CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2005 (CVSS score >= 5)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2005-2733 Exec Code 2005-08-30 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
upload_img_cgi.php in Simple PHP Blog (SPHPBlog) does not properly restrict file extensions of uploaded files, which could allow remote attackers to execute arbitrary code.
2 CVE-2005-2732 +Info 2005-08-30 2016-10-17
5.0
None Remote Low Not required Partial None None
AWStats 6.4, and possibly earlier versions, allows remote attackers to obtain sensitive information via a file that does not exist in the config parameter, which reveals the path in an error message.
3 CVE-2005-2730 +Info 2005-08-30 2017-07-10
5.0
None Remote Low Not required Partial None None
The HTTP proxy in Astaro Security Linux 6.0 allows remote attackers to obtain sensitive information via an invalid request, which reveals a Proxy-authorization string in an error message.
4 CVE-2005-2729 Bypass 2005-08-30 2017-07-10
7.5
None Remote Low Not required Partial Partial Partial
The HTTP proxy in Astaro Security Linux 6.0 does not properly filter HTTP CONNECT requests to localhost, which allows remote attackers to bypass firewall rules and connect to local services.
5 CVE-2005-2728 DoS 2005-08-30 2018-10-19
5.0
None Remote Low Not required None None Partial
The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.
6 CVE-2005-2727 +Info 2005-08-30 2017-07-10
5.0
None Remote Low Not required Partial None None
Home Ftp Server 1.0.7 stores sensitive user information and server information in the same directory as the user's home directory, which allows remote authenticated users to obtain sensitive information by obtaining ftpmembers.lst and ftpsettings.lst.
7 CVE-2005-2726 Dir. Trav. 2005-08-30 2017-07-10
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in Home Ftp Server 1.0.7 allows remote authenticated users to read arbitrary files via "C:\" (Windows drive letter) sequences in commands such as (1) LIST or (2) RETR.
8 CVE-2005-2723 Exec Code Sql 2005-08-30 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in auth.php in PaFileDB 3.1, when authmethod is set to cookies, allows remote attackers to execute arbitrary SQL commands via the username value in the pafiledbcookie cookie.
9 CVE-2005-2722 +Info 2005-08-30 2016-10-17
5.0
None Remote Low Not required Partial None None
Foojan PHP Weblog allows remote attackers to obtain sensitive information via (1) a direct request to /daylinks/index.php or (2) a negative value in the daylinkspage parameter to index.php, which reveal the path in an error message.
10 CVE-2005-2720 Exec Code Overflow 2005-08-30 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the ACE archive decompression library (vrAZace.dll) in HAURI Anti-Virus products including ViRobot Expert 4.0, Advanced Server, Linux Server 2.0, and LiveCall, when compressed file scanning is enabled, allows remote attackers to execute arbitrary code via an ACE archive that contains a file with a long filename.
11 CVE-2005-2719 DoS 2005-08-30 2017-07-10
5.0
None Remote Low Not required None None Partial
Ventrilo 2.1.2 through 2.3.0 allows remote attackers to cause a denial of service (application crash) via a status packet that contains less data than specified in the packet header sent to UDP port 3784.
12 CVE-2005-2718 Exec Code Overflow 2005-08-29 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in ad_pcm.c in MPlayer 1.0pre7 and earlier allows remote attackers to execute arbitrary code via crafted PCM audio data, as demonstrated using a video file with an audio header containing a large value in a stream format (strf) chunk.
13 CVE-2005-2717 Exec Code File Inclusion 2005-08-29 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in WebCalendar before 1.0.1 allows remote attackers to execute arbitrary PHP code when opening settings.php, possibly via send_reminders.php or other scripts.
14 CVE-2005-2716 Exec Code 2005-08-29 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
The event_pin_code_request function in the btsrv daemon (btsrv.c) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a Bluetooth device name.
15 CVE-2005-2697 Exec Code Sql 2005-08-26 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in search.php for MyBulletinBoard (MyBB) 1.00 Release Candidate 1 through 4 allows remote attackers to execute arbitrary SQL commands via the uid parameter. NOTE: this issue might overlap CVE-2005-0282.
16 CVE-2005-2696 +Info 2005-08-26 2016-10-17
5.0
None Remote Low Not required Partial None None
IBM Lotus Notes does not properly restrict access to password hashes in the Notes Address Book (NAB), which allows remote attackers to obtain sensitive information via the (1) password digest field in the Administration tab of a Lotus Notes client, (2) "PasswordDigest" and "HTTPPassword" fields in the document properties in the NAB, or (3) a direct query to the Domino LDAP server, a different vulnerability than CVE-2005-2428.
17 CVE-2005-2695 2005-08-26 2017-07-10
5.0
None Remote Low Not required None Partial None
Unspecified vulnerability in the SSL certificate checking functionality in Cisco CiscoWorks Management Center for IDS Sensors (IDSMC) 2.0 and 2.1, and Monitoring Center for Security (Security Monitor or Secmon) 1.1 through 2.0 and 2.1, allows remote attackers to spoof a Cisco Intrusion Detection Sensor (IDS) or Intrusion Prevention System (IPS).
18 CVE-2005-2694 Exec Code Overflow 2005-08-26 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in WinAce 2.6.0.5, and possibly earlier versions, allows remote attackers to execute arbitrary code via a temporary (.tmp) file that contains an entry with a long file name.
19 CVE-2005-2692 Exec Code Sql 2005-08-24 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in RunCMS 1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) addquery and (2) subquery parameters to the newbb plus module, the forum parameter to (3) newtopic.php, (4) edit.php, or (5) reply.php in the newbb plus module, or (6) the msg_id parameter to print.php in the messages module.
20 CVE-2005-2691 Exec Code 2005-08-24 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
includes/common.php in RunCMS 1.2 and earlier calls the extract function with EXTR_OVERWRITE on HTTP POST variables, which allows remote attackers to overwrite arbitrary variables, possibly allowing execution of arbitrary code.
21 CVE-2005-2690 Exec Code Sql 2005-08-24 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Downloads module in PostNuke 0.760-RC4b allows PostNuke administrators to execute arbitrary SQL commands via the show parameter to dl-viewdownload.php.
22 CVE-2005-2687 Exec Code File Inclusion 2005-08-24 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in SaveWebPortal 3.4 allows remote attackers to execute arbitrary PHP code via the (1) SITE_Path parameter to menu_dx.php or (2) CONTENTS_Dir parameter to menu_sx.php.
23 CVE-2005-2686 Dir. Trav. 2005-08-24 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in SaveWebPortal 3.4 allows remote attackers to include arbitrary files and execute arbitrary local PHP programs via ".." sequences in the (1) SITE_Path parameter to menu_dx.php or (2) CONTENTS_Dir parameter to menu_sx.php.
24 CVE-2005-2685 Exec Code 2005-08-24 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
SaveWebPortal 3.4 allows remote attackers to execute arbitrary PHP code via a direct request to admin/PhpMyExplorer/editerfichier.php, then editing the desired file to contain the PHP code, as demonstrated using header.php in the fichier parameter. NOTE: it is possible that this vulnerability stems from PhpMyExplorer, which is a separate package.
25 CVE-2005-2684 Exec Code 2005-08-23 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
nquser.php in Virtual Edge Netquery 3.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the host parameter to a dig query.
26 CVE-2005-2683 Exec Code Sql 2005-08-23 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in PHPKit 1.6.1 allow remote attackers to execute arbitrary SQL commands via the (1) letter parameter to login/member.php or (2) im_receiver parameter to login/imcenter.php.
27 CVE-2005-2682 Exec Code 2005-08-23 2018-08-13
7.5
User Remote Low Not required Partial Partial Partial
aspell_setup.php in the SpellChecker plugin in DTLink AreaEdit before 0.4.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the dictionary parameter (aka the lang variable).
28 CVE-2005-2681 +Priv 2005-08-23 2018-10-30
7.2
Admin Local Low Not required Complete Complete Complete
Unspecified vulnerability in the command line processing (CLI) logic in Cisco Intrusion Prevention System 5.0(1) and 5.0(2) allows local users with OPERATOR or VIEWER privileges to gain additional privileges via unknown vectors.
29 CVE-2005-2680 Bypass 2005-08-23 2018-10-30
5.0
None Remote Low Not required Partial None None
Unspecified vulnerability in BEA WebLogic Portal 8.1 through SP4, when using entitlements, allows remote attackers to bypass access restrictions for the pages of a Book via crafted URLs.
30 CVE-2005-2679 Exec Code Overflow 2005-08-23 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow in Sysinternals Process Explorer 9.23, and other versions before 9.25, allows local users to execute arbitrary code via a long CompanyName field in the VersionInfo information in a running process.
31 CVE-2005-2678 Bypass 2005-08-23 2018-10-30
5.0
None Remote Low Not required Partial None None
Microsoft IIS 5.1 and 6 allows remote attackers to spoof the SERVER_NAME variable to bypass security checks and conduct various attacks via a GET request with an http://localhost URI, which makes it appear as if the request is coming from localhost.
32 CVE-2005-2677 +Info 2005-08-23 2008-09-05
5.0
None Remote Low Not required Partial None None
ACNews stores the database in a file under the web document root with a db.inc extension and insufficient access control, which allows remote attackers to obtain sensitive information such as the full pathname of the server.
33 CVE-2005-2675 Exec Code Sql 2005-08-23 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
** DISPUTED ** Note: the vendor has disputed this issue. Multiple SQL injection vulnerabilities in Land Down Under (LDU) 800 allow remote attackers to execute arbitrary SQL commands via the (1) s or (2) m parameter to forums.php, (3) o, (4) w, (5) s, or (6) p parameter to list.php, (7) m parameter to journal.php, (8) x or (9) n parameter to forums.php, or (10) w parameter to links.php. NOTE: this issue has been disputed by the vendor, who says "None of the tricks written there are working, the variables are properly sanitized and no LDU version is affected."
34 CVE-2005-2673 Exec Code Sql 2005-08-23 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in modcp.php in WoltLab Burning Board 2.2.2 and 2.3.3 allows remote authenticated attackers to execute arbitrary SQL commands via the (1) x or (2) y parameters.
35 CVE-2005-2670 Dir. Trav. 2005-08-23 2008-09-05
5.0
None Remote Low Not required None Partial None
Directory traversal vulnerability in HAURI Anti-Virus products including ViRobot Expert 4.0, Advanced Server, Linux Server 2.0, and LiveCall allows remote attackers to overwrite arbitrary files via ".." sequences in filenames contained in (1) ACE, (2) ARJ, (3) CAB, (4) LZH, (5) RAR, (6) TAR and (7) ZIP files.
36 CVE-2005-2669 Exec Code 2005-08-23 2017-11-21
10.0
Admin Remote Low Not required Complete Complete Complete
Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05, 1.07 before Build 220_13, and 1.11 before Build 29_13 allows remote attackers to execute arbitrary commands via spoofed CAFT packets.
37 CVE-2005-2668 Exec Code Overflow 2005-08-23 2017-11-22
10.0
Admin Remote Low Not required Complete Complete Complete
Multiple buffer overflows in Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05, 1.07 before Build 220_13, and 1.11 before Build 29_13 allow remote attackers to execute arbitrary code via unknown vectors.
38 CVE-2005-2667 DoS 2005-08-23 2017-11-22
5.0
None Remote Low Not required None None Partial
Unknown vulnerability in Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05, 1.07 before Build 220_13, and 1.11 before Build 29_13 allows attackers to cause a denial of service via unknown vectors, aka the "CAM TCP port vulnerability."
39 CVE-2005-2665 Exec Code Overflow 2005-08-23 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in expires.c in Elm 2.5 PL5 through PL7, and possibly other versions, allows remote attackers to execute arbitrary code via an e-mail message with a long Expires header.
40 CVE-2005-2655 +Priv 2005-08-30 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
lockmail in maildrop before 1.5.3 does not drop privileges before executing commands, which allows local users to gain privileges via command line arguments.
41 CVE-2005-2654 2005-08-30 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
phpldapadmin before 0.9.6c allows remote attackers to gain anonymous access to the LDAP server, even when disable_anon_bind is set, via an HTTP request to login.php with the anonymous_bind parameter set.
42 CVE-2005-2652 2005-08-23 2017-07-10
5.0
None Remote Low Not required Partial None None
Zorum 3.5 allows remote attackers to obtain the full installation path via direct requests to (1) gorum/notification.php, (2) user.php, (3) attach.php, (4) blacklist.php, (5) zorum/forum.php, (6) globalstat.php, (7) gorum/trace.php, (8) gorum/badwords.php, or (9) gorum/flood.php.
43 CVE-2005-2651 Exec Code 2005-08-23 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
gorum/prod.php in Zorum 3.5 allows remote attackers to execute arbitrary code via shell metacharacters in the argv parameter.
44 CVE-2005-2648 Dir. Trav. 2005-08-23 2017-07-10
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in index.php in W-Agora 4.2.0 and earlier allows remote attackers to read arbitrary files via the site parameter.
45 CVE-2005-2646 DoS 2005-08-23 2008-09-05
6.4
None Remote Low Not required Partial None Partial
Unknown vulnerability in Xerox MicroServer Web Server in Document Centre 220 through 265, 332 and 340, 420 through 490, and 535 through 555 allows remote attackers to cause a denial of service or read files via unknown vectors involving crafted HTTP requests.
46 CVE-2005-2645 Bypass 2005-08-23 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Unknown vulnerability in Xerox MicroServer Web Server in Document Centre 220 through 265, 332 and 340, 420 through 490, and 535 through 555 allows remote attackers to bypass authentication.
47 CVE-2005-2644 DoS Exec Code Overflow 2005-08-23 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in JaguarEditControl.dll in Isemarket JaguarControl allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long Jtext field.
48 CVE-2005-2643 2005-08-23 2016-10-17
5.0
None Remote Low Not required Partial None None
Tor 0.1.0.13 and earlier, and experimental versions 0.1.1.4-alpha and earlier, does not reject certain weak keys when using ephemeral Diffie-Hellman (DH) handshakes, which allows malicious Tor servers to obtain the keys that a client uses for other systems in the circuit.
49 CVE-2005-2642 Exec Code Overflow 2005-08-23 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in the mutt_decode_xbit function in Handler.c for Mutt 1.5.10 allows remote attackers to execute arbitrary code, possibly due to interactions with libiconv or gettext.
50 CVE-2005-2641 +Priv 2005-08-23 2018-10-19
7.5
User Remote Low Not required Partial Partial Partial
Unknown vulnerability in pam_ldap before 180 does not properly handle a new password policy control, which could allow attackers to gain privileges. NOTE: CVE-2005-2497 had also been assigned to this issue, but CVE-2005-2641 is the correct candidate.
Total number of vulnerabilities : 230   Page : 1 (This Page)2 3 4 5
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.