10533 matches found
CVE-2005-2204
CVE-2005-2204 describes a cross-site scripting vulnerability in CA eTrust SiteMinder 5.5. When CSSChecking is set to NO, an attacker can inject arbitrary script/HTML through parameters to smpwservicescgi.exe (PASSWORD, BUFFER) and login.fcc (TARGET), and possibly other vectors. This affects SiteM...
CVE-2005-2179
PHP remote file inclusion vulnerability in BlogModel.php in Jaws 0.5.2 and earlier allows remote attackers to execute arbitrary PHP code via the path parameter...
CVE-2005-2178
probe.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the olddat parameter. NOTE: it is unclear which product or vendor this program is associated with, if any...
CVE-2005-2180
gen-index in GNATS 4.0, 4.1.0, and possibly earlier versions, when installed setuid, does not properly check files passed to the -o argument and opens the file with write access, which allows local users to overwrite arbitrary files...
CVE-2005-2193
SQL injection vulnerability in the user profile edit module in profile.php for PunBB 1.2.5 and earlier allows remote attackers to execute arbitrary SQL statements via the temp array, which is not initialized before it is used and prevents the attacker-supplied portions of the array from being...
CVE-2005-2199
CVE-2005-2199 affects the PPA web photo gallery (version 0.5.6) through a flaw in the PHP script inc/functions.inc.php. The root cause is a remote file inclusion (RFI) vulnerability in the config[ppa_root_path] parameter, allowing an attacker to influence included PHP code and potentially execute...
CVE-2005-2203
CVE-2005-2203 affects phpWishlist prior to 0.1.15. The vulnerability allows remote attackers to bypass authentication by issuing a direct request to admin.php, enabling access without valid credentials. Root cause details are not provided in the documents beyond the bypass vector. Impact is descr...
CVE-2005-2212
CVE-2005-2212 concerns Backup Manager 0.5.8a, which creates an archive repository with world-readable and world-writable permissions. This misconfiguration can let attackers modify or read the repository contents. The available sources (NVD/Red Hat/CVE entries) reiterate the same impact; no expli...
CVE-2005-2214
apt-setup in Debian GNU/Linux installs the apt.conf file with insecure permissions, which allows local users to obtain sensitive information such as passwords...
CVE-2005-2197
The CVE-2005-2197 entry refers to a SQL injection vulnerability in sql.cls.php of Id Board 1.1.3, exploitable remotely by manipulating the f parameter to index.php. The underlying issue is improper handling of SQL queries, allowing attackers to modify query logic. According to the NVD entry, the ...
CVE-2005-2206
CVE-2005-2206 concerns CartWIZ, which has multiple SQL injection vulnerabilities in the web app. According to the sources, remote attackers can modify SQL statements through specific parameters: (1) idProduct in tellAFriend.asp, (2) sortType in viewSupportTickets.asp, and (3) id in updateCreditCa...
CVE-2005-2150
Windows NT 4.0 and Windows 2000 before URP1 for Windows 2000 SP4 does not properly prevent NULL sessions from accessing certain alternate named pipes, which allows remote attackers to 1 list Windows services via svcctl or 2 read eventlogs via eventlog...
CVE-2005-2214
apt-setup in Debian GNU/Linux installs the apt.conf file with insecure permissions, which allows local users to obtain sensitive information such as passwords...
CVE-2005-2209
CVE-2005-2209 affects Capturix ScanShare 1.06 build 50. The connected PT-2005-3138 entry confirms the issue is the storage of passwords in cleartext in the capturixss_cfg.ini file, which is readable by local users. The root cause is cleartext storage of sensitive information in a local configurat...
CVE-2005-2207
CVE-2005-2207 describes a Cross-site scripting (XSS) vulnerability in CartWIZ, specifically in store/login.asp, where an attacker can inject arbitrary web script or HTML through the message parameter. The issue affects the CartWIZ login flow as described, with the impact being that unauthenticate...
CVE-2005-2198
SPiD (a PHP-based photo gallery) is affected by CVE-2005-2198 due to a remote file inclusion vulnerability in lang.php. The flaw allows an attacker to influence the lang_path parameter to include PHP code from an attacker-controlled location, enabling arbitrary code execution and potential disclo...
CVE-2005-2208
Technical details about CVE-2005-2208 are not provided in the supplied documents. No affected components or exploit specifics are described here. Monitor for updates from official advisories.
CVE-2005-2170
CVE-2005-2170 affects the LCF component (lcfd) in IBM Tivoli Management Framework Endpoint. A remote attacker can trigger a denial of service by connecting to LCF and closing the connection without sending data, causing process exit and connection loss. Exploitation details, affected versions, an...