CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2005

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1201 CVE-2005-0086 DoS Exec Code Overflow 2005-05-02 2017-10-10
7.5
User Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in less in Red Hat Enterprise Linux 3 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted file, as demonstrated using the UTF-8 locale.
1202 CVE-2005-0084 Exec Code Overflow 2005-05-02 2017-10-10
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in the X11 dissector in Ethereal 0.8.10 through 0.10.8 allows remote attackers to execute arbitrary code via a crafted packet.
1203 CVE-2005-0083 DoS 2005-05-02 2017-07-10
5.0
None Remote Low Not required None None Partial
MySQL MaxDB 7.5.00 for Windows, and possibly earlier versions and other platforms, allows remote attackers to cause a denial of service (application crash) via invalid parameters to the (1) DBMCli_String::ReallocString, (2) DBMCli_String::operator, (3) DBMCli_Buffer::ForceResize, (4) DBMCli_Wizard::InstallDatabase, (5) DBMCli_Devspaces::Complete, (6) DBMWeb_TemplateWizard::askForWriteCountStep5, or (7) DBMWeb_DBMWeb::wizardDB functions, which triggers a null dereference.
1204 CVE-2005-0080 2005-05-02 2016-10-17
5.0
None Remote Low Not required Partial None None
The 55_options_traceback.dpatch patch for mailman 2.1.5 in Ubuntu 4.10 displays a different error message depending on whether the e-mail address is subscribed to a private list, which allows remote attackers to determine the list membership for a given e-mail address.
1205 CVE-2005-0079 DoS Overflow 2005-05-02 2017-07-10
4.6
User Local Low Not required Partial Partial Partial
Buffer overflow in xtrlock 2.0 allows local users to cause a denial of service (application crash) and hijack the desktop session.
1206 CVE-2005-0078 2005-05-02 2017-10-10
4.6
User Local Low Not required Partial Partial Partial
The KDE screen saver in KDE before 3.0.5 does not properly check the return value from a certain function call, which allows attackers with physical access to cause a crash and access the desktop session.
1207 CVE-2005-0077 2005-05-02 2018-10-19
2.1
None Local Low Not required None Partial None
The DBI library (libdbi-perl) for Perl allows local users to overwrite arbitrary files via a symlink attack on a temporary PID file.
1208 CVE-2005-0076 Exec Code Overflow 2005-05-02 2017-07-10
7.2
Admin Local Low Not required Complete Complete Complete
Multiple buffer overflows in the XView library 3.2 may allow local users to execute arbitrary code via setuid applications that use the library.
1209 CVE-2005-0073 Exec Code Overflow 2005-05-02 2008-09-05
4.6
User Local Low Not required Partial Partial Partial
Buffer overflow in queue.c in a support script for sympa 3.3.3, when running setuid, allows local users to execute arbitrary code.
1210 CVE-2005-0071 2005-05-02 2017-07-10
5.0
None Remote Low Not required None Partial None
vdr before 1.2.6 does not securely create files, which allows attackers to overwrite arbitrary files.
1211 CVE-2005-0070 2005-05-02 2008-09-05
7.2
Admin Local Low Not required Complete Complete Complete
Synaesthesia 2.1 and earlier, and possibly other versions, when installed setuid root, does not drop privileges before processing configuration and mixer files, which allows local users to read arbitrary files.
1212 CVE-2005-0065 DoS 2005-05-02 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
The original design of TCP does not check that the TCP sequence number in an ICMP error message is within the range of sequence numbers for data that has been sent but not acknowledged (aka "TCP sequence number checking"), which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using (1) blind connection-reset attacks with forged "Destination Unreachable" messages, (2) blind throughput-reduction attacks with forged "Source Quench" messages, or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced. NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.
1213 CVE-2005-0064 Exec Code Overflow 2005-05-02 2017-10-10
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary code via a PDF file with a large /Encrypt /Length keyLength value.
1214 CVE-2005-0063 Exec Code 2005-05-02 2019-04-30
7.5
User Remote Low Not required Partial Partial Partial
The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document.
1215 CVE-2005-0061 +Priv 2005-05-02 2019-04-30
7.2
Admin Local Low Not required Complete Complete Complete
The kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain access requests.
1216 CVE-2005-0060 Overflow +Priv 2005-05-02 2019-04-30
7.2
Admin Local Low Not required Complete Complete Complete
Buffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application.
1217 CVE-2005-0059 Exec Code Overflow 2005-05-02 2019-04-30
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow in the Message Queuing component of Microsoft Windows 2000 and Windows XP SP1 allows remote attackers to execute arbitrary code via a crafted message.
1218 CVE-2005-0057 Exec Code Overflow 2005-05-02 2019-04-30
7.5
User Remote Low Not required Partial Partial Partial
The Hyperlink Object Library for Windows 98, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a crafted link that triggers an "unchecked buffer" in the library, possibly due to a buffer overflow.
1219 CVE-2005-0056 Exec Code +Info 2005-05-02 2018-10-12
5.1
User Remote High Not required Partial Partial Partial
Internet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability."
1220 CVE-2005-0055 Exec Code Mem. Corr. 2005-05-02 2018-10-12
7.5
User Remote Low Not required Partial Partial Partial
Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability."
1221 CVE-2005-0054 Exec Code 2005-05-02 2018-10-12
5.1
User Remote High Not required Partial Partial Partial
Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability."
1222 CVE-2005-0053 Exec Code 2005-05-02 2019-04-30
7.5
User Remote Low Not required Partial Partial Partial
Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability."
1223 CVE-2005-0051 +Info 2005-05-02 2018-10-12
7.5
User Remote Low Not required Partial Partial Partial
The Server service (srvsvc.dll) in Windows XP SP1 and SP2 allows remote attackers to obtain sensitive information (users who are accessing resources) via an anonymous logon using a named pipe, which is not properly authenticated, aka the "Named Pipe Vulnerability."
1224 CVE-2005-0050 20 DoS Exec Code 2005-05-02 2019-04-30
10.0
None Remote Low Not required Complete Complete Complete
The License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, aka the "License Logging Service Vulnerability."
1225 CVE-2005-0049 XSS 2005-05-02 2018-10-12
4.3
None Remote Medium Not required None Partial None
Windows SharePoint Services and SharePoint Team Services for Windows Server 2003 does not properly validate an HTTP redirection query, which allows remote attackers to inject arbitrary HTML and web script via a cross-site scripting (XSS) attack, or to spoof the web cache.
1226 CVE-2005-0048 DoS Exec Code 2005-05-02 2019-04-30
7.5
User Remote Low Not required Partial Partial Partial
Microsoft Windows XP SP2 and earlier, 2000 SP3 and SP4, Server 2003, and older operating systems allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IP packets with malformed options, aka the "IP Validation Vulnerability."
1227 CVE-2005-0047 Exec Code 2005-05-02 2019-04-30
7.2
Admin Local Low Not required Complete Complete Complete
Windows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability."
1228 CVE-2005-0045 Exec Code 2005-05-02 2019-04-30
7.5
User Remote Low Not required Partial Partial Partial
The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the "Server Message Block Vulnerability," and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields.
1229 CVE-2005-0044 Exec Code 2005-05-02 2019-04-30
7.5
User Remote Low Not required Partial Partial Partial
The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability."
1230 CVE-2005-0043 Exec Code Overflow 2005-05-02 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in Apple iTunes 4.7 allows remote attackers to execute arbitrary code via a long URL in (1) .m3u or (2) .pls playlist files.
1231 CVE-2005-0040 XSS 2005-05-19 2016-10-17
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in DotNetNuke before 3.0.12 allow remote attackers to inject arbitrary web script or HTML via the (1) register a new user page, (2) User-Agent, or (3) Username, which is not properly quoted before sending to the error log.
1232 CVE-2005-0039 2005-05-10 2016-10-17
6.4
None Remote Low Not required Partial Partial None
Certain configurations of IPsec, when using Encapsulating Security Payload (ESP) in tunnel mode, integrity protection at a higher layer, or Authentication Header (AH), allow remote attackers to decrypt IPSec communications by modifying the outer packet in ways that cause plaintext data from the inner packet to be returned in ICMP messages, as demonstrated using bit-flipping attacks and (1) Destination Address Rewriting, (2) a modified header length that causes portions of the packet to be interpreted as IP Options, or (3) a modified protocol field and source address.
1233 CVE-2005-0035 2005-05-02 2008-09-05
5.1
User Remote High Not required Partial Partial Partial
The Acrobat web control in Adobe Acrobat and Acrobat Reader 7.0 and earlier, when used with Internet Explorer, allows remote attackers to determine the existence of arbitrary files via the LoadFile ActiveX method.
1234 CVE-2005-0034 DoS 2005-05-02 2017-07-10
4.3
None Remote Medium Not required None None Partial
An "incorrect assumption" in the authvalidated validator function in BIND 9.3.0, when DNSSEC is enabled, allows remote attackers to cause a denial of service (named server exit) via crafted DNS packets that cause an internal consistency test (self-check) to fail.
1235 CVE-2005-0033 DoS Overflow 2005-05-02 2017-07-10
5.0
None Remote Low Not required None None Partial
Buffer overflow in the code for recursion and glue fetching in BIND 8.4.4 and 8.4.5 allows remote attackers to cause a denial of service (crash) via queries that trigger the overflow in the q_usedns array that tracks nameservers and addresses.
1236 CVE-2005-0022 Exec Code Overflow 2005-05-02 2017-10-10
4.6
User Local Low Not required Partial Partial Partial
Buffer overflow in the spa_base64_to_bits function in Exim before 4.43, as originally obtained from Samba code, and as called by the auth_spa_client function, may allow attackers to execute arbitrary code during SPA authentication.
1237 CVE-2005-0021 Exec Code Overflow 2005-05-02 2017-10-10
7.2
Admin Local Low Not required Complete Complete Complete
Multiple buffer overflows in Exim before 4.43 may allow attackers to execute arbitrary code via (1) an IPv6 address with more than 8 components, as demonstrated using the -be command line option, which triggers an overflow in the host_aton function, or (2) the -bh command line option or dnsdb PTR lookup, which triggers an overflow in the dns_build_reverse function.
1238 CVE-2005-0018 2005-05-02 2008-09-05
2.1
None Local Low Not required Partial None None
The f2 shell script in the f2c package 3.1 allows local users to read arbitrary files via a symlink attack on temporary files.
1239 CVE-2005-0017 2005-05-02 2008-09-05
2.1
None Local Low Not required Partial None None
The f2c translator in the f2c package 3.1 allows local users to read arbitrary files via a symlink attack on temporary files.
1240 CVE-2005-0015 Exec Code 2005-05-02 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
diatheke.pl in Sword 1.5.7a allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
1241 CVE-2005-0014 Exec Code Overflow 2005-05-02 2018-10-19
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in ncplogin in ncpfs before 2.2.6 allows remote malicious NetWare servers to execute arbitrary code on the NetWare client.
1242 CVE-2005-0013 +Priv 2005-05-02 2018-10-19
7.2
Admin Local Low Not required Complete Complete Complete
nwclient.c in ncpfs before 2.2.6 does not drop root privileges before executing utilities using the NetWare client functions, which allows local users to gain privileges.
1243 CVE-2005-0012 Exec Code 2005-05-02 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
Format string vulnerability in the a_Interface_msg function in Dillo before 0.8.3-r4 allows remote attackers to execute arbitrary code via format string specifiers in a web page.
1244 CVE-2005-0011 Exec Code Overflow 2005-05-02 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Multiple vulnerabilities in fliccd, when installed setuid root as part of the kdeedu Kstars support for Instrument Neutral Distributed Interface (INDI) in KDE 3.3 to 3.3.2, allow local users and remote attackers to execute arbitrary code via stack-based buffer overflows.
1245 CVE-2005-0010 DoS 2005-05-02 2017-10-10
5.0
None Remote Low Not required None None Partial
Unknown vulnerability in the MMSE dissector in Ethereal 0.10.4 through 0.10.8 allows remote attackers to cause a denial of service by triggering a free of statically allocated memory.
1246 CVE-2005-0009 DoS 2005-05-02 2017-10-10
5.0
None Remote Low Not required None None Partial
Unknown vulnerability in the Gnutella dissector in Ethereal 0.10.6 through 0.10.8 allows remote attackers to cause a denial of service (application crash).
1247 CVE-2005-0008 Mem. Corr. 2005-05-02 2017-10-10
5.0
None Remote Low Not required None Partial None
Unknown vulnerability in the DNP dissector in Ethereal 0.10.5 through 0.10.8 allows remote attackers to cause "memory corruption."
1248 CVE-2005-0007 DoS 2005-05-02 2017-10-10
5.0
None Remote Low Not required None None Partial
Unknown vulnerability in the DLSw dissector in Ethereal 0.10.6 through 0.10.8 allows remote attackers to cause a denial of service (application crash from assertion).
1249 CVE-2005-0006 DoS 2005-05-02 2017-10-10
5.0
None Remote Low Not required None None Partial
The COPS dissector in Ethereal 0.10.6 through 0.10.8 allows remote attackers to cause a denial of service (infinite loop).
1250 CVE-2005-0005 Exec Code Overflow 2005-05-02 2017-10-10
7.5
User Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in psd.c for ImageMagick 6.1.0, 6.1.7, and possibly earlier versions allows remote attackers to execute arbitrary code via a .PSD image file with a large number of layers.
Total number of vulnerabilities : 1255   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 (This Page)26
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.