CVE-2005-2054

Affected software: RealPlayer 10/10.5 (6.0.12.1040–1069) and RealOne Player v1/v2. Description indicates a vulnerability that could let remote attackers overwrite arbitrary files or run arbitrary ActiveX controls via a crafted MP3 file. Root cause and patch details are not provided in the documen...

CVE-2005-1908

Perception LiteWeb allows remote attackers to bypass access controls for files via an extra leading / slash or leading \ backslash in the URL...

CVE-2004-1933

The CVE-2004-1933 entry affects Citadel/UX versions 5.00–6.14. The underlying issue is that the database directory and files are installed with world-read permissions, enabling local users to bypass access controls and read messages that should be restricted. This is described consistently across...

CVE-2004-1933

Citadel/UX 5.00 through 6.14 installs the database directory and files with world-read permissions, which could allow local users to bypass access controls and read unauthorized messages...

CVE-2005-0241

The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size...

CVE-2005-0241

The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size...

CVE-2000-1221

The CVE describes a vulnerability in the line printer daemon (lpd) in the lpr package across multiple Linux operating systems. The root cause is an authentication check that compares the reverse-resolved hostname of the local machine to the hostname returned by gethostname; remote attackers can b...

CVE-1999-1582

The CVE-1999-1582 entry concerns the Cisco PIX firewall and a behavior of the established command. According to the description, this built-in functionality can allow connections from a single host to arbitrary ports of a target host if an alternative conduit has already been permitted, which may...

CVE-1999-1575

The Kodak/Wang 1 Image Edit imgedit.ocx, 2 Image Annotation imgedit.ocx, 3 Image Scan imgscan.ocx, 4 Thumbnail Image imgthumb.ocx, 5 Image Admin imgadmin.ocx, 6 HHOpen hhopen.ocx, 7 Registration Wizard regwizc.dll, and 8 IE Active Setup setupctl.dll ActiveX controls for Internet Explorer IE 4.01...

CVE-1999-1582

By design, the "established" command on the Cisco PIX firewall allows connections from one host to arbitrary ports of a target host if an alternative conduit has already been allowed, which can cause administrators to configure less restrictive access controls than intended if they do not...

CVE-2004-0533

Business Objects WebIntelligence 2.7.0 through 2.7.4 only enforces access controls on the client, which allows remote authenticated users to delete arbitrary files on the server via a crafted delete request using the InfoView web client...

Microsoft Internet Explorer DHTML objects contain a race condition

Overview A race condition in the way that Internet Explorer handles DHTML objects may allow a remote attacker to execute arbitrary code on a vulnerable system. Description According to Microsoft:Dynamic HTML DHTML is built on an object model that extends the traditional static HTML document which...

Microsoft Internet Explorer Content Advisor contains a buffer overflow

Overview A buffer overflow in Microsoft Internet Explorer Content Advisor may allow a remote attacker to execute arbitrary code on a vulnerable system. Description The Content Advisor is used to control what content is viewable in Internet Explorer. A buffer overflow exists in the routines that...

Microsoft Internet Explorer URL validation routine contains a buffer overflow

Overview A vulnerability in Microsoft Internet Explorer could allow a remote attacker to execute arbitrary code on a vulnerable system. Description Microsoft Internet Explorer IE contains an unspecified vulnerability in the way that it handles certain URLs. The process that checks the URL contain...

CVE-2005-0508

Unknown vulnerability in Squiggle for Batik before 1.5.1 allows attackers to bypass certain access controls via certain features of the Rhino scripting engine due to a "script security issue."...

DEBIAN-CVE-2005-0508

Unknown vulnerability in Squiggle for Batik before 1.5.1 allows attackers to bypass certain access controls via certain features of the Rhino scripting engine due to a "script security issue."...

CVE-2005-0508

CVE-2005-0508 affects Batik’s Squiggle component prior to Batik 1.5.1. The vulnerability allows bypassing certain access controls via features of the Rhino JavaScript engine due to a script security issue. Root cause is tied to Rhino scripting security in Squiggle. Affected software is Batik (Squ...

CVE-2005-0241

The CVE-2005-0241 issue affects Squid 2.5-STABLE7 and earlier, where httpProcessReplyHeader does not properly set the debug context for oversized HTTP reply headers. This can lead to cache poisoning or bypassing access controls based on header size. Connected advisories (e.g., RHSA-2005:060/061) ...

[SECURITY] [DSA 667-1] New squid packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 667-1 [email protected] http://www.debian.org/security/ Martin Schulze February 4th, 2005 http://www.debian.org/security/faq -...

CVE-2004-0533

Business Objects WebIntelligence 2.7.0 through 2.7.4 only enforces access controls on the client, which allows remote authenticated users to delete arbitrary files on the server via a crafted delete request using the InfoView web client...