CVE-2005-0928

CVE-2005-0928 : Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP Pro 5.x allow remote injection of script/HTML via parameters to showgallery.php (cat, password, ppuser, sort, si), showmembers.php (ppuser, sort, si), or slideshow.php (photo). Affects PhotoPost PHP Pro 5.x; expl...

CVE-2005-0907

CVE-2005-0907 concerns multiple SQL injection vulnerabilities in Valdersoft Shopping Cart 3.0. The affected surface includes input vectors: (1) id in category.php, (2) id in item.php, (3) lang in index.php, (4) searchQuery in search_result.php, and (5) searchTopCategoryID in search_result.php. Th...

CVE-2005-0930

CVE-2005-0930 is a documented XSS vulnerability in Chatness versions up to 2.5.1, exploitable via message.php by supplying input in the user field or the message parameter. Affected software is Chatness (≤2.5.1); the underlying issue is cross-site scripting that allows an attacker to inject arbit...

CVE-2005-0900

CVE-2005-0900 affects marks.php in NukeBookmarks 0.6 for PHP-Nuke. Vulnerability: a remote attacker can obtain sensitive information by supplying an invalid (file or category) parameter, causing an error message that reveals the path. Product/version details are as described in the CVE entry; no ...

CVE-2005-0920

CVE-2005-0920: Bugtracker.NET 2.0.1 has multiple SQL injection vulnerabilities allowing remote attackers to execute arbitrary SQL commands via unknown vectors. The NVD metrics show a base score of 7.5 (HIGH) with Network attack vector and no authentication. Impact noted as partial confidentiality...

CVE-2005-0932

CVE-2005-0932 describes multiple SQL injection flaws in phpCOIN 1.2.1b and earlier, exploitable via the search engine, forgotten-password username/email fields, or the domain name in package orders. The underlying issue is unsafe SQL construction in these modules, enabling remote attackers to exe...

CVE-2005-0919

CVE-2005-0919 affects Adventia Chat 3.1 and Adventia Server Pro 3.0. The flaw allows remote attackers to inject arbitrary web script/HTML into the chat space, enabling cross-site scripting (XSS) among users. Reported impact is MEDIUM (CVSS 2.0: AV:N/AC:M/Au:N/C:N/I:P/A:N); exploitation would not ...

CVE-2005-0903

CVE-2005-0903 is a concrete vulnerability in Apple QuickTime PictureViewer (versions around 6.5.1, with advisories noting 6.5.2 as a fix). The issue is a buffer overflow in the PictureViewer component when parsing JPEG images containing crafted Huffman Table (DHT) data, enabling remote denial of ...

CVE-2005-0902

CVE-2005-0902 affects NukeBookmarks 0.6 for PHP-Nuke, with an SQL injection in marks.php via the category parameter that allows remote SQL execution. CVSS v2 base score 7.5 (HIGH); impact includes partial confidentiality, integrity, and availability. No remediation or exploit details are provided...

CVE-2005-0926

CVE-2005-0926 affects Sylpheed prior to 1.0.4. The vulnerability is a buffer overflow exploitable via attachments with MIME-encoded filenames, enabling remote attackers to crash the application and potentially execute arbitrary code. Documented impact: denial of service and possible code executio...

CVE-2005-0912

CVE-2005-0912 applies to the deplate project, affecting versions before 0.7.2. The available descriptions indicate unknown vulnerabilities with unknown impact, possibly involving elements.rb. No concrete exploit vectors, affected configurations, or remediation steps are provided in the supplied d...

CVE-2005-0921

CVE-2005-0921 affects Microsoft Outlook 2002 Connector for IBM Lotus Domino 2.0. The vulnerability allows local users to save passwords and login credentials locally, even when password caching is disabled by a group policy. The NVD metrics show a CVSS v2 base score of 4.6 (medium), with local at...

CVE-2005-0910

CVE-2005-0910 refers to multiple XSS vulnerabilities in exoops. The vulnerability allows remote attackers to inject arbitrary web script or HTML via (1) the sortdays parameter to viewforum.php or (2) the viewcat parameter to index.php. Affected software is exoops (specific version details are not...

CVE-2005-0904

CVE-2005-0904 affects Windows XP SP1 Remote Desktop. The issue is that the system does not verify the setting “Force shutdown from a remote system,” which allows a remote attacker to shut down the host by executing TSShutdn.exe. The vulnerability details in the connected data confirm this behavio...

CVE-2005-0893

CVE-2005-0893 affects Smail, specifically version 3.2.0.120, where modes.c implements signal handlers using certain unsafe library calls. The root cause described is that these unsafe calls in signal handlers can allow an attacker to execute arbitrary code via race conditions in the signal handli...

CVE-2005-0892

CVE-2005-0892 describes a buffer overflow in Smail 3.2.0.120 that enables remote attackers or local users to execute arbitrary code via a long string in MAIL FROM (and possibly other SMTP commands). Public records show Debian advisories fixing this flaw: 3.2.0.114-4woody1 (stable) and 3.2.0.115-7...

CVE-2005-0935

CVE-2005-0935 affects the ESMI PayPal Storefront. The provided documents describe multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands through two parameters: idpages in pages.php and id2 in products1.php. The affected software is the PayPal Storefr...

CVE-2005-0936

CVE-2005-0936 describes a cross-site scripting vulnerability in the PayPal Storefront component, specifically in the file products1h.php, where the id parameter can be abused to inject arbitrary web script or HTML. Affected software is indicated as ESMI PayPal Storefront; the vulnerability is cat...

CVE-2005-0898

CVE-2005-0898 describes a cross-site scripting (XSS) vulnerability in the PHP file downloadform.php of the E-Store Kit-2 PayPal Edition. The flaw allows remote attackers to inject arbitrary web script or HTML by supplying a crafted txn_id parameter, potentially impacting users who view the affect...

CVE-2005-0901

CVE-2005-0901 affects NukeBookmarks 0.6 for PHP-Nuke with multiple XSS vulnerabilities that allow remote attackers to inject arbitrary scripts via the catname, markname, comment, or category parameters. The NVD entry records a CVSS v2 base score of 4.3 (Medium) with network attack vector, no auth...