CAN-2005-2450

CVE-2005-2450 affects Clam AntiVirus (clamav). Technical details across sources show an integer overflow vulnerability in CHM, TNEF, and FSG format handling that can lead to heap corruption, potentially allowing denial of service or remote code execution when processing specially crafted files (e...

CAN-2005-2761

CVE-2005-2761 is associated with phpGroupWare and is documented in Debian DSA-798-1 and related OpenVAS entries. The vulnerability refers to a global cross-site scripting fix designed to protect against malicious scripts embedded in CSS and xmlns across various phpGroupWare components. Remediatio...

CAN-2005-2557

CVE-2005-2557 affects MantisBT (Mantis) versions 0.19.0a1 through 1.0.0a3, where the view_all_set.php component is vulnerable to cross-site scripting due to unsanitized input in the dir parameter. This remote XSS could allow an attacker to inject arbitrary web script or HTML. The connected OpenVA...

CAN-2005-2097

The CVE-2005-2097 issue is a DoS via disk-space exhaustion caused by malformed PDF handling in xpdf and its GTK/GNUpdf frontend (gpdf). Public advisories describe heap-based overflow risks in xpdf/gpdf as related concerns, and Red Hat/CentOS advisories tie the CVE to kpdf/gpdf/xpdf fixes in kdegr...

CAN-2005-1856

The CVE-2005-1856 issue affects backup-manager (versions 0.5.8 and earlier) where the CD-burning feature logs to a fixed filename in a world-writable directory, allowing local users to overwrite log files via a symlink attack. This is documented across multiple sources (Debian DSA-787-1, OSV, NVD...

CAN-2005-2547

CVE-2005-2547 (CAN-2005-2547) affects bluez-utils and related BlueZ components. The vulnerability arises from missing input sanitising, enabling an attacker to craft a remote Bluetooth device name containing shell metacharacters to execute arbitrary commands when the PIN helper is invoked. Affect...

CAN-2005-2151

Summary: CVE-2005-2151 relates to the Courier Mail Server. The Debian/Ubuntu advisories describe a programming error where DNS SPF lookups were not handled correctly, potentially allowing memory corruption and a remote crash. The issue is mitigated in practice by SPF being disabled by default, bu...

CAN-2005-1857

CVE-2005-1857 describes a format-string vulnerability in simpleproxy prior to version 3.4 that could allow a remote attacker, via replies from remote HTTP proxies, to execute arbitrary code. Multiple sources (NVD, CVE list, OSV, Debian/DSA-786-1 advisory, and CERT vulnerability note) corroborate ...

CAN-2005-2641

The CAN-2005-2641 entry corresponds to a pam_ldap authentication bypass vulnerability. The connected documents confirm: the pam_ldap module before version 180 does not properly handle a new PasswordPolicyControl, enabling possible privilege escalation via authentication bypass. The impact stated ...

CAN-2005-2088

The connected Nessus document lists CVE-2005-2088 as an HTTP Request Smuggling issue in Apache httpd when acting as a proxy: Apache 1.3.x before 1.3.34 and 2.0.x before 2.0.55 are vulnerable to crafted requests with both Transfer-Encoding: chunked and Content-Length headers, leading to misinterpr...

CAN-2005-2627

CAN-2005-2627 and CAN-2005-2626 affect the kismet wireless sniffer. The Debian/OSS advisories describe CAN-2005-2627 as multiple integer underflows that could allow remote code execution, and CAN-2005-2626 as insecure handling of unprintable SSID characters. OpenVAS entries mirror these issues an...

CAN-2005-2101

CVE-2005-2101 concerns the KDE kdeedu suite, where the lange n2kvhtml converter (langen2kvhtml) creates insecure temporary files in /tmp with predictable names. This local-privilege issue allows a non-privileged user to potentially overwrite files, as described in Debian security advisories (DSA-...

CAN-2005-2655

CVE-2005-2655 affects maildrop (lockmail) where the lockmail utility does not drop group privileges before executing command-line arguments, enabling local privilege escalation for users with access to the maildrop package. Debian/DSA-791-1 notes the fix in version 1.5.3-1.1sarge1 (and later), so...

CAN-2005-2263

Technical details for CAN-2005-2263 are not provided in the supplied documents. The connected advisories reference this CVE, but no specifics (affected products, root cause, impact, or fix) are included. Monitor for updates.

CAN-2005-2656

Polygen before 1.0.6 generates precompiled grammar objects with world-writable permissions, enabling local users to cause a denial of service (disk consumption) and potentially perform other unauthorized activities. Remediation: upgrade to 1.0.6 or later as indicated in multiple CVE records (e.g....

CAN-2005-2717

CVE-2005-2717 relates to a remote code execution flaw in the webcalendar package (input validation). Multiple trusted sources (Debian DSA-799-1, Debian security notices) describe a trivially exploitable issue that allowed code execution with HTTP daemon privileges. The Debian advisories state the...

CAN-2005-2716

The CVE-2005-2716 entry is supported by multiple connected records: Nokia Affix vulnerable versions 2.1.2 and 3.2.0 expose a remote-command-execution flaw due to unsafe use of shell metacharacters in a Bluetooth device name, exploitable via the event_pin_code_request path in the btsrv daemon (bts...

CAN-2005-2700

CAN-2005-2700 describes a client-certificate authentication bypass in mod_ssl for Apache when SSLVerifyClient is configured as optional globally and required in a specific location. The issue allows remote bypass of access controls under certain configurations. Public advisories (e.g., F5 K5278/K...

CAN-2005-2390

CVE-2005-2390 corresponds to ProFTPD format-string vulnerabilities described in multiple advisories. The connected data confirms two primary issues: (1) a format-string vulnerability in the shutdown message display, and (2) a format-string vulnerability involving mod_sql when retrieving messages ...

CAN-2005-2693

CVE-2005-2693 refers to an insecure temporary file usage in cvsbug, the CVS graphical frontend component of gcvs. The issue allows a local attacker to exploit insecure temp files to execute arbitrary instructions as the user running cvsbug, potentially enabling privilege abuse. Public disclosures...