CVE-2005-0842

CVE-2005-0842 involves a cross-site scripting (XSS) vulnerability in Kayako eSupport version 2.3. The flaw occurs in index.php via the parameters _i and _c, allowing remote attackers to inject arbitrary web script or HTML in a victim’s browser. The public description does not specify a fix or aff...

CVE-2005-0841

CVE-2005-0841 describes an SQL injection in phpMyFamily 1.4.0 affecting multiple PHP files (people.php, track.php, edit.php, document.php, census.php, passthru.php, and possibly others). The root cause is unsanitized input that allows remote attackers to execute arbitrary SQL commands, demonstrat...

CVE-2005-0862

CVE-2005-0862 describes multiple PHP remote file inclusion vulnerabilities in PHPOpenChat 3.0.1 and earlier. An attacker can cause arbitrary PHP code execution by manipulating the phpbb_root_path, poc_root_path, or sourcedir parameters to various scripts (poc_loginform.php, phpbb/poc.php, phpnuke...

CVE-2005-0848

CVE-2005-0848 affects multiple FUN Labs games (4X4 Off-road Adventure III, Big Game Hunter, Dangerous Hunts, Deer Hunt, Revolution, Secret Service, Shadow Force, US Most Wanted). The issue: remote attackers can cause a denial of service by sending an empty UDP packet to the game server; the serve...

CVE-2005-0844

CVE-2005-0844 affects Nortel VPN client 5.01, where the cleartext password is stored in the memory of the Extranet.exe process, allowing a local user to access sensitive information. The root cause is insecure in‑memory handling of credentials in Extranet.exe, with a local attack vector and parti...

CVE-2005-0845

CVE-2005-0845 concerns SurgeMail 2.2g3, where a directory traversal in the Webmail interface, via the attach_id parameter, permits remote authenticated users to write arbitrary files or directories. The underlying issue is improper validation of the dot-dot (.. ) path segment, enabling access out...

CVE-2005-0418

CVE-2005-0418 is an argument-injection vulnerability in Java Web Start for J2SE 1.4.2 (up to 1.4.2_06) on Mac OS X. The flaw allows an untrusted JNLP file to inject values via a property tag, enabling privilege escalation. Connected entries also reference CVE-2005-0836, which describes a related ...

CVE-2005-0850

FileZilla FTP server before 0.9.6 allows remote attackers to cause a denial of service via a request for a filename containing an MS-DOS device name such as CON, NUL, COM1, LPT1, and others...

CVE-2005-0850

Vulnerability summary (CVE-2005-0850): FileZilla FTP Server prior to 0.9.6 is susceptible to denial of service when a client requests a filename containing MS-DOS device names (e.g., CON, NUL, COM1, LPT1). The issue is confirmed in multiple security feeds, and related Nessus findings also describ...

CVE-2005-0402

CVE-2005-0402 affects Mozilla Firefox, where saving a page as a Firefox sidebar panel can allow an attacker to inject JavaScript into a privileged page, enabling remote code execution with the user’s privileges. The vulnerability concerns the Firefox sidebar panel feature; no exploitation details...

CVE-2005-0853

The CVE-2005-0853 entry concerns betaparticle blog (bp blog) where the database files are stored under the web root, enabling direct access to sensitive data via HTTP requests. Affected files are (1) dbBlogMX.mdb for versions before 3.0, or (2) Blog.mdb for versions 3.0 and later, with vector 2 a...

CVE-2005-0847

CVE-2005-0847 affects Code Ocean FTP server 1.0; a flaw allows remote attackers to cause a denial of service via a large number of connections. The CVSS base score is 5.0 (Medium) with network attack vector, low complexity, no authentication, and partial availability impact. Exploit details are n...

CVE-2005-0851

CVE-2005-0851 affects the FileZilla FTP Server up to version 0.9.6. When using MODE Z (zlib compression), it can trigger a denial-of-service via certain file uploads or directory listings, causing an infinite loop. The vulnerability is associated with a NETWORK attack vector, with low complexity ...

CVE-2005-0846

CVE-2005-0846 affects NetWin SurgeMail 2.2g3 and describes multiple XSS vulnerabilities in the email auto-reply message, exploitable via the (1) message subject or (2) message header field to inject arbitrary web script/HTML. Exploitation details are not provided beyond this, but a remediation is...

CVE-2005-0855

CVE-2005-0855 affects CoolForum 0.8.1 beta and earlier. The issue allows remote attackers to trigger PHP error messages via direct requests to eight PHP pages (entete.php, profile_accueil.php, profile_mdp.php, profile_notify.php, profile_options.php, profile_perso.php, profile_pm.php, readannonce...

CVE-2005-0864

The CVE-2005-0864 entry concerns the Boa web server, used in Samsung ADSL Modem SMDK8947v1.2 and possibly other products. The vulnerability allows remote attackers to read arbitrary files by supplying a full path in the HTTP request (path traversal). Reported impact is partial breach of confident...

CVE-2005-0856

CoolForum 0.8.1 beta and earlier is affected by a SQL injection in requests to alert.php and viewip.php, allowing remote attackers to manipulate SQL commands. The issue is attributed to a likely input handling flaw in these endpoints, enabling partial/complete manipulation of queries as described...

CVE-2005-0863

PHPOpenChat v3.x contains an XSS vulnerability that allows remote attackers to inject arbitrary script/HTML through (1) chatter in regulars.php or (2) chatter, chatter1, chatter2, chatter3, or chatter4 in register.php. This can lead to client-side script execution and partial integrity impact wit...

CVE-2005-0853

betaparticle blog bp blog stores the database under the web root, which allows remote attackers to obtain sensitive information via a direct request to 1 dbBlogMX.mdb for versions before 3.0, or 2 Blog.mdb for versions 3.0 and later. NOTE: it was later reported that vector 2 also affects versions...

CVE-2005-0401

CVE-2005-0401 affects Mozilla Firefox 1.0.1 and Mozilla before 1.7.6. The issue arises from insufficient mitigation of attack vectors for loading chrome files and hijacking drag-and-drop events, enabling a remote attacker to execute arbitrary XUL code by tricking a user into dragging a scrollbar ...