CVE-2005-2055

Affected software : RealPlayer 8, RealPlayer 10, RealPlayer 10.5 (6.0.12.1040–1069), and RealPlayer Enterprise/RealOne Player v1 and v2. Issue : A vulnerability in how RealPlayer handles clip-encoded URLs could allow a remote attacker hosting a malicious web server to cause the player to generate...

CVE-2005-2059

Infopop UBB.Threads is affected by multiple CSRF vulnerabilities in addaddress.php, toggleignore.php, removeignore.php, and removeaddress.php, prior to version 6.5.2 Beta. The issue allows remote attackers to modify settings as another user via a link or IMG tag. The CVE entry provides this as th...

CVE-2005-1759

Race condition in shtool 2.0.1 and earlier allows local users to modify or create arbitrary files via a symlink attack on temporary files after they have been created, a different vulnerability than CVE-2005-1751...

CVE-2005-0201

CVE-2005-0201 affects D-BUS (dbus) before 0.22, where insufficient socket access restriction allows a local user to listen to or send arbitrary messages on another user’s per-user session bus if the socket address is known. This is a local-privilege/confidentiality issue. Connected advisories ind...

CVE-2005-2057

The CVE-2005-2057 entry concerns Infopop UBB.Threads prior to version 6.5.2 Beta, with multiple reflected cross-site scripting (XSS) vulnerabilities. The NVD description specifies specific injectable parameters across several scripts: (1) dosearch.php (Searchpage), (2) Number, (3) what, or (4) pa...

CVE-2005-1277

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-1766. Reason: This candidate is a duplicate of CVE-2005-1766. Notes: This duplicate occurred due to insufficient coordination across three separate parties. All CVE users should reference CVE-2005-1766 instead of this...

CVE-2005-2054

Affected software: RealPlayer 10/10.5 (6.0.12.1040–1069) and RealOne Player v1/v2. Description indicates a vulnerability that could let remote attackers overwrite arbitrary files or run arbitrary ActiveX controls via a crafted MP3 file. Root cause and patch details are not provided in the documen...

CVE-2005-2066

CVE-2005-2066 : A SQL injection vulnerability exists in the ASP Nuke 0.80 web application via the TaskID parameter in the file comment_post.asp. Remote attackers could execute arbitrary SQL statements, as reported by the NVD entry, with an impact described as partial confidentiality, integrity, a...

CVE-2005-1766

Heap-based buffer overflow in rtffplin.cpp in RealPlayer 10.5 6.0.12.1056 on Windows, and 10, 10.0.1.436, and other versions before 10.0.5 on Linux, allows remote attackers to execute arbitrary code via a RealMedia file with a long RealText string, such as an SMIL file...

IA eMailServer IMAP4 LIST Command Format String Remote DoS

The remote host is running True North Software's IA eMailServer, a messaging system for Windows. The remote version of IA eMailServer suffers from a format string vulnerability leading to a denial of service that can be exploited by an authenticated user when sending a specially crafted IMAP LIST...

XMLHttpRequest Object security bypass in Opera Web Browser

Overview The Opera Web Browser fails to properly enforce security restrictions on the XMLHttpRequest Object. This may allow a remote, unauthenticated attacker to insert content from potentially malicious web sites. Description The XMLHttpRequest Object is a scripting object that provides routines...

CVE-2005-1623: Adobe Reader and Adobe Acrobat PDF file command execution

CVE-2005-1623 is associated with Adobe Reader/Acrobat PDF handling. The initial description states a remote code execution vector where a specially crafted PDF containing JavaScript could cause execution of arbitrary executables if the attacker knows full application names/paths. The connected Op...

CVE-2005-1759

CVE-2005-1759 concerns a race condition in shtool 2.0.1 and earlier where a local attacker could exploit a symlink attack on temporary files created by shtool to modify or create arbitrary files. Connected sources confirm the vulnerability is tied to shtool shipped with PHP and note that updates ...

CVE-2005-2053

CVE-2005-2053 affects Just another flat file (JAF) CMS prior to 3.0 Final. The vulnerability exposes sensitive information through error messages when (1) an asterisk in the id parameter, (2) a blank id parameter, or (3) an asterisk in the disp parameter to index.php is used, potentially revealin...

CVE-2005-2050

The CVE-2005-2050 entry concerns Tor, where a memory disclosure vulnerability in the exit server’s process space could allow remote attackers to read arbitrary memory and potentially obtain key information. The description indicates this affects Tor before version 0.1.0.10. The connected sources ...

CVE-2005-0772

Affected software/versions: VERITAS Backup Exec 9.0–10.0 for Windows Server and 9.0.4019–9.1.307 for NetWare. Component and cause: Remote Agent NDMLSRVR.DLL; a null pointer dereference triggered by parsing a crafted packet or a request with non-0 Error Status value. Impact: remote denial of servi...

CVE-2005-2052

CVE-2005-2052 describes a heap-based buffer overflow in vidplin.dll used by RealPlayer family (RealPlayer 8/Enterprise, RealPlayer 10/10.5, RealOne Player v1/v2). The flaw is triggered by processing an .avi file with a modified strf structure value, allowing remote attackers to attempt arbitrary ...

CVE-2005-1277

...

CVE-2005-1766

CVE-2005-1766 describes a heap-based buffer overflow in RealPlayer’s RealText parser (RealText/SMIL handling) that can be triggered by a specially crafted RealMedia file containing a long RealText string. Exploitation could allow remote code execution with the privileges of the logged-in user. Af...

CVE-2005-2051

CVE-2005-2051 describes a buffer overflow in the VERITAS Backup Exec Web Administration Console (BEWAC) affecting versions 9.0 build 4367 up to 10.0 revision 5484, enabling remote attackers to execute arbitrary code. The root cause is a buffer overflow in BEWAC’s web interface. Impact per the pro...