CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 9 and 10)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1201 CVE-2005-1897 2005-06-09 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
Unknown vulnerability in FlexCast Audio Video Streaming Server before 2.0 has unknown impact and attack vectors.
1202 CVE-2005-1983 Exec Code Overflow +Priv 2005-08-10 2018-10-12
10.0
Admin Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the Plug and Play (PnP) service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob (aka Mytob) worm.
1203 CVE-2005-2017 +Priv 2005-08-30 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Symantec AntiVirus 9 Corporate Edition allows local users to gain privileges via the "Scan for viruses" option, which launches a help window with raised privileges, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2002-1540.
1204 CVE-2005-2023 2005-06-17 2016-12-19
10.0
None Remote Low Not required Complete Complete Complete
The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 does not properly handle certain options, which can prevent pinentry from being found and causes S/MIME signing to fail.
1205 CVE-2005-2122 Exec Code Overflow 2005-10-21 2019-04-30
10.0
Admin Remote Low Not required Complete Complete Complete
Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a different vulnerability than CVE-2005-2118.
1206 CVE-2005-2149 +Priv Sql 2005-07-06 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
config.php in Cacti 0.8.6e and earlier allows remote attackers to set the no_http_headers switch, then modify session information to gain privileges and disable the use of addslashes to conduct SQL injection attacks.
1207 CVE-2005-2222 2005-07-12 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Unknown vulnerability in the HTTPMail service in MailEnable Professional before 1.6 has unknown impact and attack vectors.
1208 CVE-2005-2247 2005-07-12 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
Multiple unknown vulnerabilities in Moodle before 1.5.1 have unknown impact and attack vectors.
1209 CVE-2005-2249 File Inclusion 2005-07-13 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
Multiple unknown vulnerabilities in Jinzora 2.0.1 have unknown impact and attack vectors, possibly involving a PHP file inclusion vulnerability.
1210 CVE-2005-2257 +Priv 2005-07-13 2016-10-17
10.0
Admin Remote Low Not required Complete Complete Complete
The saveProfile function in PhpSlash 0.8.0 allows remote attackers to modify arbitrary profiles and gain privileges by modifying the author_id parameter.
1211 CVE-2005-2259 Exec Code 2005-07-13 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
The dispallclosed2 function in dispallclosed.pl for multiple USANet Creations products, including (1) USANet Shopping Mall Software, (2) Domain Name Auction Software, (3) Standard Classified Ads Software, and (4) MakeBid Reverse Auction allows remote attackers to execute arbitrary code via shell metacharacters in the DISPCLOSED parameter.
1212 CVE-2005-2277 Exec Code 2005-07-15 2018-08-13
10.0
Admin Remote Low Not required Complete Complete Complete
Bluetooth FTP client (BTFTP) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename argument of a PUT command.
1213 CVE-2005-2286 +Priv 2005-07-18 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
WebEOC before 6.0.2 does not properly check user authorization, which allows remote attackers to gain privileges via a direct request to a resource.
1214 CVE-2005-2290 Exec Code 2005-07-18 2016-10-17
10.0
Admin Remote Low Not required Complete Complete Complete
wps_shop.cgi in WPS Web Portal System 0.7.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) art and (2) cat variables.
1215 CVE-2005-2334 Exec Code 2005-07-20 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Y.SAK allows remote attackers to execute arbitrary commands via shell metacharacters in the $no variable to (1) w_s3mbfm.cgi, (2) w_s3adix.cgi, or (3) w_s3sbfm.cgi.
1216 CVE-2005-2420 Exec Code 2005-08-03 2017-07-10
10.0
Admin Remote Low Not required Complete Complete Complete
flsearch.pl in FtpLocate 2.02 allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP GET request.
1217 CVE-2005-2425 Exec Code Overflow 2005-08-03 2017-07-10
10.0
Admin Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in Ares FileShare 1.1 allows remote attackers or local users to execute arbitrary code via a (1) long history parameter in the configuration file (ares.conf) or (2) long search string.
1218 CVE-2005-2511 2005-08-19 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Unknown vulnerability in Mac OS X 10.4.2 and earlier, when using Kerberos authentication with LDAP, allows attackers to gain access to a root Terminal window.
1219 CVE-2005-2529 +Priv 2005-12-31 2017-07-10
10.0
Admin Remote Low Not required Complete Complete Complete
Unspecified vulnerability in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to gain privileges via unspecified attack vectors relating to "the utility used to update Java shared archives."
1220 CVE-2005-2530 +Priv 2005-12-31 2017-07-10
10.0
Admin Remote Low Not required Complete Complete Complete
Unspecified vulnerability in Java 1.3.1 before 1.3.1_16 on Apple Mac OS X allows an untrusted applet to gain privileges, related to "Mac OS X specific extensions."
1221 CVE-2005-2541 +Priv 2005-08-10 2016-10-17
10.0
Admin Remote Low Not required Complete Complete Complete
Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.
1222 CVE-2005-2593 2005-08-17 2017-07-10
10.0
None Remote Low Not required Complete Complete Complete
Parlano MindAlign 5.0 and later versions uses weak encryption, with unknown impact and attack vectors.
1223 CVE-2005-2611 2005-08-17 2017-07-10
10.0
Admin Remote Low Not required Complete Complete Complete
VERITAS Backup Exec for Windows Servers 8.6 through 10.0, Backup Exec for NetWare Servers 9.0 and 9.1, and NetBackup for NetWare Media Server Option 4.5 through 5.1 uses a static password during authentication from the NDMP agent to the server, which allows remote attackers to read and write arbitrary files with the backup server.
1224 CVE-2005-2626 2005-08-19 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in Kismet before 2005-08-R1 allows remote attackers to have an unknown impact via unprintable characters in the SSID.
1225 CVE-2005-2655 +Priv 2005-08-30 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
lockmail in maildrop before 1.5.3 does not drop privileges before executing commands, which allows local users to gain privileges via command line arguments.
1226 CVE-2005-2659 Overflow 2005-11-16 2008-09-10
10.0
None Remote Low Not required Complete Complete Complete
Buffer overflow in the LZX decompression in CHM Lib (chmlib) 0.35, as used in products such as KchmViewer, has unknown impact and attack vectors.
1227 CVE-2005-2668 Exec Code Overflow 2005-08-23 2017-11-22
10.0
Admin Remote Low Not required Complete Complete Complete
Multiple buffer overflows in Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05, 1.07 before Build 220_13, and 1.11 before Build 29_13 allow remote attackers to execute arbitrary code via unknown vectors.
1228 CVE-2005-2669 Exec Code 2005-08-23 2017-11-21
10.0
Admin Remote Low Not required Complete Complete Complete
Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05, 1.07 before Build 220_13, and 1.11 before Build 29_13 allows remote attackers to execute arbitrary commands via spoofed CAFT packets.
1229 CVE-2005-2679 Exec Code Overflow 2005-08-23 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow in Sysinternals Process Explorer 9.23, and other versions before 9.25, allows local users to execute arbitrary code via a long CompanyName field in the VersionInfo information in a running process.
1230 CVE-2005-2700 Bypass 2005-09-06 2017-10-10
10.0
None Remote Low Not required Complete Complete Complete
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
1231 CVE-2005-2715 Exec Code 2005-10-12 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
Format string vulnerability in the Java user interface service (bpjava-msvc) daemon for VERITAS NetBackup Data and Business Center 4.5FP and 4.5MP, and NetBackup Enterprise/Server/Client 5.0, 5.1, and 6.0, allows remote attackers to execute arbitrary code via the COMMAND_LOGON_TO_MSERVER command.
1232 CVE-2005-2758 Exec Code Overflow 2005-10-05 2017-07-10
10.0
Admin Remote Low Not required Complete Complete Complete
Integer signedness error in the administrative interface for Symantec AntiVirus Scan Engine 4.0 and 4.3 allows remote attackers to execute arbitrary code via crafted HTTP headers with negative values, which lead to a heap-based buffer overflow.
1233 CVE-2005-2771 Bypass 2005-09-02 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
WRQ Reflection for Secure IT Windows Server 6.0 (formerly known as F-Secure SSH server) processes access and deny lists in a case-sensitive manner, when previous versions were case-insensitive, which might allow remote attackers to bypass intended restrictions and login to accounts that should be denied.
1234 CVE-2005-2840 2005-09-07 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
Multiple unknown vulnerabilities in MAXdev MD-Pro 1.0.72 and earlier have unknown impact and unspecified attack vectors, in one or more of the (1) Download, (2) Search, (3) Web links, (4) Blocks, (5) Messages, (6) News, (7) Comments, (8) Settings, (9) Stats or (10) subjects modules.
1235 CVE-2005-3016 2005-09-21 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in the WYSIWYG editor in PHP-Nuke before 7.9 Final have unknown impact and attack vectors.
1236 CVE-2005-3057 Bypass 2005-12-31 2017-07-10
10.0
None Remote Low Not required Complete Complete Complete
The FTP component in FortiGate 2.8 running FortiOS 2.8MR10 and v3beta, and other versions before 3.0 MR1, allows remote attackers to bypass the Fortinet FTP anti-virus engine by sending a STOR command and uploading a file before the FTP server response has been sent, as demonstrated using LFTP.
1237 CVE-2005-3059 2005-09-26 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in Opera 8.50 on Linux and Windows have unknown impact and attack vectors, related to (1) " handling of must-revalidate cache directive for HTTPS pages" or (2) a "display issue with cookie comment encoding."
1238 CVE-2005-3068 2005-09-27 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in Eric Integrated Development Environment (eric3) before 3.7.2 has unknown impact and attack vectors related to a "potential security exploit."
1239 CVE-2005-3116 Exec Code Overflow 2005-11-18 2017-07-10
10.0
Admin Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in a shared library as used by the Volume Manager daemon (vmd) in VERITAS NetBackup Enterprise Server 5.0 MP1 to MP5 and 5.1 up to MP3A allows remote attackers to execute arbitrary code via a crafted packet.
1240 CVE-2005-3142 Exec Code Overflow 2005-10-05 2017-07-10
10.0
Admin Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in Kaspersky Antivirus (KAV) 5.0 and Kaspersky Personal Security Suite 1.1 allows remote attackers to execute arbitrary code via a CAB file with large records after the header.
1241 CVE-2005-3184 Exec Code Overflow 2005-10-20 2017-10-10
10.0
Admin Remote Low Not required Complete Complete Complete
Buffer overflow vulnerability in the unicode_to_bytes in the Service Location Protocol (srvloc) dissector (packet-srvloc.c) in Ethereal allows remote attackers to execute arbitrary code via a srvloc packet with a modified length value.
1242 CVE-2005-3254 Exec Code 2005-10-18 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
The CGIwrap program before 3.9 on Debian GNU/Linux uses an incorrect minimum value of 100 for a UID to determine whether it can perform a seteuid operation, which could allow attackers to execute code as other system UIDs that are greater than the minimum value, which should be 1000 on Debian systems.
1243 CVE-2005-3267 189 DoS Overflow 2005-10-27 2017-07-10
10.0
None Remote Low Not required Complete Complete Complete
Integer overflow in Skype client before 1.4.x.84 on Windows, before 1.3.x.17 on Mac OS, before 1.2.x.18 on Linux, and 1.1.x.6 and earlier allows remote attackers to cause a denial of service (crash) via crafted network data with a large Object Counter value, which leads to a resultant heap-based buffer overflow.
1244 CVE-2005-3277 Exec Code 2005-10-21 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
The LPD service in HP-UX 10.20 11.11 (11i) and earlier allows remote attackers to execute arbitrary code via shell metacharacters ("`" or single backquote) in a request that is not properly handled when an error occurs, as demonstrated by killing the connection, a different vulnerability than CVE-2002-1473.
1245 CVE-2005-3296 2005-10-23 2017-10-10
10.0
Admin Remote Low Not required Complete Complete Complete
The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in.
1246 CVE-2005-3344 2005-11-16 2017-07-10
10.0
Admin Remote Low Not required Complete Complete Complete
The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain access.
1247 CVE-2005-3437 2005-11-02 2012-10-22
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the PL/SQL component in Oracle Database Server 9i up to 10.1.0.4 has unknown impact and attack vectors, aka Oracle Vuln# DB01.
1248 CVE-2005-3438 Overflow 2005-11-02 2012-10-22
10.0
None Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in Oracle Database Server 9i up to 10.1.0.4.2 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB04 in Change Data Capture; (2) DB06 in Data Guard Logical Standby; (3) DB10 in Locale; (4) DB12 in Materialized Views; (5) DB13 in Objects Extension; (6) DB15 in Oracle Label Security; (7) DB27 in Security, possibly due to a buffer overflow in sys.pbsde.init; and (8) DB28 and (9) DB29 in Workspace Manager.
1249 CVE-2005-3439 2005-11-02 2012-10-22
10.0
None Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in Oracle Database Server 10g up to 10.1.0.4.2 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB02, (2) DB03, and (3) DB05 in Change Data Capture; (4) DB07 in Data Pump Export; and (5) DB18, (6) DB19, (7) DB20, (8) DB21, (9) DB22, (10) DB23, (11) DB24, and (12) DB25 in the Spatial component.
1250 CVE-2005-3440 2005-11-02 2012-10-22
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in Database Scheduler in Oracle Database Server 10g up to 10.1.0.3 has unknown impact and attack vectors, aka Oracle Vuln# DB08.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.