CVE-2005-3912

Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, allows remote attackers to cause a denial of service crash or memory consumption and possibly execute arbitrary code via format string specifiers in the usernam...

CVE-2005-3912

Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, allows remote attackers to cause a denial of service crash or memory consumption and possibly execute arbitrary code via format string specifiers in the usernam...

Immunity Canvas: WEBMIN

Name| webmin ---|--- CVE| CVE-2005-3912 Exploit Pack| CANVAS Description| Webmin Remote Exploit Notes| CVE Name: CVE-2005-3912 VENDOR: Webmin.com OSVDB: Repeatability: References: http://www.dyadsecurity.com/webmin-0001.html - http://www.dyadsecurity.com/perl-0002.html CVE Url:...

CVE-2005-3914

Multiple SQL injection vulnerabilities in AFFcommerce 1.1.4 allow remote attackers to execute arbitrary SQL commands via 1 the cl parameter to SubCategory.php and the itemid parameter in 2 ItemInfo.php and 3 ItemReview.php...

CVE-2005-3924

CVE-2005-3924 is a SQL injection vulnerability in Randshop, specifically in themes/kategorie/index.php. The issue allows remote attackers to execute arbitrary SQL commands through the kategorieid and katid parameters. NVD lists a CVSS v2 base score of 7.5 (HIGH) with network attack vector, low co...

CVE-2005-3920

CVE-2005-3920 describes an SQL injection vulnerability in Babe Logger 2. The vulnerability allows remote attackers to execute arbitrary SQL commands via the gal parameter to index.php or the id parameter to comments.php. The public details identify the affected software (Babe Logger 2) and the sp...

CVE-2005-3929

The CVE-2005-3929 entry covers a directory traversal in Xaraya 1.0. The vulnerable component is the create function path in xarMLSXML2PHPBackend.php and the index.php module parameter handling. Due to insufficient input sanitization, an unauthenticated, remote attacker can craft a request that us...

CVE-2005-3918

CVE-2005-3918 affects OvBB 0.08a with SQL injection vulnerabilities exposed via the threadid parameter to thread.php and the userid parameter to profile.php. The connected PT-2005-4658 entry provides concrete details: attackers can remotely execute arbitrary SQL commands due to these input vector...

CVE-2005-3919

PBLang 4.65 is affected by a cross-site scripting (XSS) vulnerability in UCP.php and SendPm.php. The issue allows remote attackers to inject arbitrary web script or HTML via multiple fields, enabling potential theft or manipulation of user data as described in CVE-2005-3919. No remediation detail...

CVE-2005-3912

CVE-2005-3912: Webmin/miniserv.pl format-string vulnerability (username in login form) can crash or exhaust resources and potentially allow remote code execution when syslog logging is enabled. Affected: Webmin < 1.250 and Usermin

CVE-2005-3914

AFFcommerce 1.1.4 is affected by multiple SQL injection vulnerabilities (CVE-2005-3914). The flaws allow remote attackers to inject arbitrary SQL via (1) cl parameter to SubCategory.php and (2) item_id parameter in ItemInfo.php and (3) ItemReview.php. The connected documents confirm the affected ...

CVE-2005-3907

The CVE affects the Sun/Oracle Java Runtime Environment and JDK/JRE 5.0 Update 3 and earlier, where an untrusted Java applet may bypass security restrictions to access system resources and execute arbitrary code remotely. The root cause is an unspecified vulnerability in Java applets that can esc...

CVE-2005-3928

The CVE-2005-3928 issue affects QNX 6.2.1 and 6.3.0, where a buffer overflow in the phgrafx component is triggered by a long command line argument, allowing a local user to execute arbitrary code. The NVD entry lists a base score of 4.6 (MEDIUM) with local attack vector and no authentication. No ...

CVE-2005-3923

NetObjects Fusion 9 NOF9 allows remote attackers to obtain sensitive information, including passwords, by downloading the versioningrepository/rollbacklog.xml file, then using it to download and modify the associated ZIP file to edit and republish the site...

CVE-2005-3917

The CVE-2005-3917 entry affects CommodityRentals 2.0 Online Rental Business Creator script. It is a SQL injection vulnerability in the usersession function exploitable via the user_id parameter, enabling remote execution of arbitrary SQL commands. Impact per CVSS: Confidentiality/Integrity/Availa...

CVE-2005-3904

CVE-2005-3904 affects Java JMX in Java JDK/JRE 5.0 Update 3 and later (including 1.4.2+/1.3.1+); a remote attacker could escape the Java sandbox to access files or run arbitrary code. Mitigation from connected sources: upgrade to JDK/JRE 5.0 Update 4, and follow guidance to avoid untrusted applet...

CVE-2005-3915

Technical details for CVE-2005-3915 are not publicly available in the provided documents. Monitor for updates.

CVE-2005-3906

CVE-2005-3906 concerns multiple unspecified vulnerabilities in Java reflection APIs that could let remote attackers escape the Java sandbox and access arbitrary files or run arbitrary code. The connected sources specify affected software as Sun/Blackdown JDK/JRE up to 1.4.2_08 (and 1.3.1_15 for C...

CVE-2005-3908

CVE-2005-3908 is an XSS vulnerability in GhostScripter Amazon Shop (v5.0.0 and prior to 5.0.2) where an attacker can inject script/HTML through the query parameter in search.php. The cited references (NVD entry) confirm the affected software/version range and the vulnerability class, with a base ...

CVE-2005-3910

merchants/index.php in Post Affiliate Pro 2.0.4 and earlier, with magicquotesgpc disabled, allows remote attackers to include arbitrary local files via the md parameter, possibly due to a directory traversal vulnerability...