CVE-2005-1570

CVE-2005-1570 affects forum.asp in bttlxeForum 2.0. The vulnerability allows remote attackers to obtain full path information via a hex-encoded argument to the page parameter, with the description suggesting this may be due to a SQL injection vulnerability. The documents do not provide concrete e...

CVE-2005-1565

CVE-2005-1565 affects Bugzilla versions 2.17.1–2.18 and 2.19.1–2.19.2. When a user is prompted to log in while viewing a chart, Bugzilla may display the password in the URL, potentially allowing local users to access sensitive information via web logs or browser history. The provided documents do...

CVE-2005-1586

Quick.Forum 2.1.6 is affected by a vulnerability where sensitive data (usernames, banned IP addresses, censored words, and backups) is stored under the web document root and can be obtained by direct requests to (1) db/users.txt, (2) db/banList.txt, (3) db/censureWords.txt, or (4) backup files. R...

CVE-2005-1584

The CVE-2005-1584 entry describes a Cross-site scripting (XSS) vulnerability in Quick.Forum 2.1.6, exploitable via the topic field in a NewTopic action within index.php. The underlying issue is an XSS allowance in the input handling, enabling remote attackers to inject arbitrary web script or HTM...

CVE-2005-1574

CVE-2005-1574 affects Windows Media Player versions 9 and 10, where WMDRM-protected content could redirect users to a licensing Web site even if the auto-license setting is disabled. The connected sources describe the impact as a license-redirect vulnerability within WMDRM, but do not provide dee...

CVE-2005-1578

EnCase Forensic Edition 4.18a is affected by CVE-2005-1578, which describes that the product does not support Device Configuration Overlays (DCO). The underlying impact is that DCO non-support could allow an attacker to hide information without detection, with a CVSSv2 base score of 2.1 (LOW) and...

CVE-2005-1545

CVE-2005-1545 affects ht, a viewer/editor/analyser for executables. The vulnerability is an integer overflow in ht's ELF parser that can be triggered by a crafted ELF file, causing a heap-based buffer overflow and allowing arbitrary code execution. Debian/GLSA advisories note fixes in ht versions...

CVE-2005-1544

CVE-2005-1544 describes a stack-based buffer overflow in libTIFF prior to 3.7.2, triggered while processing a TIFF file with a malformed BitsPerSample tag. This allows remote attackers to execute arbitrary code. The OpenVAS and distro advisories (e.g., Debian DSA-755-1, Ubuntu USN-130-1, Mandrake...

CVE-2005-1580

BoastMachine 3.0 is affected by an arbitrary file upload via users.ini.php due to improper file type restriction, enabling remote code execution. Connected records also indicate a vulnerability class lasting into newer versions; remediation noted in Nessus: upgrade to BoastMachine 3.1 or later to...

CVE-2005-1562

CVE-2005-1562 affects MaxWebPortal 1.3.5 and earlier. The vulnerability is due to multiple SQL injection flaws in ASP components, allowing remote attackers to execute arbitrary SQL commands via specific parameters: fpassword (inc_functions.asp), txtAddress, message, or subject (post_info.asp), an...

Xerox Document Centre Web Server Unspecified Unauthorized Access (XRX05-003)

According to its model number and software version, the remote host is a Xerox Document Centre or WorkCentre device with an embedded web server that could allow unauthorized access to the web server directory structure, which in turn could enable a remote attacker to gain access rights and to mak...

CVE-2005-0758

zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script...

CVE-2005-0758

The CVE-2005-0758 issue affects gzip prior to 1.3.5, where zgrep does not properly sanitize file arguments, allowing local users to inject filenames into a sed script and execute arbitrary commands. Connected advisories confirm related issues (CVE-2005-0988 and CVE-2005-1228) in gunzip/bzip2 work...

CVE-2005-0972

CVE-2005-0972 corresponds to an integer overflow in the Mac OS X 10.3.9 and earlier searchfs system call, enabling a local attacker to execute arbitrary code via crafted parameters. The issue affects Mac OS X 10.3.x up to 10.3.9 and is documented across multiple sources (NVD, Red Hat CVE entry, C...

CVE-2005-1579

Apple QuickTime Player 7.0 on Mac OS X 10.4 allows remote attackers to obtain sensitive information via a .mov file with a Quartz Composer composition .qtz file that uses certain patches to read local information, then other patches to send the information to the attacker...

CVE-2005-1531

CVE-2005-1531 affects Mozilla Firefox <= 1.0.3 and Mozilla Suite

CVE-2005-0973

CVE-2005-0973 affects Mac OS X 10.3.9 and earlier. The issue is in the setsockopt system call and allows local users to cause a denial of service via crafted arguments, resulting in memory exhaustion. In the connected documents, the description consistently states a local, memory-exhaustion impac...

CVE-2005-1532

Firefox before 1.0.4 and Mozilla Suite before 1.7.8 do not properly limit privileges of Javascript eval and Script objects in the calling context, which allows remote attackers to conduct unauthorized activities via "non-DOM property overrides," a variant of CVE-2005-1160...

CVE-2005-0969

CVE-2005-0969 affects Mac OS X prior to 10.3.9: a heap-based buffer overflow in the syscall emulation functionality allows local users to trigger a denial of service (kernel panic) and potentially execute arbitrary code via crafted parameters. Remediation documented in Mac OS X 10.3.9; users shou...

CVE-2005-0974

CVE-2005-0974 concerns Mac OS X 10.3.9 and earlier, where an issue in the nfs_mount call is described as an unknown vulnerability that allows local users to gain privileges via crafted arguments. This is documented across multiple sources (NVD, CVE List) with the same description. The available c...