CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In September 2005

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2005-0138 17 2005-09-21 2016-05-09
7.5
None Remote Low Not required Partial Partial Partial
rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not correctly allow access to anonymous clients that connect from a system whose hostname can not be determined. NOTE: while this issue occurs in a security mechanism, there is no apparent attacker role and probably does not satisfy the CVE definition of a vulnerability.
2 CVE-2005-0139 264 2005-09-21 2016-05-09
7.5
None Remote Low Not required Partial Partial Partial
Unknown vulnerability in rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not sufficiently restrict access rights for read-mostly exports, which allows attackers to conduct unauthorized activities.
3 CVE-2005-0403 DoS 2005-09-01 2017-10-11
7.2
None Local Low Not required Complete Complete Complete
init_dev in tty_io.c in the Red Hat backport of NPTL to Red Hat Enterprise Linux 3 does not properly clear controlling tty's in multi-threaded applications, which allows local users to cause a denial of service (crash) and possibly gain tty access via unknown attack vectors that trigger an access of a pointer to a freed structure.
4 CVE-2005-1857 Exec Code 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Format string vulnerability in simpleproxy before 3.4 allows remote malicious HTTP proxies to execute arbitrary code via format string specifiers in a reply.
5 CVE-2005-1913 DoS 2005-09-14 2017-07-11
2.1
None Local Low Not required None None Partial
The Linux kernel 2.6 before 2.6.12.1 allows local users to cause a denial of service (kernel panic) via a non group-leader thread executing a different program than was pending in itimer, which causes the signal to be delivered to the old group-leader task, which does not exist.
6 CVE-2005-1915 2005-09-02 2011-03-08
2.1
None Local Low Not required None Partial None
The log4sh_readProperties function in log4sh 1.2.5 and earlier allows local users to overwrite arbitrary files via a symlink attack on predictable log4sh.$$ filenames.
7 CVE-2005-2020 Dir. Trav. 2005-09-08 2011-03-08
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in the web server for 3Com Network Supervisor 5.0.2 allows remote attackers to read arbitrary files via ".." sequences in the URL to TCP port 21700.
8 CVE-2005-2336 XSS 2005-09-06 2008-11-11
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Hiki 0.8.0 to 0.8.2 allows remote attackers to inject arbitrary web script or HTML via "missing pages" in which the page name is not properly escaped, a different vulnerability than CVE-2005-2803.
9 CVE-2005-2490 Exec Code Overflow 2005-09-14 2018-10-19
4.6
None Local Low Not required Partial Partial Partial
Stack-based buffer overflow in the sendmsg function call in the Linux kernel 2.6 before 2.6.13.1 allows local users to execute arbitrary code by calling sendmsg and modifying the message contents in another thread.
10 CVE-2005-2492 264 DoS 2005-09-14 2018-10-19
3.6
None Local Low Not required Partial None Partial
The raw_sendmsg function in the Linux kernel 2.6 before 2.6.13.1 allows local users to cause a denial of service (change hardware state) or read from arbitrary memory via crafted input.
11 CVE-2005-2494 2005-09-06 2017-10-11
7.2
None Local Low Not required Complete Complete Complete
kcheckpass in KDE 3.2.0 up to 3.4.2 allows local users to gain root access via a symlink attack on lock files.
12 CVE-2005-2495 189 Exec Code Overflow 2005-09-15 2018-10-19
5.1
None Remote High Not required Partial Partial Partial
Multiple integer overflows in XFree86 before 4.3.0 allow user-assisted attackers to execute arbitrary code via a crafted pixmap image.
13 CVE-2005-2496 2005-09-02 2017-10-11
4.6
None Local Low Not required Partial Partial Partial
The xntpd ntp (ntpd) daemon before 4.2.0b, when run with the -u option and using a string to specify the group, uses the group ID of the user instead of the group, which causes xntpd to run with different privileges than intended.
14 CVE-2005-2557 XSS 2005-09-28 2017-07-11
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in view_all_set.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the dir parameter, as identified by bug#0005959, and a different vulnerability than CVE-2005-3090.
15 CVE-2005-2656 DoS 2005-09-06 2008-09-05
2.1
None Local Low Not required None None Partial
Polygen before 1.0.6 generates precompiled grammar objects with world-writable permissions, which allows local users to cause a denial of service (disk consumption) and possibly perform other unauthorized activities.
16 CVE-2005-2657 Exec Code +Priv 2005-09-16 2017-07-11
4.6
None Local Low Not required Partial Partial Partial
Unknown vulnerability in common-lisp-controller 4.18 and earlier allows local users to gain privileges by compiling arbitrary code in the cache directory, which is executed by another user if the user has not run Common Lisp before.
17 CVE-2005-2658 Exec Code Overflow 2005-09-15 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in utility.cpp in Turquoise SuperStat (turqstat) 2.2.4 and earlier might allow remote NNTP servers to execute arbitrary code via a date with a long month.
18 CVE-2005-2660 2005-09-30 2008-09-05
2.1
None Local Low Not required None Partial None
apachetop 0.12.5 and earlier, when running in debug mode, allows local users to create or append to arbitrary files via a symlink attack on atop.debug.
19 CVE-2005-2662 Exec Code 2005-09-21 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
masqmail before 0.2.18 allows remote attackers to execute arbitrary commands via crafted e-mail addresses that are not properly sanitized when creating a failed delivery message.
20 CVE-2005-2663 2005-09-21 2017-07-11
2.1
None Local Low Not required None Partial None
masqmail before 0.2.18 allows local users to overwrite arbitrary files via a symlink attack on a log file.
21 CVE-2005-2700 Bypass 2005-09-06 2021-06-06
10.0
None Remote Low Not required Complete Complete Complete
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
22 CVE-2005-2701 Exec Code Overflow 2005-09-23 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to execute arbitrary code via an XBM image file that ends in a large number of spaces instead of the expected end tag.
23 CVE-2005-2702 DoS Exec Code 2005-09-23 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Unicode sequences with "zero-width non-joiner" characters.
24 CVE-2005-2703 94 2005-09-23 2017-10-11
5.0
None Remote Low Not required None Partial None
Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to modify HTTP headers of XML HTTP requests via XMLHttpRequest, and possibly use the client to exploit vulnerabilities in servers or proxies, including HTTP request smuggling and HTTP request splitting.
25 CVE-2005-2704 2005-09-23 2017-10-11
5.0
None Remote Low Not required None Partial None
Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to spoof DOM objects via an XBL control that implements an internal XPCOM interface.
26 CVE-2005-2705 Exec Code Overflow 2005-09-23 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
Integer overflow in the JavaScript engine in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 might allow remote attackers to execute arbitrary code.
27 CVE-2005-2706 2005-09-23 2017-10-11
6.4
None Remote Low Not required Partial Partial None
Firefox before 1.0.7 and Mozilla before Suite 1.7.12 allows remote attackers to execute Javascript with chrome privileges via an about: page such as about:mozilla.
28 CVE-2005-2707 2005-09-23 2017-10-11
5.0
None Remote Low Not required None Partial None
Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to spawn windows without user interface components such as the address and status bar, which could be used to conduct spoofing or phishing attacks.
29 CVE-2005-2710 Exec Code 2005-09-27 2017-10-11
5.1
None Remote High Not required Partial Partial Partial
Format string vulnerability in Real HelixPlayer and RealPlayer 10 allows remote attackers to execute arbitrary code via the (1) image handle or (2) timeformat attribute in a RealPix (.rp) or RealText (.rt) file.
30 CVE-2005-2763 DoS Exec Code 2005-09-06 2011-03-08
7.5
None Remote Low Not required Partial Partial Partial
Multiple format string vulnerabilities in OpenTTD before 0.4.0.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
31 CVE-2005-2764 DoS Exec Code Overflow 2005-09-21 2011-03-08
7.5
None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in OpenTTD before 0.4.0.1 allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
32 CVE-2005-2765 2005-09-01 2008-09-05
2.1
None Local Low Not required None Partial None
The user interface in the Windows Firewall does not properly display certain malformed entries in the Windows Registry, which makes it easier for attackers with administrator privileges to hide activities if the administrator only uses the Windows Firewall interface to monitor exceptions. NOTE: the vendor disputes this issue, saying that since administrative privileges are already required, it is not a vulnerability. CVE has not yet formally decided if such "information hiding" issues should be included.
33 CVE-2005-2766 +Info 2005-09-02 2016-10-18
2.1
None Local Low Not required Partial None None
Symantec AntiVirus Corporate Edition 9.0.1.x and 9.0.4.x, and possibly other versions, when obtaining updates from an internal LiveUpdate server, stores sensitive information in cleartext in the Log.Liveupdate log file, which allows attackers to obtain the username and password to the internal LiveUpdate server.
34 CVE-2005-2767 Exec Code Overflow 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in LeapFTP allows remote attackers to execute arbitrary code via a long Host string in a Site Queue (.lsq) file.
35 CVE-2005-2768 Exec Code Overflow 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the Sophos Antivirus Library, as used by Sophos Antivirus, PureMessage, MailMonitor, and other products, allows remote attackers to execute arbitrary code via a Visio file with a crafted sub record length.
36 CVE-2005-2769 XSS 2005-09-02 2017-10-26
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in SqWebMail 5.0.4 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via an HTML e-mail containing tags with strings that contain ">" or other special characters, which is not properly sanitized by SqWebMail.
37 CVE-2005-2770 2005-09-02 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
WRQ Reflection for Secure IT Windows Server 6.0 (formerly known as F-Secure SSH server) does not properly handle when the Windows Administrator or Guest accounts are renamed after SSH key authentication has been configured, which allows remote attackers to use the original names during login.
38 CVE-2005-2771 Bypass 2005-09-02 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
WRQ Reflection for Secure IT Windows Server 6.0 (formerly known as F-Secure SSH server) processes access and deny lists in a case-sensitive manner, when previous versions were case-insensitive, which might allow remote attackers to bypass intended restrictions and login to accounts that should be denied.
39 CVE-2005-2772 Exec Code Overflow 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Multiple stack-based buffer overflows in University of Minnesota gopher client 3.0.9 allow remote malicious servers to execute arbitrary code via (1) a long "+VIEWS:" reply, which is not properly handled in the VIfromLine function, and (2) certain arguments when launching third party programs such as a web browser from a web link, which is not properly handled in the FIOgetargv function.
40 CVE-2005-2773 Exec Code 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl, (2) cdpView.ovpl, (3) freeIPaddrs.ovpl, and (4) ecscmg.ovpl.
41 CVE-2005-2774 DoS Exec Code 2005-09-02 2017-07-11
5.0
None Remote Low Not required None None Partial
Format string vulnerability in Lithium II mod 1.24 for Quake 2 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in the nickname.
42 CVE-2005-2775 Exec Code File Inclusion 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
php_api.php in phpWebNotes 2.0.0 uses the extract function to modify key variables such as $t_path_core, which leads to a PHP file inclusion vulnerability that allows remote attackers to execute arbitrary PHP code via the t_path_core parameter.
43 CVE-2005-2776 XSS 2005-09-02 2017-07-11
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Looking Glass 20040427 allow remote attackers to inject arbitrary web script or HTML via the (1) version[fullname], (2) version[homepage], or (3) version[no] parameter to footer.php, or the (4) version[fullname], (5) version[no], (6) version[author], (7) version[email] parameter to header.php.
44 CVE-2005-2777 Exec Code 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Looking Glass 20040427 allows remote attackers to execute arbitrary commands via shell metacharacters in the DNS lookup query field.
45 CVE-2005-2778 Sql 2005-09-02 2016-10-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in member.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL statements via the fid parameter.
46 CVE-2005-2779 2005-09-02 2016-10-18
5.0
None Remote Low Not required Partial None None
The iTAN Online-Banking Security System allows remote attackers to obtain TAN numbers via a man-in-the-middle (MITM) attack while the transaction is taking place, which facilitates a "phishing" attack.
47 CVE-2005-2780 XSS 2005-09-02 2016-10-18
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Land Down Under (LDU) allows remote attackers to inject arbitrary web script or HTML via a signature.
48 CVE-2005-2781 Exec Code 2005-09-02 2018-10-19
7.5
None Remote Low Not required Partial Partial Partial
The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitrary PHP code via a file with a .php extension that contains image data followed by PHP code.
49 CVE-2005-2782 Exec Code Bypass File Inclusion 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in al_initialize.php for AutoLinks Pro 2.1 allows remote attackers to execute arbitrary PHP code via an "ftp://" URL in the alpath parameter, which bypasses the incomplete blacklist that only checks for "http" and "https" URLs.
50 CVE-2005-2783 XSS 2005-09-02 2017-07-11
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in PHP-Fusion 6.00.107 and earlier allows remote attackers to inject arbitrary web script or HTML via nested, malformed URL BBCode tags.
Total number of vulnerabilities : 309   Page : 1 (This Page)2 3 4 5 6 7
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.