CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2005

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
51 CVE-2005-2672 2005-08-23 2018-10-03
2.1
None Local Low Not required None Partial None
pwmconfig in LM_sensors before 2.9.1 creates temporary files insecurely, which allows local users to overwrite arbitrary files via a symlink attack on the fancontrol temporary file.
52 CVE-2005-2670 Dir. Trav. 2005-08-23 2008-09-05
5.0
None Remote Low Not required None Partial None
Directory traversal vulnerability in HAURI Anti-Virus products including ViRobot Expert 4.0, Advanced Server, Linux Server 2.0, and LiveCall allows remote attackers to overwrite arbitrary files via ".." sequences in filenames contained in (1) ACE, (2) ARJ, (3) CAB, (4) LZH, (5) RAR, (6) TAR and (7) ZIP files.
53 CVE-2005-2669 Exec Code 2005-08-23 2017-11-21
10.0
Admin Remote Low Not required Complete Complete Complete
Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05, 1.07 before Build 220_13, and 1.11 before Build 29_13 allows remote attackers to execute arbitrary commands via spoofed CAFT packets.
54 CVE-2005-2668 Exec Code Overflow 2005-08-23 2017-11-22
10.0
Admin Remote Low Not required Complete Complete Complete
Multiple buffer overflows in Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05, 1.07 before Build 220_13, and 1.11 before Build 29_13 allow remote attackers to execute arbitrary code via unknown vectors.
55 CVE-2005-2667 DoS 2005-08-23 2017-11-22
5.0
None Remote Low Not required None None Partial
Unknown vulnerability in Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05, 1.07 before Build 220_13, and 1.11 before Build 29_13 allows attackers to cause a denial of service via unknown vectors, aka the "CAM TCP port vulnerability."
56 CVE-2005-2666 255 2005-08-23 2017-10-10
1.2
None Local High Not required Partial None None
SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.
57 CVE-2005-2665 Exec Code Overflow 2005-08-23 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in expires.c in Elm 2.5 PL5 through PL7, and possibly other versions, allows remote attackers to execute arbitrary code via an e-mail message with a long Expires header.
58 CVE-2005-2664 2005-08-23 2016-10-17
2.1
None Local Low Not required Partial None None
Whisper 32 1.16, and possibly earlier versions, stores passwords in plaintext in memory, which allows local users to obtain the password using a debugger or another mechanism to read process memory.
59 CVE-2005-2655 +Priv 2005-08-30 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
lockmail in maildrop before 1.5.3 does not drop privileges before executing commands, which allows local users to gain privileges via command line arguments.
60 CVE-2005-2654 2005-08-30 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
phpldapadmin before 0.9.6c allows remote attackers to gain anonymous access to the LDAP server, even when disable_anon_bind is set, via an HTTP request to login.php with the anonymous_bind parameter set.
61 CVE-2005-2653 XSS 2005-08-23 2017-07-10
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in BBCaffe 2.0 allows remote attackers to inject arbitrary web script or HTML via e-mail data in a message.
62 CVE-2005-2652 2005-08-23 2017-07-10
5.0
None Remote Low Not required Partial None None
Zorum 3.5 allows remote attackers to obtain the full installation path via direct requests to (1) gorum/notification.php, (2) user.php, (3) attach.php, (4) blacklist.php, (5) zorum/forum.php, (6) globalstat.php, (7) gorum/trace.php, (8) gorum/badwords.php, or (9) gorum/flood.php.
63 CVE-2005-2651 Exec Code 2005-08-23 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
gorum/prod.php in Zorum 3.5 allows remote attackers to execute arbitrary code via shell metacharacters in the argv parameter.
64 CVE-2005-2650 1 XSS 2005-08-23 2008-09-05
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in sign.asp in Emefa Guestbook 1.2 allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) location, and (3) email parameters.
65 CVE-2005-2649 XSS 2005-08-23 2017-07-10
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in ATutor 1.5.1 allows remote attackers to inject arbitrary web script or HTML via (1) course parameter in login.php or (2) words parameter in search.php.
66 CVE-2005-2648 Dir. Trav. 2005-08-23 2017-07-10
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in index.php in W-Agora 4.2.0 and earlier allows remote attackers to read arbitrary files via the site parameter.
67 CVE-2005-2647 XSS 2005-08-23 2008-09-05
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Xerox MicroServer Web Server in Document Centre 220 through 265, 332 and 340, 420 through 490, and 535 through 555 allows remote attackers to inject arbitrary web script or HTML and modify web pages via unknown vectors.
68 CVE-2005-2646 DoS 2005-08-23 2008-09-05
6.4
None Remote Low Not required Partial None Partial
Unknown vulnerability in Xerox MicroServer Web Server in Document Centre 220 through 265, 332 and 340, 420 through 490, and 535 through 555 allows remote attackers to cause a denial of service or read files via unknown vectors involving crafted HTTP requests.
69 CVE-2005-2645 Bypass 2005-08-23 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Unknown vulnerability in Xerox MicroServer Web Server in Document Centre 220 through 265, 332 and 340, 420 through 490, and 535 through 555 allows remote attackers to bypass authentication.
70 CVE-2005-2644 DoS Exec Code Overflow 2005-08-23 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in JaguarEditControl.dll in Isemarket JaguarControl allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long Jtext field.
71 CVE-2005-2643 2005-08-23 2016-10-17
5.0
None Remote Low Not required Partial None None
Tor 0.1.0.13 and earlier, and experimental versions 0.1.1.4-alpha and earlier, does not reject certain weak keys when using ephemeral Diffie-Hellman (DH) handshakes, which allows malicious Tor servers to obtain the keys that a client uses for other systems in the circuit.
72 CVE-2005-2642 Exec Code Overflow 2005-08-23 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in the mutt_decode_xbit function in Handler.c for Mutt 1.5.10 allows remote attackers to execute arbitrary code, possibly due to interactions with libiconv or gettext.
73 CVE-2005-2641 +Priv 2005-08-23 2018-10-19
7.5
User Remote Low Not required Partial Partial Partial
Unknown vulnerability in pam_ldap before 180 does not properly handle a new password policy control, which could allow attackers to gain privileges. NOTE: CVE-2005-2497 had also been assigned to this issue, but CVE-2005-2641 is the correct candidate.
74 CVE-2005-2640 +Info 2005-08-23 2016-10-17
5.0
None Remote Low Not required Partial None None
Behavioral discrepancy information leak in Juniper Netscreen VPN running ScreenOS 5.2.0 and earlier, when using IKE with pre-shared key authentication, allows remote attackers to enumerate valid usernames via an IKE Aggressive Mode packet, which generates a response if the username is valid but does not respond when the username is invalid.
75 CVE-2005-2639 DoS Exec Code Overflow 2005-08-23 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in Chris Moneymaker's World Poker Championship 1.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long nickname.
76 CVE-2005-2638 XSS 2005-08-23 2016-10-17
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in PHPFreeNews 1.40 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) NewsMode parameter to NewsCategoryForm.php, or the (2) Match or (3) NewsMode parameter to SearchResults.php.
77 CVE-2005-2637 Exec Code Sql 2005-08-23 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in PHPFreeNews 1.40 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) Match or (2) CatID parameter to SearchResults.php, or (3) the password to AccessControl.php.
78 CVE-2005-2636 Exec Code Sql 2005-08-23 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in lib-view-direct.inc.php in phpAdsNew and phpPgAds before 2.0.6 allows remote attackers to execute arbitrary SQL commands via the clientid parameter.
79 CVE-2005-2635 Dir. Trav. 2005-08-23 2017-07-10
5.0
None Remote Low Not required None Partial None
Multiple directory traversal vulnerabilities in phpAdsNew and phpPgAds before 2.0.6 allow remote attackers to include arbitrary files via a .. (dot dot) in the (1) layerstyle parameter to adlayer.php or (2) language parameter to js-form.php.
80 CVE-2005-2634 DoS Exec Code Overflow 2005-08-23 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in the Log-SCR function in the "Log to Screen" feature in WinFtp Server 1.6.8 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long request.
81 CVE-2005-2633 Exec Code File Inclusion 2005-08-23 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Multiple PHP file inclusion vulnerabilities in (1) admin_o.php, (2) board_o.php, (3) dev_o.php, (4) file_o.php or (5) tech_o.php in PHPTB Topic Board 2.0 and earlier allow remote attackers to execute arbitrary PHP code via the absolutepath parameter.
82 CVE-2005-2632 Exec Code Sql 2005-08-23 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in login_admin_mediabox404.php in mediabox404 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the User field.
83 CVE-2005-2631 Bypass 2005-08-23 2018-10-30
7.5
None Remote Low Not required Partial Partial Partial
Cisco Clean Access (CCA) 3.3.0 to 3.3.9, 3.4.0 to 3.4.5, and 3.5.0 to 3.5.3 does not properly authenticate users when invoking API methods, which could allow remote attackers to bypass security checks, change the assigned role of a user, or disconnect users.
84 CVE-2005-2627 Exec Code Overflow 2005-08-19 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Multiple integer underflows in Kismet before 2005-08-R1 allow remote attackers to execute arbitrary code via (1) kernel headers in a pcap file or (2) data frame dissection, which leads to heap-based buffer overflows.
85 CVE-2005-2626 2005-08-19 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in Kismet before 2005-08-R1 allows remote attackers to have an unknown impact via unprintable characters in the SSID.
86 CVE-2005-2625 Exec Code 2005-08-19 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Incomplete blacklist vulnerability in the checkBlacklist function in CPAINT allows remote attackers to execute arbitrary commands via the (1) ExecuteGlobal function or (2) GetRef statement, which is not included in the blacklist.
87 CVE-2005-2624 Exec Code 2005-08-19 2016-10-17
5.0
None Remote Low Not required None Partial None
Eval injection vulnerability in CPAINT 1.3-SP allows remote attackers to execute arbitrary ASP code via the cpaint_argument[] parameter to (1) calculator.asp or (2) cpaintfile.asp, which is directly fed into an eval statement.
88 CVE-2005-2623 2005-08-19 2016-10-17
5.0
None Remote Low Not required None Partial None
ECW-Shop 6.0.2 allows remote attackers to reduce the total cost of their shopping cart by specifying a negative quantity for an item, which causes the price of the item to be subtracted from the total cost.
89 CVE-2005-2622 XSS 2005-08-19 2016-10-17
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php in ECW-Shop 6.0.2 allows remote attackers to inject arbitrary web script or HTML via the (1) max or (2) ctg parameter.
90 CVE-2005-2621 Sql +Info 2005-08-19 2016-10-17
5.0
None Remote Low Not required Partial None None
index.php in ECW-Shop 6.0.2 allows remote attackers to obtain sensitive information via the (1) min or (2) max parameter with a "'" (single quote), which reveals the path in an error message, possibly due to a SQL injection vulnerability.
91 CVE-2005-2620 2005-08-17 2017-07-10
5.0
None Remote Low Not required Partial None None
grpWise.exe for Novell GroupWise client 5.5 through 6.5.2 stores the password in plaintext in memory, which allows attackers to obtain the password using a debugger or another mechanism to read process memory.
92 CVE-2005-2617 2005-08-17 2008-09-05
3.6
None Local Low Not required None Partial Partial
The syscall32_setup_pages function in syscall32.c for Linux kernel 2.6.12 and later, on the 64-bit x86 platform, does not check the return value of the insert_vm_struct function, which allows local users to trigger a memory leak via a 32-bit application with crafted ELF headers.
93 CVE-2005-2616 Exec Code 2005-08-17 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Multiple PHP file include vulnerabilities in ezUpload 2.2 allow remote attackers to execute arbitrary code via the path parameter to (1) initialize.php, (2) customize.php, (3) form.php, or (4) index.php.
94 CVE-2005-2615 2005-08-17 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
Unknown vulnerability in session.php in EQdkp before 1.3.0 has unknown impact and attack vectors, possibly involving auto_login_id.
95 CVE-2005-2614 Exec Code 2005-08-17 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Discuz! 4.0 rc4 does not properly restrict types of files that are uploaded to the server, which allows remote attackers to execute arbitrary commands via a filename containing ".php.rar" or other multiple extensions that include .php.
96 CVE-2005-2613 Exec Code 2005-08-17 2017-07-10
6.4
None Remote Low Not required Partial Partial None
Unknown vulnerability in CPAINT Ajax Toolkit before 1.3-SP allows attackers to execute arbitrary PHP or ASP code or read files via unknown vectors.
97 CVE-2005-2612 Exec Code 2005-08-17 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Direct code injection vulnerability in WordPress 1.5.1.3 and earlier allows remote attackers to execute arbitrary PHP code via the cache_lastpostdate[server] cookie.
98 CVE-2005-2611 2005-08-17 2017-07-10
10.0
Admin Remote Low Not required Complete Complete Complete
VERITAS Backup Exec for Windows Servers 8.6 through 10.0, Backup Exec for NetWare Servers 9.0 and 9.1, and NetBackup for NetWare Media Server Option 4.5 through 5.1 uses a static password during authentication from the NDMP agent to the server, which allows remote attackers to read and write arbitrary files with the backup server.
99 CVE-2005-2610 XSS 2005-08-17 2008-09-05
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php in VegaDNS 0.8.1, 0.9.8, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the message parameter.
100 CVE-2005-2609 2005-08-17 2008-09-05
5.0
None Remote Low Not required Partial None None
index.php in VegaDNS 0.8.1, 0.9.8, and possibly other versions, allows remote attackers to obtain the full server path via an invalid VDNS_Sessid parameter.
Total number of vulnerabilities : 322   Page : 1 2 (This Page)3 4 5 6 7
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.