CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In February 2005

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2005-0937 2005-02-22 2018-10-19
1.2
 None Local High Not required None None Partial
Some futex functions in futex.c for Linux kernel 2.6.x perform get_user calls while holding the mmap_sem semaphore, which could allow local users to cause a deadlock condition in do_page_fault by triggering get_user faults while another thread is executing mmap or other functions.
2 CVE-2005-0625 2005-02-28 2017-07-11
2.1
 None Local Low Not required Partial None None
reportbug 3.2 includes settings from .reportbugrc in bug reports, which exposes sensitive information such as smtpuser and smtppasswd.
3 CVE-2005-0624 2005-02-28 2017-07-11
2.1
 None Local Low Not required Partial None None
reportbug before 2.62 creates the .reportbugrc configuration file with world-readable permissions, which allows local users to obtain email smarthost passwords.
4 CVE-2005-0619 +Priv 2005-02-28 2017-10-19
2.1
 None Local Low Not required Partial None None
Einstein 1.0.1 stores sensitive information such as usernames and passwords in plaintext in the registry, which allows local users to gain privileges.
5 CVE-2005-0616 XSS 2005-02-28 2016-10-18
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the Download module for PostNuke 0.750 and 0.760-RC2 allow remote attackers to inject arbitrary web script or HTML via the (1) Program name, (2) File link, (3) Author name (4) Author e-mail address, (5) File size, (6) Version, or (7) Home page variables.
6 CVE-2005-0613 2005-02-28 2008-09-05
5.0
 None Remote Low Not required None Partial None
Unknown vulnerability in FCKeditor 2.0 RC2, when used with PHP-Nuke, allows remote attackers to upload arbitrary files.
7 CVE-2005-0608 DoS Exec Code Overflow 2005-02-28 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in server.cpp for WebMod 0.47 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a POST request with a Content-Length that is less than the amount of data that is actually sent.
8 CVE-2005-0603 +Info 2005-02-28 2016-10-18
5.0
 None Remote Low Not required Partial None None
viewtopic.php in phpBB 2.0.12 and earlier allows remote attackers to obtain sensitive information via a highlight parameter containing invalid regular expression syntax, which reveals the path in a PHP error message.
9 CVE-2005-0600 DoS 2005-02-24 2018-10-30
5.0
 None Remote Low Not required None None Partial
Cisco devices running Application and Content Networking System (ACNS) 5.0, 5.1 before 5.1.13.7, or 5.2 before 5.2.3.9 allow remote attackers to cause a denial of service (bandwidth consumption) via "crafted IP packets" that are continuously forwarded.
10 CVE-2005-0598 DoS 2005-02-24 2018-10-30
5.0
 None Remote Low Not required None None Partial
The RealServer RealSubscriber on Cisco devices running Application and Content Networking System (ACNS) 5.1 allow remote attackers to cause a denial of service (CPU consumption) via malformed packets.
11 CVE-2005-0580 2005-02-25 2008-09-05
2.1
 None Local Low Not required Partial None None
cmd5checkpw, when running setuid, does not properly drop privileges before calling the execvp function, which allows local users to read the poppasswd file.
12 CVE-2005-0579 2005-02-25 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
nxagent in FreeNX before 0.2.8 does not properly handle when the XAUTHORITY environment variable is not set, which allows local users to access the X server without X authentication.
13 CVE-2005-0547 2005-02-24 2017-10-11
4.6
 None Local Low Not required Partial Partial Partial
Unknown vulnerability in ftpd on HP-UX B.11.00, B.11.04, B.11.11, B.11.22, and B.11.23 allows remote authenticated users to gain "unauthorized access to files."
14 CVE-2005-0543 79 XSS 2005-02-24 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary HTML and web script via (1) the strServer, cfg[BgcolorOne], or strServerChoice parameters in select_server.lib.php, (2) the bg_color or row_no parameters in display_tbl_links.lib.php, the left_font_family parameter in theme_left.css.php, or the right_font_family parameter in theme_right.css.php.
15 CVE-2005-0537 Sql 2005-02-21 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in page.php for iGeneric (iG) Shop 1.2 may allow remote attackers to execute arbitrary SQL statements via the (1) cats, (2) l_price, or (3) u_price parameters.
16 CVE-2005-0535 CSRF 2005-02-22 2011-03-08
7.5
 None Remote Low Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to perform unauthorized actions as authenticated MediaWiki users.
17 CVE-2005-0521 +Priv 2005-02-23 2008-09-05
2.1
 None Local Low Not required Partial None None
SendLink 1.5 stores sensitive information, possibly including passwords, in plaintext in the data.eat file, which allows local users to gain privileges.
18 CVE-2005-0520 2005-02-23 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
ArGoSoft FTP Server before 1.4.2.8 allows remote attackers to read arbitrary files via shortcut (.LNK) files in the SITE COPY command, a different vulnerability than CVE-2005-0519.
19 CVE-2005-0519 2005-02-18 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
ArGoSoft FTP Server before 1.4.2.7 allows remote attackers to read arbitrary files by uploading a ZIP file containing a shortcut (.LNK) file, using SITE UNZIP to extract the .LNK file onto the server, then accessing the file, a different vulnerability than CVE-2005-0520.
20 CVE-2005-0518 +Priv 2005-02-23 2008-09-05
2.1
 None Local Low Not required Partial None None
eXeem 0.21 stores sensitive information such as passwords in plaintext in the Exeem registry key, which allows local users to gain privileges via the proxy_user and proxy_password values.
21 CVE-2005-0517 +Priv 2005-02-23 2008-09-05
2.1
 None Local Low Not required Partial None None
PeerFTP_5 stores sensitive information such as passwords in plaintext in the PeerFTP.ini files, which allows local users to gain privileges.
22 CVE-2005-0516 Exec Code 2005-02-23 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
The ImageGalleryPlugin (ImageGalleryPlugin.pm) in Twiki allows remote attackers to execute arbitrary commands via certain commands that generate thumbnails.
23 CVE-2005-0514 XSS 2005-02-22 2008-09-05
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Verity Ultraseek before 5.3.3 allows remote attackers to inject arbitrary HTML and web script via search parameters.
24 CVE-2005-0513 Exec Code File Inclusion 2005-02-19 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in mail_autocheck.php in the Email This Entry add-on for pMachine Pro 2.4, and possibly other versions including pMachine Free, allows remote attackers to execute arbitrary PHP code by directly requesting mail_autocheck.php and modifying the pm_path parameter to reference a URL on a remote web server that contains the code, a different vulnerability than CVE-2003-1086.
25 CVE-2005-0512 Exec Code File Inclusion 2005-02-21 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in Tar.php in Mambo 4.5.2 allows remote attackers to execute arbitrary PHP code by modifying the mosConfig_absolute_path parameter to reference a URL on a remote web server that contains the code, a different vulnerability than CVE-2004-1693.
26 CVE-2005-0511 Exec Code 2005-02-21 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the template parameter.
27 CVE-2005-0503 +Priv 2005-02-21 2008-09-10
4.6
 None Local Low Not required Partial Partial Partial
uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges.
28 CVE-2005-0502 Dir. Trav. 2005-02-18 2017-07-11
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in Xinkaa 1.0.3 and earlier allows remote attackers to read arbitrary files via (1) ../ and (2) ..\ characters in an HTTP request.
29 CVE-2005-0499 DoS 2005-02-20 2017-07-11
5.0
 None Remote Low Not required None None Partial
Gigafast router (aka CompUSA router) with the DNS proxy option enabled allows remote attackers to cause a denial of service via malformed DNS queries.
30 CVE-2005-0496 Exec Code 2005-02-21 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Arkeia Network Backup Client 5.x contains hard-coded credentials that effectively serve as a back door, which allows remote attackers to access the file system and possibly execute arbitrary commands.
31 CVE-2005-0495 XSS 2005-02-19 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in ZeroBoard allows remote attackers to inject arbitrary web script or HTML via the (1) sn1, (2) year, or (3) page parameter to zboard.php or (4) filename to view_image.php.
32 CVE-2005-0494 2005-02-21 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
The RgSecurity form in the HTTP server for the Thomson TCW690 cable modem running firmware 2.1 and software ST42.03.0a does not properly validate the password before performing changes, which allows remote attackers on the LAN to gain access via a direct POST request.
33 CVE-2005-0467 Exec Code Overflow 2005-02-21 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Multiple integer overflows in the (1) sftp_pkt_getstring and (2) fxp_readdir_recv functions in the PSFTP and PSCP clients for PuTTY 0.56, and possibly earlier versions, allow remote malicious web sites to execute arbitrary code via SFTP responses that corrupt the heap after insufficient memory has been allocated.
34 CVE-2005-0462 XSS 2005-02-17 2008-09-05
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in MercuryBoard 1.0.x and 1.1.x allows remote attackers to inject arbitrary HTML and web script via the f parameter.
35 CVE-2005-0453 2005-02-16 2008-09-05
5.0
 None Remote Low Not required Partial None None
The buffer_urldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source code for CGI and FastCGI scripts via a URL with a %00 (null) character after the file extension.
36 CVE-2005-0452 XSS 2005-02-16 2016-10-18
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Microsoft ASP.NET (.Net) 1.0 and 1.1 to SP1 allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including ">" and "<".
37 CVE-2005-0447 DoS 2005-02-15 2018-10-30
5.0
 None Remote Low Not required None None Partial
Solaris 7, 8, and 9 allows remote attackers to cause a denial of service (hang) via a flood of certain ARP packets.
38 CVE-2005-0444 Exec Code 2005-02-14 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
VMware before 4.5.2.8848-r5 searches for gdk-pixbuf shared libraries using a path that includes the rrdharan world-writable temporary directory, which allows local users to execute arbitrary code.
39 CVE-2005-0434 XSS 2005-02-15 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 7.5 allow remote attackers to inject arbitrary HTML or web script via (1) the newdownloadshowdays parameter in a NewDownloads operation or (2) the newlinkshowdays parameter in a NewLinks operation.
40 CVE-2005-0433 2005-02-15 2017-07-11
5.0
 None Remote Low Not required Partial None None
Php-Nuke 7.5 allows remote attackers to determine the full path of the web server via invalid or missing arguments to (1) db.php, (2) mainfile.php, (3) Downloads/index.php, or (4) Web_Links/index.php, which lists the path in a PHP error message.
41 CVE-2005-0430 DoS Overflow 2005-02-12 2016-10-18
5.0
 None Remote Low Not required None None Partial
The Quake 3 engine, as used in multiple game packages, allows remote attackers to cause a denial of service (shutdown game server) and possibly crash the server via a long infostring, possibly triggering a buffer overflow.
42 CVE-2005-0411 Dir. Trav. 2005-02-14 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in index.php for CitrusDB 0.3.6 and earlier allows remote attackers and local users to include arbitrary PHP files via .. (dot dot) sequences in the load parameter.
43 CVE-2005-0410 Sql 2005-02-14 2008-09-10
5.0
 None Remote Low Not required None Partial None
SQL injection vulnerability in importcc.php for CitrusDB 0.3.6 and earlier allows remote attackers to inject data via the fields of a CSV file.
44 CVE-2005-0409 +Info 2005-02-14 2008-09-10
6.4
 None Remote Low Not required Partial Partial None
CitrusDB 0.3.6 and earlier does not verify authorization for the (1) importcc.php and (2) uploadcc.php, which allows remote attackers to upload credit card data and obtain sensitive information such as the pathnames for temporary files that store credit card data, and facilitates the exploitation of other vulnerabilities.
45 CVE-2005-0408 +Priv Bypass 2005-02-14 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the "boogaadeeboo" string, which is hard-coded in the $hidden_hash variable.
46 CVE-2005-0406 +Info 2005-02-14 2008-09-10
2.1
 None Local Low Not required Partial None None
A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, which could lead to an information leak of potentially sensitive visual information that had been removed from the main JPEG image.
47 CVE-2005-0367 Dir. Trav. 2005-02-09 2016-10-18
4.6
 None Local Low Not required Partial Partial Partial
Multiple directory traversal vulnerabilities in ArGoSoft Mail Server 1.8.7.3 allow remote authenticated users to read, delete, or upload arbitrary files via a .. (dot dot) in (1) the filename of an e-mail attachment, (2) the _msgatt.rec file, (3) and the /msg, /delete, /folderadd, and /folderdelete operations for the Folder parameter.
48 CVE-2005-0364 DoS 2005-02-10 2017-10-11
5.0
 None Remote Low Not required None None Partial
Unknown vulnerability in BIND 9.2.0 in HP-UX B.11.00, B.11.11, and B.11.23 allows remote attackers to cause a denial of service.
49 CVE-2005-0362 Exec Code 2005-02-09 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pluginmode", (2) "loadplugin", or (3) "noloadplugin" parameters.
50 CVE-2005-0261 2005-02-10 2017-07-11
2.1
 None Local Low Not required Partial None None
lspath in AIX 5.2, 5.3, and possibly earlier versions, does not drop privileges before processing the -f option, which allows local users to read one line of arbitrary files.
Total number of vulnerabilities : 105   Page : 1 (This Page)2 3
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.