CVE-2005-0800

PHP remote file inclusion vulnerability in install.php in mcNews 1.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the l parameter to reference a URL on a remote web server that contains the code, a different vulnerability than CVE-2005-0720...

CVE-2005-0799

MySQL 4.1.9, and possibly earlier versions, allows remote attackers with certain privileges to cause a denial of service application crash via a use command followed by an MS-DOS device name such as 1 LPT1 or 2 PRN...

CVE-2005-0782

CVE-2005-0782 is a cross-site scripting (XSS) vulnerability in paFileDB 3.1 and earlier, affecting viewall.php and category.php. The start parameter to pafiledb.php enables remote attackers to inject arbitrary script/HTML. The NVD entry notes MEDIUM impact (I partial) with CVSS v2.0 base score 4....

CVE-2005-0804

CVE-2005-0804 affects MailEnable 1.8. The issue is a format string vulnerability in the mailto field that allows remote attackers to cause a denial of service (application crash) by supplying format specifiers. Connected documents confirm the vulnerability exists in MailEnable 1.8 and describe a ...

CVE-2005-0776

CVE-2005-0776 affects PhotoPost PHP 5.0 RC3, where adm-photo.php does not properly verify administrative privileges before manipulating photos. This could allow remote attackers to modify other users’ photos. The vulnerability details are described in multiple sources (e.g., NVD entry), but the p...

CVE-2005-0808

Apache Tomcat before 5.x is affected by a remote denial-of-service vulnerability triggered by a crafted AJP12 packet to TCP port 8007, which can cause the application to crash or stop responding. The vulnerability is attributed to handling of AJP12 input (malformed/input handling). Affected compo...

CVE-2005-0775

CVE-2005-0775 affects PhotoPost PHP 5.0 RC3 where the reportpost action in misc.php fails to limit logging data sent to the administrator, enabling remote attackers to flood the admin with email. The NVD lists a CVSS v2 base score of 7.5 (HIGH) with network access, low attack complexity, and no a...

CVE-2005-0801

CVE-2005-0801 describes a directory traversal vulnerability in the web application component includer.cgi of The Includer . The issue allows remote attackers to read arbitrary files by supplying directory traversal sequences (.. or a full pathname) in the URL, compromising confidentiality. The pr...

CVE-2005-0793

Summary: The provided documents describe a PHP remote file inclusion (RFI) vulnerability in ZPanel, affecting zpanel.php and related template code. The issue arises from insufficient sanitization of user-supplied input in the page parameter (and, for templates/ZPanelV2/template.php, the body para...

CVE-2005-0810

CVE-2005-0810: NotifyLink contains SQL injection vulnerabilities affecting NotifyLink Server (pre-3.0). Unauthenticated remote attackers can append SQL via various URLs to view/modify the NotifyLink SQL database; impact includes unauthorized user creation, password changes, and data exposure. The...

CVE-2005-0777

PhotoPost PHP 5.0 RC3 is affected by multiple XSS vulnerabilities. Specifically, remote attackers can inject arbitrary script or HTML via (1) the check_tags function and (2) the editbio field in the user profile. The issues arise from unsanitized input in these areas, enabling reflected or stored...

CVE-2005-0796

CVE-2005-0796 is a directory traversal vulnerability in HolaCMS 1.4.9-1. An attacker can overwrite arbitrary files by injecting a path like holaDB/votes/.. into the vote_filename parameter, bypassing the directory check. The NVD entry documents this vulnerability and its impact as partial integri...

CVE-2005-0778

CVE-2005-0778 affects PhotoPost PHP 5.0 RC3. The vulnerability arises because the upload handling does not fully verify that a file is an image, allowing remote attackers to inject arbitrary Javascript by uploading non-image files with image extensions (e.g., .gif). This results in a potential XS...

CVE-2005-0788

CVE-2005-0788 affects LimeWire versions 4.1.2 through 4.5.6, where improper handling of Gnutella GET requests allows remote attackers to read arbitrary files by specifying a full pathname. The coupled issue CAN-2005-0788 (and CAN-2005-0789 for magnet requests) enables directory traversal/read acc...

CVE-2005-0643

CVE-2005-0643 (and related CVEs) describe a buffer overflow in McAfee Scan Engine 4320 when parsing LHA archives. The vulnerability is triggered by crafted LHA files; DAT versions before 4357 (CVE-2005-0643) and before 4436 (CVE-2005-0644) are affected. Exploitation can lead to remote code execut...

CVE-2005-0774

CVE-2005-0774 affects PhotoPost PHP 5.0 RC3. The SQL injection occurs in member.php (and possibly other scripts) via the uid parameter, enabling remote attackers to execute arbitrary SQL commands. This is reported as a high-severity issue (CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:P). Connected docum...

CVE-2005-0821

Unknown vulnerability in Citrix MetaFrame Conferencing Manager 3.0 allows conference members to bypass organizer restrictions to control the keyboard and mouse...

CVE-2005-0811

CVE-2005-0811 concerns the NotifyLink 3.0 web interface, where authenticated users can bypass GUI-enabled access restrictions by issuing direct requests to restricted URLs. The underlying issue is ineffective server-side access control for features that are disabled in the user interface, enablin...

CVE-2005-0789

Summary: CVE-2005-0789 is a directory traversal vulnerability in LimeWire 3.9.6–4.6.0 that lets remote attackers read arbitrary files via a .. in a magnet request. The affected component is LimeWire’s handling of magnet/Gnutella requests; the underlying issue is directory traversal in user-contro...

CVE-2005-0780

CVE-2005-0780 affects paFileDB 3.1 and earlier, where remote attackers can trigger PHP errors via direct requests to auth.php, login.php, category.php, file.php, team.php, license.php, custom.php, admins.php, or backupdb.php, revealing the server path and potentially sensitive information. The pu...