CVE-2005-0316

WebWasher Classic 2.2.1 and 3.3 (server mode) are affected by CVE-2005-0316: the product fails to drop CONNECT requests to localhost from external hosts, enabling remote bypass of access restrictions. Affected component is WebWasher Server mode proxy handling CONNECT to 127.0.0.1. Impact is descr...

CVE-2005-0277

The CVE-2005-0277 entry describes a buffer overflow in the 3Com 3CDaemon 2.0 FTP server (revision 10) that allows remote denial of service and arbitrary code execution via (1) a long USER username or (2) an FTP command with a long argument (e.g., cd, send, ls). Connected documents confirm concret...

CVE-2005-0320

CVE-2005-0320 concerns multiple cross-site scripting vulnerabilities in MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0. The issues allow remote attackers to inject arbitrary web script or HTML via specific parameters: login.html (username), accountsettings_add.html (accountid), and calendar....

CVE-2005-0337

Postfix 2.1.3, when /proc/net/ifinet6 is not available and permitmxbackup is enabled in smtpdrecipientrestrictions, allows remote attackers to bypass e-mail restrictions and perform mail relaying by sending mail to an IPv6 hostname...

CVE-2005-0317

CVE-2005-0317 affects Alt-N WebAdmin 3.0.4. The XSS flaw is in useredit_account.wdm (via the user parameter) and is caused by insufficient input validation/filtering. The NVD entry lists a CVSS v2 base score of 4.3 (Medium) with network attack vector, no confidentiality impact, partial integrity ...

CVE-2005-0319

The CVE-2005-0319 entry describes a Direct remote injection vulnerability in the Alt-N WebAdmin 3.0.4 component modalfram.wdm, where an attacker can load external webpages and inject arbitrary HTML or script to facilitate cross-site scripting (XSS) and phishing. The root cause is an input/content...

CVE-2005-0324

CVE-2005-0324 affects Infinite Mobile Delivery Webmail 2.6. The issue allows remote attackers to gain sensitive information by sending an HTTP request containing invalid characters for a Windows folder name, causing an error message that reveals the path. This is a path disclosure vulnerability w...

CVE-2005-0272

ReviewPost PHP Pro before 2.84 allows remote attackers to upload and execute arbitrary PHP files by posting a review file with multiple extensions, which bypasses the intended restrictions...

CVE-2005-0331

CVE-2005-0331 describes a directory traversal vulnerability in WinRAR 3.42 and earlier. When a user clicks a ZIP file to extract it, an attacker can cause arbitrary files to be created via a ". . ." (triple dot) in the ZIP filename, enabling potential arbitrary write on the user’s system if the a...

CVE-2005-0261

lspath in AIX 5.2, 5.3, and possibly earlier versions, does not drop privileges before processing the -f option, which allows local users to read one line of arbitrary files...

CVE-2005-0289

Apple AirPort Express (pre-6.1.1) and Extreme (pre-5.5.1) devices configured as Wireless Data Service (WDS) are susceptible to a denial-of-service when a remote actor connects to UDP port 161 and before a link-state change occurs. The CVE-2005-0289 entry notes the issue as a device freeze and ide...

CVE-2005-0286

The CVE-2005-0286 issue affects eMotion MediaPartner Web Server 5.0 and 5.1. A remote attacker can request a .bhtml file ending with a dot (.) or a plus sign (+) to retrieve the file’s source code. The vulnerability description specifies this behavior but does not provide root-cause details, affe...

CVE-2005-0333

CVE-2005-0333 affects LANChat Pro Revival 1.666c. A remote attacker can cause an application crash by sending a malformed UDP packet, per NVD entry. The available document set does not specify exploit status, affected versions beyond 1.666c, or a remediation/patch. The CVSS v2 base score is 5.0 (...

CVE-2005-0310

Exponent 0.95 allows remote attackers to obtain sensitive information via a direct HTTP request to 1 search.info.php, 2 permissions.info.php, 3 security.info.php, 4 formcontrol.php, or 5 filemodules.php, which reveals the path in an error message because the pathoscoreversion variable is undefine...

CVE-2005-0304

CVE-2005-0304 describes a directory traversal in DivX Player 2.6 and earlier. A specially crafted ZIP file containing a skin allows a remote attacker to overwrite arbitrary files by using a .. in a filename, enabling possible partial availability impact as reflected in the CVSS score. The records...

CVE-2005-0314

The CVE-2005-0314 entry describes a Cross-site Scripting (XSS) vulnerability in the Magic Winmail Server 4.0 Build 1112, specifically in user.php, where remote attackers can inject arbitrary web script or HTML through personal information fields. The connected records corroborate the same vulnera...

CVE-2005-0297

SQL injection vulnerability in Oracle Database 9i and 10g allows remote attackers to execute arbitrary SQL commands and gain privileges...

CVE-2005-0290

NETGEAR FVS318 running firmware 2.4, and possibly other versions, allows remote attackers to bypass the filters using hex encoded URLs, as demonstrated using a hex encoded file extension...

CVE-2005-0314

Cross-site scripting XSS vulnerability in user.php in Magic Winmail Server 4.0 Build 1112 allows remote attackers to inject arbitrary web script or HTML via the personal information fields...

CVE-2005-0264

The CVE-2005-0264 vulnerability affects Owl (intranet engine) versions 0.7 and 0.8. It is a cross-site scripting (XSS) issue in browse.php, exploitable via the (1) expand or (2) order parameters, allowing remote attackers to inject arbitrary scripts or HTML into pages viewed by other users. The u...