CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In October 2005 (CVSS score >= 6)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2005-3386 Exec Code Sql Bypass 2005-10-30 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Techno Dreams Web Directory script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.
2 CVE-2005-3385 Exec Code Sql Bypass 2005-10-30 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Techno Dreams Mailing List script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.
3 CVE-2005-3384 Exec Code Sql Bypass 2005-10-30 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Techno Dreams Guest Book script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.
4 CVE-2005-3383 Exec Code Sql Bypass 2005-10-30 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Techno Dreams Announcement script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.
5 CVE-2005-3369 Exec Code Sql 2005-10-30 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the Info-DB module (info_db.php) in Woltlab Burning Board 2.7 and earlier allow remote attackers to execute arbitrary SQL commands and possibly upload files via the (1) fileid and (2) subkatid parameters.
6 CVE-2005-3366 Exec Code XSS File Inclusion 2005-10-30 2017-07-10
6.8
User Remote Medium Not required Partial Partial Partial
PHP file inclusion vulnerability in index.php in PHP iCalendar 2.0a2 through 2.0.1 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the phpicalendar cookie. NOTE: this is not a cross-site scripting (XSS) issue as claimed by the original researcher.
7 CVE-2005-3365 89 Exec Code Sql 2005-10-30 2018-10-19
7.5
User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in DCP-Portal 6 and earlier allow remote attackers to execute arbitrary SQL commands, possibly requiring encoded characters, via (1) the name parameter in register.php, (2) the email parameter in lostpassword.php, (3) the year parameter in calendar.php, and the (4) cid parameter to index.php. NOTE: the mid parameter for forums.php is already associated with CVE-2005-0454. NOTE: the index.php/cid vector was later reported to affect 6.11.
8 CVE-2005-3364 Exec Code Sql 2005-10-30 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in DboardGear allow remote attackers to execute arbitrary SQL commands via (1) the buddy parameter in buddy.php, (2) the u2uid parameter in u2u.php, and (3) an invalid theme file in the themes action to ctrtools.php.
9 CVE-2005-3363 Exec Code Sql 2005-10-30 2018-10-19
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Saphp Lesson, possibly saphp Lesson1.1 and saphpLesson2.0, allows remote attackers to execute arbitrary SQL commands via the forumid parameter in (1) showcat.php and (2) add.php.
10 CVE-2005-3339 2005-10-27 2008-09-05
7.2
None Local Low Not required Complete Complete Complete
Mantis before 0.19.3 caches the User ID longer than necessary, which has unknown impact and attack vectors.
11 CVE-2005-3336 Exec Code Sql 2005-10-27 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
12 CVE-2005-3335 Exec Code File Inclusion 2005-10-27 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
PHP file inclusion vulnerability in bug_sponsorship_list_view_inc.php in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the t_core_path parameter.
13 CVE-2005-3333 Exec Code Sql 2005-10-27 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in eBASEweb 3.0 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
14 CVE-2005-3332 Exec Code 2005-10-27 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
PHP remote file include vulnerability in admin/define.inc.php in Belchior Foundry vCard 2.9 allows remote attackers to execute arbitrary PHP code via the match parameter.
15 CVE-2005-3330 20 Exec Code 2005-10-27 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
The _httpsrequest function in Snoopy 1.2, as used in products such as (1) MagpieRSS, (2) WordPress, (3) Ampache, and (4) Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL to an SSL protected web page, which is not properly handled by the fetch function.
16 CVE-2005-3328 Exec Code File Inclusion 2005-10-27 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in common.php in PunBB 1.1.2 through 1.1.5 allows remote attackers to execute arbitrary code via the pun_root parameter.
17 CVE-2005-3327 Bypass 2005-10-27 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Network Appliance Data ONTAP 7.0 and earlier allows iSCSI Initiators to bypass iSCSI authentication via a modified client that skips the Security (Start) mode, as required by the Login Negotiation protocol, and uses Operational mode without proving identity.
18 CVE-2005-3326 Exec Code Sql 2005-10-27 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in usercp.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the awayday parameter.
19 CVE-2005-3325 89 Exec Code Sql 2005-10-27 2012-07-03
7.5
User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in (1) acid_qry_main.php in Analysis Console for Intrusion Databases (ACID) 0.9.6b20 and (2) base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.2, and unspecified other console scripts in these products, allow remote attackers to execute arbitrary SQL commands via the sig[1] parameter and possibly other parameters.
20 CVE-2005-3324 Exec Code Sql 2005-10-27 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in chat.php in MWChat 6.8 allows remote attackers to execute arbitrary SQL commands via the username parameter.
21 CVE-2005-3323 2005-10-27 2018-10-03
7.5
None Remote Low Not required Partial Partial Partial
docutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in RestructuredText functionality.
22 CVE-2005-3317 119 Exec Code Overflow 2005-10-27 2009-03-25
7.5
User Remote Low Not required Partial Partial Partial
Multiple stack-based buffer overflows in ZipGenius 5.5.1.468 and 6.0.2.1041, and other versions before 6.0.2.1050, allow remote attackers to execute arbitrary code via (1) a ZIP archive that contains a file with a long filename, which is not properly handled by (a) zipgenius.exe, (b) zg.exe, (c) zgtips.dll, and (d) contmenu.dll; (2) a long original name in a (a) UUE, (b) XXE, or (c) MIM file, which is not properly handled by zipgenius.exe; or (3) an ACE archive with a file with a long filename, which is not properly handled by unacev2.dll.
23 CVE-2005-3316 +Priv 2005-10-27 2013-07-07
7.5
User Remote Low Not required Partial Partial Partial
The installation of ON Symantec Discovery 4.5.x and Symantec Discovery 6.0 creates the (1) DiscoveryWeb and (2) DiscoveryRO database accounts with null passwords, which could allow attackers to gain privileges or prevent Discovery from running by setting another password.
24 CVE-2005-3315 Exec Code Sql 2005-10-30 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Novell ZENworks Patch Management 6.x before 6.2.2.181 allow remote attackers to execute arbitrary SQL commands via the (1) Direction parameter to computers/default.asp, and the (2) SearchText, (3) StatusFilter, and (4) computerFilter parameters to reports/default.asp.
25 CVE-2005-3309 Exec Code Sql 2005-10-25 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Zomplog 3.4 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in detail.php and the catid parameter in (2) get.php and (3) index.php.
26 CVE-2005-3305 Exec Code Sql 2005-10-25 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Nuked Klan 1.7 allow remote attackers to execute arbitrary SQL commands via the (1) forum_id or (2) thread_id parameter in the Forum file, (3) the link_id in the Links file, (4) the artid parameter in the Sections file, and (5) the dl_id parameter in the Download file.
27 CVE-2005-3304 Exec Code Sql 2005-10-25 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in PHP-Nuke 7.8 allow remote attackers to modify SQL queries and execute arbitrary PHP code via (1) the username parameter in the Your Account page, (2) the url parameter in the Downloads module, and (3) the description parameter in the Web_Links module.
28 CVE-2005-3302 Exec Code 2005-10-24 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Eval injection vulnerability in bvh_import.py in Blender 2.36 allows attackers to execute arbitrary Python code via a hierarchy element in a .bvh file, which is supplied to an eval function call.
29 CVE-2005-3298 Exec Code Overflow 2005-10-23 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
Multiple buffer overflows in OpenWBEM on SuSE Linux 9 allow remote attackers to execute arbitrary code via unknown vectors.
30 CVE-2005-3297 Exec Code Overflow 2005-10-23 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
Multiple integer overflows in OpenWBEM on SuSE Linux 9 allow remote attackers to execute arbitrary code via unknown vectors.
31 CVE-2005-3296 2005-10-23 2017-10-10
10.0
Admin Remote Low Not required Complete Complete Complete
The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in.
32 CVE-2005-3290 Exec Code Sql 2005-10-23 2008-09-10
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Accelerated Mortgage Manager allows remote attackers to execute arbitrary SQL commands via the password field.
33 CVE-2005-3284 Exec Code Overflow 2005-10-23 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Multiple buffer overflows in AhnLab V3 AntiVirus V3Pro 2004 before 6.0.0.488, V3Net for Windows Server 6.0 before 6.0.0.488, and MyV3, with compressed file scanning enabled, allow remote attackers to execute arbitrary code via crafted (1) ALZ, (2) UUE, or (3) XXE archives.
34 CVE-2005-3282 Bypass 2005-10-23 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Splatt Forum 3.0 to 3.2 allows remote attackers to bypass authentication via unknown vectors.
35 CVE-2005-3280 +Priv 2005-10-23 2018-10-19
7.5
User Remote Low Not required Partial Partial Partial
Paros 3.2.5 uses a default password for the "sa" account in the underlying HSQLDB database and does not restrict access to the local machine, which allows remote attackers to gain privileges.
36 CVE-2005-3279 Overflow +Priv 2005-10-23 2008-09-05
7.2
Admin Local Low Not required Complete Complete Complete
Stack-based buffer overflow in the vgasco_printf function in Jan Kybic BitMap Viewer (BMV) 1.2, when compiled with the M_UNIX flag and running setuid, allows local users to gain privileges via a long filename in the -b command line option.
37 CVE-2005-3278 Exec Code Overflow 2005-10-23 2017-07-10
7.2
Admin Local Low Not required Complete Complete Complete
Integer overflow in the openpsfile function in gsinterf.c for Jan Kybic BitMap Viewer (BMV) 1.2 allows local users to execute arbitrary code via a PostScript (PS) file containing a large number of pages value, which leads to a resultant buffer overflow.
38 CVE-2005-3277 Exec Code 2005-10-21 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
The LPD service in HP-UX 10.20 11.11 (11i) and earlier allows remote attackers to execute arbitrary code via shell metacharacters ("`" or single backquote) in a request that is not properly handled when an error occurs, as demonstrated by killing the connection, a different vulnerability than CVE-2002-1473.
39 CVE-2005-3270 +Priv 2005-10-20 2008-09-05
7.2
Admin Local Low Not required Complete Complete Complete
Untrusted search path vulnerability in DiskMountNotify for Symantec Norton AntiVirus 9.0.3 allows local users to gain privileges by modifying the PATH to reference a malicious (1) ps or (2) grep file.
40 CVE-2005-3269 119 DoS Overflow +Priv 2005-10-20 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in help.cgi in the HTTP administrative interface for (1) Sun Java System Directory Server 5.2 2003Q4, 2004Q2, and 2005Q1, (2) Red Hat Directory Server and (3) Certificate Server before 7.1 SP1, (4) Sun ONE Directory Server 5.1 SP4 and earlier, and (5) Sun ONE Administration Server 5.2 allows remote attackers to cause a denial of service (admin server crash), or local users to gain root privileges.
41 CVE-2005-3267 189 DoS Overflow 2005-10-27 2017-07-10
10.0
None Remote Low Not required Complete Complete Complete
Integer overflow in Skype client before 1.4.x.84 on Windows, before 1.3.x.17 on Mac OS, before 1.2.x.18 on Linux, and 1.1.x.6 and earlier allows remote attackers to cause a denial of service (crash) via crafted network data with a large Object Counter value, which leads to a resultant heap-based buffer overflow.
42 CVE-2005-3265 119 Exec Code Overflow 2005-10-27 2017-07-10
9.3
Admin Remote Medium Not required Complete Complete Complete
Buffer overflow in Skype for Windows 1.1.x.0 through 1.4.x.83 allows remote attackers to execute arbitrary code via (1) callto:// and (2) skype:// links, or (3) a non-standard VCARD, possibly due to an underlying error in the SysUtils.WideFmtStr Delphi routine.
43 CVE-2005-3263 Exec Code Overflow 2005-10-20 2008-09-10
7.5
User Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in UNACEV2.DLL for RARLAB WinRAR 2.90 through 3.50 allows remote attackers to execute arbitrary code via an ACE archive containing a file with a long name.
44 CVE-2005-3262 Exec Code 2005-10-20 2008-09-10
7.5
User Remote Low Not required Partial Partial Partial
Format string vulnerability in RARLAB WinRAR 2.90 through 3.50 allows remote attackers to execute arbitrary code via format string specifiers in a UUE/XXE file, which are not properly handled when WinRAR displays diagnostic errors related to an invalid filename.
45 CVE-2005-3259 Exec Code Sql Bypass 2005-10-20 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in versatileBulletinBoard (vBB) 1.0.0 RC2 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) login field, (2) "search this thread" feature, (3) "search for posts" feature, (4) "forgot password" feature, (5) list parameter in userlistpre.php, and the (6) select, (7) categ, and (8) to parameters in index.php.
46 CVE-2005-3254 Exec Code 2005-10-18 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
The CGIwrap program before 3.9 on Debian GNU/Linux uses an incorrect minimum value of 100 for a UID to determine whether it can perform a seteuid operation, which could allow attackers to execute code as other system UIDs that are greater than the minimum value, which should be 1000 on Debian systems.
47 CVE-2005-3252 Exec Code Overflow 2005-10-18 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the Back Orifice (BO) preprocessor for Snort before 2.4.3 allows remote attackers to execute arbitrary code via a crafted UDP packet.
48 CVE-2005-3251 Dir. Trav. 2005-10-17 2008-09-05
6.4
None Remote Low Not required Partial Partial None
Directory traversal vulnerability in the gallery script in Gallery 2.0 (G2) allows remote attackers to read or include arbitrary files via ".." sequences in the g2_itemId parameter.
49 CVE-2005-3249 DoS 2005-10-27 2017-10-10
6.4
None Remote Low Not required None Partial Partial
Unspecified vulnerability in the WSP dissector in Ethereal 0.10.1 to 0.10.12 allows remote attackers to cause a denial of service or corrupt memory via unknown vectors that cause Ethereal to free an invalid pointer.
50 CVE-2005-3243 Exec Code Overflow 2005-10-27 2017-10-10
7.5
User Remote Low Not required Partial Partial Partial
Multiple buffer overflows in Ethereal 0.10.12 and earlier might allow remote attackers to execute arbitrary code via unknown vectors in the (1) SLIMP3 and (2) AgentX dissector.
Total number of vulnerabilities : 103   Page : 1 (This Page)2 3
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.