10535 matches found
SOL4809 - tcpdump vulnerabilities - CAN-2005-1278, CAN-2005-1279, and CAN-2005-1280
F5 Networks Product Development tracked this issue as CR48152 and CR48153 and it was fixed in BIG-IP and 3-DNS version 4.5.13. This issue still exists in the BIG-IP and 3-DNS 4.6 software branch...
SUSE-SA:2005:033: spamassassin
The remote host is missing the patch for the advisory SUSE-SA:2005:033 spamassassin. The anti spam tool SpamAssassin was prone to a denial-of-service attack. A remote attacker could craft a MIME E-Mail message that would waste a lot of CPU cycles parsing the Content-Type header. This is tracked b...
[SECURITY] [DSA 761-1] New heartbeat packages fix insecure temporary files
-------------------------------------------------------------------------- Debian Security Advisory DSA 761-1 [email protected] http://www.debian.org/security/ Martin Schulze July 19th, 2005 http://www.debian.org/security/faq -...
CVE-2005-2304
The CVE-2005-2304 entry concerns Microsoft MSN Messenger 9.0 and Internet Explorer 6.0, where processing an image with an ICC Profile that has a large Tag Count can cause a denial of service (crash). The vulnerability is rooted in image handling in these products, enabling a remote attacker to tr...
CVE-2005-2303
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-1218. Reason: This candidate is a duplicate of CVE-2005-1218. Notes: All CVE users should reference CVE-2005-1218 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...
CVE-2005-2308
The CVE-2005-2308 entry affects Microsoft Internet Explorer's JPEG decoding component. The provided documents describe a denial-of-service condition (CPU consumption or crash) and the possibility of arbitrary code execution triggered by specially crafted JPEG images (examples: mov_fencepost.jpg, ...
CVE-2005-2306
The CVE describes a race condition in Macromedia JRun 4.0 and ColdFusion MX 6.1/7.0 where under heavy load JRun may assign a duplicate authentication token to multiple sessions. This could allow authenticated users to gain privileges as other users. Affected components include JRun 4.0 and ColdFu...
CVE-2005-2320
WebCalendar (PHP-based calendar) before 1.0.0 contains an access-control flaw in assistant_edit.php that can let remote attackers gain privileges. Affected versions are WebCalendar prior to 1.0.0; multiple advisories (Debian DSA-766-1, Red Hat CVE note) confirm an unauthorized-access/privilege di...
CVE-2005-2326
CVE-2005-2326 is a Cross-site scripting (XSS) vulnerability in Clever Copy 2.0 and 2.0a that allows remote attackers to inject arbitrary web script or HTML via the yr parameter to calendar.php. The NVD entry provides a MEDIUM severity (CVSSv2 base score 4.3) with network access and no authenticat...
CVE-2005-2319
CVE-2005-2319 describes a PHP remote file include vulnerability in the Yawp library (version 1.0.6 and earlier) as used in YaWiki and potentially other products. The issue allows attackers to include arbitrary files via the parameter _Yawp[conf_path] . Affected software: Yawp library 1.0.6 and ol...
CVE-2005-1850
Certain contributed scripts for ekg Gadu Gadu client 1.5 and earlier create temporary files insecurely, with unknown impact and attack vectors, a different vulnerability than CVE-2005-1916...
CVE-2005-2324
Cross-site scripting XSS vulnerability in Clever Copy 2.0 and 2.0a allows remote attackers to inject arbitrary web script or HTML via the searchtype or searchterm parameters to 1 results.php or 2 categorysearch.php...
CVE-2005-2317
Shorewall 2.4.x before 2.4.1, 2.2.x before 2.2.5, and 2.0.x before 2.0.17, when MACLISTTTL is greater than 0 or MACLISTDISPOSITION is set to ACCEPT, allows remote attackers with an accepted MAC address to bypass other firewall rules or policies...
CVE-2005-1851
CVE-2005-1851 affects the ekg Gadu-Gadu client and its contributed scripts. Umbrella advisories describe insecure temporary file handling and a shell command injection path in contributed scripts (including ekgbot-pre1.py), which could allow an attacker to execute arbitrary commands with the priv...
CVE-2005-2298
CVE-2005-2298 affects BitDefender Engine versions 1.6.1 and earlier. The issue arises because the scanner does not properly process all email attachments: begin and end commands in the message body are treated as a uuencoded attachment, causing scanning to stop prematurely. This allows remote att...
CVE-2005-2324
CVE-2005-2324 affects Clever Copy 2.0 and 2.0a. The vulnerability is a Cross-site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via the searchtype or searchterm parameters to (1) results.php or (2) categorysearch.php. The cited sources confirm the vulner...
CVE-2005-1850
CVE-2005-1850 concerns ekg Gadu Gadu client (contributed scripts) with insecure temporary file creation in version 1.5 and earlier. Connected entries also reference CVE-2005-1851 (potential shell command injection) and CVE-2005-1916 (insecure temp file creation plus arbitrary command execution) i...
CVE-2005-2311
CVE-2005-2311 affects SMS 1.9.2m and earlier. The vulnerability is a local file overwrite via a symlink attack on temporary files (request1 or request2), caused by improper handling of symbolic links in the temporary file paths. Impact is local privilege concerns (I = PARTIAL) with no confidentia...
CVE-2005-2318
Concrete details exist: CVE-2005-2318 is an XSS vulnerability in DVBBS 7.1 SP2, specifically in showerr.asp, exploitable via the action parameter. The issue allows remote injection of arbitrary script/HTML and is rated with CVSS v2.0 base metrics (AV:N/AC:M/Au:N/C:N/I:P/A:N; base score 4.3, MEDIU...