CVE-2005-0070

CVE-2005-0070 affects synaesthesia up to version 2.1 where the binary is installed setuid root and does not drop privileges while reading user configuration/mixer files, allowing local users to read arbitrary files. Public sources detail a privilege-escalation issue with synaesthesia and Debian’s...

CVE-2005-0105

Unknown vulnerability in typespeed 0.4.1 and earlier allows local users to gain privileges...

CVE-2005-0411

Directory traversal vulnerability in index.php for CitrusDB 0.3.6 and earlier allows remote attackers and local users to include arbitrary PHP files via .. dot dot sequences in the load parameter...

CVE-2005-0450

Directory traversal vulnerability in Sami HTTP Server 1.0.5 allows remote attackers to read arbitrary files via an HTTP request containing 1 .. dot dot or 2 "%2e%2e" encoded dot dot sequences...

CVE-2005-0105

Unknown vulnerability in typespeed 0.4.1 and earlier allows local users to gain privileges...

CVE-2005-0406

A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, which could lead to an information leak of potentially sensitive visual information that had been removed from the main JPEG image...

CVE-2005-0363

AWStats CVE-2005-0363 affects awstats.pl in AWStats 4.0 and 6.2, where insufficient input sanitization allows remote attackers to execute arbitrary shell commands via shell metacharacters in the config parameter. The issue enables remote, unauthenticated command execution with web server privileg...

CVE-2005-0362

CVE-2005-0362 affects AWStats (awstats.pl) with AWStats 6.2, where remote attackers can execute arbitrary commands by injecting shell metacharacters into the parameters 1) pluginmode, 2) loadplugin, or 3) noloadplugin. The issue arises from improper handling/sanitation of user-supplied input in t...

CVE-2005-0407

CVE-2005-0407 is a cross-site scripting vulnerability in Openconf 1.04 (and possibly earlier versions prior to 1.10). Attackers can inject arbitrary HTML/JavaScript via the paper title, which can be executed when an admin reviews submissions, enabling potential session takeover or script executio...

CVE-2005-0177

CVE-2005-0177 relates to the Linux kernel: nls_ascii.c incorrectly sized the translation table (128 vs 256), enabling a buffer overflow that can crash the kernel (DoS). Public references in Ubuntu/SUSE/NVD describe the same issue affecting Linux kernels up to 2.6.8.1, with fixes provided in newer...

CVE-2005-0408

CitrusDB 0.3.6 and earlier uses an authentication cookie id_hash which is md5(user_name + 'boogaadeeboo'); because id_hash is derived from the username with a hard-coded suffix, an attacker who knows a valid username can compute the MD5 and forge the cookie to bypass authentication and gain privi...

CVE-2005-0451

Sami HTTP Server 1.0.5 allows remote attackers to cause a denial of service via an HTTP request containing two CRLF sequences, which triggers a NULL dereference...

CVE-2005-0178

Race condition in the setsid function in Linux before 2.6.8.1 allows local users to cause a denial of service crash and possibly access portions of kernel memory, related to TTY changes, locking, and semaphores...

DEBIAN-CVE-2005-0105

Unknown vulnerability in typespeed 0.4.1 and earlier allows local users to gain privileges...

Fedora Core 2 : xemacs-21.4.17-0.FC2 (2005-145)

Update to 21.4.17 stable release, which also fixes the CVE-2005-0100 movemail string format vulnerability. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as muc...

lighttpd < 1.3.8 Null Byte Request CGI Script Source Code Disclosure

According to its banner, the version of lighttpd running on the remote host is prior to 1.3.8. It is, therefore, affected by an information disclosure vulnerability. An unauthenticated, remote attacker can exploit this vulnerability, by requesting a CGI script that is appended by a '%00', to read...

osCommerce contact_us.php enquiry Parameter XSS

The installed version of OSCommerce is vulnerable to a cross-site scripting XSS attack. An attacker, exploiting this flaw, would need to be able to coerce an unsuspecting user into visiting a malicious website. Upon successful exploitation, the attacker would potentially be able to steal...

RHEL 2.1 : postgresql (RHSA-2005:150)

Updated PostgreSQL packages to fix various security flaws are now available for Red Hat Enterprise Linux 2.1AS. This update has been rated as having important security impact by the Red Hat Security Response Team. PostgreSQL is an advanced Object-Relational database management system DBMS. A flaw...

Fedora Core 3 : xemacs-21.4.17-0.FC3 (2005-146)

Update to 21.4.17 stable release, which also fixes the CVE-2005-0100 movemail string format vulnerability and the AltGr issue for European input. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Debian DSA-684-1 : typespeed - format string

Ulf Harnhammar from the Debian Security Audit Project discovered a problem in typespeed, a touch-typist trainer disguised as game. This could lead to a local attacker executing arbitrary code as group games. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...