CVE-2005-1615

Ultimate PHP Board (UPB) versions 1.8 through 1.9.6 are affected by a vulnerability in viewforum.php where the postorder parameter is not properly handled by textdb.inc.php, potentially allowing remote attackers to read sensitive data via a SQL injection-like flaw. Multiple sources (CVE records a...

CVE-2005-1193

The CVE-2005-1193 vulnerability affects phpBB up to version 2.0.14 (before 2.0.15). The bbencode_second_pass and make_clickable functions in bbcode.php fail to filter BBCode URLs, allowing remote attackers to execute arbitrary script via URL schemes such as javascript:, applet:, about:, activex:,...

CVE-2005-1606

H-Sphere Winbox 2.4.2 and 2.4.3 RC1 stores sensitive information such as username and password in plaintext in world-readable log files, which allows local users to gain privileges...

CVE-2005-1616

CVE-2005-1616 concerns Ultimate PHP Board (UPB). The connected docs show that UPB versions up to 1.9.6 (i.e.,

CVE-2005-1592

Multiple "javascript vulerabilities in BB code" in BirdBlog before 1.3.1 allow remote attackers to inject arbitrary Javascript...

CVE-2005-1614

Cross-site scripting XSS vulnerability in viewforum.php in Ultimate PHP Board UPB 1.8 through 1.9.6 allows remote attackers to inject arbitrary web script or HTML via the postorder parameter...

CVE-2005-1599

The CVE-2005-1599 entry describes a cross-site scripting (XSS) flaw in Kryloff Technologies Subject Search Server (SSServer) 1.1, exploitable via the "Search For" field to inject arbitrary web script/HTML. The NVD/CVE records show a MEDIUM risk (CVSSv2: AV:N/AC:M/Au:N/C:N/I:P/A:N, base 4.3) but n...

CVE-2005-1592

CVE-2005-1592 affects BirdBlog versions before 1.3.1, where multiple javascript vulnerabilities in BBCode allow remote attackers to inject arbitrary JavaScript. The issue is documented across multiple feeds (NVD/Red Hat/CVE) with the same description. No exploit details are provided in the connec...

CVE-2005-1601

MRO Maximo Self Service 4 and 5 stores certain information under the web document root using file extensions that are not processed by Tomcat, which allows remote attackers to obtain sensitive information via a direct request for the file, such as MXServer.properties...

CVE-2005-1597

CVE-2005-1597 affects Invision Power Board (IPB) versions 2.0.3 and earlier. The vulnerability is a Cross-Site Scripting (XSS) flaw in the search.php and topics.php scripts, caused by unsanitized input in the highlite parameter, which allows arbitrary script/HTML injection. Public sources (IPB ex...

CVE-2005-1607

CVE-2005-1607 describes an XSS vulnerability in the Remote Cart product’s shop.cgi, permitting remote attackers to inject arbitrary web script or HTML via the (1) merchant or (2) demo parameters. The issue is confirmed across multiple sources (e.g., NVD, Red Hat advisory) and is caused by inadequ...

CVE-2005-1621

CVE-2005-1621 is a directory traversal vulnerability in PostNuke. Affects PostNuke 0.750 through 0.760rc4, in the pnModFunc function of pnMod.php. Attackers can read arbitrary files by supplying .. in the func parameter to index.php. The connected sources confirm the vulnerability and affected ve...

CVE-2005-1618

The CVE-2005-1618 entry describes a DoS in Yahoo! Messenger (YMSGR URL handler) for versions 5.x–6.0. A room login/join packet containing a colon and ampersand can cause Messenger to send a corrupted packet to the server, triggering a disconnect. Concrete impact is denial of service; exploitation...

CVE-2005-1596

Fusion SBX 1.2 and earlier contain an authentication bypass and remote code execution vulnerability in index.php due to improper use of the extract function. By setting is_logged, an attacker can bypass authentication; by manipulating maxname2, arbitrary code may be executed. Affected versions ar...

CVE-2005-1367

Pico Server (pServ) before version 3.3 contains a local information disclosure vulnerability: pServ follows symlinks without validating that the link target remains inside the webroot, allowing a local user to read arbitrary files with pServ’s permissions (e.g., /etc/shadow). The issue stems from...

CVE-2005-1608

The CVE-2005-1608 entry concerns the Blocks module in Spidean AutoTheme 1.7 and AT-Lite for PostNuke. Multiple unspecified vulnerabilities affect the Blocks component, with exposure described as potentially allowing a remote attacker to gain unauthorized access to the remote host. Affected produc...

CVE-2005-1611

Technical details for CVE-2005-1611 are not publicly available in the provided documents. Monitor for updates; no further specifics (affected versions, root cause, exploitability, or mitigations) are provided here.

CVE-2005-1248

CVE-2005-1248 describes a buffer overflow in Apple iTunes prior to 4.8 that can be triggered by a crafted MPEG‑4 file, allowing a remote attacker to execute arbitrary code. The description and related references consistently point to a vulnerability in the MPEG‑4 parsing path of iTunes, with impa...

CVE-2005-1592

Multiple "javascript vulerabilities in BB code" in BirdBlog before 1.3.1 allow remote attackers to inject arbitrary Javascript...

CVE-2005-1596

index.php in Fusion SBX 1.2 and earlier does not properly use the extract function, which allows remote attackers to bypass authentication by setting the islogged parameter or execute arbitrary code via the maxname2 parameter...