comersusv6.txt

--Alt-Boundary-27163.23868601 Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT Content-description: Mail message body Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Title: Comersus v6 Shopping Cart Sever Script injection Risk: High...

ocean12_xss_and_sql_inj.txt

Content-type: Multipart/Alternative; boundary="Alt-Boundary-17843.14003556" --Alt-Boundary-17843.14003556 Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Title: Ocean12 Membership Manager Pro : XSS and Sql injection Risk: High Date: 5/04/2005 Vendor:...

CVE-2005-1108

JunkBuster 2.0.2-r2 in single-threaded mode is affected by CVE-2005-1108. The vulnerability allows remote attackers to overwrite the referrer field in HTTP requests by sending a crafted request, enabling partial integrity impact as described in the CVE entry. The linked OpenVAS entries and NVD re...

CVE-2005-1109

CVE-2005-1109 affects JunkBuster (before 2.0.2-r3): the URL filtering fails, allowing remote attackers to cause an application crash (DoS) and possibly execute arbitrary code via heap corruption. Remediation: upgrade to 2.0.2-r3 or later, per public descriptions. Exploitation details are not prov...

CVE-2005-1150

The CVE-2005-1150 entry describes an unknown vulnerability in Sun Java System Web Server 6.0 SP7 and earlier when running on Windows, which can allow an attacker to cause a denial of service (hang). The available connected records corroborate the affected product and Windows-based DoS impact but ...

CVE-2005-1118

CVE-2005-1118 describes a cross-site scripting (XSS) vulnerability in IISWebAgentIF.dll of the RSA Authentication Agent for Web 5.2. The flaw allows remote attackers to inject arbitrary web script or HTML via the postdata parameter. The CVE entry lists the affected product as RSA Authentication A...

CVE-2005-1124

CVE-2005-1124 affects Solaris 7–9 where the libgss Generic Security Services Library is vulnerable. The issue allows local users to gain privileges by loading their own GSS-API, with partial impact to confidentiality, integrity, and availability (per CVSS). The exploitation status and concrete fi...

CVE-2005-1138

CVE-2005-1138 refers to an unknown vulnerability in the WebMail component of Kerio MailServer prior to 6.0.9 that can cause a denial of service via certain e‑mail messages. Multiple sources (NVD, CVE List, and Nessus plugin) describe it as a resource exhaustion/CPU consumption issue when malforme...

CVE-2005-1117

CVE-2005-1117 concerns All4WWW-Homepagecreator 1.0a, where index.php is vulnerable to PHP remote file inclusion via manipulation of the site parameter to reference a remote URL. The underlying issue is unsafe inclusion of external PHP code, enabling arbitrary code execution on the server. The NVD...

CVE-2005-1121

CVE-2005-1121 affects Oops! Proxy Server up to version 1.5.23. A format string vulnerability in the my_xlog function (lib.c), triggered via the passwd_mysql and passwd_pgsql authentication modules, may allow an attacker to execute arbitrary code remotely by crafting a URL. The CVSS v2 base score ...

CVE-2005-1142

Heap-based buffer overflow in the readpgm function in pnm.c for GOCR 0.40, when it is not using netpbm, allows remote attackers to execute arbitrary code via a P3 format PNM file with more data than implied by its width and height values...

CVE-2005-1115

CVE-2005-1115 refers to multiple XSS flaws in Photo Album 2.0.53 module for phpBB. The vulnerabilities arise when user-supplied input is not properly sanitized, allowing remote attackers to inject arbitrary script or HTML via the bsid parameter to the scripts album_cat.php and album_comment.php. ...

CVE-2005-1137

Simple PHP Blog sphpBlog 0.4.0 allows remote attackers to obtain sensitive information via a direct request to sbfunctions.php, which leaks the full pathname in a PHP error message...

CVE-2005-1122

The CVE-2005-1122 entry concerns the Monkey HTTP Server component monkeyd, specifically a format string vulnerability in cgi.c prior to version 0.9.1. A remote attacker can trigger a denial of service and potentially arbitrary code execution by sending an HTTP GET request containing double-encode...

CVE-2005-1125

CVE-2005-1125 describes a race condition in the Libsafe library (versions up to 2.0.16) that can occur in multi-threaded applications. The issue allows an attacker to bypass Libsafe protection and potentially trigger other vulnerabilities before the _libsafe_die function completes. Public details...

CVE-2005-1130

Pinned: CVE-2005-1130 is an XSS vulnerability in Pinnacle Cart (PHP) where the index.php script fails to sanitize the pg parameter, allowing arbitrary HTML/script injection. Affected component: Pinnacle Cart index.php; entry points: pg parameter. Reported exploitability is remote with no authenti...

CVE-2005-1141

GOCR 0.40 is affected by an Integer overflow in the readpgm function of pnm.c when using the netpbm library, allowing remote attackers to potentially execute arbitrary code via a specially crafted PNM file with large width/height, resulting in a heap-based buffer overflow. Affected component: GOC...

CVE-2005-1142

CVE-2005-1142: Heap-based buffer overflow in GOCR 0.40’s readpgm (pnm.c) when not using netpbm; a specially crafted P3 PNM file with more data than implied by width/height allows remote code execution. Severity is high (CVSS v2 base 7.5); exploitation status is not detailed in the provided docume...

CVE-2005-1129

The CVE-2005-1129 entry applies to eGroupWare 1.0.6 and earlier. If an e-mail is composed with an attachment but not sent, the system may send that attachment in the next e-mail, potentially exposing sensitive information to the wrong recipient. Affected component: the e-mail/attachment handling ...

CVE-2005-1110

The CVE-2005-1110 entry describes a stack-based buffer overflow in the RespondeHTTPPendiente function of SUMUS 0.2.2’s HTTP server. A large packet sent to TCP port 81 can allow remote attackers to execute arbitrary code. The NVD entry lists a CVSSv2 base score of 7.5 (HIGH) with network access, l...