CVE-2005-4484

CVE-2005-4484 affects IntranetApp version 3.3 and earlier. The vulnerability is a set of cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML via (1) the ret_page parameter to login.asp, and (2) the do_search and (3) search parameters to content.asp....

CVE-2005-4497

The CVE-2005-4497 entry affects Tangora Portal CMS 4.0 and earlier. The vulnerability is a Cross-site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML through the action parameter in the search page (demonstrated with page1631.aspx and page496.aspx). No rem...

CVE-2005-4485

CVE-2005-4485 describes cross-site scripting (XSS) in ProjectApp 3.3 and earlier. The issue arises from unsanitized input in multiple parameters across several pages: keywords (forums.asp, search_employees.asp, cat.asp, links.asp), projectid (pmprojects.asp), ret_page (login.asp), and skin_number...

CVE-2005-4486

CVE-2005-4486 concerns SQL injection in Quantum Art QP7.Enterprise (formerly Q-Publishing). The vulnerability allows remote attackers to manipulate SQL via the p_news_id parameter on endpoints such as news_and_events_new.asp and news.asp . The vendor disputed the report’s accuracy in 2006, noting...

CVE-2005-4481

Polopoly 9 and earlier are affected by an XSS vulnerability described as allowing remote attackers to inject arbitrary web script or HTML via unspecified search parameters. The vendor disputes the issue, stating the XSS flaw was part of a custom site implementation. Public records do not provide ...

CVE-2005-4489

CVE-2005-4489 describes a Cross-site Scripting (XSS) vulnerability in Scoop 1.1 RC1 and earlier, where remote attackers can inject arbitrary web script or HTML via the (1) type, (2) count parameters, and (3) the query string in a story. Affected product is Scoop (version 1.1 RC1 and earlier); und...

CVE-2005-4494

SPIP 1.8.2 and earlier exposes a cross-site scripting (XSS) vulnerability. According to the CVE record, remote attackers can inject arbitrary web script or HTML via unspecified parameters to spip_login.php3 and spip_pass.php3. The affected software is SPIP (content management system), but the des...

CVE-2005-4495

The advisory concerns SpireMedia mx7, specifically the index.cfm script, where the cid parameter is vulnerable to SQL injection. The root cause is untrusted input used in SQL queries, enabling remote attackers to potentially run arbitrary SQL commands. Some sources also suggest this may illuminat...

CVE-2005-4484

Multiple cross-site scripting XSS vulnerabilities in IntranetApp 3.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 retpage parameter to login.asp or the 2 dosearch and 3 search parameters to content.asp...

CVE-2005-4490

CVE-2005-4490 affects SCOOP! 2.3 and earlier, with multiple XSS vulnerabilities. An attacker can inject arbitrary script/HTML via parameters to articleSearch.asp (keyword, invalid parameter); lostPassword.asp (username, invalid parameter); account_login.asp (Username, Password, invalid parameter)...

CVE-2005-4491

Affected software: Sitekit CMS 6.6 and earlier. Vulnerability: Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML via several parameters (1) query string, (2) textonly, (3) locID, (4) lang to Default.aspx, and the (6) ClickFrom parame...

CVE-2005-4480

CVE-2005-4480 : A cross-site scripting (XSS) vulnerability affects Plexcor CMS 4.0 and earlier, allowing remote attackers to inject arbitrary web script or HTML via unspecified search parameters. Documents do not specify the exact vulnerable component/version beyond the CMS family, nor provide co...

CVE-2005-4499

The Downloadable RADIUS ACLs feature in Cisco PIX and VPN 3000 concentrators, when creating an ACL on the Cisco Secure Access Control Server CS ACS, generates a random internal name for an ACL that is also used as a hidden user name and password, which allows remote attackers to gain privileges b...

CVE-2005-4496

CVE-2005-4496 is an XSS vulnerability in SyntaxCMS 1.2.1 and earlier, exploitable via the search_query parameter to inject arbitrary script or HTML. Affected: SyntaxCMS versions up to 1.2.1 (and earlier). Impact: remote script/HTML execution as an attacker-provided payload; details on exploit vec...

CVE-2005-4493

CVE-2005-4493 describes a cross-site scripting (XSS) vulnerability in SpearTek 6.0 and earlier . The issue allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters . CVSS v2 base score reported as 6.8 (Medium) with network attack vector, no authentication, ...

CVE-2005-4474

The CVE-2005-4474 entry concerns WinRAR 3.51 with a buffer overflow in the “Add to archive” command. The described issue arises when a user is tricked into adding a file whose filename contains non-default code page and non-ANSI characters (e.g., Chinese filenames). The root cause is described as...

xpdf security update

CentOS Errata and Security Advisory CESA-2005:840-02 An updated xpdf package that fixes several security issues is now available. This update has been rated as having important security impact by the Red Hat Security Response Team. Updated 20 Dec 2005 The initial fix for these issues was...

CVE-2005-4465

The Internet Key Exchange version 1 IKEv1 implementation in NEC UNIVERGE IX1000, IX2000, and IX3000 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of...

WebDB SQL inj vuln.

WebDB SQL inj vuln. Vuln. discovered by : r0t Date: 22 dec. 2005 orginal advisory:http://pridels.blogspot.com/2005/12/webdb-sql-inj-vuln.html vendor:http://www.loissoftware.com affected version:1.1 and prior Product Description: WebDB is the totally generic, instant online database system - It is...

CVE-2005-4465

The CVE-2005-4465 entry concerns IKEv1 in NEC UNIVERGE IX1000/IX2000/IX3000, where crafted IKE packets can cause a denial of service and possibly arbitrary code execution, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. Connected sources also reference related IKEv1 issues (CVE-2005-36...