CVE-2005-1411

CVE-2005-1411 affects Cybration ICUII 7.0, where passwords are stored in plaintext in the world-readable icuii.ini file. This local-privilege scenario arises from the insecure storage, enabling local users to gain privileges by reading the file. The available sources describe the vulnerability an...

CVE-2005-1445

CVE-2005-1445 affects SitePanel 2.6.1 and earlier (SitePanel2). The issue is multiple directory traversal vulnerabilities allowing remote attackers to (1) delete arbitrary files via the id parameter in a rmattach action to 5.php, and (2) read arbitrary files via the lang parameter to index.php. R...

CVE-2005-1439

CVE-2005-1439 : In osTicket, a directory traversal vulnerability exists in attachments.php that allows remote attackers to read arbitrary files via .. sequences in the file parameter. Evidence from multiple sources confirms a network-wide, unauthenticated remote attack vector with a base CVSS v2 ...

CVE-2005-1441

The vulnerability is a format string issue in Lotus Domino Server NRPC (Notes protocol) that allows remote denial of service. Affected products: Lotus Domino 6.0.x before 6.0.5 and 6.5.x before 6.5.4. Root cause: incorrect handling of format strings in NRPC processing. Impact: remote DoS as descr...

CVE-2005-1402

CVE-2005-1402 affects older versions of the NeL library (as used in Mtp-Target 1.2.2 and earlier). The flaw is an integer signedness error in a STLport call, not caught by a signed comparison, allowing remote attackers to cause a denial of service via memory consumption or a server crash. The pro...

CVE-2005-1430

The CVE-2005-1430 issue affects Mac OS X 10.3.x and earlier. The vulnerability arises from insecure permissions on a pseudo terminal (pty) that is managed by a non-setuid program, allowing local users to read or modify other users’ sessions. Public documents do not specify affected versions beyon...

CVE-2005-1405

CVE-2005-1405 affects Lotus Domino 6.5.x (before 6.5.4) and 6.0.x (before 6.0.5). The vulnerability is an HTTP response splitting flaw in the @SetHTTPHeader function, enabling attackers to poison the web cache through malicious applications. The provided sources describe the issue and affected ve...

CVE-2005-1449

Unknown vulnerability in serendipityconfiglocal.inc.php for Serendipity before 0.8 has unknown impact...

CVE-2005-1434

OpenView Network Node Manager (OV NNM) versions 6.2, 6.4, 7.01, and 7.50 are associated with CVE-2005-1434. The available descriptions indicate multiple unknown vulnerabilities that can cause denial of service or allow arbitrary code execution. The connected documents do not provide concrete tech...

CVE-2005-1446

SitePanel 2.6.1 and earlier (SitePanel2) are vulnerable to remote file upload: an attacker can attach a file to a trouble ticket and have it executed (e.g., PHP scripts). The entry does not provide specific affected versions beyond 2.6.1 and earlier, nor details on exact vulnerable components, ro...

CVE-2005-0106

SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGDPATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file...

CVE-2005-0106

SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGDPATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file...

CVE-2005-1379

The LAM runtime environment package lam-runtime-7.0.6-2mdk on Mandrake Linux installs the mpi user without a password, which allows local users to gain privileges...

DEBIAN-CVE-2005-0106

SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGDPATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file...

CVE-2005-1409

PostgreSQL 7.3.x through 8.0.x gives public EXECUTE access to certain character conversion functions, which allows unprivileged users to call those functions with malicious values, with unknown impact, aka the "Character conversion vulnerability."...

CVE-2005-1412

CVE-2005-1412 affects Ecomm Professional Guestbook 3.x. The vulnerability is a SQL injection in verify.asp that allows remote attackers to execute arbitrary SQL commands via the AdminPWD parameter. The Red Hat/ vendor CVE references corroborate the description. The documents do not provide explic...

CVE-2005-1426

Affected software: Ublog Reload (Uapplication Ublog Reload). Vulnerable component: mdb-database/blog.mdb (aka blog.msb) exposed under the web root. Root cause: insufficient access control in the web root enables direct HTTP retrieval of the database by remote attackers. Impact: potential unauthor...

CVE-2005-1435

Open WebMail (OWM) before version 2.51 (20050430) is vulnerable to remote command execution when an authenticated user supplies a filename containing shell metacharacters. The root cause is failure to properly remove shell escapes from filenames before processing them, enabling arbitrary command ...

CVE-2005-1427

Affected component: Uapplication Uphotogallery. Vulnerability: storing the database under the web document root allows remote attackers to access sensitive data via a direct request to uphotogallery.mdb. Impact: exposure of information (confidentiality impact Partial; per CVSS). Notes: the provid...

CVE-2005-1424

StumbleInside GoText 1.01 stores sensitive username, mail address, and phone number information in plaintext in the GoText.bin file, which allows local users to obtain that information. The CVE description identifies local access and partial confidentiality impact (CONFIDENTIALITY=PARTIAL) with a...