CVE-2005-3549

CVE-2005-3549 describes a direct code injection vulnerability in Invision Power Board 2.0.1 Task Manager. The flaw allows limited remote attackers to execute arbitrary code by placing a target file reference in the Task PHP File To Run field and selecting Run Task Now. The affected software is In...

CVE-2005-3594

gamescore.php in e107 allows remote attackers to insert high scores via HTTP POST methods utilizing the $playername, $playerscore, and $gamename variables...

CVE-2005-3592

The CVE-2005-3592 entry documents a path disclosure vulnerability in CuteNews 1.4.0 and earlier. An attacker can trigger an error message (for example by supplying multiple ../ sequences in the archive parameter) to obtain the installation path of the application. This is a information-disclosure...

CVE-2005-3582

CVE-2005-3582 affects ImageMagick before 6.2.4.2-r1. Local users in the portage group can escalate privileges by placing a malicious shared object in the Portage temporary build directory, which is added to the runtime search path and loaded by executables. The issue stems from RUNPATH handling i...

CVE-2005-3578

CVE-2005-3578 affects Walla TeleSite 3.0 and earlier due to an SQL injection in ts.exe (ts.cgi) that allows remote attackers to inject arbitrary SQL via the sug parameter. The NVD entry lists a network attack vector with low complexity and no authentication, yielding partial confidentiality, inte...

CVE-2005-3589

The CVE-2005-3589 entry describes a buffer overflow in FileZilla Server Terminal (0.9.4d and earlier) that enables remote denial of service by sending an excessively long USER command to the FTP server. Connected documents corroborate a Denial of Service vector against the FileZilla FTP Server Ad...

CVE-2005-3561

CVE-2005-3561 is rejected/not used; reference CVE-2005-2954 instead.

CVE-2005-3584

CVE-2005-3584 is a cross-site scripting (XSS) vulnerability in PhpWebThings 1.4.4, exploitable through forum.php via the forum parameter. The underlying issue is insufficient input sanitization for that parameter, enabling remote attackers to inject arbitrary web script or HTML. The connected doc...

CVE-2005-3567

The CVE-2005-3567 entry concerns the slapd daemon in IBM Tivoli Directory Server (ITDS) versions 5.2.0 and 6.0.0. It describes a vulnerability where binds using SASL EXTERNAL can bypass authentication, enabling an attacker to modify and delete directory data via unspecified attack vectors. The co...

CVE-2005-3583

The CVE-2005-3583 entry concerns Oracle/Sun Java Runtime Environment (JRE) and Software Development Kit (SDK) versions 1.4.2_08, 1.4.2_09, and 1.5.0_05 (and possibly others) that allow remote attackers to cause a denial of service by sending a crafted serialized object (e.g., a font object), whic...

CVE-2005-3578

SQL injection vulnerability in ts.exe aka ts.cgi in Walla TeleSite 3.0 and earlier allows remote attackers to inject arbitrary SQL commands via the sug parameter...

CVE-2005-3547

CVE-2005-3547 affects Invision Power Board 2.1. The vulnerability is a Cross-site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via multiple input fields (e.g., adsess, name, description in admin.php, ACP Notes, Member Name, Password, Email Address, Comp...

CVE-2005-3574

CVE-2005-3574 affects iCMS (PHP) via index.php. The vulnerability allows remote attackers to include arbitrary files through the page parameter, enabling a network-based attack with no authentication. The CVSSv2 base metrics in the provided data indicate a MEDIUM severity, with partial confidenti...

CVE-2005-3560

CVE-2005-3560 affects Zone Labs products (ZoneAlarm Pro 6.0, ZoneAlarm Internet Security Suite 6.0, ZoneAlarm Anti-Virus 6.0, ZoneAlarm Anti-Spyware 6.0–6.1, and ZoneAlarm 6.0). The issue allows remote attackers to bypass the product’s Advanced Program Control and OS Firewall filters by sending U...

CVE-2005-3576

CVE-2005-3576 affects ts.exe in Walla TeleSite 3.0 and earlier. The vulnerability arises when an article number is supplied in the tsurl parameter, allowing remote attackers to access privileged information. The available documents confirm the affected software/component and the impact as informa...

CVE-2005-3552

CVE-2005-3552 affects PHP-Kit 1.6.1 RC2 and earlier. The vulnerability is multiple cross-site scripting (XSS) flaws that allow a remote attacker to inject arbitrary script/HTML via several vectors, including login/profile.php, login/userinfo.php, admin/admin.php, imcenter.php, referer statistics,...

CVE-2005-3544

** vuln: XMB 1.9.3** has an XSS in u2u.php that lets remote attackers inject arbitrary scripts via the username parameter. The vulnerability arises from insufficient input sanitization in the web interface, enabling script execution in the victim’s browser. No explicit exploit details, affected v...

CVE-2005-3542

CVE-2005-3542 is a reservation duplicate of CVE-2005-3508. The connected document CVE-2005-3508 describes a SQL injection in Gallery (Galerie) 2.4 where the galid parameter allows remote attackers to execute arbitrary SQL commands via showGallery.php.

CVE-2005-2659

CVE-2005-2659 is a buffer overflow in the LZX decompression path of CHM Lib (chmlib) 0.35, used by KchmViewer. Root cause: overflow in LZX decompression. The impact and attack vectors are described as unknown in initial sources; later advisories (Debian DSA-886-1 and related OpenVAS entries) refe...

CVE-2005-3579

CVE-2005-3579 affects ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier. The vulnerability allows remote attackers to access arbitrary local files by manipulating the querystring. Public references (NVD) confirm the affected product/version and the local-file-access impact. No exploit code or...