CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2005

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-1999-1374 +Info 2005-05-02 2016-10-18
5.0
 None Remote Low Not required Partial None None
perlshop.cgi shopping cart program stores sensitive customer information in directories and files that are under the web root, which allows remote attackers to obtain that information via an HTTP request.
2 CVE-1999-1557 DoS Exec Code Overflow 2005-05-02 2017-12-19
5.0
 None Remote Low Not required None None Partial
Buffer overflow in the login functions in IMAP server (imapd) in Ipswitch IMail 5.0 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via (1) a long user name or (2) a long password.
3 CVE-2001-1420 DoS Overflow 2005-05-02 2017-07-11
5.0
 None Remote Low Not required None None Partial
AOL Instant Messenger (AIM) 4.7 allows remote attackers to cause a denial of service (application crash) via a long filename, possibly caused by a buffer overflow.
4 CVE-2005-0001 Exec Code 2005-05-02 2017-10-11
6.9
 None Local Medium Not required Complete Complete Complete
Race condition in the page fault handler (fault.c) for Linux kernel 2.2.x to 2.2.7, 2.4 to 2.4.29, and 2.6 to 2.6.10, when running on multiprocessor machines, allows local users to execute arbitrary code via concurrent threads that share the same virtual memory space and simultaneously request stack expansion.
5 CVE-2005-0002 2005-05-02 2008-09-10
10.0
 None Remote Low Not required Complete Complete Complete
poppassd_pam 1.0 and earlier, when changing a user password, does not verify that the user entered the old password correctly, which allows remote attackers to change passwords for arbitrary users.
6 CVE-2005-0005 Exec Code Overflow 2005-05-02 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in psd.c for ImageMagick 6.1.0, 6.1.7, and possibly earlier versions allows remote attackers to execute arbitrary code via a .PSD image file with a large number of layers.
7 CVE-2005-0006 DoS 2005-05-02 2017-10-11
5.0
 None Remote Low Not required None None Partial
The COPS dissector in Ethereal 0.10.6 through 0.10.8 allows remote attackers to cause a denial of service (infinite loop).
8 CVE-2005-0007 DoS 2005-05-02 2017-10-11
5.0
 None Remote Low Not required None None Partial
Unknown vulnerability in the DLSw dissector in Ethereal 0.10.6 through 0.10.8 allows remote attackers to cause a denial of service (application crash from assertion).
9 CVE-2005-0008 Mem. Corr. 2005-05-02 2017-10-11
5.0
 None Remote Low Not required None Partial None
Unknown vulnerability in the DNP dissector in Ethereal 0.10.5 through 0.10.8 allows remote attackers to cause "memory corruption."
10 CVE-2005-0009 DoS 2005-05-02 2017-10-11
5.0
 None Remote Low Not required None None Partial
Unknown vulnerability in the Gnutella dissector in Ethereal 0.10.6 through 0.10.8 allows remote attackers to cause a denial of service (application crash).
11 CVE-2005-0010 DoS 2005-05-02 2017-10-11
5.0
 None Remote Low Not required None None Partial
Unknown vulnerability in the MMSE dissector in Ethereal 0.10.4 through 0.10.8 allows remote attackers to cause a denial of service by triggering a free of statically allocated memory.
12 CVE-2005-0011 Exec Code Overflow 2005-05-02 2008-09-05
10.0
 None Remote Low Not required Complete Complete Complete
Multiple vulnerabilities in fliccd, when installed setuid root as part of the kdeedu Kstars support for Instrument Neutral Distributed Interface (INDI) in KDE 3.3 to 3.3.2, allow local users and remote attackers to execute arbitrary code via stack-based buffer overflows.
13 CVE-2005-0012 Exec Code 2005-05-02 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Format string vulnerability in the a_Interface_msg function in Dillo before 0.8.3-r4 allows remote attackers to execute arbitrary code via format string specifiers in a web page.
14 CVE-2005-0013 +Priv 2005-05-02 2018-10-19
7.2
 None Local Low Not required Complete Complete Complete
nwclient.c in ncpfs before 2.2.6 does not drop root privileges before executing utilities using the NetWare client functions, which allows local users to gain privileges.
15 CVE-2005-0014 Exec Code Overflow 2005-05-02 2018-10-19
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in ncplogin in ncpfs before 2.2.6 allows remote malicious NetWare servers to execute arbitrary code on the NetWare client.
16 CVE-2005-0015 Exec Code 2005-05-02 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
diatheke.pl in Sword 1.5.7a allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
17 CVE-2005-0017 2005-05-02 2008-09-05
2.1
 None Local Low Not required Partial None None
The f2c translator in the f2c package 3.1 allows local users to read arbitrary files via a symlink attack on temporary files.
18 CVE-2005-0018 2005-05-02 2008-09-05
2.1
 None Local Low Not required Partial None None
The f2 shell script in the f2c package 3.1 allows local users to read arbitrary files via a symlink attack on temporary files.
19 CVE-2005-0021 Exec Code Overflow 2005-05-02 2017-10-11
7.2
 None Local Low Not required Complete Complete Complete
Multiple buffer overflows in Exim before 4.43 may allow attackers to execute arbitrary code via (1) an IPv6 address with more than 8 components, as demonstrated using the -be command line option, which triggers an overflow in the host_aton function, or (2) the -bh command line option or dnsdb PTR lookup, which triggers an overflow in the dns_build_reverse function.
20 CVE-2005-0022 Exec Code Overflow 2005-05-02 2017-10-11
4.6
 None Local Low Not required Partial Partial Partial
Buffer overflow in the spa_base64_to_bits function in Exim before 4.43, as originally obtained from Samba code, and as called by the auth_spa_client function, may allow attackers to execute arbitrary code during SPA authentication.
21 CVE-2005-0033 DoS Overflow 2005-05-02 2017-07-11
5.0
 None Remote Low Not required None None Partial
Buffer overflow in the code for recursion and glue fetching in BIND 8.4.4 and 8.4.5 allows remote attackers to cause a denial of service (crash) via queries that trigger the overflow in the q_usedns array that tracks nameservers and addresses.
22 CVE-2005-0034 DoS 2005-05-02 2017-07-11
4.3
 None Remote Medium Not required None None Partial
An "incorrect assumption" in the authvalidated validator function in BIND 9.3.0, when DNSSEC is enabled, allows remote attackers to cause a denial of service (named server exit) via crafted DNS packets that cause an internal consistency test (self-check) to fail.
23 CVE-2005-0035 2005-05-02 2011-03-08
5.1
 None Remote High Not required Partial Partial Partial
The Acrobat web control in Adobe Acrobat and Acrobat Reader 7.0 and earlier, when used with Internet Explorer, allows remote attackers to determine the existence of arbitrary files via the LoadFile ActiveX method.
24 CVE-2005-0039 2005-05-10 2016-10-18
6.4
 None Remote Low Not required Partial Partial None
Certain configurations of IPsec, when using Encapsulating Security Payload (ESP) in tunnel mode, integrity protection at a higher layer, or Authentication Header (AH), allow remote attackers to decrypt IPSec communications by modifying the outer packet in ways that cause plaintext data from the inner packet to be returned in ICMP messages, as demonstrated using bit-flipping attacks and (1) Destination Address Rewriting, (2) a modified header length that causes portions of the packet to be interpreted as IP Options, or (3) a modified protocol field and source address.
25 CVE-2005-0040 XSS 2005-05-19 2016-10-18
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in DotNetNuke before 3.0.12 allow remote attackers to inject arbitrary web script or HTML via the (1) register a new user page, (2) User-Agent, or (3) Username, which is not properly quoted before sending to the error log.
26 CVE-2005-0043 Exec Code Overflow 2005-05-02 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Apple iTunes 4.7 allows remote attackers to execute arbitrary code via a long URL in (1) .m3u or (2) .pls playlist files.
27 CVE-2005-0044 Exec Code 2005-05-02 2019-04-30
7.5
 None Remote Low Not required Partial Partial Partial
The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability."
28 CVE-2005-0045 Exec Code 2005-05-02 2019-04-30
7.5
 None Remote Low Not required Partial Partial Partial
The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the "Server Message Block Vulnerability," and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields.
29 CVE-2005-0047 Exec Code 2005-05-02 2019-04-30
7.2
 None Local Low Not required Complete Complete Complete
Windows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability."
30 CVE-2005-0048 DoS Exec Code 2005-05-02 2019-04-30
7.5
 None Remote Low Not required Partial Partial Partial
Microsoft Windows XP SP2 and earlier, 2000 SP3 and SP4, Server 2003, and older operating systems allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IP packets with malformed options, aka the "IP Validation Vulnerability."
31 CVE-2005-0049 XSS 2005-05-02 2018-10-12
4.3
 None Remote Medium Not required None Partial None
Windows SharePoint Services and SharePoint Team Services for Windows Server 2003 does not properly validate an HTTP redirection query, which allows remote attackers to inject arbitrary HTML and web script via a cross-site scripting (XSS) attack, or to spoof the web cache.
32 CVE-2005-0050 20 DoS Exec Code 2005-05-02 2019-04-30
10.0
 None Remote Low Not required Complete Complete Complete
The License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, aka the "License Logging Service Vulnerability."
33 CVE-2005-0051 +Info 2005-05-02 2018-10-12
7.5
 None Remote Low Not required Partial Partial Partial
The Server service (srvsvc.dll) in Windows XP SP1 and SP2 allows remote attackers to obtain sensitive information (users who are accessing resources) via an anonymous logon using a named pipe, which is not properly authenticated, aka the "Named Pipe Vulnerability."
34 CVE-2005-0053 Exec Code 2005-05-02 2021-07-23
7.5
 None Remote Low Not required Partial Partial Partial
Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability."
35 CVE-2005-0054 Exec Code 2005-05-02 2021-07-23
5.1
 None Remote High Not required Partial Partial Partial
Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability."
36 CVE-2005-0055 Exec Code Mem. Corr. 2005-05-02 2021-07-23
7.5
 None Remote Low Not required Partial Partial Partial
Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability."
37 CVE-2005-0056 Exec Code +Info 2005-05-02 2021-07-23
5.1
 None Remote High Not required Partial Partial Partial
Internet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability."
38 CVE-2005-0057 Exec Code Overflow 2005-05-02 2019-04-30
7.5
 None Remote Low Not required Partial Partial Partial
The Hyperlink Object Library for Windows 98, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a crafted link that triggers an "unchecked buffer" in the library, possibly due to a buffer overflow.
39 CVE-2005-0059 Exec Code Overflow 2005-05-02 2019-04-30
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the Message Queuing component of Microsoft Windows 2000 and Windows XP SP1 allows remote attackers to execute arbitrary code via a crafted message.
40 CVE-2005-0060 Overflow +Priv 2005-05-02 2019-04-30
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application.
41 CVE-2005-0061 +Priv 2005-05-02 2019-04-30
7.2
 None Local Low Not required Complete Complete Complete
The kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain access requests.
42 CVE-2005-0063 Exec Code 2005-05-02 2019-04-30
7.5
 None Remote Low Not required Partial Partial Partial
The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document.
43 CVE-2005-0064 Exec Code Overflow 2005-05-02 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary code via a PDF file with a large /Encrypt /Length keyLength value.
44 CVE-2005-0065 DoS 2005-05-02 2008-09-05
10.0
 None Remote Low Not required Complete Complete Complete
The original design of TCP does not check that the TCP sequence number in an ICMP error message is within the range of sequence numbers for data that has been sent but not acknowledged (aka "TCP sequence number checking"), which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using (1) blind connection-reset attacks with forged "Destination Unreachable" messages, (2) blind throughput-reduction attacks with forged "Source Quench" messages, or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced. NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.
45 CVE-2005-0070 2005-05-02 2008-09-05
7.2
 None Local Low Not required Complete Complete Complete
Synaesthesia 2.1 and earlier, and possibly other versions, when installed setuid root, does not drop privileges before processing configuration and mixer files, which allows local users to read arbitrary files.
46 CVE-2005-0071 2005-05-02 2017-07-11
5.0
 None Remote Low Not required None Partial None
vdr before 1.2.6 does not securely create files, which allows attackers to overwrite arbitrary files.
47 CVE-2005-0073 Exec Code Overflow 2005-05-02 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
Buffer overflow in queue.c in a support script for sympa 3.3.3, when running setuid, allows local users to execute arbitrary code.
48 CVE-2005-0076 Exec Code Overflow 2005-05-02 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
Multiple buffer overflows in the XView library 3.2 may allow local users to execute arbitrary code via setuid applications that use the library.
49 CVE-2005-0077 2005-05-02 2018-10-19
2.1
 None Local Low Not required None Partial None
The DBI library (libdbi-perl) for Perl allows local users to overwrite arbitrary files via a symlink attack on a temporary PID file.
50 CVE-2005-0078 2005-05-02 2017-10-11
4.6
 None Local Low Not required Partial Partial Partial
The KDE screen saver in KDE before 3.0.5 does not properly check the return value from a certain function call, which allows attackers with physical access to cause a crash and access the desktop session.
Total number of vulnerabilities : 1255   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.