CVE-2005-1905

CVE-2005-1905 affects Kaspersky Anti-Virus on Windows 2000 via the klif.sys kernel driver. The Seebug and NVD records indicate the klif.sys component can be abused by a local attacker to gain privileges by modifying certain high-privilege code addresses that are later accessed by privileged proce...

CVE-2005-1899

Affected software: Rakkarsoft RakNet network library 2.33 and earlier. Vulnerability: remote denial of service via a zero-byte UDP packet, causing an infinite loop. Impact scope: used in multiple products (e.g., nFusion Elite Warriors: Vietnam) as of the cited CVE. Root cause/notes: the descripti...

CVE-2005-1889

Technical details about CVE-2005-1889 are not provided in the supplied documents; no concrete information on affected versions, root cause, or remediation is available here.

CVE-2005-1896

CVE-2005-1896 affects FlatNuke 2.5.3; a directory traversal vulnerability in thumb.php allows remote attackers to read arbitrary images or obtain the installation path via the image parameter. CVSS v2 base score 5.0 (MEDIUM) with network vector and low attack complexity; no exploitable details be...

CVE-2005-1890

Unknown vulnerability in Mortiforo before 0.9.1 allows users to access private forums via unknown attack vectors...

CVE-2005-1895

CVE-2005-1895 describes a cross-site scripting (XSS) vulnerability in FlatNuke 2.5.3. The issue allows remote attackers to inject arbitrary web script or HTML by supplying crafted values in the border or back parameters to (1) help.php or (2) footer.php. Affected software: FlatNuke 2.5.3. The ava...

CVE-2005-1888

CVE-2005-1888 is an XSS vulnerability in MediaWiki prior to 1.4.5 where remote attackers can inject arbitrary script via HTML attributes in page templates. The SUSE entry confirms the same description; other connected documents reiterate the vulnerability without new technical details. Exploit sp...

CVE-2005-1910

The CVE-2005-1910 issue affects WWWeb Concepts Events System 1.0, specifically the login.asp login path. The vulnerability is a SQL injection via the password parameter in login.asp, enabling remote attackers to execute arbitrary SQL commands and potentially gain unauthorized access or manipulate...

CVE-2005-1906

SQL injection vulnerability in login.asp in livingmailing 1.3 allows remote attackers to execute arbitrary SQL commands via the password. NOTE: there is little public information about this product and its vendor, and the original researcher announcement is no longer available...

Mac OS X Multiple Vulnerabilities (Security Update 2005-006)

The remote host is missing Security Update 2005-006. This security update contains security fixes for the following application : - AFP Server - Bluetooth - CoreGraphics - Folder Permissions - launchd - LaunchServices - NFS - PHP - VPN These programs have multiple vulnerabilities, some of which m...

[Full-disclosure] [USN-137-1] Linux kernel vulnerabilities

=========================================================== Ubuntu Security Notice USN-137-1 June 08, 2005 linux-source-2.6.10, linux-source-2.6.8.1 vulnerabilities CAN-2005-0756, CAN-2005-1265 =========================================================== A security issue affects the following Ubun...

CVE-2005-1883

CVE-2005-1883 affects YaPiG (YaPiG 0.92b) and is documented as a local/remote file inclusion vulnerability. The root cause is an insecure handling of the BASE_DIR parameter in global.php, allowing attackers to include arbitrary local files. Public references (NVD, CVE listings) confirm this entry...

CVE-2005-1866

CVE-2005-1866 affects Calendarix Advanced

CVE-2005-1872

The CVE-2005-1872 entry covers a buffer overflow in the administrative console of IBM WebSphere Application Server 5.x when global security is enabled. The related advisory materials describe improper validation of user-supplied input in the authentication process, which can allow remote attacker...

CVE-2005-1880

Vulnerability summary (CVE-2005-1880) everybuddy versions 0.4.3 and earlier are affected. Local users can overwrite arbitrary files through a symlink attack on a temporary file created by a system call to wget. The PT-2005-2837 entry confirms the affected versions and describes the issue as a sym...

CVE-2005-1875

Exhibit Engine (EE) 1.22 is affected by multiple SQL injection vulnerabilities in list.php, exploitable via the parameters (1) search_row, (2) sort_row, (3) order, or (4) perpage, allowing remote attackers to execute arbitrary SQL. The connected sources confirm the vulnerable component and parame...

CVE-2005-1873

CVE-2005-1873 affects Crob FTP Server up to version 3.6.1 (build 263). The vulnerability consists of multiple remote buffer overflows triggered by (1) an FTP command with a large string followed by an RMD with a long string, or (2) a globbing ("*") character followed by a long string. After authe...

CVE-2005-1868

I-Man 0.9, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code by uploading a file attachment with a .php extension...

CVE-2005-1874

CVE-2005-1874 describes a directory-traversal vulnerability in the Dzip tool prior to version 2.9, allowing remote attackers to create arbitrary files by supplying a filename containing a “..” in a .dz archive. The issue affects Dzip’s archive extraction logic and could enable arbitrary file writ...

CVE-2005-1885

YaPiG is a PHP-based image gallery. CVE-2005-1885 affects YaPiG 0.92b/0.93u/0.94u, where view.php accepts a phid parameter that is not required to be an integer, causing an error message that reveals the filesystem path. OpenVAS notes this within YaPiG’s broader set of flaws (including remote/loc...