CVE-2005-1078

CVE-2005-1078 affects XAMPP 1.4.x with multiple default or null passwords. The underlying issue is default credentials in the XAMPP installation, allowing an attacker to gain privileges (attack vector: network; authentication: none; impact: partial confidentiality, integrity, and availability). T...

CVE-2005-1079

The CVE-2005-1079 entry describes a SQL injection in zOOm Media Gallery 2.1.2 through the catid parameter in index.php, allowing remote attackers to execute arbitrary SQL commands. Affected software: zOOm Media Gallery 2.1.2 (index.php vulnerability in catid). Root cause: unsafely concatenated us...

CVE-2005-1078

XAMPP 1.4.x has multiple default or null passwords, which allows attackers to gain privileges...

CVE-2005-1052

The vulnerability (CVE-2005-1052) affects Microsoft Outlook 2003 and Outlook Web Access 2003, where From header display fails to correctly render comma-separated addresses. This could enable remote email spoofing since the From field may appear to originate from a different address. Root cause: i...

CVE-2005-1042

The CVE-2005-1042 entry corresponds to an integer overflow in exif_process_IFD_TAG within PHP’s exif.c (pre-4.3.11), enabling possible remote code execution via an crafted IFD tag with a negative byte count. Connected records corroborate that PHP4/Exif-related components were affected and that mu...

CVE-2005-1072

The CVE-2005-1072 entry describes a Cross-site Scripting (XSS) vulnerability in PunBB versions prior to 1.2.5, allowing remote attackers to inject arbitrary web script or HTML. The description explicitly states the affected product and the vulnerability type, with the impact limited to injection ...

CVE-2005-1146

NOTE: this issue has been disputed by the vendor. Cross-site scripting XSS vulnerability in the login command in calendar.pl in CalendarScript 3.21 allows remote attackers to inject arbitrary web script or HTML via the username parameter, a different vulnerability than CVE-2005-1145...

CVE-2005-1080

Directory traversal vulnerability in the Java Archive Tool Jar utility in J2SE SDK 1.4.2 and 1.5, and OpenJDK, allows remote attackers to create or overwrite arbitrary files via a .. dot dot in filenames in a .jar file...

CVE-2005-1066

Pine 4.62 and earlier (University of Washington Pine) is affected by a race condition in rpdump that allows local users to overwrite arbitrary files via a symlink attack, leading to Local File Write. Root cause: race window in rpdump during file operations. Impact: potential overwriting of sensit...

CVE-2005-1067

CVE-2005-1067 describes a local privilege escalation in the Access_user Class prior to version 1.75, where an attacker can gain access as another user using the password “new.” The connected documents confirm this vulnerability but do not provide vendor/product specifics, affected versions beyond...

CVE-2005-1068

CVE-2005-1068 describes a Cross-site scripting (XSS) vulnerability in sCssBoard 1.11 and earlier. The issue allows remote attackers to execute arbitrary Javascript via [url] tags, indicating an input handling flaw that fails to sanitize or validate user-supplied URLs. The documents provide the af...

CVE-2005-1055

CVE-2005-1055 (TowerBlog): TowerBlog 0.6 and earlier stores the login data file under the web root, enabling remote access to the file via a direct request to the _dat/login path. This exposes MD5 checksums of usernames and passwords, constituting a partial confidentiality impact. The connected r...

CVE-2005-1059

CVE-2005-1059 affects Linksys WET11 1.5.4. The vulnerability allows remote attackers to change the device password without providing the original password by sending data to changepw.html, indicating an authentication/authorization weakness. The provided sources describe the exploit scenario and ...

CVE-2005-1070

CVE-2005-1070 describes a SQL injection in Invision Power Board 1.3.1 Final and earlier, occurring in index.php via the st parameter. The vulnerability allows remote attackers to execute arbitrary SQL commands and is indicated to affect versions up to 1.3.1 Final and earlier; specific impact and ...

CVE-2005-1074

CVE-2005-1074 : SQL injection in index.php for RadScripts RadBids Gold 2. An attacker can supply the mode parameter to remotely execute arbitrary SQL commands. Affected: RadScripts RadBids Gold 2; vulnerability arises in the index.php handling of mode. CVSSv2 base score 7.5 (HIGH) with network ac...

CVE-2005-1084

SQL injection vulnerability in sdating.php in aeDating 3.2 allows remote attackers to execute arbitrary SQL commands files via the event parameter...

CVE-2005-1084

The CVE describes an SQL injection in aeDating 3.2 involving sdating.php where the event parameter can be exploited by remote attackers to execute arbitrary SQL commands. Affected component: sdating.php within aeDating 3.2. Root cause: improper handling/sanitization of the event parameter leading...

CVE-2005-1046

CVE-2005-1046 is a vulnerability in KDE’s kimgio library used by KDE 3.4.0 (kdelibs/kimgio). A buffer overflow when processing PCX images allows remote attackers to execute arbitrary code. Impact is remote code execution with network access and no user interaction per the CVSS data. The public do...

CVE-2005-1080

The CVE-2005-1080 entry concerns a directory traversal vulnerability in the jar utility of the Java Archive Tool (Jar) used by J2SE SDK 1.4.2/1.5 and OpenJDK. The underlying issue allows a remote attacker to create or overwrite arbitrary files via a .. sequence in filenames stored inside a .jar f...

CVE-2005-1076

CVE-2005-1076 describes a cross-site scripting (XSS) vulnerability in the WebCT Campus Edition 4.1 discussion board, allowing an attacker to inject arbitrary script/HTML via the message field. The connected Red Hat and CVE-2008-1225 records corroborate XSS in WebCT 4.1.5.8 and note potential over...