CVE-2005-2453

CVE-2005-2453 describes a cross-site scripting (XSS) vulnerability in NetworkActiv Web Server. The affected products include Web Server versions 1.0, 2.0.0.6, 3.0.1.1, and 3.5.13, with the potential for injection of arbitrary web script or HTML via the query string. The connected documents corrob...

CVE-2005-2456

CVE-2005-2456 refers to an array index overflow in the Linux kernel 2.6, in xfrm_user.c within xfrm_sk_policy_insert. A local user can trigger the overflow by supplying a p->dir value larger than XFRM_POLICY_OUT, causing writes beyond sock->sk_policy and resulting in a kernel crash (DoS) an...

CVE-2005-2456

Array index overflow in the xfrmskpolicyinsert function in xfrmuser.c in Linux kernel 2.6 allows local users to cause a denial of service oops or deadlock and possibly execute arbitrary code via a p-dir value that is larger than XFRMPOLICYOUT, which is used as an index in the sock-skpolicy array...

CVE-2005-2453

Cross-site scripting XSS vulnerability in NetworkActiv Web Server 1.0, 2.0.0.6, 3.0.1.1, and 3.5.13, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the query string...

[SECURITY] [DSA 772-1] New apt-cacher package fixes arbitrary command execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 772-1 [email protected] http://www.debian.org/security/ Martin Schulze August 3rd, 2005 http://www.debian.org/security/faq -...

RHEL 4 : squirrelmail (RHSA-2005:595)

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:595 advisory. SquirrelMail is a standards-based webmail package written in PHP4. A bug was found in the way SquirrelMail handled the $POST variable. If a...

dump, rmt security update

CentOS Errata and Security Advisory CESA-2005:583-01 Updated dump packages that address two security issues are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having low security impact by the Red Hat Security Response Team. Dump examines files in a file system,...

Moderate: Red Hat Security Advisory: squirrelmail security update

An updated squirrelmail package that fixes two security issues is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Updated 04 Aug 2005 The previous SquirrelMail package released with this errata contained a bug which rendered the...

[SECURITY] [DSA 772-1] New apt-cacher package fixes arbitrary command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 772-1 [email protected] http://www.debian.org/security/ Martin Schulze August 3rd, 2005 http://www.debian.org/security/faq -...

CVE-2005-2448

CVE-2005-2448 : Endianness errors in libgadu used by ekg (centericq) allow remote denial of service on big‑endian systems. Public records tie this to Debian advisories DSA-813-1 and DSA-1318‑1, which describe fixes in the ekg package. Exploit details are not provided in the sources. Remediation: ...

CVE-2005-2449

CVE-2005-2449 describes a TOCTOU race condition in Gentoo’s sandbox prior to 1.2.11, enabling local users to create or overwrite arbitrary files via a symlink attack on sandboxpids.tmp. Connected advisories (Gentoo GLSA 200507-22) confirm a multiple TOCTOU issue in sandbox and give the remediatio...

CVE-2005-2452

libtiff up to 3.7.0 allows remote attackers to cause a denial of service application crash via a TIFF image header with a zero "YCbCr subsampling" value, which causes a divide-by-zero error in 1 tifstrip.c and 2 tiftile.c, a different vulnerability than CVE-2004-0804...

CVE-2005-2430

Multiple cross-site scripting XSS vulnerabilities in GForge 4.5 allow remote attackers to inject arbitrary web script or HTML via the 1 forumid or 2 groupid parameter to forum.php, 3 projecttaskid parameter to task.php, 4 id parameter to detail.php, 5 the text field on the search page, 6 groupid...

CVE-2005-2436

CVE-2005-2436 affects Website Baker Project. Affected functionality: browse.php allows remote disclosure of sensitive data. Root cause: error messages reveal the filesystem path when accessing (1) a non-existent dir parameter value or (2) direct requests to certain PHP files. Impact: partial conf...

CVE-2005-2132

RPC portmapper rpcbind in SCO UnixWare 7.1.1 m5, 7.1.3 mp5, and 7.1.4 mp2 allows remote attackers or local users to cause a denial of service lack of response via multiple invalid portmap requests...

CVE-2005-2447

...

CVE-2005-2418

CVE-2005-2418 is rejected/not used; duplicate of CVE-2005-2403.

CVE-2005-2132

RPC portmapper rpcbind in SCO UnixWare 7.1.1 m5, 7.1.3 mp5, and 7.1.4 mp2 allows remote attackers or local users to cause a denial of service lack of response via multiple invalid portmap requests...

CVE-2005-2427

CVE-2005-2427 describes a cross-site scripting (XSS) vulnerability in CartWIZ’s viewCart.asp, exploitable via the message parameter to inject arbitrary script/HTML. The connected documents confirm the affected component (viewCart.asp) and the vulnerability class (XSS) but do not provide product v...

CVE-2005-2435

CVE-2005-2435 affects Website Baker Project in browse.php, where the dir parameter is susceptible to cross-site scripting (XSS). The vulnerability arises from insufficient input handling/escaping of the dir parameter, allowing remote attackers to inject arbitrary web script or HTML. The existing ...