CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In September 2005

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
251 CVE-2005-2792 22 Dir. Trav. 2005-09-02 2020-11-16
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in welcome.php in phpLDAPadmin 0.9.6 and 0.9.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the custom_welcome_page parameter.
252 CVE-2005-2791 DoS 2005-09-02 2017-07-11
5.0
None Remote Low Not required None None Partial
BFCommand & Control Server Manager BFCC 1.22_A and earlier, and BFVCC 2.14_B and earlier, allows remote attackers to cause a denial of service (refused new connections) via a series of connections and disconnections without sending the login command.
253 CVE-2005-2790 Bypass 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
BFCommand & Control Server Manager BFCC 1.22_A and earlier, and BFVCC 2.14_B and earlier, relies on the client to enforce permissions and perform actions such as disconnections, which allows remote attackers to bypass administrative restrictions via a modified client.
254 CVE-2005-2789 Bypass 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
BFCommand & Control Server Manager BFCC 1.22_A and earlier, and BFVCC 2.14_B and earlier, allows remote attackers to bypass authentication via (1) an unknown attack vector or (2) a NULL (0x00) as a username.
255 CVE-2005-2788 Exec Code Sql 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Land Down Under (LDU) 801 and earlier allow remote attackers to execute arbitrary SQL commands via the c parameter to (1) events.php, (2) index.php, or (3) list.php.
256 CVE-2005-2787 2005-09-02 2017-07-11
5.0
None Remote Low Not required None Partial None
comment_delete_cgi.php in Simple PHP Blog allows remote attackers to delete arbitrary files via the comment parameter.
257 CVE-2005-2786 Dir. Trav. 2005-09-02 2016-10-18
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in bestmail_edit.cgi in cosmoshop 8.10.78 and earlier allows remote administrators to read arbitrary files via ".." sequences in the file parameter.
258 CVE-2005-2785 +Info 2005-09-02 2017-07-11
2.1
None Local Low Not required Partial None None
cosmoshop 8.10.78 and earlier stores passwords in plaintext in the database, which allows local users to obtain sensitive information.
259 CVE-2005-2784 Exec Code Sql Bypass 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the login function for the administration login panel in cosmoshop 8.10.78 allows remote attackers to execute arbitrary SQL commands and bypass authentication via unspecified vectors.
260 CVE-2005-2783 XSS 2005-09-02 2017-07-11
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in PHP-Fusion 6.00.107 and earlier allows remote attackers to inject arbitrary web script or HTML via nested, malformed URL BBCode tags.
261 CVE-2005-2782 Exec Code Bypass File Inclusion 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in al_initialize.php for AutoLinks Pro 2.1 allows remote attackers to execute arbitrary PHP code via an "ftp://" URL in the alpath parameter, which bypasses the incomplete blacklist that only checks for "http" and "https" URLs.
262 CVE-2005-2781 Exec Code 2005-09-02 2018-10-19
7.5
None Remote Low Not required Partial Partial Partial
The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitrary PHP code via a file with a .php extension that contains image data followed by PHP code.
263 CVE-2005-2780 XSS 2005-09-02 2016-10-18
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Land Down Under (LDU) allows remote attackers to inject arbitrary web script or HTML via a signature.
264 CVE-2005-2779 2005-09-02 2016-10-18
5.0
None Remote Low Not required Partial None None
The iTAN Online-Banking Security System allows remote attackers to obtain TAN numbers via a man-in-the-middle (MITM) attack while the transaction is taking place, which facilitates a "phishing" attack.
265 CVE-2005-2778 Sql 2005-09-02 2016-10-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in member.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL statements via the fid parameter.
266 CVE-2005-2777 Exec Code 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Looking Glass 20040427 allows remote attackers to execute arbitrary commands via shell metacharacters in the DNS lookup query field.
267 CVE-2005-2776 XSS 2005-09-02 2017-07-11
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Looking Glass 20040427 allow remote attackers to inject arbitrary web script or HTML via the (1) version[fullname], (2) version[homepage], or (3) version[no] parameter to footer.php, or the (4) version[fullname], (5) version[no], (6) version[author], (7) version[email] parameter to header.php.
268 CVE-2005-2775 Exec Code File Inclusion 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
php_api.php in phpWebNotes 2.0.0 uses the extract function to modify key variables such as $t_path_core, which leads to a PHP file inclusion vulnerability that allows remote attackers to execute arbitrary PHP code via the t_path_core parameter.
269 CVE-2005-2774 DoS Exec Code 2005-09-02 2017-07-11
5.0
None Remote Low Not required None None Partial
Format string vulnerability in Lithium II mod 1.24 for Quake 2 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in the nickname.
270 CVE-2005-2773 Exec Code 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) node parameter to connectedNodes.ovpl, (2) cdpView.ovpl, (3) freeIPaddrs.ovpl, and (4) ecscmg.ovpl.
271 CVE-2005-2772 Exec Code Overflow 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Multiple stack-based buffer overflows in University of Minnesota gopher client 3.0.9 allow remote malicious servers to execute arbitrary code via (1) a long "+VIEWS:" reply, which is not properly handled in the VIfromLine function, and (2) certain arguments when launching third party programs such as a web browser from a web link, which is not properly handled in the FIOgetargv function.
272 CVE-2005-2771 Bypass 2005-09-02 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
WRQ Reflection for Secure IT Windows Server 6.0 (formerly known as F-Secure SSH server) processes access and deny lists in a case-sensitive manner, when previous versions were case-insensitive, which might allow remote attackers to bypass intended restrictions and login to accounts that should be denied.
273 CVE-2005-2770 2005-09-02 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
WRQ Reflection for Secure IT Windows Server 6.0 (formerly known as F-Secure SSH server) does not properly handle when the Windows Administrator or Guest accounts are renamed after SSH key authentication has been configured, which allows remote attackers to use the original names during login.
274 CVE-2005-2769 XSS 2005-09-02 2017-10-26
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in SqWebMail 5.0.4 and possibly other versions allows remote attackers to inject arbitrary web script or HTML via an HTML e-mail containing tags with strings that contain ">" or other special characters, which is not properly sanitized by SqWebMail.
275 CVE-2005-2768 Exec Code Overflow 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the Sophos Antivirus Library, as used by Sophos Antivirus, PureMessage, MailMonitor, and other products, allows remote attackers to execute arbitrary code via a Visio file with a crafted sub record length.
276 CVE-2005-2767 Exec Code Overflow 2005-09-02 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in LeapFTP allows remote attackers to execute arbitrary code via a long Host string in a Site Queue (.lsq) file.
277 CVE-2005-2766 +Info 2005-09-02 2016-10-18
2.1
None Local Low Not required Partial None None
Symantec AntiVirus Corporate Edition 9.0.1.x and 9.0.4.x, and possibly other versions, when obtaining updates from an internal LiveUpdate server, stores sensitive information in cleartext in the Log.Liveupdate log file, which allows attackers to obtain the username and password to the internal LiveUpdate server.
278 CVE-2005-2765 2005-09-01 2008-09-05
2.1
None Local Low Not required None Partial None
The user interface in the Windows Firewall does not properly display certain malformed entries in the Windows Registry, which makes it easier for attackers with administrator privileges to hide activities if the administrator only uses the Windows Firewall interface to monitor exceptions. NOTE: the vendor disputes this issue, saying that since administrative privileges are already required, it is not a vulnerability. CVE has not yet formally decided if such "information hiding" issues should be included.
279 CVE-2005-2764 DoS Exec Code Overflow 2005-09-21 2011-03-08
7.5
None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in OpenTTD before 0.4.0.1 allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
280 CVE-2005-2763 DoS Exec Code 2005-09-06 2011-03-08
7.5
None Remote Low Not required Partial Partial Partial
Multiple format string vulnerabilities in OpenTTD before 0.4.0.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
281 CVE-2005-2710 Exec Code 2005-09-27 2017-10-11
5.1
None Remote High Not required Partial Partial Partial
Format string vulnerability in Real HelixPlayer and RealPlayer 10 allows remote attackers to execute arbitrary code via the (1) image handle or (2) timeformat attribute in a RealPix (.rp) or RealText (.rt) file.
282 CVE-2005-2707 2005-09-23 2017-10-11
5.0
None Remote Low Not required None Partial None
Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to spawn windows without user interface components such as the address and status bar, which could be used to conduct spoofing or phishing attacks.
283 CVE-2005-2706 2005-09-23 2017-10-11
6.4
None Remote Low Not required Partial Partial None
Firefox before 1.0.7 and Mozilla before Suite 1.7.12 allows remote attackers to execute Javascript with chrome privileges via an about: page such as about:mozilla.
284 CVE-2005-2705 Exec Code Overflow 2005-09-23 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
Integer overflow in the JavaScript engine in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 might allow remote attackers to execute arbitrary code.
285 CVE-2005-2704 2005-09-23 2017-10-11
5.0
None Remote Low Not required None Partial None
Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to spoof DOM objects via an XBL control that implements an internal XPCOM interface.
286 CVE-2005-2703 94 2005-09-23 2017-10-11
5.0
None Remote Low Not required None Partial None
Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to modify HTTP headers of XML HTTP requests via XMLHttpRequest, and possibly use the client to exploit vulnerabilities in servers or proxies, including HTTP request smuggling and HTTP request splitting.
287 CVE-2005-2702 DoS Exec Code 2005-09-23 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Unicode sequences with "zero-width non-joiner" characters.
288 CVE-2005-2701 Exec Code Overflow 2005-09-23 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to execute arbitrary code via an XBM image file that ends in a large number of spaces instead of the expected end tag.
289 CVE-2005-2700 Bypass 2005-09-06 2021-06-06
10.0
None Remote Low Not required Complete Complete Complete
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
290 CVE-2005-2663 2005-09-21 2017-07-11
2.1
None Local Low Not required None Partial None
masqmail before 0.2.18 allows local users to overwrite arbitrary files via a symlink attack on a log file.
291 CVE-2005-2662 Exec Code 2005-09-21 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
masqmail before 0.2.18 allows remote attackers to execute arbitrary commands via crafted e-mail addresses that are not properly sanitized when creating a failed delivery message.
292 CVE-2005-2660 2005-09-30 2008-09-05
2.1
None Local Low Not required None Partial None
apachetop 0.12.5 and earlier, when running in debug mode, allows local users to create or append to arbitrary files via a symlink attack on atop.debug.
293 CVE-2005-2658 Exec Code Overflow 2005-09-15 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in utility.cpp in Turquoise SuperStat (turqstat) 2.2.4 and earlier might allow remote NNTP servers to execute arbitrary code via a date with a long month.
294 CVE-2005-2657 Exec Code +Priv 2005-09-16 2017-07-11
4.6
None Local Low Not required Partial Partial Partial
Unknown vulnerability in common-lisp-controller 4.18 and earlier allows local users to gain privileges by compiling arbitrary code in the cache directory, which is executed by another user if the user has not run Common Lisp before.
295 CVE-2005-2656 DoS 2005-09-06 2008-09-05
2.1
None Local Low Not required None None Partial
Polygen before 1.0.6 generates precompiled grammar objects with world-writable permissions, which allows local users to cause a denial of service (disk consumption) and possibly perform other unauthorized activities.
296 CVE-2005-2557 XSS 2005-09-28 2017-07-11
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in view_all_set.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the dir parameter, as identified by bug#0005959, and a different vulnerability than CVE-2005-3090.
297 CVE-2005-2496 2005-09-02 2017-10-11
4.6
None Local Low Not required Partial Partial Partial
The xntpd ntp (ntpd) daemon before 4.2.0b, when run with the -u option and using a string to specify the group, uses the group ID of the user instead of the group, which causes xntpd to run with different privileges than intended.
298 CVE-2005-2495 189 Exec Code Overflow 2005-09-15 2018-10-19
5.1
None Remote High Not required Partial Partial Partial
Multiple integer overflows in XFree86 before 4.3.0 allow user-assisted attackers to execute arbitrary code via a crafted pixmap image.
299 CVE-2005-2494 2005-09-06 2017-10-11
7.2
None Local Low Not required Complete Complete Complete
kcheckpass in KDE 3.2.0 up to 3.4.2 allows local users to gain root access via a symlink attack on lock files.
300 CVE-2005-2492 264 DoS 2005-09-14 2018-10-19
3.6
None Local Low Not required Partial None Partial
The raw_sendmsg function in the Linux kernel 2.6 before 2.6.13.1 allows local users to cause a denial of service (change hardware state) or read from arbitrary memory via crafted input.
Total number of vulnerabilities : 309   Page : 1 2 3 4 5 6 (This Page)7
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.