CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2005

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
201 CVE-2005-1579 +Info 2005-05-12 2011-03-08
5.0
 None Remote Low Not required Partial None None
Apple QuickTime Player 7.0 on Mac OS X 10.4 allows remote attackers to obtain sensitive information via a .mov file with a Quartz Composer composition (.qtz) file that uses certain patches to read local information, then other patches to send the information to the attacker.
202 CVE-2005-1578 2005-05-13 2008-09-05
2.1
 None Local Low Not required None Partial None
EnCase Forensic Edition 4.18a does not support Device Configuration Overlays (DCO), which allows attackers to hide information without detection.
203 CVE-2005-1577 2005-05-14 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
APG Technology ClassMaster does not properly restrict access to sensitive folders, which allows remote attackers to access folders via a network share.
204 CVE-2005-1576 2005-05-12 2008-09-05
2.6
 None Remote High Not required None Partial None
The file download dialog in Mozilla Firefox 0.10.1 and 1.0 for Windows uses the Content-Type HTTP header to determine the file type, but saves the original file extension when "Save to Disk" is selected, which allows remote attackers to hide the real file types of downloaded files.
205 CVE-2005-1575 2005-05-14 2008-09-05
5.0
 None Remote Low Not required None Partial None
The file download dialog in Mozilla Firefox 0.10.1 and 1.0 for Windows allows remote attackers to hide the real file types of downloaded files via the Content-Type HTTP header and a filename containing whitespace, dots, or ASCII byte 160.
206 CVE-2005-1574 2005-05-14 2018-08-13
7.5
 None Remote Low Not required Partial Partial Partial
Windows Media Player 9 and 10, in certain cases, allows content protected by Windows Media Digital Rights Management (WMDRM) to redirect the user to a web site to obtain a license, even when the "Acquire licenses automatically for protected content" setting is not enabled.
207 CVE-2005-1573 Exec Code Sql 2005-05-11 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in admin_login.asp for ASP Virtual News Manager allows remote attackers to execute arbitrary SQL commands via the password parameter.
208 CVE-2005-1572 DoS 2005-05-11 2008-09-05
5.0
 None Remote Low Not required None None Partial
ShowOff! 1.5.4 allows remote attackers to cause a denial of service (server crash) via a malformed request to port 8083.
209 CVE-2005-1571 Dir. Trav. 2005-05-14 2008-09-05
5.0
 None Remote Low Not required Partial None None
Multiple directory traversal vulnerabilities in ShowOff! 1.5.4 allow remote attackers to read arbitrary files via ".." sequences in arguments to the (1) ShowAlbum, (2) ShowVideo, or (3) ShowGraphic scripts.
210 CVE-2005-1570 Sql +Info 2005-05-14 2008-09-05
5.0
 None Remote Low Not required Partial None None
forum.asp in bttlxeForum 2.0 allows remote attackers to obtain full path information via a certain hex-encoded argument to the page parameter, possibly due to a SQL injection vulnerability.
211 CVE-2005-1569 XSS 2005-05-14 2016-10-18
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in DirectTopics 2.1 and 2.2 allows remote attackers to inject arbitrary web script via a javascript: URL in (1) a thread or (2) an IMG tag.
212 CVE-2005-1568 +Info 2005-05-12 2016-10-18
5.0
 None Remote Low Not required Partial None None
topic.php in DirectTopics 2.1 and 2.2 allows remote attackers to obtain sensitive information via an invalid topic parameter, which reveals the path in an error message.
213 CVE-2005-1567 Exec Code Sql 2005-05-12 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in topic.php in DirectTopics 2.1 and 2.2 allows remote attackers to execute arbitrary SQL commands via the topic parameter.
214 CVE-2005-1566 Bypass 2005-05-14 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Acrowave AAP-3100AR wireless router allows remote attackers to bypass authentication by pressing CTRL-C at the username or password prompt in a telnet session, which causes the shell to crash and restart, then leave the user in the new shell.
215 CVE-2005-1565 2005-05-12 2016-10-18
5.0
 None Remote Low Not required Partial None None
Bugzilla 2.17.1 through 2.18, 2.19.1, and 2.19.2, when a user is prompted to log in while attempting to view a chart, displays the password in the URL, which may allow local users to gain sensitive information from web logs or browser history.
216 CVE-2005-1564 2005-05-12 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
post_bug.cgi in Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 allows remote authenticated users to "enter bugs into products that are closed for bug entry" by modifying the URL to specify the name of the product.
217 CVE-2005-1563 2005-05-14 2016-10-18
5.0
 None Remote Low Not required Partial None None
Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 displays a different error message depending on whether a product exists or not, which allows remote attackers to determine hidden products.
218 CVE-2005-1562 Exec Code Sql 2005-05-11 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in MaxWebPortal 1.3.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) fpassword parameter to inc_functions.asp, (2) txtAddress, (3) message, or (4) subject parameter to post_info.asp, (5) andor parameter to search.asp, (6) verkey parameter to pop_profile.asp, or (7) Remove or (8) Delete parameter to pm_delete2.asp.
219 CVE-2005-1561 XSS 2005-05-11 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in post.asp in MaxWebPortal 1.3.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) mod, (2) M, or (3) type parameter.
220 CVE-2005-1560 Exec Code 2005-05-11 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
The SSH module in Neteyes Nexusway allows remote attackers to execute arbitrary commands via shell metacharacters in arguments to certain commands, as demonstrated using ping and traceroute.
221 CVE-2005-1559 Exec Code 2005-05-11 2017-07-11
10.0
 None Remote Low Not required Complete Complete Complete
The web module in Neteyes Nexusway allows remote attackers to execute arbitrary commands via hex-encoded shell metacharacters in the ip parameter for (1) nslookup.cgi or (2) ping.cgi.
222 CVE-2005-1558 +Priv Bypass 2005-05-11 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
The web module in Neteyes Nexusway allows remote attackers to bypass authentication and gain administrator privileges by setting the cyclone500_auth cookie.
223 CVE-2005-1557 XSS 2005-05-11 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in WebApp Guestbook PRO 3.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) content of a message.
224 CVE-2005-1556 DoS 2005-05-14 2017-07-11
5.0
 None Remote Low Not required None None Partial
Gamespy cd-key validation system allows remote attackers to cause a denial of service (cd-key already in use) by capturing and replaying a cd-key authorization session.
225 CVE-2005-1555 XSS 2005-05-10 2017-07-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the JRun Web Server in ColdFusion MX 7.0 allows remote attackers to inject arbitrary script or HTML via the URL, which is not properly quoted in the resulting default 404 error page.
226 CVE-2005-1554 Exec Code Sql 2005-05-14 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in view_user.php in WowBB 1.6, 1.61, and 1.62 allows remote attackers to execute arbitrary SQL commands via the sort_by parameter.
227 CVE-2005-1553 2005-05-14 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
GeoVision Digital Video Surveillance System 6.04, 6.1 and 7.0 uses a weak encryption scheme to encrypt passwords, which allows remote attackers to obtain the password via sniffing.
228 CVE-2005-1552 2005-05-14 2017-07-11
5.0
 None Remote Low Not required Partial None None
GeoVision Digital Video Surveillance System 6.04, 6.1 and 7.0, when set to create JPEG images, does not properly protect an image even when a password and username is assigned, which may allow remote attackers to gain sensitive information via a direct request to the image.
229 CVE-2005-1551 Bypass 2005-05-14 2017-07-11
5.1
 None Remote High Not required Partial Partial Partial
Sophos Anti-Virus 3.93 does not check downloaded files for viruses when they have only been written, which creates a race condition and may allow remote attackers to bypass virus protection if the file is executed before the antivirus starts on system reboot.
230 CVE-2005-1550 Exec Code 2005-05-14 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
easymsgb.pl in Easy Message Board allows remote attackers to execute arbitrary commands via shell metacharacters in the print parameter.
231 CVE-2005-1549 Dir. Trav. 2005-05-14 2016-10-18
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in easymsgb.pl in Easy Message Board allows remote attackers to read arbitrary files via a .. (dot dot) in the print parameter.
232 CVE-2005-1548 Exec Code Sql 2005-05-14 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Advanced Guestbook 2.3.1 allows remote attackers to execute arbitrary SQL commands via the entry parameter.
233 CVE-2005-1547 Exec Code Overflow 2005-05-14 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the demo version of Bakbone Netvault, and possibly other versions, allows remote attackers to execute arbitrary commands via a large packet to port 20031.
234 CVE-2005-1546 Exec Code Overflow 2005-05-14 2008-09-10
5.1
 None Remote High Not required Partial Partial Partial
Buffer overflow in the PE parser in HT Editor before 0.8.0 allows remote attackers to execute arbitrary code via a crafted PE file.
235 CVE-2005-1545 Exec Code Overflow 2005-05-14 2008-09-10
5.1
 None Remote High Not required Partial Partial Partial
Integer overflow in the ELF parser in HT Editor before 0.8.0 allows remote attackers to execute arbitrary code via a crafted ELF file, which leads to a heap-based buffer overflow.
236 CVE-2005-1544 Exec Code Overflow 2005-05-14 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in libTIFF before 3.7.2 allows remote attackers to execute arbitrary code via a TIFF file with a malformed BitsPerSample tag.
237 CVE-2005-1543 Exec Code Overflow 2005-05-25 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Multiple stack-based and heap-based buffer overflows in Remote Management authentication (zenrem32.exe) on Novell ZENworks 6.5 Desktop and Server Management, ZENworks for Desktops 4.x, ZENworks for Servers 3.x, and Remote Management allows remote attackers to execute arbitrary code via (1) unspecified vectors, (2) type 1 authentication requests, and (3) type 2 authentication requests.
238 CVE-2005-1532 264 2005-05-12 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
Firefox before 1.0.4 and Mozilla Suite before 1.7.8 do not properly limit privileges of Javascript eval and Script objects in the calling context, which allows remote attackers to conduct unauthorized activities via "non-DOM property overrides," a variant of CVE-2005-1160.
239 CVE-2005-1531 2005-05-12 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
Firefox before 1.0.4 and Mozilla Suite before 1.7.8 does not properly implement certain security checks for script injection, which allows remote attackers to execute script via "Wrapped" javascript: URLs, as demonstrated using (1) a javascript: URL in a view-source: URL, (2) a javascript: URL in a jar: URL, or (3) "a nested variant."
240 CVE-2005-1523 Exec Code 2005-05-26 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Format string vulnerability in imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via format string specifiers in the command tag for IMAP commands.
241 CVE-2005-1522 DoS 2005-05-26 2008-09-05
5.0
 None Remote Low Not required None None Partial
The imap4d server for GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows authenticated remote users to cause a denial of service (CPU consumption) via a large range value in the FETCH command.
242 CVE-2005-1521 Exec Code Overflow 2005-05-26 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Integer overflow in the fetch_io function of the imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via a partial message request with a large value in the END parameter, which leads to a heap-based buffer overflow.
243 CVE-2005-1520 Exec Code Overflow 2005-05-26 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the header_get_field_name function in header.c for GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via a crafted e-mail.
244 CVE-2005-1519 2005-05-11 2017-10-11
6.4
 None Remote Low Not required None Partial Partial
Squid 2.5 STABLE9 and earlier, when the DNS client port is unfiltered and the environment does not prevent IP spoofing, allows remote attackers to spoof DNS lookups.
245 CVE-2005-1518 DoS 2005-05-11 2018-10-30
2.1
 None Local Low Not required None None Partial
Unknown vulnerability in Solaris 7 through 9, when using Federated Naming Services (FNS), autofs, and FNS X.500 configuration, allows local users to cause a denial of service (automountd crash) when "accessing" /xfn/_x500.
246 CVE-2005-1517 Bypass 2005-05-11 2011-03-08
7.5
 None Remote Low Not required Partial Partial Partial
Unknown vulnerability in Cisco Firewall Services Module (FWSM) 2.3.1 and earlier, when using URL, FTP, or HTTPS filtering exceptions, allows certain TCP packets to bypass access control lists (ACLs).
247 CVE-2005-1516 Bypass 2005-05-11 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
DList (dlist.exe) in DMail 3.1a allows remote attackers to bypass authentication, read log files, and shutdown the system via a sendlog command with an incorrect password hash, which is not properly handled by the _cmd_sendlog function.
248 CVE-2005-1515 DoS Exec Code 2005-05-11 2020-10-05
5.0
 None Remote Low Not required None None Partial
Integer signedness error in the qmail_put and substdio_put functions in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large number of SMTP RCPT TO commands.
249 CVE-2005-1514 DoS Exec Code 2005-05-11 2020-10-05
5.0
 None Remote Low Not required None None Partial
commands.c in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long SMTP command without a space character, which causes an array to be referenced with a negative index.
250 CVE-2005-1513 DoS Exec Code Overflow 2005-05-11 2020-10-05
5.0
 None Remote Low Not required None None Partial
Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.
Total number of vulnerabilities : 1255   Page : 1 2 3 4 5 (This Page)6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.