CVE-2005-2154

CVE-2005-2154 concerns osTicket prior to or including 1.3.1 beta, where a PHP Local File Inclusion (LFI) flaw exists in the scripts view.php and open.php . The vulnerability arises from unsafely handling the inc parameter, enabling remote attackers to include and potentially execute arbitrary loc...

CVE-2005-2151

spf.c in Courier Mail Server does not properly handle DNS failures when looking up Sender Policy Framework SPF records, which could allow attackers to cause memory corruption...

CVE-2005-2147

CVE-2005-2147 concerns Trac prior to 0.8.4. Multiple connected sources confirm a flaw where an attacker can read or upload arbitrary files by supplying a full pathname in the id parameter to the upload or attachment viewer scripts. The vulnerability enables remote access to files and, in some con...

CVE-2005-2160

IMail stores usernames and passwords in cleartext in a cookie, which allows remote attackers to obtain sensitive information...

CVE-2005-2161

The CVE-2005-2161 entry covers a cross-site scripting (XSS) vulnerability in phpBB 2.0.16 that allows remote attackers to inject arbitrary script or HTML via nested [url] tags. Connected sources confirm phpBB2 exposure and the Debian security advisory DSA-768-1 (and related Debian/NVD entries) de...

CVE-2005-2156

CVE-2005-2156 describes a SQL injection in PHPNews 1.2.5 via the prevnext parameter in news.php. A remote attacker could exploit this to influence database queries and potentially expose information. Related advisories corroborate exploitation potential and indicate the issue affects PHPNews prio...

CVE-2005-2169

CVE-2005-2169 is a directory traversal vulnerability in Quick & Dirty PHPSource Printer 1.1 and earlier. The flaw allows remote attackers to read arbitrary files by supplying evil ".../...//" sequences in the file parameter, which are reduced to "../" by a regex, enabling access to parent directo...

CVE-2005-2166

SQL injection vulnerability in index.php in Plague News System 0.6 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter...

CVE-2005-2148

Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks, which allows remote attackers to execute arbitrary commands or SQL by sending a legitimate value in a POST request or cookie, then specifying the attack string in the URL, which causes the...

CVE-2005-2166

CVE-2005-2166 targets Plague News System (version 0.6 and earlier). The vulnerability is a SQL injection in index.php via the cid parameter, enabling remote attackers to execute arbitrary SQL commands. Connected PT-2005-3098 notes affected versions and confirms no publicly known fix in newer vers...

CVE-2005-2149

config.php in Cacti 0.8.6e and earlier allows remote attackers to set the nohttpheaders switch, then modify session information to gain privileges and disable the use of addslashes to conduct SQL injection attacks...

phpBB < 2.0.17 Nested BBCode URL Tags XSS

According to its banner, the remote host is running a version of phpBB that fails to sanitize BBCode containing nested URL tags, which enables attackers to cause arbitrary HTML and script code to be executed in a user's browser within the context of the affected site. %NASLMINLEVEL 70300 C Tenabl...

Fedora Core 3 : php-4.3.11-2.6 (2005-517)

This update includes the PEAR XMLRPC 1.3.1 package, which fixes a security issue in the XMLRPC server implementation. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the name CVE-2005-1921 to this issue. The bundled version of shtool is also updated, to fix some...

PT-2005-2872 · Ekg · Ekg

Name of the Vulnerable Software and Affected Versions: ekg versions 2005-06-05 and earlier Description: The issue allows local users to overwrite or create arbitrary files via a symlink attack on temporary files. This is related to the linki.py component in ekg. Recommendations: For ekg versions...

FreeBSD-SA-05:16.zlib

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-05:16.zlib Security Advisory The FreeBSD Project Topic: Buffer overflow in zlib Category: core Module: libz Announced: 2005-07-06 Credits: Tavis Ormandy Affects:...

Debian DSA-737-1 : clamav - remote denial of service

A number of potential remote denial of service vulnerabilities have been identified in ClamAV. In addition to the four issues identified by CVE ID above, there are fixes for issues in libclamav/cvd.c and libclamav/message.c. Together, these issues could allow a carefully crafted message to crash ...

GlobalSCAPE Secure FTP Server User Input Overflow

The remote host is running GlobalSCAPE Secure FTP Server. GlobalSCAPE Secure FTP Server 3.0.2 and prior versions are affected by a buffer overflow due to mishandling the user-supplied input. An attacker would first need to authenticate to the server before they can execute arbitrary commands...

Fedora Core 4 : php-5.0.4-10.3 (2005-518)

This update includes the PEAR XMLRPC 1.3.1 package, which fixes a security issue in the XMLRPC server implementation. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the name CVE-2005-1921 to this issue. The bundled version of shtool is also updated, to fix some...

[SECURITY] [DSA 738-1] New razor packages fix potential DOS

------------------------------------------------------------------------ Debian Security Advisory DSA 738-1 [email protected] http://www.debian.org/security/ Michael Stone July 05, 2005 http://www.debian.org/security/faq - ------------------------------------------------------------------------...

php security update

CentOS Errata and Security Advisory CESA-2005:0705-001 Merged security bulletin from advisories: https://lists.centos.org/pipermail/centos-announce/2005-July/074075.html https://lists.centos.org/pipermail/centos-announce/2005-July/074076.html Affected packages: php php-bcmath php-dba php-devel...