CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2005

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
851 CVE-2005-0758 Exec Code 2005-05-13 2019-10-16
4.6
 None Local Low Not required Partial Partial Partial
zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script.
852 CVE-2005-0757 DoS 2005-05-18 2017-10-11
2.1
 None Local Low Not required None None Partial
The xattr file system code, as backported in Red Hat Enterprise Linux 3 on 64-bit systems, does not properly handle certain offsets, which allows local users to cause a denial of service (system crash) via certain actions on an ext3 file system with extended attributes enabled.
853 CVE-2005-0746 2005-05-02 2017-07-11
5.0
 None Remote Low Not required Partial None None
The Mini FTP server in Novell iChain 2.2 and 2.3 SP2 and earlier allows remote unauthenticated attackers to obtain the full path of the server via the PWD command.
854 CVE-2005-0744 +Priv +Info 2005-05-02 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
The web GUI for Novell iChain 2.2 and 2.3 SP2 and SP3 allows attackers to hijack sessions and gain administrator privileges by (1) sniffing the connection on TCP port 51100 and replaying the authentication information or (2) obtaining and replaying the PCZQX02 authentication cookie from the browser.
855 CVE-2005-0743 2005-05-02 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
The custom avatar uploading feature (uploader.php) for XOOPS 2.0.9.2 and earlier allows remote attackers to upload arbitrary PHP scripts, whose file extensions are not filtered.
856 CVE-2005-0742 XSS 2005-05-02 2010-03-02
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Sun Java System Application Server 7 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
857 CVE-2005-0739 189 Overflow 2005-05-02 2017-10-11
5.0
 None Remote Low Not required None None Partial
The IAPP dissector (packet-iapp.c) for Ethereal 0.9.1 to 0.10.9 does not properly use certain routines for formatting strings, which could leave it vulnerable to buffer overflows, as demonstrated using modified length values that are not properly handled by the dissect_pdus and pduval_to_str functions.
858 CVE-2005-0738 400 DoS 2005-05-02 2020-04-09
5.0
 None Remote Low Not required None None Partial
Stack consumption vulnerability in Microsoft Exchange Server 2003 SP1 allows users to cause a denial of service (hang) by deleting or moving a folder with deeply nested subfolders, which causes Microsoft Exchange Information Store service (Store.exe) to hang as a result of a large number of recursive calls.
859 CVE-2005-0737 Exec Code Overflow 2005-05-02 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Yahoo! Messenger allows remote attackers to execute arbitrary code via the offline mode.
860 CVE-2005-0735 264 +Priv 2005-05-02 2009-04-03
10.0
 None Remote Low Not required Complete Complete Complete
newsscript.pl for NewsScript allows remote attackers to gain privileges by setting the mode parameter to admin.
861 CVE-2005-0734 DoS 2005-05-02 2017-07-11
5.0
 None Remote Low Not required None None Partial
PY Software Active Webcam WebServer (webcam.exe) 5.5 allows remote attackers to cause a denial of service (memory exhaustion and process crash) via a large number of HTTP requests.
862 CVE-2005-0733 2005-05-02 2017-07-11
5.0
 None Remote Low Not required Partial None None
PY Software Active Webcam WebServer (webcam.exe) 5.5 allows remote attackers to determine the existence of files via an HTTP request with a full pathname, which produces different messages whether the file exists or not.
863 CVE-2005-0732 2005-05-02 2017-07-11
5.0
 None Remote Low Not required Partial None None
PY Software Active Webcam WebServer (webcam.exe) 5.5 allows remote attackers to obtain the full path of the web server via a request for a non-existent filename, which leaks the full path in an error message.
864 CVE-2005-0730 DoS 2005-05-02 2017-07-11
5.0
 None Remote Low Not required None None Partial
PY Software Active Webcam WebServer (webcam.exe) 5.5 allows remote attackers to cause a denial of service via a request to a file on the floppy drive, as demonstrated using A:\a.txt.
865 CVE-2005-0729 Exec Code 2005-05-02 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Format string vulnerability in Xpand Rally 1.1.0.0 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a message.
866 CVE-2005-0726 Exec Code Sql 2005-05-02 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in editpost.php in UBB.threads 6.0 allows remote attackers to execute arbitrary SQL commands via the Number parameter.
867 CVE-2005-0724 +Info 2005-05-02 2016-10-18
5.0
 None Remote Low Not required Partial None None
paFileDB 3.1 and earlier allows remote attackers to obtain sensitive information via (1) an invalid str parameter to pafiledb.php, or a direct request to (2) viewall.php, (3) stats.php, (4) search.php, (5) rate.php, (6) main.php, (7) license.php, (8) category.php, (9) download.php, (10) file.php, (11) email.php, or (12) admin.php, which reveals the path in a PHP error message.
868 CVE-2005-0721 Exec Code File Inclusion 2005-05-02 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in modules.php in eXPerience2 allows remote attackers to execute arbitrary PHP code by modifying the file parameter to reference a URL on a remote web server that contains the code.
869 CVE-2005-0712 +Priv 2005-05-02 2008-09-10
4.6
 None Local Low Not required Partial Partial Partial
Mac OS X before 10.3.8 users world-writable permissions for certain directories, which may allow local users to gain privileges, possibly via the receipt cache or ColorSync profiles.
870 CVE-2005-0711 2005-05-02 2019-12-17
2.1
 None Local Low Not required None Partial None
MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, uses predictable file names when creating temporary tables, which allows local users with CREATE TEMPORARY TABLE privileges to overwrite arbitrary files via a symlink attack.
871 CVE-2005-0710 Bypass 2005-05-02 2019-12-17
4.6
 None Local Low Not required Partial Partial Partial
MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to bypass library path restrictions and execute arbitrary libraries by using INSERT INTO to modify the mysql.func table, which is processed by the udf_init function.
872 CVE-2005-0709 94 Exec Code 2005-05-02 2019-12-17
4.6
 None Local Low Not required Partial Partial Partial
MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by using CREATE FUNCTION to access libc calls, as demonstrated by using strcat, on_exit, and exit.
873 CVE-2005-0708 +Info 2005-05-02 2017-10-12
10.0
 None Remote Low Not required Complete Complete Complete
The sendfile system call in FreeBSD 4.8 through 4.11 and 5 through 5.4 can transfer portions of kernel memory if a file is truncated while it is being sent, which could allow remote attackers to obtain sensitive information.
874 CVE-2005-0707 Exec Code Overflow 2005-05-02 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in the IMAP daemon (IMAP4d32.exe) for Ipswitch Collaboration Suite (ICS) before 8.15 Hotfix 1 allows remote authenticated users to execute arbitrary code via a long EXAMINE command.
875 CVE-2005-0706 DoS Exec Code Overflow 2005-05-02 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in discdb.c for grip 3.1.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing the cddb lookup to return more matches than expected.
876 CVE-2005-0705 DoS 2005-05-02 2017-10-11
5.0
 None Remote Low Not required None None Partial
The GPRS-LLC dissector in Ethereal 0.10.7 through 0.10.9, with the "ignore cipher bit" option enabled. allows remote attackers to cause a denial of service (application crash).
877 CVE-2005-0704 DoS Exec Code Overflow 2005-05-02 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the Etheric dissector in Ethereal 0.10.7 through 0.10.9 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code.
878 CVE-2005-0682 XSS 2005-05-02 2008-09-05
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in common.inc in Drupal before 4.5.2 allows remote attackers to inject arbitrary web script or HTML via certain inputs.
879 CVE-2005-0679 94 Exec Code File Inclusion 2005-05-02 2018-10-19
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in tell_a_friend.inc.php for Tell A Friend Script 2.7 before 20050305 allows remote attackers to execute arbitrary PHP code by modifying the script_root parameter to reference a URL on a remote web server that contains the code. NOTE: it was later reported that 2.4 is also affected.
880 CVE-2005-0678 Exec Code File Inclusion 2005-05-02 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in formmail.inc.php for Form Mail Script 2.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the script_root to reference a URL on a remote web server that contains the code.
881 CVE-2005-0677 2005-05-02 2008-09-05
5.0
 None Remote Low Not required None Partial None
index.php for Zorum 3.5 allows remote attackers to perform certain actions as other users by modifying the id parameter.
882 CVE-2005-0676 2005-05-04 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
index.php in Zorum 3.5 allows remote attackers to trigger an SQL error, and possibly inject arbitrary SQL commands, via the search capability.
883 CVE-2005-0675 XSS 2005-05-02 2008-09-05
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php for Zorum 3.5 allows remote attackers to inject arbitrary web script or HTML via the (1) list or (2) frommethod parameters.
884 CVE-2005-0673 XSS 2005-05-02 2008-09-05
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in usercp_register.php for phpBB 2.0.13 allows remote attackers to inject arbitrary web script or HTML by setting the (1) allowhtml, (2) allowbbcode, or (3) allowsmilies parameters to inject HTML into signatures for personal messages, possibly when they are processed by privmsg.php or viewtopic.php.
885 CVE-2005-0672 Exec Code 2005-05-02 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Carsten's 3D Engine (Ca3DE), March 2004 version and earlier, allows remote attackers to execute arbitrary code via text strings that are not null terminated, which triggers a null dereference.
886 CVE-2005-0670 XSS 2005-05-02 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in phpCOIN 1.2.0 through 1.2.1b allows remote attackers to inject arbitrary web script or HTML via (1) the new parameter to mod.php, (2) the w parameter to mod.php, (3) the e parameter to login.php, (4) the o parameter to login.php, and possibly other scripts.
887 CVE-2005-0669 Exec Code Sql 2005-05-02 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in mod.php for phpCOIN 1.2.0 through 1.2.1b allow remote attackers to execute arbitrary SQL commands via the (1) the faq_id in the faq mod, (2) the id parameter in the pages mod, (3) the id parameter in the siteinfo module, (4) the topic_id parameter in the articles module, (5) the ord_id in the orders module, (6) the dom_id parameter in the domains module, or (7) the invd_id parameter in the invoices module.
888 CVE-2005-0666 Exec Code Bypass 2005-05-02 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
Unknown vulnerability in PaX from the September 2003 release to 2.2 before 2005.03.05, related to SEGMEXEC or RANDEXEC and VMA mirroring, allows local users and possibly remote attackers to bypass intended access restrictions and execute arbitrary code.
889 CVE-2005-0665 Exec Code 2005-05-02 2008-09-05
5.1
 None Remote High Not required Partial Partial Partial
Format string vulnerability in xv before 3.10a allows remote attackers to execute arbitrary code via format string specifiers in a filename.
890 CVE-2005-0664 DoS Exec Code Overflow 2005-05-02 2018-10-03
2.6
 None Remote High Not required None None Partial
Buffer overflow in the EXIF library (libexif) 0.6.9 does not properly validate the structure of the EXIF tags, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a JPEG image with a crafted EXIF tag.
891 CVE-2005-0663 Sql 2005-05-02 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php for MercuryBoard 1.1.2 allows remote attackers to inject arbitrary SQL commands via the f parameter.
892 CVE-2005-0662 XSS 2005-05-02 2008-09-05
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php for MercuryBoard 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the Avatar field.
893 CVE-2005-0661 Exec Code Sql 2005-05-02 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the getwbbuserdata function in session.php for Woltlab Burning Board 2.0.3 through 2.3.0 allows remote attackers to execute arbitrary SQL commands via the (1) userid or (2) lastvisit cookie.
894 CVE-2005-0660 XSS 2005-05-02 2008-09-05
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in D-Forum 1.11 allows remote attackers to inject arbitrary web script or HTML via certain fields, as demonstrated using the page parameter in nav.php3.
895 CVE-2005-0659 +Info 2005-05-02 2016-10-18
5.0
 None Remote Low Not required Partial None None
phpBB 2.0.13 and earlier allows remote attackers to obtain sensitive information via a direct request to oracle.php, which reveals the path in a PHP error message.
896 CVE-2005-0658 Exec Code Sql 2005-05-02 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in a third party extension to TYPO3 allows remote attackers to execute arbitrary SQL commands via the category_uid parameter.
897 CVE-2005-0657 DoS Dir. Trav. 2005-05-02 2017-07-11
6.4
 None Remote Low Not required Partial None Partial
Directory traversal vulnerability in Computalynx CProxy 3.3.x and 3.4.x through 3.4.4 allows remote attackers to read arbitrary files or cause a denial of service (application crash) via a .. (dot dot) in an HTTP request.
898 CVE-2005-0656 XSS 2005-05-02 2016-10-18
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in auraCMS 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) hits parameter to hits.php, (2) query parameter to index.php, or (3) theCount parameter to counter.php.
899 CVE-2005-0655 +Info 2005-05-02 2016-10-18
5.0
 None Remote Low Not required Partial None None
auraCMS 1.5 allows remote attackers to obtain sensitive information via an HTTP request with an invalid id parameter to (1) teman.php, (2) hal.php, or (3) arsip.php, which reveals the path in a PHP error message.
900 CVE-2005-0654 DoS 2005-05-02 2022-02-07
5.0
 None Remote Low Not required None None Partial
gifload.exe in GIMP 2.0.5, 2.2.3, and possibly 2.2.4 allows remote attackers or local users to cause a denial of service (application crash) via the image descriptor (1) height or (2) width fields set to zero.
Total number of vulnerabilities : 1255   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 (This Page)19 20 21 22 23 24 25 26
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.