CVE-2005-0850

FileZilla FTP server before 0.9.6 allows remote attackers to cause a denial of service via a request for a filename containing an MS-DOS device name such as CON, NUL, COM1, LPT1, and others...

CVE-2005-0418

CVE-2005-0418 is an argument-injection vulnerability in Java Web Start for J2SE 1.4.2 (up to 1.4.2_06) on Mac OS X. The flaw allows an untrusted JNLP file to inject values via a property tag, enabling privilege escalation. Connected entries also reference CVE-2005-0836, which describes a related ...

CVE-2005-0850

Vulnerability summary (CVE-2005-0850): FileZilla FTP Server prior to 0.9.6 is susceptible to denial of service when a client requests a filename containing MS-DOS device names (e.g., CON, NUL, COM1, LPT1). The issue is confirmed in multiple security feeds, and related Nessus findings also describ...

CVE-2005-0402

CVE-2005-0402 affects Mozilla Firefox, where saving a page as a Firefox sidebar panel can allow an attacker to inject JavaScript into a privileged page, enabling remote code execution with the user’s privileges. The vulnerability concerns the Firefox sidebar panel feature; no exploitation details...

CVE-2005-0855

CVE-2005-0855 affects CoolForum 0.8.1 beta and earlier. The issue allows remote attackers to trigger PHP error messages via direct requests to eight PHP pages (entete.php, profile_accueil.php, profile_mdp.php, profile_notify.php, profile_options.php, profile_perso.php, profile_pm.php, readannonce...

CVE-2005-0857

CVE-2005-0857 describes a cross-site scripting (XSS) vulnerability in CoolForum 0.8 and earlier, where an attacker can inject arbitrary web script or HTML through the img parameter in avatar.php. The connected documents corroborate this XSS claim, with NVD listing the CVE and Tenable/Nessus plugi...

CVE-2005-0856

CoolForum 0.8.1 beta and earlier is affected by a SQL injection in requests to alert.php and viewip.php, allowing remote attackers to manipulate SQL commands. The issue is attributed to a likely input handling flaw in these endpoints, enabling partial/complete manipulation of queries as described...

CVE-2005-0399

CVE-2005-0399 describes a heap-based buffer overflow in GIF2.cpp used by Firefox (before 1.0.2), Mozilla (before 1.7.6), Thunderbird (before 1.0.2), and other apps sharing the same library. The vulnerability is triggered by a crafted GIF image containing a Netscape extension 2 block, allowing rem...

CVE-2005-0401

CVE-2005-0401 affects Mozilla Firefox 1.0.1 and Mozilla before 1.7.6. The issue arises from insufficient mitigation of attack vectors for loading chrome files and hijacking drag-and-drop events, enabling a remote attacker to execute arbitrary XUL code by tricking a user into dragging a scrollbar ...

CVE-2005-0847

CVE-2005-0847 affects Code Ocean FTP server 1.0; a flaw allows remote attackers to cause a denial of service via a large number of connections. The CVSS base score is 5.0 (Medium) with network attack vector, low complexity, no authentication, and partial availability impact. Exploit details are n...

CVE-2005-0864

The CVE-2005-0864 entry concerns the Boa web server, used in Samsung ADSL Modem SMDK8947v1.2 and possibly other products. The vulnerability allows remote attackers to read arbitrary files by supplying a full path in the HTTP request (path traversal). Reported impact is partial breach of confident...

CVE-2005-0846

CVE-2005-0846 affects NetWin SurgeMail 2.2g3 and describes multiple XSS vulnerabilities in the email auto-reply message, exploitable via the (1) message subject or (2) message header field to inject arbitrary web script/HTML. Exploitation details are not provided beyond this, but a remediation is...

CVE-2005-0863

PHPOpenChat v3.x contains an XSS vulnerability that allows remote attackers to inject arbitrary script/HTML through (1) chatter in regulars.php or (2) chatter, chatter1, chatter2, chatter3, or chatter4 in register.php. This can lead to client-side script execution and partial integrity impact wit...

CVE-2005-0851

CVE-2005-0851 affects the FileZilla FTP Server up to version 0.9.6. When using MODE Z (zlib compression), it can trigger a denial-of-service via certain file uploads or directory listings, causing an infinite loop. The vulnerability is associated with a NETWORK attack vector, with low complexity ...

CVE-2005-0853

betaparticle blog bp blog stores the database under the web root, which allows remote attackers to obtain sensitive information via a direct request to 1 dbBlogMX.mdb for versions before 3.0, or 2 Blog.mdb for versions 3.0 and later. NOTE: it was later reported that vector 2 also affects versions...

CVE-2005-0853

The CVE-2005-0853 entry concerns betaparticle blog (bp blog) where the database files are stored under the web root, enabling direct access to sensitive data via HTTP requests. Affected files are (1) dbBlogMX.mdb for versions before 3.0, or (2) Blog.mdb for versions 3.0 and later, with vector 2 a...

Interspire ArticleLive 2005 (php version) is vulnerable to XSS

Can you please confirm my suggestion that: Interspire ArticleLive 2005 php version is vulnerable to XSS: e.g. http://localhost/articles/newcomment?ArticleId="scriptalert'hi'/script // best wishes, mircia [email protected]...

SUSE-SA:2005:017: ImageMagick

The remote host is missing the patch for the advisory SUSE-SA:2005:017 ImageMagick. This update fixes several security issues in the ImageMagick program suite: - A format string vulnerability was found in the display program which could lead to a remote attacker being to able to execute code as t...

Non-administrators can shut down Windows XP SP1 thru TSShutdn.exe (889323)

The version of Microsoft Windows XP SP1 on the remote host is missing security update KB889323. A non-administrative user can remotely shut down the remote host by using the TSShutdn.exe command. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid17607;...

Critical: Red Hat Security Advisory: thunderbird security update

Updated thunderbird packages that fix various bugs are now available. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. A buffer overflow bug was found in the way Thunderbird processe...