CVE-2005-0482

TrackerCam 5.12 and earlier is affected by CVE-2005-0482. The vulnerability allows remote denial of service (crash) via two vectors: (1) a large number of connections with a negative Content-Length header that may trigger a signedness error, and (2) a large amount of data. The sources cite these ...

CVE-2005-0471

Sun Java JRE 1.1.x through 1.4.x writes temporary files with long filenames that become predictable on a file system that uses 8.3 style short names, which allows remote attackers to write arbitrary files to known locations and facilitates the exploitation of vulnerabilities in applications that...

CVE-2005-0481

TrackerCam 5.12 and earlier allows remote attackers to read log files via the fn parameter in a direct request to the ComGetLogFile.php3 script...

CVE-2005-0479

Directory traversal vulnerability in ComGetLogFile.php3 for TrackerCam 5.12 and earlier allows remote attackers to read arbitrary files via ".." sequences and 1 "/" slash, 2 "" backslash, or 3 hex-encoded characters in the fn parameter...

CVE-2005-0470

The CVE-2005-0470 issue affects wpa_supplicant prior to 0.2.7, where a buffer overflow in handling EAPOL-Key frames can cause a denial of service (segmentation fault) via remote attacker-supplied data. Affected component is the wpa_supplicant software; root cause is improper validation/handling o...

CVE-2005-0487

CVE-2005-0487 affects Kayako ESupport 2.3.1 (and possibly other versions). The vulnerability is a cross-site scripting (XSS) flaw in index.php exposed via the nav parameter, allowing remote attackers to inject arbitrary HTML/script. The NVD entry lists a base CVSS v2 score of 6.8 (MEDIUM) with ne...

CVE-2005-0476

CVE-2005-0476 describes a cross-site scripting (XSS) flaw in hpm_guestbook.cgi that allows remote attackers to inject arbitrary web script or HTML by posting a message. The NVD entry lists a Network attack vector, Medium complexity, no authentication, with an impact profile of confidentiality: no...

CVE-2005-0486

Tarantella Secure Global Desktop Enterprise Edition 4.00 and 3.42, and Tarantella Enterprise 3 3.40 and 3.30, when using RSA SecurID and multiple users have the same username, reveals sensitive information during authentication, which allows remote attackers to identify valid usernames and the...

CVE-2005-0481

TrackerCam 5.12 and earlier is affected. A remote attacker can read log files by supplying a fn parameter to the ComGetLogFile.php3 script. The affected component is the ComGetLogFile.php3 endpoint of TrackerCam; root cause details are not specified in the provided documents. Impact is partial co...

CVE-2005-0513

PHP remote file inclusion vulnerability in mailautocheck.php in the Email This Entry add-on for pMachine Pro 2.4, and possibly other versions including pMachine Free, allows remote attackers to execute arbitrary PHP code by directly requesting mailautocheck.php and modifying the pmpath parameter ...

CVE-2005-0483

Multiple directory traversal vulnerabilities in sitenfo.sh, sitezipchk.sh, and siteziplist.sh in Glftpd 1.26 to 2.00 allow remote authenticated users to 1 determine the existence of arbitrary files, 2 list files in restricted directories, or 3 read arbitrary files from within ZIP or gzip files, v...

[SECURITY] [DSA 687-1] New bidwatcher packages fix format string vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 687-1 [email protected] http://www.debian.org/security/ Martin Schulze February 18th, 2005 http://www.debian.org/security/faq -...

CVE-2005-0243

Yahoo! Messenger 6.0.0.1750 (and potentially earlier than 6.0.0.1921) is affected by a filename spoofing vulnerability in the file transfer dialog where long filenames are not displayed correctly. This can lead users to download and open a misrepresented executable. The issue is mitigated by upda...

CVE-2005-0242

The Audio Setup Wizard asw.dll in Yahoo! Messenger 6.0.0.1750, and possibly other versions, allows attackers to arbitrary code by placing a malicious ping.exe program into the Messenger program directory, which is installed with weak default permissions...

CVE-2005-0158

Bidwatcher is affected by a format-string vulnerability (CVE-2005-0158) in versions before 1.3.17. A remote attacker—via a malicious or spoofed eBay web server—can cause a denial of service and potentially execute arbitrary code by sending certain responses. Multiple connected advisories referenc...

CVE-2005-0158

Format string vulnerability in bidwatcher before 1.3.17 allows remote malicious web servers from eBay, or a spoofed eBay server, to cause a denial of service and possibly execute arbitrary code via certain responses...

CVE-2005-0243

Yahoo! Messenger 6.0.0.1750, and possibly other versions before 6.0.0.1921, does not properly display long filenames in file dialog boxes, which could allow remote attackers to trick users into downloading and executing programs via file names containing a large number of spaces and multiple file...

CVE-2005-0519

ArGoSoft FTP Server before 1.4.2.7 allows remote attackers to read arbitrary files by uploading a ZIP file containing a shortcut .LNK file, using SITE UNZIP to extract the .LNK file onto the server, then accessing the file, a different vulnerability than CVE-2005-0520...

CVE-2005-0502

Directory traversal vulnerability in Xinkaa 1.0.3 and earlier allows remote attackers to read arbitrary files via 1 ../ and 2 ..\ characters in an HTTP request...

CVE-2005-0242

The CVE-2005-0242 vector affects Yahoo! Messenger (Windows), where the Audio Setup Wizard (asw.dll) could execute arbitrary code by placing a malicious ping.exe in the Messenger directory due to weak default permissions. The vulnerability enables local code execution with the privileges of the us...