CVE-2005-4047

CVE-2005-4047 describes an XSS vulnerability in IISWorks ASPKnowledgeBase 2.0, affecting the kb.asp component. The flaw allows remote attackers to inject arbitrary web script or HTML via the a parameter. The available data does not specify affected versions beyond IISWorks KB 2.0, nor details on ...

CVE-2005-4059

CVE-2005-4059 describes an SQL injection vulnerability in LocazoList 1.03c and earlier, specifically in searchdb.asp, exploitable via the q parameter. The underlying issue is unsanitized input that enables remote attackers to alter SQL queries. Affected component: LocazoList search functionality ...

CVE-2005-4064

CVE-2005-4064 describes multiple SQL injection vulnerabilities in A-FAQ 1.0, allowing remote attackers to execute arbitrary SQL commands through the faqDspItem.asp (faqid parameter) and faqDsp.asp (catcode parameter). Affected product: A-FAQ 1.0. Underlying cause and exact impact are documented a...

CVE-2005-4056

CVE-2005-4056 describes a SQL injection vulnerability in the search.php component of PluggedOut Nexus 0.1. The flaw allows remote attackers to manipulate the database by injecting SQL through the Location, Last Name, and First Name parameters. The vulnerability is documented with a high impact po...

CVE-2005-4052

CVE-2005-4052 affects e107 0.6174. The vulnerability arises in rate.php: the download parameter is used after a file download rating, enabling remote attackers to redirect users to arbitrary sites. The default installation reportedly mitigates this via the e_BASE check, restricting redirects to t...

CVE-2005-4057

CVE-2005-4057 describes a Cross-site scripting (XSS) vulnerability in the PluggedOut Nexus 0.1 project, specifically in search.php. The vulnerability allows remote attackers to inject arbitrary web script or HTML through the (1) Location, (2) Last Name, and (3) First Name parameters. The entries ...

CVE-2005-4063

CVE-2005-4063 describes multiple cross-site scripting (XSS) vulnerabilities in NetAuctionHelp 3.0 and earlier . An attacker can inject arbitrary HTML/JavaScript via the parameters L, sort, category, and categoryname in the search.asp endpoint. The NVD entry lists a Medium severity (CVSS v2.0 base...

CVE-2005-4053

The CVE-2005-4053 entry describes a Cross-site Scripting (XSS) vulnerability in coWiki version 0.3.4. The issue allows remote attackers to inject arbitrary web script or HTML via the q parameter, demonstrated with 26.html. Affected software: coWiki 0.3.4. Underlying cause: input handling in the q...

CVE-2005-4062

CVE-2005-4062 describes a cross-site scripting (XSS) flaw in CPSearch.asp of XcClassified 3.x that allows remote attackers to inject arbitrary script/HTML via the search parameters. The provided documents do not specify exact affected versions beyond 3.x, nor a published fix or workaround. Exploi...

CVE-2005-4063

Multiple cross-site scripting XSS vulnerabilities in NetAuctionHelp 3.0 and earlier allow remote attackers to inject arbitrary HTML and web script via the 1 L, 2 sort, 3 category, 4 categoryname parameters to search.asp...

CVE-2005-4065

CVE-2005-4065 is a SQL injection vulnerability in the Trac search module, affecting Trac prior to 0.9.2. The root cause is missing input sanitisation that allows an attacker to inject arbitrary SQL. The impact is remote code execution on the database level (partial confidentiality, integrity, and...

CVE-2005-4048

CVE-2005-4048 is corroborated across OpenVAS/Gentoo/Ubuntu advisories tied to FFmpeg libavcodec up to 0.4.9-pre1 and earlier. A heap-based buffer overflow in avcodec_default_get_buffer (utils.c) can be triggered by crafted small PNG images with palettes, potentially enabling remote command execut...

CVE-2005-4054

CVE-2005-4054 describes a SQL injection vulnerability in index.php of PluggedOut Blog 1.9.5 and earlier. The issue allows remote attackers to inject arbitrary SQL commands through the parameters (1) categoryid, (2) entryid, (3) year, (4) month, and (5) day. The connected documents confirm the aff...

CVE-2005-4065

SQL injection vulnerability in the search module in Edgewall Trac before 0.9.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors...

[SECURITY] [DSA 916-1] New Inkscape packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 916-1 [email protected] http://www.debian.org/security/ Martin Schulze December 7th, 2005 http://www.debian.org/security/faq -...

CVE-2005-3191

Multiple heap-based buffer overflows in the 1 DCTStream::readProgressiveSOF and 2 DCTStream::readBaselineSOF functions in the DCT stream parsing code Stream.cc in xpdf 3.01 and earlier, as used in products such as a Poppler, b teTeX, c KDE kpdf, d pdftohtml, e KOffice KWord, f CUPS, and g...

CVE-2005-2923

CVE-2005-2923 affects Ipswitch’s IMail Server IMAP service (IP: Ipswitch Collaboration Suite). The vulnerability lies in the IMAP LIST command handling: when a long LIST argument (~8000 bytes) is processed, the server can reference invalid memory, leading to a crash (DoS). This requires authentic...

CVE-2005-3191

CVE-2005-3191 involves multiple heap-based buffer overflows in the DCT stream parsing code (Stream.cc) of xpdf 3.01 and earlier, specifically in DCTStream::readProgressiveSOF and DCTStream::readBaselineSOF. The vulnerability arises from using an out-of-range numComps value as an array index, lead...

CVE-2005-2931

Ipswitch Collaboration Suite / IMail Server 8.20 (ICS) is affected by a format-string vulnerability in the SMTP server that allows remote attackers to execute arbitrary code via crafted input to the EXPN, MAIL, MAIL FROM, or RCPT TO commands. The issue stems from improper handling of format speci...

xpdf security update

CentOS Errata and Security Advisory CESA-2005:840-01 An updated xpdf package that fixes several security issues is now available. This update has been rated as having important security impact by the Red Hat Security Response Team. Updated 20 Dec 2005 The initial fix for these issues was...