CVE-2005-3138

CVE-2005-3138 affects Bugzilla 2.18rc1–2.18.3, 2.19–2.20rc2, and 2.21. An unauthorized remote attacker can retrieve sensitive information (e.g., the list of installed products) through the config.cgi endpoint, which remains accessible even when the requirelogin parameter is set. The underlying is...

CVE-2005-3143

CVE-2005-3143 affects the Mailbox Server for 4D WebStar prior to 5.3.5. It allows denial-of-service (crash) via IMAP clients on Mac OS X Mail 2. The NVD/Nessus entries document the issue; no exploitation details are provided in the connected documents, and no remediation details are stated here.

CVE-2005-3142

The connected advisory CPAI-2005-306 documents a heap-based buffer overflow in the Kaspersky Antivirus library used by KAV/AV scanner products when processing CAB archives. Root cause: insufficient boundary checks on user-supplied data during archive processing. Impact: remote code execution and ...

CVE-2005-0023

gnome-pty-helper in GNOME libzvt2 and libvte4 allows local users to spoof the logon hostname via a modified DISPLAY environment variable. NOTE: the severity of this issue has been disputed...

CVE-2005-3149

CVE-2005-3149 affects uim, specifically 0.4.x (before 0.4.9.1) and 0.5.0 and earlier, where LIBUIM_VANILLA is not handled correctly when linked into suid/sgid apps (e.g., immodule for Qt), enabling local privilege escalation. Public advisories from Debian (DSA-895-1), Gentoo GLSA 200510-03, Mandr...

CVE-2005-3153

Affected software: myBloggie 2.1.3 beta and earlier. Vulnerable component: login.php. Root cause / vector: remote attackers can bypass a whitelist regular expression and perform SQL injection via the username parameter when a null character is present, allowing injection into the query string. Th...

CVE-2005-3146

StoreBackup before 1.19 allows local users to perform unauthorized operations on arbitrary files via a symlink attack on temporary files...

CVE-2005-2960

Removed by vendor...

CVE-2005-3150

CVE-2005-3150 affects Weex, a non-interactive FTP client used for updating web pages. The vulnerability is a format string bug in Weex that could allow remote code execution when processing filenames, as described in multiple sources. Debian and Gentoo advisories cite fixes in older branches and ...

CVE-2005-0023

CVE-2005-0023 affects gnome-pty-helper within GNOME libzvt2 and libvte4. The root cause is a vulnerability where a modified DISPLAY environment variable allows local users to spoof the logon hostname. Implications are limited to local access with partial confidentiality/availability impact as des...

CVE-2005-3146

StoreBackup before 1.19 allows local users to perform unauthorized operations on arbitrary files via a symlink attack on temporary files...

CVE-2005-2758

CVE-2005-2758 affects Symantec AntiVirus Scan Engine (administrative web interface). The vulnerability is a buffer overflow caused by insufficient validation of HTTP header input, allowing remote code execution when a crafted request is sent to the web service port (default 8004) on affected vers...

CVE-2005-3151

Buffer overflow in blenderplay in Blender Player 2.37a allows attackers to execute arbitrary code via a long command line argument...

CVE-2005-0023

gnome-pty-helper in GNOME libzvt2 and libvte4 allows local users to spoof the logon hostname via a modified DISPLAY environment variable. NOTE: the severity of this issue has been disputed...

SUSE-SA:2005:057: opera

The remote host is missing the patch for the advisory SUSE-SA:2005:057 opera. This update upgrades the Opera web browser to the 8.50 release. Besides the changes in 8.50 that are listed in http://www.opera.com/docs/changelogs/linux/850/ following security problems were fixed: 1. Attached files ar...

Fedora Core 4 : kernel-2.6.12-1.1456_FC4 (2005-906)

Thu Sep 22 2005 Dave Jones 2.6.12-1.1456FC4 - Disable crash driver on Xen kernels. - Wed Sep 14 2005 Dave Jones 2.6.12-1.1455FC4 - Fixes for CVE-2005-2490 and CVE-2005-2492 - Thu Sep 8 2005 Rik van Riel - upgrade to a newer Xen snapshot - exclude Xen TPM bits, since those conflict with 2.6.12.5 -...

SUSE-SA:2005:053: squid

The remote host is missing the patch for the advisory SUSE-SA:2005:053 squid. This update of the Squid web-proxy fixes two remotely exploitable denial of service vulnerabilities. One can be triggered by aborting a request CVE-2005-2794 due to a faulty assertion. The other one occurs in...

Debian DSA-843-1 : arc - insecure temporary file

Two vulnerabilities have been discovered in the ARC archive program under Unix. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2005-2945 Eric Romang discovered that the ARC archive program under Unix creates a temporary file with insecure permissions...

Fedora Core 3 : HelixPlayer-1.0.6-0.fc3.1 (2005-941)

This is a fix for CVE-2005-2710 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

GLSA-200509-11 : Mozilla Suite, Mozilla Firefox: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200509-11 Mozilla Suite, Mozilla Firefox: Multiple vulnerabilities The Mozilla Suite and Firefox are both vulnerable to the following issues: Tom Ferris reported a heap overflow in IDN-enabled browsers with malicious Host: headers...