CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2005

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
901 CVE-2005-0653 2005-05-02 2008-09-05
4.6
User Local Low Not required Partial Partial Partial
phpMyAdmin 2.6.1 does not properly grant permissions on tables with an underscore in the name, which grants remote authenticated users more privileges than intended.
902 CVE-2005-0652 2005-05-02 2017-07-10
2.1
None Local Low Not required Partial None None
Unknown vulnerability in HP OpenVMS VAX 7.x and 6.x and OpenVMS Alpha 7.x or 6.x allows local users to access privileged files.
903 CVE-2005-0651 Exec Code Sql 2005-05-02 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in ProjectBB 0.4.5.1 allow remote attackers to execute arbitrary SQL commands via (1) liste or (2) desc parameters to divers.php (incorrectly referred to as "drivers.php" by some sources), (3) the search feature text area, (4) post name in the post creation feature, (5) City, (6) Homepage, (7) ICQ, (8) AOL, (9) Yahoo!, (10) MSN, or (11) e-mail fields in the profile feature or (12) the new field in the moderator section.
904 CVE-2005-0650 XSS 2005-05-02 2017-07-10
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in ProjectBB 0.4.5.1 allow remote attackers to inject arbitrary web script or HTML via (1) the pages parameter to divers.php (incorrectly referred to as "drivers.php" by some sources), (2) in the search feature text area, (3) forum name, (4) site name or (5) the maximum avatar size in the option section, (5) new category or (6) new forum fields in the forum section.
905 CVE-2005-0649 XSS Bypass 2005-05-02 2008-09-05
4.3
None Remote Medium Not required None Partial None
Pixel-Apes SafeHTML before 1.2.1 allows remote attackers to bypass cross-site scripting (XSS) protection via "hexadecimal HTML entities."
906 CVE-2005-0648 XSS Bypass 2005-05-02 2008-09-05
4.3
None Remote Medium Not required None Partial None
Multiple vulnerabilities in Pixel-Apes SafeHTML before 1.3.0 allow remote attackers to bypass cross-site scripting (XSS) protection via (1) "decimal HTML entities" or (2) "the \x00 symbol."
907 CVE-2005-0647 2005-05-02 2016-10-17
5.0
None Remote Low Not required None Partial None
admin_setup.php in paNews 2.0.4b allows remote attackers to inject arbitrary PHP code via the (1) $form[comments] or (2) $form[autoapprove] parameters, which are written to config.php.
908 CVE-2005-0646 Sql 2005-05-02 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in auth.php in paNews 2.0.4b allows remote attackers to execute arbitrary SQL via the mysql_prefix parameter.
909 CVE-2005-0645 XSS 2005-05-02 2016-10-17
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in show.inc.php in cuteNews 1.3.6 allows remote attackers to inject arbitrary HTML, web script, and PHP code via the (1) CLIENT-IP or (2) X-FORWARDED-FOR header in an HTTP POST request to show_news.php.
910 CVE-2005-0644 Exec Code Overflow 2005-05-02 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in McAfee Scan Engine 4320 with DAT version before 4436 allows remote attackers to execute arbitrary code via a malformed LHA file with a type 2 header file name field, a variant of CVE-2005-0643.
911 CVE-2005-0643 Exec Code Overflow 2005-05-02 2008-09-10
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in McAfee Scan Engine 4320 with DAT version before 4357 allows remote attackers to execute arbitrary code via crafted LHA files.
912 CVE-2005-0642 Sql 2005-05-02 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Query Designer for Computer Associates (CA) Unicenter Asset Management (UAM) 4.0 allows remote attackers to execute arbitrary SQL via an imported file.
913 CVE-2005-0637 2005-05-02 2017-07-10
5.0
None Remote Low Not required None Partial None
The copy functions in locore.s such as copyout in OpenBSD 3.5 and 3.6, and possibly other BSD based operating systems, may allow attackers to exceed certain address boundaries and modify kernel memory.
914 CVE-2005-0635 Exec Code Overflow 2005-05-02 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow in Foxmail Server 2.0 allows remote attackers to execute arbitrary code via a long USER command.
915 CVE-2005-0634 Exec Code Overflow 2005-05-02 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in Golden FTP Server 1.92 allows remote attackers to execute arbitrary code via a long USER command.
916 CVE-2005-0627 2005-05-02 2008-09-05
4.6
User Local Low Not required Partial Partial Partial
Qt before 3.3.4 searches the BUILD_PREFIX directory, which could be world-writable, to load shared libraries regardless of the LD_LIBRARY_PATH environment variable, which allows local users to execute arbitrary programs.
917 CVE-2005-0621 DoS 2005-05-02 2016-10-17
5.0
None Remote Low Not required None None Partial
Scrapland 1.0 and earlier allows remote attackers to cause a denial of service (server termination) by triggering an error, which is treated as a fatal error by the server, as demonstrated using (1) signed integers for size values, (2) an invalid model, (3) a "newpos" value that is less than or equal to a size value, or (4) partial packets.
918 CVE-2005-0618 2005-05-02 2008-09-05
6.4
None Remote Low Not required Partial Partial None
The SMTP binding function in Symantec Firewall/VPN Appliance 200/200R firmware after 1.5Z and before 1.68, Gateway Security 360/360R and 460/460R firmware before vuild 858, and Nexland Pro800turbo, when configured for load balancing between two WANs, might send SMTP traffic to a trusted network through an untrusted network.
919 CVE-2005-0617 Exec Code Sql 2005-05-02 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in dl-search.php in PostNuke 0.750 and 0.760-RC2 allows remote attackers to execute arbitrary SQL commands via the show parameter.
920 CVE-2005-0615 Exec Code Sql 2005-05-02 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in (1) index.php, (2) modules.php, or (3) admin.php in PostNuke 0.760-RC2 allow remote attackers to execute arbitrary SQL code via the catid parameter.
921 CVE-2005-0614 +Priv 2005-05-02 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
sessions.php in phpBB 2.0.12 and earlier allows remote attackers to gain administrator privileges via the autologinid value in a cookie.
922 CVE-2005-0612 DoS 2005-05-02 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Cisco IP/VC Videoconferencing System 3510, 3520, 3525 and 3530 contain hard-coded default SNMP community strings, which allows remote attackers to gain access, cause a denial of service, and modify configuration.
923 CVE-2005-0611 Exec Code Overflow 2005-05-02 2017-10-10
5.1
User Remote High Not required Partial Partial Partial
Heap-based buffer overflow in RealNetworks RealPlayer 10.5 (6.0.12.1056 and earlier), 10, 8, and RealOne Player V2 and V1, allows remote attackers to execute arbitrary code via .WAV files.
924 CVE-2005-0607 2005-05-02 2017-07-10
5.0
None Remote Low Not required Partial None None
CubeCart 2.0.0 through 2.0.5 allows remote attackers to determine the full path of the server via direct calls without parameters to (1) information.php, (2) language.php, (3) list_docs.php, (4) popular_prod.php, (5) sale.php, (6) subfooter.inc.php, (7) subheader.inc.php, (8) cat_navi.php, or (9) check_sum.php, which reveals the path in a PHP error message.
925 CVE-2005-0606 XSS 2005-05-02 2017-07-10
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in settings.inc.php for CubeCart 2.0.0 through 2.0.5, as used in multiple PHP files, allows remote attackers to inject arbitrary HTML or web script via the (1) cat_id, (2) PHPSESSID, (3) view_doc, (4) product, (5) session, (6) catname, (7) search, or (8) page parameters.
926 CVE-2005-0604 2005-05-02 2016-10-17
4.6
User Local Low Not required Partial Partial Partial
lnss.exe in GFI Languard Network Security Scanner 5.0 stores the username and password in memory in plaintext, which could allow local administrators to obtain domain administrator credentials.
927 CVE-2005-0602 +Priv 2005-05-02 2016-10-17
6.2
Admin Local High Not required Complete Complete Complete
Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges.
928 CVE-2005-0601 2005-05-02 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
Cisco devices running Application and Content Networking System (ACNS) 4.x, 5.0, 5.1, or 5.2 use a default password when the setup dialog has not been run, which allows remote attackers to gain access.
929 CVE-2005-0599 DoS 2005-05-02 2017-07-10
5.0
None Remote Low Not required None None Partial
Cisco devices running Application and Content Networking System (ACNS) 4.x, 5.0, or 5.1 before 5.1.11.6 allow remote attackers to cause a denial of service (CPU consumption) via malformed IP packets.
930 CVE-2005-0597 DoS 2005-05-02 2018-09-26
5.0
None Remote Low Not required None None Partial
Cisco devices running Application and Content Networking System (ACNS) 5.0 before 5.0.17.6 and 5.1 before 5.1.11.6 allow remote attackers to cause a denial of service (process restart) via a "crafted TCP connection."
931 CVE-2005-0596 DoS 2005-05-02 2008-09-05
2.1
None Local Low Not required None None Partial
PHP 4 (PHP4) allows attackers to cause a denial of service (daemon crash) by using the readfile function on a file whose size is a multiple of the page size.
932 CVE-2005-0595 Exec Code Overflow 2005-05-02 2017-07-11
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in ext.dll in BadBlue 2.55 allows remote attackers to execute arbitrary code via a long mfcisapicommand parameter.
933 CVE-2005-0594 Exec Code Overflow 2005-05-04 2008-09-05
7.2
Admin Local Low Not required Complete Complete Complete
Buffer overflow in the Netinfo Setup Tool (NeST) allows local users to execute arbitrary code.
934 CVE-2005-0591 2005-05-02 2017-10-10
2.6
None Remote High Not required None Partial None
Firefox before 1.0.1 allows remote attackers to spoof the (1) security and (2) download modal dialog boxes, which could be used to trick users into executing script or downloading and executing a file, aka "Firespoofing."
935 CVE-2005-0590 2005-05-02 2017-10-10
5.0
None Remote Low Not required None Partial None
The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla before 1.7.6 allows remote attackers to use InstallTrigger to spoof the hostname of the host performing the installation via a long "user:pass" sequence in the URL, which appears before the real hostname.
936 CVE-2005-0589 2005-05-02 2017-10-10
5.0
None Remote Low Not required Partial None None
The Form Fill feature in Firefox before 1.0.1 allows remote attackers to steal potentially sensitive information via an input control that monitors the values that are generated by the autocomplete capability.
937 CVE-2005-0588 2005-05-02 2017-10-10
5.0
None Remote Low Not required Partial None None
Firefox before 1.0.1 and Mozilla before 1.7.6 does not restrict xsl:include and xsl:import tags in XSLT stylesheets to the current domain, which allows remote attackers to determine the existence of files on the local system.
938 CVE-2005-0586 2005-05-02 2017-10-10
2.6
None Remote High Not required None Partial None
Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to spoof the extensions of files to download via the Content-Disposition header, which could be used to trick users into downloading dangerous content.
939 CVE-2005-0584 2005-05-02 2017-10-10
2.6
None Remote High Not required None Partial None
Firefox before 1.0.1 and Mozilla before 1.7.6, when displaying the HTTP Authentication dialog, do not change the focus to the tab that generated the prompt, which could facilitate spoofing and phishing attacks.
940 CVE-2005-0583 Dir. Trav. 2005-05-02 2016-10-17
5.0
None Remote Low Not required None Partial None
Directory traversal vulnerability in Computer Associates (CA) License Client 0.1.0.15 allows remote attackers to create arbitrary files via .. (dot dot) sequences in a PUTOLF request.
941 CVE-2005-0582 Exec Code Overflow 2005-05-02 2016-10-17
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow in Computer Associates (CA) License Client 0.1.0.15 allows remote attackers to execute arbitrary code via a long filename in a PUTOLF request.
942 CVE-2005-0581 Exec Code Overflow 2005-05-02 2016-10-17
4.6
User Local Low Not required Partial Partial Partial
Multiple buffer overflows in Computer Associates (CA) License Client and Server 0.1.0.15 allow remote attackers to execute arbitrary code via (1) certain long fields in the Checksum item in a GCR request, (2) a long IP address, hostname, or netmask values in a GCR request, (3) a long last parameter in a GETCONFIG packet, or (4) long values in a request with an invalid format.
943 CVE-2005-0578 2005-05-02 2017-10-10
2.1
None Local Low Not required None None Partial
Firefox before 1.0.1 and Mozilla Suite before 1.7.6 use a predictable filename for the plugin temporary directory, which allows local users to delete arbitrary files of other users via a symlink attack on the plugtmp directory.
944 CVE-2005-0577 Exec Code 2005-05-02 2008-09-05
5.1
User Remote High Not required Partial Partial Partial
Format string vulnerability in DNA MKBold-MKItalic 0.06_1 and earlier allows remote attackers to execute arbitrary code via crafted BDF font files.
945 CVE-2005-0576 2005-05-02 2008-09-05
3.6
None Local Low Not required None Partial Partial
Unknown vulnerability in Standard Type Services Framework (STSF) Font Server Daemon (stfontserverd) in Solaris 9 allows local users to modify or delete arbitrary files.
946 CVE-2005-0575 2 DoS Exec Code Overflow 2005-05-02 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in Stormy Studios Knet 1.04c and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP GET request.
947 CVE-2005-0574 Dir. Trav. 2005-05-02 2008-09-05
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in CIS WebServer 3.5.13 allows remote attackers to read arbitrary files via .. (dot dot) sequences in the URL.
948 CVE-2005-0573 DoS 2005-05-02 2016-10-17
5.0
None Remote Low Not required None None Partial
Gaim 1.1.3 on Windows systems allows remote attackers to cause a denial of service (client crash) via a file transfer in which the filename contains "(" or ")" (parenthesis) characters.
949 CVE-2005-0572 +Info 2005-05-02 2017-07-10
5.0
None Remote Low Not required Partial None None
index.php in phpWebSite 0.10.0 and earlier allows remote attackers to obtain sensitive information via an invalid SEA_search_module parameter, which reveals the path in a PHP error message.
950 CVE-2005-0571 2005-05-02 2017-07-10
5.0
None Remote Low Not required Partial None None
admin_loader.php in PunBB 1.2.1 allows remote attackers to read arbitrary files via the plugin parameter.
Total number of vulnerabilities : 1255   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 (This Page)20 21 22 23 24 25 26
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.