CVE-2005-1506

CJ Ultra (CJUltra) Plus versions 1.0.3 and 1.0.4 are affected by a SQL injection in out.php that allows remote attackers to modify/ retrieve data via the perm parameter. The root cause is improper handling of user-supplied input in the SQL query constructed in out.php. The available sources do no...

CVE-2005-1498

CVE-2005-1498 affects myBloggie 2.1.1 with multiple XSS vulnerabilities: parameters year (viewmode.php) and cat_id, month_no, post_id (index.php) that are not properly sanitized before display in error messages. Connected OpenVAS entry confirms multiple vulnerabilities in myBloggie and lists this...

CVE-2005-1479

CVE-2005-1479 affects JGS-Portal 3.0.1 and earlier. A SQL injection in jgs_portal.php via the id parameter allows remote attackers to execute arbitrary SQL commands. This impacts confidentiality, integrity, and availability (partial). Attack vector is network with low complexity and no authentica...

CVE-2005-1580

users.ini.php in BoastMachine 3.0 does not properly restrict the types of files that can be uploaded, which allows remote attackers to execute arbitrary code...

CVE-2005-1588

SQL injection vulnerability in index.php for Quick.cart 0.3.0 allows remote attackers to execute arbitrary SQL commands via the iCategory parameter. NOTE: the vendor has privately disputed this issue, saying that Quick.cart does not even use SQL and therefore can not be vulnerable to SQL injectio...

CVE-2005-1482

ArticleLive 2005 allows remote attackers to gain privileges by modifying the 1 auth and 2 userId fields in a cookie...

CVE-2005-1483

Multiple cross-site scripting XSS vulnerabilities in ArticleLive 2005 allow remote attackers to inject arbitrary web script or HTML via the 1 Query, 2 Username, 3 LastName, 4 Biography, or 5 BlogId parameter...

CVE-2005-1505

The CVE describes a vulnerability in Mail.app 2.0 on Mac OS X 10.4 during IMAP account configuration: the new account wizard does not prompt for SSL until after the password is sent, allowing plaintext leakage. Affected component is the IMAP credential flow in Mail.app 2.0; root cause is delayed ...

CVE-2005-1508

PWSPHP (Portail Web System) is affected by cross-site scripting (XSS) in version 1.2.2 due to insufficient input validation in multiple modules/parameters (e.g., news, stats, profil.php, memberlist, recherche) and specifically the SettingsBase.php skin parameter per the NASL entry. The vulnerabil...

CVE-2005-1496

Oracle 10g DBMS_Scheduler Privilege Escalation (CVE-2005-1496): A flaw in the DBMS_Scheduler package allows a user with CREATE JOB privileges to switch SESSION_USER to SYS, enabling privilege escalation. Affected: Oracle 10g DBMS_Scheduler component. Root cause: vulnerability in how DBMS_Schedule...

CVE-2005-1486

FishCart 3.1 is affected by multiple vulnerabilities. The primary CVE (CVE-2005-1486) describes cross-site scripting via the following parameters: trackingnum, reqagree, or m in upstracking.php, and nlst in display.php. OpenVAS data also indicates SQL injection vulnerabilities in FishCart that co...

CVE-2005-1510

The CVE-2005-1510 entry affects PwsPHP 1.2.2. A remote attacker can obtain partial confidential information by making a direct request to the admin directory, triggering an error message that reveals the path. The issue is described as an information-disclosure bug in the admin directory handling...

CVE-2005-1485

Golden FTP Server Pro 2.52 is affected by an information-disclosure vulnerability: when a GET request targets a non-existent file, the FTP error response reveals the absolute path of the server. This is a server-side path disclosure issue that can aid an attacker in mapping the environment. The p...

CVE-2005-1515

CVE-2005-1513, CVE-2005-1514, CVE-2005-1515, CVE-2020-3811, CVE-2020-3812 are referenced in the Debian DLA-2234-1 advisory for netqmail. The Debian advisory reports multiple issues in netqmail (qmail) affecting 64-bit platforms with large memory, including: CVE-2005-1513 (overflow in stralloc_rea...

CVE-2005-1493

SimpleCam 1.2 is affected by a directory traversal vulnerability that allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the URL. The underlying issue is improper validation of path input, enabling access to files outside the web root. Impact is information disclosur...

CVE-2005-1262

CVE-2005-1262 affects Gaim 1.2.1 and earlier. The issue allows remote attackers to cause a denial of service (application crash) by sending a malformed MSN message. Connected sources corroborate a separate but related buffer/URL handling flaw (CVE-2005-1261) and indicate updated packages to fix b...

CVE-2005-1519

CVE-2005-1519 affects Squid (2.5 STABLE9 and earlier) where an unfiltered DNS client UDP port can allow remote spoofing of DNS lookups, potentially redirecting users to spoofed sites. Public advisories (Debian DSA-751-1, CentOS/Red Hat advisories, Ubuntu USN-129-1) describe a fix in updated Squid...

CVE-2005-1494

Multiple cross-site scripting XSS vulnerabilities in admin.cgi in MegaBook 2.0 and 2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 entryid or 2 password parameter...

CVE-2005-1519

Squid 2.5 STABLE9 and earlier, when the DNS client port is unfiltered and the environment does not prevent IP spoofing, allows remote attackers to spoof DNS lookups...

CVE-2005-1488

Merak Mail Server 8.0.3 with Icewarp Web Mail 5.4.2 contains multiple cross-site scripting (XSS) vulnerabilities. Remote authenticated users can inject arbitrary web script or HTML through four input paths: (1) E-mail address, Note, or Public Certificate fields to address.html, (2) addressaction....