CVE-2005-2115

Soldier of Fortune II, versions 1.02x and 1.03, is affected by CVE-2005-2115. A remote attacker can cause a denial-of-service (server crash) by sending a large ID value to the ignore command, which is used as an array index and triggers an out-of-bounds operation. The provided documents do not in...

CVE-2005-2111

The OpenVAS/Nessus entries confirm CVE-2005-2111 affects Community Link Pro Web Editor’s login.cgi. The flaw lies in the login.cgi script where the file parameter is not sanitized, enabling an unauthenticated attacker to execute arbitrary commands on the remote host. This is described as remote c...

CVE-2005-2114

Mozilla 1.7.8, Firefox 1.0.4, Camino 0.8.4, Netscape 8.0.2, and K-Meleon 0.9, and possibly other products that use the Gecko engine, allow remote attackers to cause a denial of service application crash via JavaScript that repeatedly calls an empty function...

CVE-2005-2109

This CVE (CVE-2005-2109) affects WordPress 1.5.1.2 and earlier. The vulnerability arises in wp-login.php where the forgotten-password email content can be altered by remote attackers due to an uninitialized message variable. The impact is that an attacker could modify the email message sent durin...

CVE-2005-0393

CVE-2005-0393 affects crip, a terminal-based ripper/encoder/tagger tool. The advisory notes that crip 3.5 helper scripts do not securely use temporary files, allowing local users to exploit this in an insecure manner with unknown impact and attack vectors. The Debian DSA-733-1 and OpenVAS entry c...

CVE-2005-2105

CVE-2005-2105 : Affects Cisco IOS 12.2T through 12.4. A faulty RADIUS implementation allows remote attackers to bypass AAA RADIUS authentication when the fallback method is set to none by using a long username. This is a remote authentication bypass taking advantage of the none fallback configura...

CVE-2005-2116

...

CVE-2005-2108

CVE-2005-2108 affects WordPress 1.5.1.2 and earlier, with an SQL injection in the XMLRPC server. The vulnerability arises because input is not filtered in the HTTP_RAW_POST_DATA variable that stores XML data, allowing remote attackers to execute arbitrary SQL commands. The NVD entry lists a CVSSv...

CVE-2005-2110

CVE-2005-2110 affects WordPress 1.5.1.2 and earlier. It allows remote attackers to disclose sensitive information by accessing (1) a direct request to menu-header.php or (2) a feed parameter with value "1" to (a) wp-atom.php, (b) wp-rss.php, or (c) wp-rss2.php. These actions reveal the path in er...

CVE-2005-2108

SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the HTTPRAWPOSTDATA variable, which stores the data in an XML file...

[SECURITY] [DSA 735-1] New sudo packages fix pathname validation race

------------------------------------------------------------------------ Debian Security Advisory 735-1 [email protected] http://www.debian.org/security/ Michael Stone July 01, 2005 http://www.debian.org/security/faq - ------------------------------------------------------------------------...

Prevx Pro 2005 <= 1.0.0.1 Multiple Local Vulnerabilities

Binary data 3044.prm...

Advisory 02/2005: Remote code execution in Serendipity

Hardened PHP Project www.hardened-php.net -= Security Advisory =- Advisory: Remote code execution in Serendipity Release Date: 2005/06/29 Last Modified: 2005/06/29 Author: Christopher Kunz [email protected] Application: Serendipity = 0.8.2 Severity: Arbitrary remote code execution...

CVE-2005-2090

CVE-2005-2090 affects Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0): it enables HTTP Request Smuggling via a request containing both Transfer-Encoding: chunked and Content-Length, causing the body to be mis‑interpreted and processed as a new request. This issue is noted to hav...

CVE-2005-1690

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-1250. Reason: This candidate is a duplicate of CVE-2005-1250. Notes: this duplicate occurred as a result of multiple independent discoveries and insufficient coordination by the vendor and CNA. All CVE users should reference...

CVE-2005-1923

CVE-2005-1923 affects ClamAV up to 0.85/0.83 (affected: ClamAV 0.83 and other versions before 0.86). The vulnerability is in the ENSURE_BITS macro used in mszipd.c, where a CAB file with cffile_FolderOffset = 0xff can cause a zero-length read, leading to an infinite loop and high CPU usage (remot...

CVE-2005-1931

CVE-2005-1931 affects GoodTech SMTP Server 5.14. A RCPT TO command with an invalid argument (e.g., 'A') can cause the server to crash, producing a denial of service. The issue is documented in multiple sources (NVD/NASL/Nessus) with the same impact. A remediation is available: upgrade to GoodTech...

CVE-2005-2085

The CVE-2005-2085 entry describes a buffer overflow in Inframail Advantage Server Edition (Infradig Systems) 6.0–6.7. The SMTP server is vulnerable to a DoS via an excessively long MAIL FROM field (and the FTP server via a long NLST argument), reported as enabling remote crash and, per Nessus ref...

CVE-2005-1922

ClamAV (clamav) before 0.86 is affected by an MS-Expand file handling vulnerability in cli_msexpand. A crafted file can cause repeated errors, leading to denial of service via resource exhaustion (file descriptors and memory). Affected product/version: ClamAV prior to 0.86. Remedy: upgrade to 0.8...

CVE-2005-2088

The CVE-2005-2088 vulnerability affects the Apache HTTP Server when acting as an HTTP proxy. Specifically, versions before 1.3.34 and 2.0.x before 2.0.55 are susceptible. The issue arises from handling a request containing both Transfer-Encoding: chunked and Content-Length, causing the body to be...