrary web script or HTML. The CVE entry documents these two vectors but...
CVE-2005-2452
CVE-2005-2452 affects libtiff up to 3.7.0. A TIFF header with a zero value for YCbCr subsampling can trigger a divide-by-zero, causing an application crash (denial of service) via code paths in tif_strip.c and tif_tile.c. The issue is discussed in multiple advisories related to libtiff within Man...
