CVE-2005-1364

CVE-2005-1364 describes multiple SQL injection vulnerabilities in MetaBid Auctions that allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password fields in logIn.asp, or (3) intAuctionID parameter to item.asp. The initial and connected documents confirm a SQLi ...

CVE-2005-1356

The CVE-2005-1356 refers to a Cross-site scripting (XSS) vulnerability in the includer.cgi script of The Includer. The flaw allows remote attackers to inject arbitrary web script or HTML via the argument, enabling ability to execute/script content in a victim’s browser. The available references d...

CVE-2005-1349

CVE-2005-1349 affects the Perl Convert::UUlib (Convert-UUlib) library. A buffer overflow in the library’s handling of read parameters allows remote attackers to execute arbitrary code. Affected version range is prior to 1.051; upgrading to 1.051 fixes the issue (as cited by multiple advisories an...

CVE-2005-1345

CVE-2005-1345 affects Squid up to version 2.5.STABLE9, where missing or invalid http_access ACLs do not trigger a fatal error, potentially allowing broader access than intended. The initial description explicitly notes the ACL error in Squid’s http_access handling. Connected advisories identify a...

CVE-2005-1358

CVE-2005-1358 describes a vulnerability in a text.cgi script that allows remote attackers to execute arbitrary commands by injecting shell metacharacters in the argument. The provided documents do not specify the affected product, vendor, version, or root cause beyond the general command injectio...

CVE-2005-1357

The CVE-2005-1357 entry concerns a vulnerability in a text.cgi script that allows remote attackers to read arbitrary files by supplying a full pathname in the argument. The underlying flaw is unrestricted file access via the argument, enabling disclosure of sensitive data from the server. The con...

US-CERT Technical Cyber Security Alert TA05-117A -- Oracle Products Contain Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Technical Cyber Security Alert TA05-117A Oracle Products Contain Multiple Vulnerabilities Original release date: April 27, 2005 Last revised: -- Source: US-CERT Systems Affected From the Oracle Critical Patch Update - April 2005: Oracle Database 10g...

Debian DSA-717-1 : lsh-utils - buffer overflow, typo

Several security relevant problems have been discovered in lsh, the alternative secure shell v2 SSH2 protocol server. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CAN-2003-0826 Bennett Todd discovered a heap buffer overflow in lshd which could lead...

[SECURITY] [DSA 717-1] New lsh packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 717-1 [email protected] http://www.debian.org/security/ Martin Schulze April 27th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 717-1] New lsh packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 717-1 [email protected] http://www.debian.org/security/ Martin Schulze April 27th, 2005 http://www.debian.org/security/faq -...

CVE-2005-1321

The CVE-2005-1321 entry concerns the Horde Vacation module. Affected software: Horde Vacation prior to version 2.2.2. Vulnerability: Cross-site scripting (XSS) via the parent’s frame page title in the Vacation module. Impact: enables remote attackers to inject arbitrary web script or HTML. Root c...

CVE-2005-1320

CVE-2005-1320 affects Horde Mnemo Note Manager prior to 1.1.4. It is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the parent frame page title. Exploitation details are limited to this vector in the provided documents; there is ...

CVE-2005-1314

The vulnerability CVE-2005-1314 affects the Horde Kronolith module prior to version 1.1.4. It is an XSS in the web UI that allows a remote attacker to inject arbitrary script or HTML via the parent frame page title. Impact is cross-site scripting; the document does not provide exploitation detail...

CVE-2005-1344

CVE-2005-1344 describes a buffer overflow in Apache's htdigest (version 2.0.52) that could allow arbitrary code execution via a long realm argument. The advisory notes that htdigest is typically locally accessible and not setuid/setgid, so privilege escalation is unlikely unless htdigest is invok...

CVE-2005-1311

CVE-2005-1311 affects Yappa-NG prior to 2.3.2. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unknown vectors. According to the NVD entry, the issue has a CVSS v2 base score of 4.3 (Medium) with Network access, no aut...

CVE-2005-1325

CVE-2005-1325 affects phpMyVisites 1.3, where the file set_lang.php processes a mylang parameter in a way that allows remote attackers to read and include arbitrary files. The underlying flaw is the uncontrolled file handling via the mylang input, enabling arbitrary file access/inclusion. Documen...

CVE-2005-1327

CVE-2005-1327 is a cross-site scripting vulnerability in Woltlab Burning Board 2.3.1 PL2 and earlier, affecting the pms.php script where the folderid parameter is not sanitized. The issue allows remote attackers to inject arbitrary HTML/script that is executed in a user’s browser within the conte...

CVE-2005-1309

CVE-2005-1309 is an XSS vulnerability in bBlog 0.7.4 that allows remote attackers to inject arbitrary script or HTML via the entry title field or the comment body text. The weakness is confirmed in multiple sources (NVD entry with CVSSv2 base score 4.3, MEDIUM) and is echoed across related adviso...

CVE-2005-1319

CVE-2005-1319 describes a cross-site scripting (XSS) vulnerability in the Horde IMP Webmail client, affecting versions prior to 3.2.8. The root cause is unsanitized input used to set the parent frame page title, allowing remote attackers to inject arbitrary script/HTML. Public references (NVD, SU...

CVE-2005-1324

CVE-2005-1324 affects phpMyVisites via multiple XSS in index.php. The vulnerability allows remote attackers to inject arbitrary scripts/HTML through the (1) part, (2) per, or (3) site parameters. The issue originates from improper handling of user-supplied input in the index.php script, enabling ...