CVE-2005-2116

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-1921. Reason: This candidate is a duplicate of CVE-2005-1921. Notes: All CVE users should reference CVE-2005-1921 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2005-2110

WordPress 1.5.1.2 and earlier allows remote attackers to obtain sensitive information via 1 a direct request to menu-header.php or a "1" value in the feed parameter to 2 wp-atom.php, 3 wp-rss.php, or 4 wp-rss2.php, which reveal the path in an error message. NOTE: vector 1 was later reported to al...

CVE-2005-2146

The CVE concerns SSH Tectia Server (Windows) 4.3.1 and earlier, and SSH Secure Shell for Windows Servers, which generate the host key with insecure permissions. This allows a local user to read the private host key and spoof the server, enabling impersonation. Evidence from multiple sources confi...

CVE-2005-1625

CVE-2005-1625 affects Adobe Reader on Unix, specifically versions 5.0.9 and 5.0.10. A stack-based buffer overflow in the UnixAppOpenFilePerform function can be triggered by a crafted PDF with a long /Filespec tag, enabling remote code execution. The provided connected sources confirm the vulnerab...

CVE-2005-2144

Prevx Pro 2005 1.0 allows local users to bypass file protection and modify files by using MapViewOfFile to perform memory mapping on the file...

CVE-2005-2088

The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Lengt...

CVE-2005-2111

login.cgi in Community Link Pro Web Editor allows remote attackers to execute arbitrary commands via the file parameter...

CVE-2005-2115

Soldier of Fortune II 1.02x and 1.03 allows remote attackers to cause a denial of service server crash via a large ID value in the ignore command, which is used as an array index and causes an out-of-bounds operation...

CVE-2005-2137

Public technical details for CVE-2005-2137 are not provided in the supplied documents. They only state an unknown vulnerability in NateOn Messenger 3.0 allowing directory listing; no affected versions, root cause, or fixes are disclosed. Monitor for updates.

CVE-2005-1917

CVE-2005-1917 affects kpopper 1.0 and earlier. Local users can create and overwrite arbitrary files through a symlink attack on the .popper-new temporary file due to insecure temporary file handling. Impact is described as low; exploitation is indicated in public advisories. Affected versions: kp...

Fedora Core 4 : kernel-2.6.12-1.1387_FC4 (2005-510)

Wed Jun 29 2005 Dave Jones - 2.6.12.2 - Mon Jun 27 2005 Dave Jones - Disable multipath caches. 161168 - Reenable AMD756 I2C driver for x86-64. 159609 - Add more IBM r40e BIOS's to the C2/C3 blacklist. - Thu Jun 23 2005 Dave Jones - Make orinoco driver suck less. Scanning/roaming/ethtool support...

[SECURITY] [DSA 725-2] New ppxp packages fix local root exploit

-------------------------------------------------------------------------- Debian Security Advisory DSA 725-2 [email protected] http://www.debian.org/security/ Martin Schulze July 4th, 2005 http://www.debian.org/security/faq -...

JVIEW Profiler (javaprxy.dll) COM object contains an unspecified vulnerability

Overview The JVIEW Profiler COM object contains an unspecified vulnerability, which may allow a remote attacker to execute arbitrary code on a vulnerable system. Description Microsoft COMMicrosoft COM is a technology that allows programmers to create reusable software components that can be...

CVE-2005-2113

XOOPS <= 2.0.11 is affected by an SQL injection in the XMLRPC loginUser function that lets remote attackers execute arbitrary SQL and bypass authentication via crafted XML (e.g., blogger.getPost). The issue is documented as CVE-2005-2113; severity is HIGH (CVSS v2: AV:N/AC:L/Au:N/C:P/I:P/A:P)....

CVE-2005-2114

CVE-2005-2114 affects Gecko-based browsers (Mozilla 1.7.8, Firefox 1.0.4, Camino 0.8.4, Netscape 8.0.2, K-Meleon 0.9, etc.). The issue allows remote attackers to cause an application crash (DoS) by JavaScript that repeatedly calls an empty function. Public reports map this to Red Hat/CentOS advis...

CVE-2005-0393

The helper scripts for crip 3.5 do not properly use temporary files, which allows local users to have an unknown impact with unknown attack vectors...

CVE-2005-2109

This CVE (CVE-2005-2109) affects WordPress 1.5.1.2 and earlier. The vulnerability arises in wp-login.php where the forgotten-password email content can be altered by remote attackers due to an uninitialized message variable. The impact is that an attacker could modify the email message sent durin...

CVE-2005-2107

CVE-2005-2107 involves multiple XSS vulnerabilities in WordPress up to version 1.5.1.2, exploitable via the post.php parameters p and comment. The connected OpenVAS/OSV/NVD records confirm the affected product (WordPress) and the script injection vectors, describing remote execution of arbitrary ...

CVE-2005-2106

Drupal 4.5.0–4.6.1 contains a vulnerability that allows remote attackers to execute arbitrary PHP code via public comments or postings. Debian’s DSA-745-1 fixes this in 4.5.3-3; upgrade recommended to remediate.

CVE-2005-0360

The CVE-2005-0360 issue involves the Microsoft Log Sink Class ActiveX control in pkmcore.dll, which is marked as unsafe for scripting yet is labeled safe for scripting. The ActiveX control can create or append to arbitrary files on the local file system when exploited via Internet Explorer, enabl...