CVE-2005-1174

MIT Kerberos 5 krb5 1.3 through 1.4.1 Key Distribution Center KDC allows remote attackers to cause a denial of service application crash via a certain valid TCP connection that causes a free of unallocated memory...

CVE-2005-1689

Double free vulnerability in the krb5recvauth function in MIT Kerberos 5 krb5 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions...

CVE-2005-2279

Cisco ONS 15216 Optical Add/Drop Multiplexer OADM running firmware 2.2.2 and earlier allows remote attackers to cause a denial of service management plane session loss via crafted telnet data...

CVE-2005-1689

Double free vulnerability in the krb5recvauth function in MIT Kerberos 5 krb5 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions...

CVE-2005-2289

PHPCounter 7.2 allows remote attackers to obtain sensitive information via a direct request to prelims.php, which reveals the path in an error message...

CVE-2005-1689

Double free vulnerability in the krb5recvauth function in MIT Kerberos 5 krb5 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions...

Winamp < 5.093 Malformed ID3v2 Tag Handling Buffer Overflow

The remote host is using Winamp, a popular media player for Windows. The installed version of Winamp suffers from a buffer overflow vulnerability when processing overly-long ID3v2 tags in an MP3 file. An attacker may be able to exploit this flaw to execute arbitrary code on the remote host...

GLSA-200507-17 : Mozilla Thunderbird: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200507-17 Mozilla Thunderbird: Multiple vulnerabilities The following vulnerabilities were found and fixed in Mozilla Thunderbird: 'mozbugra4' and 'shutdown' discovered that Thunderbird was improperly cloning base objects MFSA...

[SECURITY] [DSA 757-1] New krb5 packages fix multiple vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA 757-1 [email protected] http://www.debian.org/security/ Michael Stone July 17, 2005 http://www.debian.org/security/faq - ------------------------------------------------------------------------...

CVE-2005-2282

WebEOC (before 6.0.2) contains multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary script/HTML via unknown vectors. The issue is addressed in version 6.0.2, which adds validation checks to vulnerable input fields. The CVE references come from multip...

CVE-2005-2292

CVE-2005-2292 : Oracle JDeveloper versions 9.0.4, 9.0.5, and 10.1.2 store cleartext passwords in IDEConnections.xml, XSQLConfig.xml, and settings.xml. The issue allows local users to obtain sensitive information from these configuration files. The connected documents confirm the affected products...

CVE-2005-2285

CVE-2005-2285 concerns WebEOC prior to version 6.0.2, where sensitive information was stored in insecure locations such as URIs, web pages, and configuration files. This could allow remote attackers to obtain credentials and other sensitive data (e.g., usernames, passwords, emergency and medical ...

CVE-2005-2289

The CVE describes a defect in PHPCounter 7.2 where remote attackers can obtain sensitive information by requesting prelims.php directly; an error message reveals the file path. The vulnerability is an information disclosure through an error path exposure. No explicit remediation is provided in th...

CVE-2005-2286

CVE-2005-2286 affects WebEOC prior to 6.0.2. The issue is improper authorization checks, allowing remote attackers to gain privileges by directly requesting a resource. Public sources in the connected documents confirm that privileges/authorizations are tied to client-side resources and that dire...

CVE-2005-2291

CVE-2005-2291 : Oracle JDeveloper 9.0.4, 9.0.5, and 10.1.2 pass the cleartext password as a parameter when starting sqlplus, enabling local users to gain sensitive information. The connected documents confirm the affected products and the root cause (password passed in cleartext as a startup para...

CVE-2005-2288

PHPCounter 7.2 is affected by a Cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML through the EpochPrefix parameter. The provided sources confirm the vulnerability and affected software, but do not include exploit details or official reme...

CVE-2005-2284

WebEOC prior to version 6.0.2 contains multiple SQL injection vulnerabilities that allow remote attackers to modify SQL statements, potentially viewing or modifying data or issuing database commands. Affected component is the WebEOC web application; the underlying issue is improper input filterin...

CVE-2005-1914

CVE-2005-1914 affects CenterICQ versions 4.20.0 and earlier. The vulnerability arises because CenterICQ creates temporary files with predictable file names, enabling a local attacker to perform a symlink attack to overwrite arbitrary files via the gg.token.PID temporary file. The connected source...

CVE-2005-2283

WebEOC before 6.0.2 does not properly restrict uploaded file sizes, allowing authenticated users to cause a denial of service through large uploads. Affected product: WebEOC (before 6.0.2); vulnerability affects the upload handling that stores file data in the database, consuming system/database ...

CVE-2005-2294

Affected software: Oracle Forms on Unix (versions 4.5, 6.0, 6i, 9i). Vulnerability: when a large number of records are retrieved by an Oracle form, a copy of the database tables is stored in a world-readable temporary file. Root cause: insecure temporary file handling enabling a local user to rea...