5997 matches found
CAN-2005-2971
CVE-2005-2971 affects the RTF importer in KWord/KOffice (KDE Office). The connected OpenVAS/Nessus entries confirm a buffer overflow that can lead to arbitrary code execution. Advisories across distributions document the issue and release patches or updates (e.g., Debian DSA-872-1; Gentoo GLSA 20...
CAN-2005-2963
CVE-2005-2963 affects the mod_auth_shadow Apache module (versions 1.0–2.0) where AuthShadow-enabled configurations cause shadow authentication to apply to all locations using the require group directive, potentially bypassing other access controls. Public disclosures in Debian (DSA-844-1), SUSE/O...
CAN-2005-2367
This CVE (CAN-2005-2367) is part of a set of issues in Ethereal (network traffic analyser). Connected advisories confirm format-string vulnerabilities in several dissectors could allow remote code execution; other CVEs (2360–2366) primarily describe denial-of-service conditions. Remediation acros...
CAN-2005-2661
CVE-2005-2661 affects up-imapproxy (IMAP Proxy). The vulnerability is a format-string error in ParseBannerAndCapability in main.c that affects up-imapproxy versions 1.2.3 and 1.2.4, allowing a remote attacker to execute arbitrary code via crafted banner or capability lines. Advisories indicate re...
CAN-2005-1279
The CAN-2005-1279 entry corresponds to tcpdump vulnerabilities in the BGP dissector (RT_ROUTING_INFO handling) that can cause a denial of service via an infinite loop when processing crafted packets. Public advisories and patches exist across multiple distributions: Debian DSA-850-1/DSA-850 fix t...
CAN-2005-1267
CVE-2005-1267 affects tcpdump (BGP dissector). The vulnerability arises when tcpdump’s bgp_update_print decodes a BGP packet and mishandles a -1 return value from decode_prefix4, allowing remote attackers to trigger an infinite loop and cause a denial of service. This issue has been addressed in ...
CAN-2005-2875
The CVE CAN-2005-2875 corresponds to Py2Play, a peer-to-peer game engine, where a design error allows remote code execution by processing untrusted pickled objects. Public advisories (Debian DSA-856-1 and related Debian/Nessus entries) describe that Py2Play can execute arbitrary code received fro...
CAN-2005-2965
CVE-2005-4803 affects graphviz before 2.2.1, allowing a local user to overwrite arbitrary files through a symlink attack on temporary files. This issue was originally associated with CVE-2005-2965, but multiple sources (SUSE advisory) clarify that CVE-2005-4803 is the correct identifier. Connecte...
CAN-2005-3178
CVE-2005-3178 describes a buffer overflow in XLI/Xloadimage caused by a fixed-length buffer used to store NIFF/XPM image titles during image processing. An attacker could craft a malicious NIFF/XPM image to overflow this buffer, potentially enabling arbitrary code execution with the user’s privil...
CAN-2005-3069
CVE-2005-3069 concerns HylaFax: several scripts (faxcron, recvstats, xferfaxstats) may create insecure temporary files/directories, enabling local users to exploit symlinks. Debian and Gentoo advisories assign this as a local vulnerability in HylaFax 4.x classic releases, with fixed packages prov...
CAN-2005-2967
CVE-2005-2967 is a format-string vulnerability in the CDDB processing component of the xine-lib library. Across multiple distributions (Debian, Ubuntu, Gentoo, Mandrake/Mandriva, FreeBSD ports, etc.), advisories describe that an attacker can cause arbitrary code execution by pointing a vulnerable...
CAN-2005-2933
CVE-2005-2933 is referenced in multiple advisories (RHSA-2006:0276, RHSA-2006:0501, CESA-2005:850, CESA-2006:0276) and is associated with a buffer overflow in the UW-IMAP c-client library used by IMAP/imapd. A specially crafted mailbox name could allow authenticated attackers to execute arbitrary...
CAN-2005-2337
CVE-2005-2337 is a Ruby vulnerability involving bypass of the language’s safe level checks, potentially allowing an attacker to execute arbitrary code. The JVNDB entry describes bypassing safe level to run arbitrary scripts, implying code execution beyond safety restrictions. Ubuntu advisories US...
CAN-2005-3068
The CVE CAN-2005-3068 maps to an issue in Eric (eric3) with missing input sanitising that could allow arbitrary code execution. Publicly referenced material in connected documents identifies Debian advisory DSA-869-1 fix for eric, affecting older 3.6.2-2 (Sarge) and 3.7.2-1 (Sid). The OpenVAS/NVD...
CAN-2004-0817
CVE-2004-0817 is evidenced across connected advisories for imlib and imlib2 in FreeBSD Ports and SLES9, with CVSS base 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P). OpenVAS entries reference FreeBSD/ Gentoo advisories (imagemagick/imlib) and note missing updates per those advisories, indicating vulnerable in...
CAN-2005-3121
CVE-2005-3121 affects the module-assistant tool; a rule file before 0.9.10 creates a temporary file insecurely, allowing local users to perform unauthorized operations. Debian notes fixed in 0.9.10 (DSA-867-1) and provides upgrade guidance. Open questions remain about real-world exploitation deta...
CVE-2024-25602
Stored cross-site scripting XSS vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject...
Liferay Portal and Liferay DXP Security Vulnerabilities
Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...
ITFlow Cross Site Request Forgery
CVE: CVE-2024-25344 CWE: CWE-352 Vendor: ITFlow.org Affected product: ITFlow - Before commit 432488eca3998c5be6b6b9e8f8ba01f54bc12378 Discoverer: stehled, WP-Pomoc.cz Attack-Type: Remote AV: Admin user has to open a page, provided by an attacker, which will then perform malicious request changing...