CVE-2005-2520

The CVE-2005-2520 entry concerns Mac OS X 10.4 through 10.4.2, where the password assistant used to create multiple accounts from the same process fails to reset the suggested password list when the assistant is displayed. This behavior can allow an attacker to view recently used passwords, repre...

CVE-2005-2517

Technical details about CVE-2005-2517 are not publicly available in the provided connected documents. Monitor for updates from vendor advisories; no additional affected products, impact, or fixes are disclosed here.

CVE-2005-2501

CVE-2005-2501 : A buffer overflow in Apple Mac OS X’s AppKit (handling of rich text, .rtf) could allow a remote attacker to execute arbitrary code on vulnerable systems. Affected: Mac OS X 10.3.9 and 10.4.2 (and apps using AppKit such as TextEdit). Root cause: overflow in AppKit’s RTF handling. I...

CVE-2005-2506

CVE-2005-2506 describes an algorithmic complexity vulnerability in CoreFoundation on Mac OS X 10.3.9 and 10.4.2. The issue arises in the handling of crafted Gregorian dates, allowing an attacker to trigger excessive CPU usage and cause a denial of service. The affected component is CoreFoundation...

CVE-2005-2507

CVE-2005-2507 is a buffer overflow in Apple Mac OS X Directory Services authentication (affecting Mac OS X 10.3.9 and 10.4.2) that may allow remote code execution. The root cause is a vulnerability in the Directory Services authentication routine that can be triggered by a crafted authentication ...

CVE-2005-2623

ECW-Shop 6.0.2 is affected. A remote attacker can specify a negative quantity for an item, causing the item price to be subtracted from the cart total, which impacts cart integrity. The NVD entry notes a base score of 5.0 (Medium) with the impact on integrity as PARTIAL and no confidentiality or ...

CVE-2005-2522

The CVE-2005-2522 issue affects Apple Mac OS X Safari/WebKit prior to Security Update 2005-007. Description from multiple sources confirms that Safari could directly access URLs inside PDF files, bypassing normal security checks, which may allow remote command execution. Affected range includes M...

CVE-2005-2624

CVE-2005-2624 affects CPAINT 1.3-SP. The vulnerability occurs when user-supplied cpaint_argument[] is fed directly into an eval statement in calculator.asp and cpaintfile.asp, allowing remote attackers to execute arbitrary ASP code. The root cause is eval-injection via unsanitized input. The publ...

CVE-2005-2627

Kismet is affected by CVE-2005-2627 (and CAN-2005-2626 noted in advisories). The issue involves multiple integer underflows in Kismet that can lead to remote code execution via heap-based overflows in two areas: kernel headers in PCAP data and data frame dissection. Debian and Gentoo/OpenVAS advi...

CVE-2005-2521

Technical details for CVE-2005-2521 are not present in the provided connected documents. Public information about affected components, root cause, impact or fixes is not available here. Monitor for updates from official advisories and vulnerability feeds.

CVE-2005-2510

The Server Admin tool in servermgripfilter for Mac OS X 10.4 to 10.4.2, when using multiple subnets and Address Groups, does not always properly write firewall rules to the Active Rules when certain conditions occur, which could result in firewall policies that are less restrictive than intended ...

CVE-2005-2515

The CVE-2005-2515 entry concerns Quartz Composer Screen Saver in Mac OS X 10.4.2. Affected component: the Screen Saver subsystem (Quartz Composer Screen Saver). Root cause / vulnerability: local users can access links from the RSS Visualizer even when a password is required, enabling partial conf...

CVE-2005-2518

CVE-2005-2518 corresponds to a buffer overflow in the Mac OS X Server component servermgrd during authentication on Mac OS X 10.3.9 and 10.4.2. The unspecified overflow may allow remote attackers to execute arbitrary code with the privileges of the servermgrd process. The vulnerability is address...

CVE-2005-2622

The CVE-2005-2622 entry concerns ECW-Shop 6.0.2. The affected component is index.php, with a vulnerability in the parameters (1) max and (2) ctg that allows cross-site scripting (XSS). The NVD entry lists a CVSSv2 base score of 4.3 (Medium) with network attack vector, requiring no authentication,...

CVE-2005-2511

CVE-2005-2511 affects Mac OS X 10.4.2 and earlier. The issue is described as an unknown vulnerability where, when using Kerberos authentication with LDAP, an attacker could gain access to a root Terminal window. The available documents do not specify an exact root cause, vulnerable component, aff...

CVE-2005-2504

The CVE-2005-2504 entry concerns Apple Mac OS X 10.4.2 System Profiler: a Bluetooth device is labeled with "Requires Authentication: No" despite the user enabling the "Require pairing for security" option, potentially confusing users about which setting is valid. The available documents state the...

CVE-2005-2503

Affected software: AppKit on Mac OS X 10.3.9 and 10.4.2. Vulnerability: allows attackers with physical access to create local accounts by forcing a specific error at the login window. Impact/conditions: local access; described CVSS as local, with partial confidentiality, integrity, and availabili...

CVE-2005-2127

CVE-2005-2127 is a remote code-execution vulnerability in Internet Explorer 5.01/5.5/6 related to memory corruption when instantiating certain COM objects not designed for IE. The issue, documented as COM Object Instantiation Memory Corruption, affects multiple CLSIDs (e.g., Msdds.dll, Blnmgrps.d...

CVE-2005-2508

The CVE-2005-2508 entry concerns Mac OS X 10.4.2, where dsidentity in Directory Services allows local users to add or remove user accounts. The vulnerability is a local privilege-abuse issue affecting the Directory Services component; exploitation would occur on systems with local access. Remedia...

CVE-2005-2626

Kismet (before 2005-08-R1) is affected by CVE-2005-2626 and CVE-2005-2627 for insecure handling of unprintable SSID characters and multiple integer underflows that could allow remote code execution. Public advisories (Debian DSA-788-1, GLSA 200508-10, Debian DSAs) document remote exploitation vec...