CVE-2005-1116

CVE-2005-1116 is a documented XSS vulnerability in the phpBB Calendar module. The issue allows remote attackers to inject arbitrary web script or HTML via the start parameter to calendar_scheduler.php. The affected component is the phpBB Calendar integration; the root cause is improper sanitizati...

CVE-2005-1119

CVE-2005-1119 affects Sudo VISudo 1.6.8 and earlier. The vulnerability arises from a symlink attack on temporary files, enabling local users to corrupt arbitrary files. Impact is local privilege concern (I = Partial) with no confidentiality/vitality impact, per available data. The provided docume...

CVE-2005-1126

CVE-2005-1126 is a kernel memory disclosure vulnerability tied to the SIOCGIFCONF (ifconf) path. In FreeBSD 4.x (4.0–4.11) and 5.x (5.0–5.4), the ifconf code may copy uninitialized kernel memory to user space because the buffer is not cleared before use, enabling local users to obtain portions of...

CVE-2005-1127

CVE-2005-1127 covers a format-string vulnerability in the log function of the perl-Net-Server module (versions ≤ 0.87) as used by Postfix Greylisting Policy Server (Postgrey) ≤ 1.18. The issue arises from format specifiers not being properly handled before sending to syslog, allowing remote attac...

CVE-2005-1131

CVE-2005-1131 affects Veritas i3 Focalpoint Server versions 7.1 and earlier. The vulnerability is described with unknown attack vectors and an impact described as 'critical' in the initial records, with NVD noting a network-attack vector (AV:N) and a base score of 10.0. The connected documents do...

CVE-2005-1132

CVE-2005-1132 affects the LG U8120 mobile phone. The vulnerability allows remote attackers to trigger a denial of service (device crash) by presenting a malformed MIDI file. The provided documents confirm the affected device and the impact but do not include explicit root-cause details, exploit c...

CVE-2005-1134

Serendipity (0.8 and earlier) is affected by an SQL injection in exit.php. The vulnerability allows remote attackers to inject arbitrary SQL via the url_id or entry_id parameters, risking data disclosure and modification. Root cause: unsafe handling of user-supplied input in SQL queries. CVSS2 ba...

CVE-2005-1143

EasyPHPCalendar vulnerability CVE-2005-1143: XSS in index.php via the yr parameter, affecting versions prior to 6.2.8. Remote code execution of arbitrary scripts/HTML possible as described. Remediation: upgrade to 6.2.8 or later. No exploitation details provided in the connected documents.

CVE-2005-1144

Summary : popup.php in EasyPHPCalendar before 6.2.8 is vulnerable to information disclosure via an invalid ev parameter, which reveals the web server’s full pathname in a PHP error message. Affected software : EasyPHPCalendar (prior to 6.2.8). Root cause : improper handling/display of the ev para...

CVE-2005-1150

Unknown vulnerability in Sun Java System Web Server 6.0 SP7 and earlier, when running on Windows systems, allows attackers to cause a denial of service hang...

CVE-2005-1123

CVE-2005-1123 affects the Monkey HTTP Daemon (monkeyd) before version 0.9.1. The vulnerability allows a remote attacker to cause a denial-of-service via a request for a zero-byte file, resulting in memory corruption. Public sources (Gentoo GLSA 200504-14 and Nessus entries) describe a DoS and, in...

CVE-2005-1135

The CVE-2005-1135 issue affects Simple PHP Blog (sphpBlog) 0.4.0, where the search.php script’s q parameter is not properly validated, enabling a remote attacker to inject arbitrary web script or HTML (XSS). The vulnerability is confirmed by the primary CVE entry and supports remediation guidance...

CVE-2005-1137

Vulnerability CVE-2005-1137 affects Simple PHP Blog (sphpBlog) 0.4.0. The issue arises when an attacker directly requests sb_functions.php and triggers a PHP error message that leaks the full filesystem pathname, exposing sensitive information. This is a server-side information disclosure vulnera...

CVE-2005-1146

CalendarScript 3.21 is affected by a Cross‑Site Scripting (XSS) flaw in the login command (calendar.pl) via the username parameter. The issue is documented as CVE-2005-1146 and is noted by some sources as disputed by the vendor. Connected sources also reference CalendarScript 3.21 alongside previ...

CVE-2005-1149

CVE-2005-1149 is a SQL injection flaw in aspclick.it ACNews 1.0, affecting admin/login.asp where the (1) username and (2) password parameters are unsafely handled. The Red Hat advisory echoes the same description, indicating remote attackers could execute arbitrary SQL commands. The available doc...

CVE-2005-1146

NOTE: this issue has been disputed by the vendor. Cross-site scripting XSS vulnerability in the login command in calendar.pl in CalendarScript 3.21 allows remote attackers to inject arbitrary web script or HTML via the username parameter, a different vulnerability than CVE-2005-1145...

CVE-2005-1113

CVE-2005-1113 corresponds to multiple cross-site scripting (XSS) flaws in PhpBB Plus 1.52 and earlier. The vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the bsid parameter to groupcp.php, index.php, portal.php, viewforum.php, or viewtopic.php; or via the c para...

CVE-2005-1133

The CVE-2005-1133 entry corresponds to the IBM iSeries AS/400 POP3 server that reveals whether a username exists by returning different error messages. This enables remote user enumeration (valid user IDs). Related Nessus data notes additional disclosure risk and lack of login throttling/brute-fo...

[SECURITY] [DSA 709-1] New libexif packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 709-1 [email protected] http://www.debian.org/security/ Martin Schulze April 15th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 709-1] New libexif packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 709-1 [email protected] http://www.debian.org/security/ Martin Schulze April 15th, 2005 http://www.debian.org/security/faq -...