CVE-2005-0660

Multiple cross-site scripting XSS vulnerabilities in D-Forum 1.11 allows remote attackers to inject arbitrary web script or HTML via certain fields, as demonstrated using the page parameter in nav.php3...

CVE-2005-0657

Directory traversal vulnerability in Computalynx CProxy 3.3.x and 3.4.x through 3.4.4 allows remote attackers to read arbitrary files or cause a denial of service application crash via a .. dot dot in an HTTP request...

CVE-2005-0653

phpMyAdmin 2.6.1 does not properly grant permissions on tables with an underscore in the name, which grants remote authenticated users more privileges than intended...

CVE-2005-0678

PHP remote file inclusion vulnerability in formmail.inc.php for Form Mail Script 2.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the scriptroot to reference a URL on a remote web server that contains the code...

CVE-2005-0676

index.php in Zorum 3.5 allows remote attackers to trigger an SQL error, and possibly inject arbitrary SQL commands, via the search capability...

CVE-2005-0663

SQL injection vulnerability in index.php for MercuryBoard 1.1.2 allows remote attackers to inject arbitrary SQL commands via the f parameter...

CVE-2005-0661

The CVE-2005-0661 entry affects Woltlab Burning Board 2.0.3 through 2.3.0. A SQL injection risk exists in the getwbbuserdata function in session.php, exploitable via the (1) userid or (2) lastvisit cookies, enabling an attacker to execute arbitrary SQL commands. The NVD metrics indicate a high ba...

CVE-2005-0663

MercuryBoard 1.1.2 is affected by CVE-2005-0663 due to an SQL injection vulnerability in index.php via the f parameter. This is a remote issue allowing arbitrary SQL commands and is documented by multiple sources (NVD/OpenVAS entries). No remediation steps or fixes are provided in the supplied do...

CVE-2005-0675

CVE-2005-0675 affects Zorum 3.5. A Cross-site scripting (XSS) vulnerability exists in index.php, exploitable via the list or frommethod parameters to inject arbitrary script/HTML. This is a remote, unauthenticated vector with impact limited to client-side script execution; no remediation details ...

CVE-2005-0666

The CVE-2005-0666 entry describes an unknown vulnerability in PaX (Sept 2003 release to 2.2 before 2005.03.05) related to SEGMEXEC or RANDEXEC and VMA mirroring that allows local users and possibly remote attackers to bypass access restrictions and execute arbitrary code. The provided sources rei...

CVE-2005-0677

CVE-2005-0677 affects Zorum 3.5 where the file index.php allows remote attackers to perform certain actions as other users by modifying the id parameter. The underlying issue is parameter manipulation that enables privilege escalation within the application, leading to actions executed with anoth...

CVE-2005-0671

Ca3DE (Carsten’s 3D Engine) is affected: the March 2004 version and earlier contain a format string vulnerability in a command that allows remote code execution. Root cause is improper handling of format strings in the engine, enabling an attacker to supply format specifiers that are interpreted ...

CVE-2005-0665

The CVE-2005-0665 entry describes a format-string vulnerability in xv (pre-3.10a) that lets remote attackers execute arbitrary code via crafted filenames. Root cause: processing of format specifiers in filenames. Impact: arbitrary code execution on affected xv deployments. Remediation: upgrade to...

CVE-2005-0673

CVE-2005-0673 affects phpBB 2.0.13 via Cross-site scripting in usercp_register.php, enabling remote attackers to inject arbitrary HTML/JS by manipulating (1) allowhtml, (2) allowbbcode, or (3) allowsmilies in signatures associated with privmsg.php or viewtopic.php. Documented impact is limited to...

CVE-2005-0654

GIMP affected: gifload.exe in GIMP 2.0.5, 2.2.3, and possibly 2.2.4. Vulnerability: image descriptor fields height or width set to zero can cause an application crash (DoS). Exploitation: described as remote attacker or local user impact. No remediation details provided in the supplied documents;...

CVE-2005-0683

CVE-2005-0683 is rejected and not used; reference CVE-2005-0659 instead.

CVE-2005-0658

SQL injection vulnerability in a third party extension to TYPO3 allows remote attackers to execute arbitrary SQL commands via the categoryuid parameter...

CVE-2005-0177

nlsascii.c in Linux before 2.6.8.1 uses an incorrect table size, which allows attackers to cause a denial of service kernel crash via a buffer overflow...

CVE-2005-0695

The password recovery feature forgotpassword.asp in Hosting Controller 6.1 Hotfix 1.7 and earlier allows remote attackers to determine the owner's e-mail address by providing a portion of the domain name to the "login ID" field...

CVE-2005-0701

Directory traversal vulnerability in Oracle Database Server 8i and 9i allows remote attackers to read or rename arbitrary files via "\.\.." modified dot dot backslash sequences to UTLFILE functions such as 1 UTLFILE.FOPEN or 2 UTLFILE.frename...