CVE-2005-0800

CVE-2005-0800 describes a PHP remote file inclusion vulnerability in mcNews 1.3 and earlier. The flaw exists in install.php where the l parameter can be modified to reference a URL on a remote server containing PHP code, allowing an attacker to execute arbitrary PHP. The issue is triggered throug...

CVE-2005-0644

CVE-2005-0644 describes a buffer overflow in McAfee Scan Engine 4320 when scanning LHA archives. The issue arises from insufficient bounds checking in the LHA archive handling code (Type-2 header file name field), allowing remote code execution with SYSTEM privileges via a malformed LHA file. Aff...

CVE-2005-0805

The CVE-2005-0805 entry describes a SQL injection in Subdreamer Light’s index.php when magic_quotes_gpc is enabled. The vulnerability allows remote attackers to run arbitrary SQL via parameters treated as global variables, demonstrated via the imageid parameter that imagegallery.php fails to sani...

CVE-2005-0815

Multiple "range checking flaws" in the ISO9660 filesystem handler in Linux 2.6.11 and earlier may allow attackers to cause a denial of service or corrupt memory via a crafted filesystem...

CVE-2005-0802

CVE-2005-0802 concerns a cross-site scripting (XSS) vulnerability in the search.asp handler of ACS Blog versions 0.8 through 1.1b. The issue allows remote attackers to inject and execute arbitrary web script or HTML via the search parameter, potentially impacting users viewing search results. The...

CVE-2005-0782

CVE-2005-0782 is a cross-site scripting (XSS) vulnerability in paFileDB 3.1 and earlier, affecting viewall.php and category.php. The start parameter to pafiledb.php enables remote attackers to inject arbitrary script/HTML. The NVD entry notes MEDIUM impact (I partial) with CVSS v2.0 base score 4....

CVE-2005-0643

CVE-2005-0643 (and related CVEs) describe a buffer overflow in McAfee Scan Engine 4320 when parsing LHA archives. The vulnerability is triggered by crafted LHA files; DAT versions before 4357 (CVE-2005-0643) and before 4436 (CVE-2005-0644) are affected. Exploitation can lead to remote code execut...

CVE-2005-0808

Apache Tomcat before 5.x is affected by a remote denial-of-service vulnerability triggered by a crafted AJP12 packet to TCP port 8007, which can cause the application to crash or stop responding. The vulnerability is attributed to handling of AJP12 input (malformed/input handling). Affected compo...

CVE-2005-0801

CVE-2005-0801 describes a directory traversal vulnerability in the web application component includer.cgi of The Includer . The issue allows remote attackers to read arbitrary files by supplying directory traversal sequences (.. or a full pathname) in the URL, compromising confidentiality. The pr...

CVE-2005-0788

CVE-2005-0788 affects LimeWire versions 4.1.2 through 4.5.6, where improper handling of Gnutella GET requests allows remote attackers to read arbitrary files by specifying a full pathname. The coupled issue CAN-2005-0788 (and CAN-2005-0789 for magnet requests) enables directory traversal/read acc...

CVE-2005-0793

Summary: The provided documents describe a PHP remote file inclusion (RFI) vulnerability in ZPanel, affecting zpanel.php and related template code. The issue arises from insufficient sanitization of user-supplied input in the page parameter (and, for templates/ZPanelV2/template.php, the body para...

CVE-2005-0815

CVE-2005-0815 affects the Linux kernel iso9660 filesystem handler in versions up to 2.6.11 (and earlier). The issue is described as multiple range-checking flaws in the ISO-9660 file system code, which could be triggered by mounting a crafted/corrupted ISO image on CD-ROM. Impact stated in connec...

CVE-2005-0800

PHP remote file inclusion vulnerability in install.php in mcNews 1.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the l parameter to reference a URL on a remote web server that contains the code, a different vulnerability than CVE-2005-0720...

CVE-2005-0799

MySQL 4.1.9, and possibly earlier versions, allows remote attackers with certain privileges to cause a denial of service application crash via a use command followed by an MS-DOS device name such as 1 LPT1 or 2 PRN...

CVE-2005-0810

CVE-2005-0810: NotifyLink contains SQL injection vulnerabilities affecting NotifyLink Server (pre-3.0). Unauthenticated remote attackers can append SQL via various URLs to view/modify the NotifyLink SQL database; impact includes unauthorized user creation, password changes, and data exposure. The...

CVE-2005-0796

CVE-2005-0796 is a directory traversal vulnerability in HolaCMS 1.4.9-1. An attacker can overwrite arbitrary files by injecting a path like holaDB/votes/.. into the vote_filename parameter, bypassing the directory check. The NVD entry documents this vulnerability and its impact as partial integri...

CVE-2005-0777

PhotoPost PHP 5.0 RC3 is affected by multiple XSS vulnerabilities. Specifically, remote attackers can inject arbitrary script or HTML via (1) the check_tags function and (2) the editbio field in the user profile. The issues arise from unsanitized input in these areas, enabling reflected or stored...

CVE-2005-0775

CVE-2005-0775 affects PhotoPost PHP 5.0 RC3 where the reportpost action in misc.php fails to limit logging data sent to the administrator, enabling remote attackers to flood the admin with email. The NVD lists a CVSS v2 base score of 7.5 (HIGH) with network access, low attack complexity, and no a...

CVE-2005-0778

CVE-2005-0778 affects PhotoPost PHP 5.0 RC3. The vulnerability arises because the upload handling does not fully verify that a file is an image, allowing remote attackers to inject arbitrary Javascript by uploading non-image files with image extensions (e.g., .gif). This results in a potential XS...

CVE-2005-0804

CVE-2005-0804 affects MailEnable 1.8. The issue is a format string vulnerability in the mailto field that allows remote attackers to cause a denial of service (application crash) by supplying format specifiers. Connected documents confirm the vulnerability exists in MailEnable 1.8 and describe a ...