CVE-2005-2357

EMC Navisphere Manager 6.4.1.0.0 is affected by a directory traversal vulnerability exposed via HTTP requests, enabling remote attackers to read arbitrary files using a .. in the URL. Root cause: insufficient HTTP request validation allowing traversal. In iDEFENSE advisory, CAN-2005-2357 (and CAN...

CVE-2005-2571

FunkBoard 0.66CF (and possibly earlier) has an access-control flaw: the admin/mysql_install.php and admin/pg_install.php scripts are not properly restricted, allowing an attacker to obtain the database username and password or inject arbitrary PHP code into info.php. The issue is described as a l...

CVE-2005-2583

The CVE-2005-2583 entry describes a vulnerability in the Mentor ADSL-FR4II router (firmware 2.00.0111) where an undocumented web server running on TCP port 5678 can be accessed by local users to gain access. The available connected documentation confirms the affected device and the root cause as ...

CVE-2005-2565

CVE-2005-2565 concerns Gravity Board X (GBX) 1.1. The vulnerability is an information-disclosure in which error messages from several GBX pages (e.g., deletethread.php with a perm value, ban.php, addnews.php, banned.php, boardstats.php, adminform.php, /forms/admininfo.php, /forms/announcements.ph...

CVE-2005-2585

CVE-2005-2585 affects Mentor ADSL-FR4II router with firmware 2.00.0111. The issue is a denial-of-service condition caused by the router’s active TCP connections state table being consumed by a large number of connections (e.g., port scans). Other connected documents do not provide additional tech...

CVE-2005-2562

SQL injection vulnerability in Gravity Board X GBX 1.1 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the login field...

CVE-2005-2555

CVE-2005-2555 affects the Linux kernel 2.6.x line. The issue is that socket policy access is not properly restricted to users with the CAP_NET_ADMIN capability, potentially allowing local users to perform unauthorized activities. The vulnerability is associated with the IPv4 and IPv6 socket glue ...

CVE-2005-2581

Technical details (affected product, vulnerable component, impact, remediation) are not publicly provided in the supplied documents. Monitor for updates from official CVE records and security advisories.

BELL-CVE-2005-2555 CVE-2005-2555 does not affect BellSoft software

Bulletin has no description...

CVE-2005-2097

xpdf and kpdf do not properly validate the "loca" table in PDF files, which allows local users to cause a denial of service disk consumption and hang via a PDF file with a "broken" loca table, which causes a large temporary file to be created when xpdf attempts to reconstruct the information...

[Full-disclosure] Apple Mac Tiger 10.4 weblog server

------------------------------------------------------------ - EXPL-A-2005-010 exploitlabs.com Advisory 039 - ------------------------------------------------------------ - Mac OSX Server weblog - AFFECTED PRODUCTS ================= Mac OSX 10.4.0 Weblog Server http://apple.com OVERVIEW ========...

CVE-2005-1527

Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call...

CVE-2005-2498

PHPXMLRPC

CVE-2005-1527

Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call...

CVE-2005-1527

AWStats 6.4 and earlier are affected by an eval() injection when a URLPlugin is enabled, allowing remote attackers to execute arbitrary Perl code via the HTTP Referrer taint passed into an eval call. The issue is triggered by user-supplied data being evaluated, enabling remote code execution with...

CVE-2005-1527

Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call...

CVE-2005-1527

Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call...

Novell eDirectory iMonitor vulnerable to buffer overflow

Overview Novell eDirectory iMonitor contains a buffer overflow that can be remotely exploited to allow execution of arbitrary code or crash an affected system. Description Novell eDirectory iMonitor is a service for monitoring servers in an eDirectory installation. A buffer overflow exists in...

[Full-disclosure] Advisory 15/2005: PHPXMLRPC Remote PHP Code Injection Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened-PHP Project www.hardened-php.net -= Security Advisory =- Advisory: PHPXMLRPC Remote PHP Code Injection Vulnerability Release Date: 2005/08/15 Last Modified: 2005/08/15 Author: Stefan Esser [email protected] Application: PHPXMLRPC = 1.1....

rt-sa-2005-012.txt

Advisory: Pico Server pServ Local Information Disclosure RedTeam found a local information disclosure vulnerability in Pico Server pServ which results in a local user reading all files on the server with pServ's permissions. Details ======= Product: Pico Server pServ Affected Version: 3.3,...