CVE-2005-0679

CVE-2005-0679 describes a PHP remote file inclusion in the Tell A Friend Script. The vulnerability is in tell_a_friend.inc.php, where the script_root parameter can reference a URL on a remote server, allowing arbitrary PHP code execution. Affected versions include Tell A Friend Script 2.7 (before...

CVE-2005-0682

CVE-2005-0682 describes a cross-site scripting (XSS) vulnerability in Drupal’s common.inc prior to version 4.5.2, allowing remote attackers to inject arbitrary web script or HTML via certain inputs. The issue is documented with a NVD base score of 4.3 (Medium), and the impact is limited to partia...

CVE-2005-0667

Buffer overflow in Sylpheed before 1.0.3 and other versions before 1.9.5 allows remote attackers to execute arbitrary code via an e-mail message with certain headers containing non-ASCII characters that are not properly handled when the user replies to the message...

CVE-2005-0697

SQL injection vulnerability in the processpicture function xppublish.php in CopperExport 0.2.1 allows remote attackers to execute arbitrary SQL commands, possibly via the 1 title, 2 caption, or 3 keywords parameters...

CVE-2005-0670

The provided threat data centers on phpCOIN versions 1.2.0 through 1.2.1b, which are reported to contain multiple input-validation flaws. The CVE-2005-0670 entry describes cross-site scripting (XSS) vulnerabilities allowing arbitrary script/HTML injection via specific parameters to mod.php and lo...

CVE-2005-0722

eXPerience2 allows remote attackers to obtain the full path for the web root via a direct request to modules.php without any parameters, which leaks the path in a PHP error message...

CVE-2005-0703

Xerox MicroServer Web Server for various WorkCentre products including M35/M45/M55 2.028.11.000 through 2.97.20.032 and 4.84.16.000 through 4.97.20.032, Pro 35/45/55 3.028.11.000 through 3.97.20.032, Pro 65/75/90 1.001.00.060 through 1.001.02.084, and others, has an "unauthenticated account," whi...

CVE-2005-0652

Technical details about CVE-2005-0652 (affected products, vulnerable components, root cause, impact) are not publicly available in the supplied documents. Monitor for updates.

CVE-2005-0656

CVE-2005-0656 affects auraCMS 1.5 with multiple XSS vulnerabilities. The issues allow remote attackers to inject arbitrary web script or HTML through (1) hits.php via the hits parameter, (2) index.php via an unspecified query parameter, and (3) counter.php via the theCount parameter. The NVD entr...

CVE-2005-0178

Race condition in the setsid function in Linux before 2.6.8.1 allows local users to cause a denial of service crash and possibly access portions of kernel memory, related to TTY changes, locking, and semaphores...

CVE-2005-0672

The CVE-2005-0672 entry concerns Carsten’s 3D Engine (Ca3DE), March 2004 and earlier. A vulnerability in text strings that are not null terminated can trigger a null dereference, enabling remote code execution. Documents confirm affected software and root cause (unterminated text leading to deref...

CVE-2005-0667

CVE-2005-0667 is a buffer‑overflow in Sylpheed’s header processing when replying to messages that contain non‑ASCII headers. Affected are Sylpheed before 1.0.3 and other versions before 1.9.5; successful exploitation can allow remote code execution with the user’s privileges. Several connected ad...

CVE-2005-0397

Format string vulnerability in the SetImageInfo function in image.c for ImageMagick before 6.0.2.5 may allow remote attackers to cause a denial of service application crash and possibly execute arbitrary code via format string specifiers in a filename argument to convert, which may be called by...

CVE-2005-0678

CVE-2005-0678 is a PHP remote file inclusion vulnerability in Form Mail Script (formmail.inc.php) for version 2.3 and earlier. The issue arises when an attacker modifies script_root to reference a URL on a remote server, enabling execution of arbitrary PHP code on the vulnerable host. Affected co...

CVE-2005-0700

The exportindex action in myadmin.php for Aztek Forum 4.0 allows remote attackers to obtain database files, possibly by setting the ATKADMIN cookie...

CVE-2005-0662

CVE-2005-0662 is an XSS vulnerability in MercuryBoard 1.1.2, occurring in index.php via the Avatar field. The affected component is MercuryBoard’s web interface; the root cause is improper sanitization of user-supplied data in the Avatar parameter, allowing injection of arbitrary script/HTML. Pub...

CVE-2005-0655

The vulnerability CVE-2005-0655 affects auraCMS 1.5. An attacker can trigger an information disclosure by issuing an HTTP request with an invalid id parameter to one of three PHP endpoints (teman.php, hal.php, arsip.php), causing a PHP error message that reveals the file path. The NVD page report...

CVE-2005-0665

Format string vulnerability in xv before 3.10a allows remote attackers to execute arbitrary code via format string specifiers in a filename...

CVE-2005-0653

CVE-2005-0653 affects phpMyAdmin 2.6.1 and concerns improper permission handling on tables whose names contain an underscore. The vulnerability allows remote authenticated users to obtain more privileges than intended for those tables, with a CVSSv2 base score of 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)....

CVE-2005-0668

The CVE-2005-0668 entry describes an issue in HTTP Anti Virus Proxy (HAVP) prior to version 0.51 where viruses are not properly detected in certain archive files (notably CAB and ZIP). Affected component: HAVP (HTTP proxy). Root cause: scanning failure for specific archive formats, enabling poten...