CVE-2005-0698

PHP remote file inclusion vulnerability in PHPWebLog 0.5.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the 1 GPATH parameter to init.inc.php or the 2 PATH parameter to index.php to reference a URL on a remote web server that contains the code...

CVE-2005-0703

Xerox MicroServer Web Server for various WorkCentre products including M35/M45/M55 2.028.11.000 through 2.97.20.032 and 4.84.16.000 through 4.97.20.032, Pro 35/45/55 3.028.11.000 through 3.97.20.032, Pro 65/75/90 1.001.00.060 through 1.001.02.084, and others, has an "unauthenticated account," whi...

CVE-2005-0722

eXPerience2 allows remote attackers to obtain the full path for the web root via a direct request to modules.php without any parameters, which leaks the path in a PHP error message...

CVE-2005-0667

Buffer overflow in Sylpheed before 1.0.3 and other versions before 1.9.5 allows remote attackers to execute arbitrary code via an e-mail message with certain headers containing non-ASCII characters that are not properly handled when the user replies to the message...

CVE-2005-0397

Format string vulnerability in the SetImageInfo function in image.c for ImageMagick before 6.0.2.5 may allow remote attackers to cause a denial of service application crash and possibly execute arbitrary code via format string specifiers in a filename argument to convert, which may be called by...

CVE-2005-0677

index.php for Zorum 3.5 allows remote attackers to perform certain actions as other users by modifying the id parameter...

CVE-2005-0665

Format string vulnerability in xv before 3.10a allows remote attackers to execute arbitrary code via format string specifiers in a filename...

CVE-2005-0662

CVE-2005-0662 is an XSS vulnerability in MercuryBoard 1.1.2, occurring in index.php via the Avatar field. The affected component is MercuryBoard’s web interface; the root cause is improper sanitization of user-supplied data in the Avatar parameter, allowing injection of arbitrary script/HTML. Pub...

CVE-2005-0667

CVE-2005-0667 is a buffer‑overflow in Sylpheed’s header processing when replying to messages that contain non‑ASCII headers. Affected are Sylpheed before 1.0.3 and other versions before 1.9.5; successful exploitation can allow remote code execution with the user’s privileges. Several connected ad...

CVE-2005-0659

CVE-2005-0659 affects phpBB 2.0.13 and earlier. A direct request to oracle.php can disclose the installation path via a PHP error message, enabling remote disclosure of sensitive information. This mode provides the vulnerability description, affected software, and the underlying cause (path discl...

CVE-2005-0397

The CVE-2005-0397 issue affects ImageMagick and is caused by a format-string vulnerability in SetImageInfo() within image.c. It could allow remote attackers to crash the application (DoS) and potentially execute arbitrary code via format specifiers in a filename argument passed to convert, which ...

CVE-2005-0678

CVE-2005-0678 is a PHP remote file inclusion vulnerability in Form Mail Script (formmail.inc.php) for version 2.3 and earlier. The issue arises when an attacker modifies script_root to reference a URL on a remote server, enabling execution of arbitrary PHP code on the vulnerable host. Affected co...

CVE-2005-0653

CVE-2005-0653 affects phpMyAdmin 2.6.1 and concerns improper permission handling on tables whose names contain an underscore. The vulnerability allows remote authenticated users to obtain more privileges than intended for those tables, with a CVSSv2 base score of 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)....

CVE-2005-0655

The vulnerability CVE-2005-0655 affects auraCMS 1.5. An attacker can trigger an information disclosure by issuing an HTTP request with an invalid id parameter to one of three PHP endpoints (teman.php, hal.php, arsip.php), causing a PHP error message that reveals the file path. The NVD page report...

CVE-2005-0680

The CVE-2005-0680 issue affects Download Center Lite 1.6 and is a PHP remote file inclusion in the file download_center_lite.inc.php. The root cause is that the script_root parameter can be manipulated to reference a URL containing PHP code on a remote server, allowing an attacker to execute arbi...

CVE-2005-0672

The CVE-2005-0672 entry concerns Carsten’s 3D Engine (Ca3DE), March 2004 and earlier. A vulnerability in text strings that are not null terminated can trigger a null dereference, enabling remote code execution. Documents confirm affected software and root cause (unterminated text leading to deref...

CVE-2005-0668

The CVE-2005-0668 entry describes an issue in HTTP Anti Virus Proxy (HAVP) prior to version 0.51 where viruses are not properly detected in certain archive files (notably CAB and ZIP). Affected component: HAVP (HTTP proxy). Root cause: scanning failure for specific archive formats, enabling poten...

CVE-2005-0700

The exportindex action in myadmin.php for Aztek Forum 4.0 allows remote attackers to obtain database files, possibly by setting the ATKADMIN cookie...

CVE-2005-0178

Race condition in the setsid function in Linux before 2.6.8.1 allows local users to cause a denial of service crash and possibly access portions of kernel memory, related to TTY changes, locking, and semaphores...

CVE-2005-0660

Multiple cross-site scripting XSS vulnerabilities in D-Forum 1.11 allows remote attackers to inject arbitrary web script or HTML via certain fields, as demonstrated using the page parameter in nav.php3...