CVE-2005-2109

This CVE (CVE-2005-2109) affects WordPress 1.5.1.2 and earlier. The vulnerability arises in wp-login.php where the forgotten-password email content can be altered by remote attackers due to an uninitialized message variable. The impact is that an attacker could modify the email message sent durin...

CVE-2005-2107

CVE-2005-2107 involves multiple XSS vulnerabilities in WordPress up to version 1.5.1.2, exploitable via the post.php parameters p and comment. The connected OpenVAS/OSV/NVD records confirm the affected product (WordPress) and the script injection vectors, describing remote execution of arbitrary ...

CVE-2005-2115

Soldier of Fortune II, versions 1.02x and 1.03, is affected by CVE-2005-2115. A remote attacker can cause a denial-of-service (server crash) by sending a large ID value to the ignore command, which is used as an array index and triggers an out-of-bounds operation. The provided documents do not in...

CVE-2005-2106

Drupal 4.5.0–4.6.1 contains a vulnerability that allows remote attackers to execute arbitrary PHP code via public comments or postings. Debian’s DSA-745-1 fixes this in 4.5.3-3; upgrade recommended to remediate.

CVE-2005-2116

...

CVE-2005-2108

CVE-2005-2108 affects WordPress 1.5.1.2 and earlier, with an SQL injection in the XMLRPC server. The vulnerability arises because input is not filtered in the HTTP_RAW_POST_DATA variable that stores XML data, allowing remote attackers to execute arbitrary SQL commands. The NVD entry lists a CVSSv...

CVE-2005-2105

CVE-2005-2105 : Affects Cisco IOS 12.2T through 12.4. A faulty RADIUS implementation allows remote attackers to bypass AAA RADIUS authentication when the fallback method is set to none by using a long username. This is a remote authentication bypass taking advantage of the none fallback configura...

CVE-2005-2110

CVE-2005-2110 affects WordPress 1.5.1.2 and earlier. It allows remote attackers to disclose sensitive information by accessing (1) a direct request to menu-header.php or (2) a feed parameter with value "1" to (a) wp-atom.php, (b) wp-rss.php, or (c) wp-rss2.php. These actions reveal the path in er...

CVE-2005-0393

CVE-2005-0393 affects crip, a terminal-based ripper/encoder/tagger tool. The advisory notes that crip 3.5 helper scripts do not securely use temporary files, allowing local users to exploit this in an insecure manner with unknown impact and attack vectors. The Debian DSA-733-1 and OpenVAS entry c...

CVE-2005-2108

SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the HTTPRAWPOSTDATA variable, which stores the data in an XML file...

[SECURITY] [DSA 735-1] New sudo packages fix pathname validation race

------------------------------------------------------------------------ Debian Security Advisory 735-1 [email protected] http://www.debian.org/security/ Michael Stone July 01, 2005 http://www.debian.org/security/faq - ------------------------------------------------------------------------...

Prevx Pro 2005 <= 1.0.0.1 Multiple Local Vulnerabilities

Binary data 3044.prm...

Advisory 02/2005: Remote code execution in Serendipity

Hardened PHP Project www.hardened-php.net -= Security Advisory =- Advisory: Remote code execution in Serendipity Release Date: 2005/06/29 Last Modified: 2005/06/29 Author: Christopher Kunz [email protected] Application: Serendipity = 0.8.2 Severity: Arbitrary remote code execution...

CVE-2005-1922

The MS-Expand file handling in Clam AntiVirus ClamAV before 0.86 allows remote attackers to cause a denial of service file descriptor and memory consumption via a crafted file that causes repeated errors in the climsexpand function...

CVE-2005-1690

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-1250. Reason: This candidate is a duplicate of CVE-2005-1250. Notes: this duplicate occurred as a result of multiple independent discoveries and insufficient coordination by the vendor and CNA. All CVE users should reference...

CVE-2005-2090

CVE-2005-2090 affects Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0): it enables HTTP Request Smuggling via a request containing both Transfer-Encoding: chunked and Content-Length, causing the body to be mis‑interpreted and processed as a new request. This issue is noted to hav...

CVE-2005-2088

The CVE-2005-2088 vulnerability affects the Apache HTTP Server when acting as an HTTP proxy. Specifically, versions before 1.3.34 and 2.0.x before 2.0.55 are susceptible. The issue arises from handling a request containing both Transfer-Encoding: chunked and Content-Length, causing the body to be...

CVE-2005-1931

CVE-2005-1931 affects GoodTech SMTP Server 5.14. A RCPT TO command with an invalid argument (e.g., 'A') can cause the server to crash, producing a denial of service. The issue is documented in multiple sources (NVD/NASL/Nessus) with the same impact. A remediation is available: upgrade to GoodTech...

CVE-2005-1922

ClamAV (clamav) before 0.86 is affected by an MS-Expand file handling vulnerability in cli_msexpand. A crafted file can cause repeated errors, leading to denial of service via resource exhaustion (file descriptors and memory). Affected product/version: ClamAV prior to 0.86. Remedy: upgrade to 0.8...

CVE-2005-2085

The CVE-2005-2085 entry describes a buffer overflow in Inframail Advantage Server Edition (Infradig Systems) 6.0–6.7. The SMTP server is vulnerable to a DoS via an excessively long MAIL FROM field (and the FTP server via a long NLST argument), reported as enabling remote crash and, per Nessus ref...