Search
Total
86024 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2005-3784 | 1 Linux | 1 Linux Kernel | 2018-10-19 | 4.9 MEDIUM | N/A |
| The auto-reap of child processes in Linux kernel 2.6 before 2.6.15 includes processes with ptrace attached, which leads to a dangling ptrace reference and allows local users to cause a denial of service (crash) and gain root privileges. | |||||
| CVE-2005-3787 | 1 Phpmyadmin | 1 Phpmyadmin | 2018-10-19 | 4.3 MEDIUM | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-pl4 allow remote attackers to inject arbitrary web script or HTML via (1) the cookie-based login panel, (2) the title parameter and (3) the table creation dialog. | |||||
| CVE-2005-3792 | 1 Francisco Burzi | 1 Php-nuke | 2018-10-19 | 7.5 HIGH | N/A |
| Multiple SQL injection vulnerabilities in the Search module in PHP-Nuke 7.8, and possibly other versions before 7.9 with patch 3.1, allows remote attackers to execute arbitrary SQL commands, as demonstrated via the query parameter in a stories type. | |||||
| CVE-2005-3805 | 1 Linux | 1 Linux Kernel | 2018-10-19 | 4.9 MEDIUM | N/A |
| A locking problem in POSIX timer cleanup handling on exit in Linux kernel 2.6.10 to 2.6.14, when running on SMP systems, allows local users to cause a denial of service (deadlock) involving process CPU timers. | |||||
| CVE-2005-3806 | 1 Linux | 1 Linux Kernel | 2018-10-19 | 6.6 MEDIUM | N/A |
| The IPv6 flow label handling code (ip6_flowlabel.c) in Linux kernels 2.4 up to 2.4.32 and 2.6 before 2.6.14 modifies the wrong variable in certain circumstances, which allows local users to corrupt kernel memory or cause a denial of service (crash) by triggering a free of non-allocated memory. | |||||
| CVE-2005-3807 | 1 Linux | 1 Linux Kernel | 2018-10-19 | 4.9 MEDIUM | N/A |
| Memory leak in the VFS file lease handling in locks.c in Linux kernels 2.6.10 to 2.6.15 allows local users to cause a denial of service (memory exhaustion) via certain Samba activities that cause an fasync entry to be re-allocated by the fcntl_setlease function after the fasync queue has already been cleaned by the locks_delete_lock function. | |||||
| CVE-2005-3812 | 1 Freeftpd | 1 Freeftpd | 2018-10-19 | 6.8 MEDIUM | N/A |
| freeFTPd 1.0.10 allows remote authenticated users to cause a denial of service (null dereference and crash) via a PORT command with missing arguments. | |||||
| CVE-2005-3813 | 1 Mailenable | 2 Mailenable Enterprise, Mailenable Professional | 2018-10-19 | 4.0 MEDIUM | N/A |
| IMAP service (meimaps.exe) of MailEnable Professional 1.7 and Enterprise 1.1 allows remote authenticated attackers to cause a denial of service (application crash) by using RENAME with a non-existent mailbox, a different vulnerability than CVE-2005-3690. | |||||
| CVE-2005-3818 | 1 Vtiger | 1 Vtiger Crm | 2018-10-19 | 4.3 MEDIUM | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) various input fields, including the contact, lead, and first or last name fields, (2) the record parameter in a DetailView action in the Leads module for index.php, (3) the $_SERVER['PHP_SELF'] variable, which is used in multiple locations such as index.php, and (4) aggregated RSS feeds in the RSS aggregation module. | |||||
| CVE-2005-3819 | 1 Vtiger | 1 Vtiger Crm | 2018-10-19 | 7.5 HIGH | N/A |
| Multiple SQL injection vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to inject arbitrary SQL commands and bypass authentication via the (1) user_name and (2) date parameter in the HelpDesk module. | |||||
| CVE-2005-3820 | 1 Vtiger | 1 Vtiger Crm | 2018-10-19 | 6.4 MEDIUM | N/A |
| Multiple directory traversal vulnerabilities in index.php in vTiger CRM 4.2 and earlier allow remote attackers to read or include arbitrary files, an ultimately execute arbitrary PHP code, via .. (dot dot) and null byte ("%00") sequences in the (1) module parameter and (2) action parameter in the Leads module, as also demonstrated by injecting PHP code into log messages and accessing the log file. | |||||
| CVE-2005-3821 | 1 Vtiger | 1 Vtiger Crm | 2018-10-19 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in vTiger CRM 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via multiple vectors, including the account name. | |||||
| CVE-2005-3822 | 1 Vtiger | 1 Vtiger Crm | 2018-10-19 | 7.5 HIGH | N/A |
| Multiple SQL injection vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username in the login form or (2) record parameter, as demonstrated in the EditView action for the Contacts module. | |||||
| CVE-2005-3823 | 1 Vtiger | 1 Vtiger Crm | 2018-10-19 | 7.5 HIGH | N/A |
| The Users module in vTiger CRM 4.2 and earlier allows remote attackers to execute arbitrary PHP code via an arbitrary file in the templatename parameter, which is passed to the eval function. | |||||
| CVE-2005-3824 | 1 Vtiger | 1 Vtiger Crm | 2018-10-19 | 5.0 MEDIUM | N/A |
| The uploads module in vTiger CRM 4.2 and earlier allows remote attackers to upload arbitrary files, such as PHP files, via the add2db action. | |||||
| CVE-2005-3831 | 1 Speedproject | 3 Speedcommander, Squeez, Zipstar | 2018-10-19 | 5.1 MEDIUM | N/A |
| Stack-based buffer overflow in (1) CxZIP60.dll and (2) CxZIP60u.dll, as used in SpeedProject products including (a) ZipStar 5.0 Build 4285, (b) Squeez 5.0 Build 4285, and (c) SpeedCommander 11.0 Build 4430 and 10.51 Build 4430, allows user-assisted attackers to execute arbitrary code via a ZIP archive containing a long filename. | |||||
| CVE-2005-3832 | 1 Speedproject | 2 Speedcommander, Squeez | 2018-10-19 | 5.1 MEDIUM | N/A |
| Stack-based buffer overflow in (1) CxUux60.dll and (2) CxUux60u.dll, as used in SpeedProject products including (a) Squeez 5.0 Build 4285, and (b) SpeedCommander 11.0 Build 4430 and 10.51 Build 4430, allows user-assisted attackers to execute arbitrary code via a ZIP archive containing a long filename. | |||||
| CVE-2005-3849 | 1 Pmwiki | 1 Pmwiki | 2018-10-19 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in the Search module in PmWiki up to 2.0.12 allows remote attackers to inject arbitrary web script or HTML via the q parameter. | |||||
| CVE-2005-3857 | 1 Linux | 1 Linux Kernel | 2018-10-19 | 4.9 MEDIUM | N/A |
| The time_out_leases function in locks.c for Linux kernel before 2.6.15-rc3 allows local users to cause a denial of service (kernel log message consumption) by causing a large number of broken leases, which is recorded to the log using the printk function. | |||||
| CVE-2005-3859 | 1 Q-news | 1 Q-news | 2018-10-19 | 7.5 HIGH | N/A |
| PHP remote file inclusion vulnerability in q-news.php in Q-News 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the id parameter. | |||||
| CVE-2005-3860 | 1 Oliver May | 1 Athena Php Website Administration | 2018-10-19 | 7.5 HIGH | N/A |
| PHP remote file inclusion vulnerability in athena.php in Oliver May Athena PHP Website Administration 0.1a allows remote attackers to execute arbitrary PHP code via a URL in the athena_dir parameter. | |||||
| CVE-2005-3861 | 1 Phpgreetz | 1 Phpgreetz | 2018-10-19 | 7.5 HIGH | N/A |
| PHP remote file inclusion vulnerability in content.php in phpGreetz 0.99 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the content parameter. | |||||
| CVE-2005-3863 | 1 Ktools | 1 Ktools | 2018-10-19 | 7.5 HIGH | N/A |
| Stack-based buffer overflow in kkstrtext.h in ktools library 0.3 and earlier, as used in products such as (1) centericq, (2) orpheus, (3) motor, and (4) groan, allows local users or remote attackers to execute arbitrary code via a long parameter to the VGETSTRING macro. | |||||
| CVE-2005-3921 | 1 Cisco | 1 Ios | 2018-10-19 | 2.6 LOW | N/A |
| Cross-site scripting (XSS) vulnerability in Cisco IOS Web Server for IOS 12.0(2a) allows remote attackers to inject arbitrary web script or HTML by (1) packets containing HTML that an administrator views via an HTTP interface to the contents of memory buffers, as demonstrated by the URI /level/15/exec/-/buffers/assigned/dump; or (2) sending the router Cisco Discovery Protocol (CDP) packets with HTML payload that an administrator views via the CDP status pages. NOTE: these vectors were originally reported as being associated with the dump and packet options in /level/15/exec/-/show/buffers. | |||||
| CVE-2005-3922 | 1 Panda | 19 Panda Activescan, Panda Antivirus, Panda Antivirus Platinum and 16 more | 2018-10-19 | 7.5 HIGH | N/A |
| Heap-based buffer overflow in pskcmp.dll in Panda Software Antivirus library allows remote attackers to execute arbitrary code via a crafted ZOO archive. | |||||
| CVE-2005-3926 | 1 Guppy | 1 Guppy | 2018-10-19 | 7.5 HIGH | N/A |
| Direct static code injection vulnerability in error.php in GuppY 4.5.9 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via the _SERVER[REMOTE_ADDR] parameter, which is injected into a .inc script that is later included by the main script. | |||||
| CVE-2005-3927 | 1 Guppy | 1 Guppy | 2018-10-19 | 6.4 MEDIUM | N/A |
| Multiple directory traversal vulnerabilities in GuppY 4.5.9 and earlier allow remote attackers to read and include arbitrary files via (1) the meskin parameter to admin/editorTypetool.php, or the lng parameter to the in admin/inc scripts (2) archbatch.php, (3) dbbatch.php, and (4) nwlmail.php. | |||||
| CVE-2005-3928 | 1 Qnx | 1 Rtos | 2018-10-19 | 4.6 MEDIUM | N/A |
| Buffer overflow in phgrafx in QNX 6.2.1 and 6.3.0 allows local users to execute arbitrary code via a long command line argument. | |||||
| CVE-2005-3929 | 1 Xaraya | 1 Xaraya | 2018-10-19 | 5.0 MEDIUM | N/A |
| Directory traversal vulnerability in the create function in xarMLSXML2PHPBackend.php in Xaraya 1.0 allows remote attackers to create directories and overwrite arbitrary files via ".." sequences in the module parameter to index.php. | |||||
| CVE-2005-3930 | 1 N-13 News | 1 N-13 News | 2018-10-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in index.php in N-13 News 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter. | |||||
| CVE-2005-3931 | 1 Asp-rider | 1 Asp-rider | 2018-10-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in default.asp in ASP-Rider 1.6 allows remote attackers to execute arbitrary SQL commands via the HTTP referer. | |||||
| CVE-2005-3949 | 1 Webcalendar | 1 Webcalendar | 2018-10-19 | 7.5 HIGH | N/A |
| Multiple SQL injection vulnerabilities in WebCalendar 1.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) startid parameter to activity_log.php, (2) startid parameter to admin_handler.php, (3) template parameter to edit_template.php, and (4) multiple parameters to export_handler.php. | |||||
| CVE-2005-3952 | 1 Php Labs | 1 Top Auction | 2018-10-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in PHP Labs Top Auction allows remote attackers to execute arbitrary SQL commands via the (1) category and (2) type parameters to viewcat.php, or (3) certain search parameters. NOTE: later a disclosure reported the affected version as 1.0. | |||||
| CVE-2005-3955 | 3 Blogbuddies, Jaws, Magpierss | 3 Blogbuddies, Jaws, Magpierss | 2018-10-19 | 4.3 MEDIUM | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in MagpieRSS 7.1, as used in (a) blogBuddiesv 0.3, (b) Jaws 0.6.2, and possibly other products, allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to (a) magpie_debug.php and (2) rss_url parameter to (b) magpie_slashbox.php and (c) simple_smarty.php. | |||||
| CVE-2005-3959 | 1 Freewebstat | 1 Freewebstat | 2018-10-19 | 4.3 MEDIUM | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in FreeWebStat 1.0 rev37 allow remote attackers to inject arbitrary web script or HTML via the (1) site, (2) jsref, (3) jsres, and (4) jscolor parameters to pixel.php, which are not sanitized before being included in the logdb.html file, and (5) the search key to stat.php. | |||||
| CVE-2005-3960 | 1 Kadu | 1 Kadu | 2018-10-19 | 7.8 HIGH | N/A |
| Kadu 0.4.2 and 0.5.0pre allows remote attackers to cause a denial of service (crash or generated traffic) via a malformed message, possibly with incomplete information. | |||||
| CVE-2005-3961 | 1 Webcalendar | 1 Webcalendar | 2018-10-19 | 5.0 MEDIUM | N/A |
| export_handler.php in WebCalendar 1.0.1 allows remote attackers to overwrite WebCalendar data files via a modified id parameter. | |||||
| CVE-2005-3962 | 1 Perl | 1 Perl | 2018-10-19 | 4.6 MEDIUM | N/A |
| Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications. | |||||
| CVE-2005-3964 | 1 Integrated Computer Solutions | 1 Openmotif | 2018-10-19 | 7.5 HIGH | N/A |
| Multiple buffer overflows in libUil (libUil.so) in OpenMotif 2.2.3, and possibly other versions, allows attackers to execute arbitrary code via the (1) diag_issue_diagnostic function in UilDiags.c and (2) open_source_file function in UilSrcSrc.c. | |||||
| CVE-2005-3968 | 1 Phpx | 1 Phpx | 2018-10-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in auth.inc.php in PHPX 3.5.9 and earlier allows remote attackers to execute arbitrary SQL commands, bypass authentication, and upload arbitrary PHP code via the username parameter. | |||||
| CVE-2005-3973 | 1 Drupal | 1 Drupal | 2018-10-19 | 4.3 MEDIUM | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allow remote attackers to inject arbitrary web script or HTML via various HTML tags and values, such as the (1) legend tag and the value parameter used in (2) label and (3) input tags, possibly due to an incomplete blacklist. | |||||
| CVE-2005-3974 | 1 Drupal | 1 Drupal | 2018-10-19 | 6.4 MEDIUM | N/A |
| Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3, when running on PHP5, does not correctly enforce user privileges, which allows remote attackers to bypass the "access user profiles" permission. | |||||
| CVE-2005-3975 | 1 Drupal | 1 Drupal | 2018-10-19 | 4.0 MEDIUM | N/A |
| Interpretation conflict in file.inc in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer as a result of CVE-2005-3312. NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer and the proper fix should be in that browser; if so, then this should not be treated as a vulnerability in Drupal. | |||||
| CVE-2005-3980 | 1 Edgewall Software | 1 Trac | 2018-10-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in the ticket query module in Edgewall Trac 0.9 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the group parameter. | |||||
| CVE-2005-3982 | 1 Webcalendar | 1 Webcalendar | 2018-10-19 | 5.0 MEDIUM | N/A |
| CRLF injection vulnerability in layers_toggle.php in WebCalendar 1.0.1 might allow remote attackers to modify HTTP headers and conduct HTTP response splitting attacks via the ret parameter, which is used to redirect URL requests. | |||||
| CVE-2005-3983 | 1 Hp | 1 Systems Insight Manager | 2018-10-19 | 7.8 HIGH | N/A |
| Unknown vulnerability in the login page for HP Systems Insight Manager (SIM) 4.0 and 4.1, when accessed by Microsoft Internet Explorer with the MS04-025 patch, leads to a denial of service (browser hang). NOTE: although the advisory is vague, this issue does not appear to involve an attacker at all. If not, then this issue is not a vulnerability. | |||||
| CVE-2005-3984 | 1 Webcalendar | 1 Webcalendar | 2018-10-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in WebCalendar 1.0.1 allows remote attackers to execute arbitrary SQL commands via the time_range parameter to edit_report_handler.php. NOTE: the startid/activity_log.php vector is already covered by CVE-2005-3949. | |||||
| CVE-2005-3991 | 1 Phpheaven | 1 Phpmychat | 2018-10-19 | 4.3 MEDIUM | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in phpMyChat 0.14.6 allow remote attackers to inject arbitrary web script or HTML via the medium parameter to (1) start_page.css.php and (2) style.css.php; or the From parameter to users_popupL.php. | |||||
| CVE-2005-3995 | 1 Sobexsrv | 1 Sobexsrv | 2018-10-19 | 5.1 MEDIUM | N/A |
| Format string vulnerability in the dosyslog function in the OBEX server (obexsrv.c) for Sobexsrv before 1.0.0-pre4, when the syslog (-S) function is enabled, allows remote attackers to execute arbitrary code via format string specifiers in file name arguments to OBEX commands. | |||||
| CVE-2005-3996 | 1 Zen-cart | 1 Zen Cart | 2018-10-19 | 5.1 MEDIUM | N/A |
| SQL injection vulnerability in admin/password_forgotten.php in Zen Cart 1.2.6d and earlier allows remote attackers to execute arbitrary SQL commands via the admin_email parameter. | |||||