CVE-2005-2256

Summary: CVE-2005-2256 is a directory-traversal vulnerability in phppgadmin up to versions 3.5.3, exploitable via encoded \%2e\%2e\%2f in the formLanguage parameter to access arbitrary files. The flaw requires that magic_quotes_gpc is disabled. Affected products/versions are documented in Debian ...

CVE-2005-2261

CVE-2005-2261 affects multiple browsers: Firefox <1.0.5, Thunderbird <1.0.5, Mozilla

CVE-2005-2267

Firefox before 1.0.5 allows remote attackers to steal information and possibly execute arbitrary code by using standalone applications such as Flash and QuickTime to open a javascript: URL, which is run in the context of the previous page, and may lead to code execution if the standalone...

CVE-2005-2254

Multiple cross-site scripting XSS vulnerabilities in PhpAuction 2.5 allow remote attackers to inject arbitrary web script or HTML via the lan parameter to 1 index.php or 2 admin/index.php, or 3 the auctionid parameter to profile.php. NOTE: there is evidence that viewnews.php and login.php may not...

CVE-2005-2272

CVE-2005-2272 affects Safari 2.0 (412). The vulnerability stems from the dialog origin not being clearly associated with the generating web page, enabling remote attackers to spoof a dialog box from a trusted site and facilitate phishing. The available connected records confirm the issue and its ...

CVE-2005-2260

CVE-2005-2260 affects the Firefox browser (before 1.0.5), Mozilla (before 1.7.9), and Netscape 8.0.2/7.2. The issue arises from the browser UI not reliably distinguishing user-generated events from untrusted synthetic events, enabling remote attackers to trigger dangerous actions that normally re...

CVE-2005-2257

PhpSlash 0.8.0 is affected by a vulnerability in the saveProfile function that allows remote attackers to modify arbitrary profiles and gain privileges by changing the author_id parameter. The available sources (CVE/NVD) describe the flaw and its impact as complete confidentiality, integrity, and...

CVE-2005-2249

The CVE relates to Jinzora, specifically multiple unknown vulnerabilities in version 2.0.1 with a confirmed route related to PHP include_path, described in connected analyses as a Remote File Inclusion issue. The Nessus entry for Jinzora Multiple Script include_path Parameter Remote File Inclusio...

CVE-2005-2252

PhpAuction 2.5 allows remote attackers to bypass authentication and gain privileges as another user by setting the PHPAUCTIONRMID cookie to the user ID...

CVE-2005-2250

CVE-2005-2250 is a buffer overflow in Nokia Affix Bluetooth FTP client (BTFTP) affecting Affix versions 2.1.2 and 3.2.0, exploitable via a long filename in an OBEX file share to potentially execute arbitrary code. Debian/DSA-762-1 notes the issue as CAN-2005-2250 and CAN-2005-2277, with fixes pro...

CVE-2005-2269

Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 does not properly verify the associated types of DOM node names within the context of their namespaces, which allows remote attackers to modify certain tag properties, possibly leading to execution of arbitrary script or code, as...

CVE-2005-2259

The CVE-2005-2259 issue affects multiple USANet Creations products (USANet Shopping Mall Software, Domain Name Auction Software, Standard Classified Ads Software, and MakeBid Reverse Auction). The vulnerability lies in the dispallclosed2 function within dispallclosed.pl, which allows remote attac...

CVE-2005-2258

CVE-2005-2258 describes a remote file inclusion vulnerability in the Squito Gallery 1.33 product, specifically in the photolist.inc.php component. The underlying issue is a vulnerability in the photoroot parameter that allows an attacker to execute arbitrary code on the server. Affected software ...

CVE-2005-2263

CVE-2005-2263 affects Firefox (before 1.0.5) and Mozilla (before 1.7.9). The issue arises in InstallTrigger.install: forcing a page navigation after the install method is called causes a callback to be executed in the context of the new page, resulting in a same-origin violation. This means a rem...

CVE-2005-2267

CVE-2005-2267 affects Mozilla Firefox up to version 1.0.4 (before 1.0.5). The issue arises when a standalone application (e.g., Flash or QuickTime) opens a javascript: URL, which runs in the context of the previous page. This can lead to code execution if the standalone application subsequently l...

CVE-2005-2263

The InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by forcing a page navigation after the install method has been called, which causes the callback to be run in the context of t...

CVE-2005-2253

SQL injection vulnerability in PhpAuction 2.5 allow remote attackers to modify SQL queries via the category parameter to adsearch.php. NOTE: there is evidence that viewnews.php may not be part of the PhpAuction product, so it is not included in this description...

CVE-2005-2266

Firefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the parent is in a different domain, which violates the same origin policy and allows remote attackers to steal sensitive information such as cookies and passwords...

CVE-2005-2253

CVE-2005-2253 is a SQL injection in PhpAuction 2.5, where an attacker can modify SQL queries through the category parameter in adsearch.php. Root cause: unsanitized input used in database queries. Affected: PhpAuction 2.5. Impact: as described by CVE/NVD (base score 7.5, HIGH). Exploitation detai...

Fedora Core 4 : krb5-1.4.1-5 (2005-553)

A double-free flaw was found in the krb5recvauth routine which may be triggered by a remote unauthenticated attacker. Fedora Core 4 contains checks within glibc that detect double-free flaws. Therefore, on Fedora Core 4, successful exploitation of this issue can only lead to a denial of service K...