|
346851
|
5.0 |
MEDIUM
|
enhanced_simple_php_gallery
|
enhanced_simple_php_gallery
|
Enhanced Simple PHP Gallery 1.7 allows remote attackers to obtain the full path of the application via a direct request to sp_helper_functions.php, which leaks the pathname in an error message.
|
NVD-CWE-Other
|
CVE-2006-0113
|
2008-09-6 05:58 |
2006-01-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346852
|
7.5 |
HIGH
|
rockliffe
|
mailsite
|
Mail Management Agent (MAILMA) (aka Mail Management Server) in Rockliffe MailSite 7.0.3.1 and earlier allows remote attackers to attempt authentication with an unlimited number of user account names …
|
NVD-CWE-Other
|
CVE-2006-0130
|
2008-09-6 05:58 |
2006-01-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346853
|
5.0 |
MEDIUM
|
amsn
|
amsn
|
aMSN (aka Alvaro's Messenger) allows remote attackers to cause a denial of service (client hang and termination of client's instant-messaging session) by repeatedly sending crafted data to the defaul…
|
NVD-CWE-Other
|
CVE-2006-0138
|
2008-09-6 05:58 |
2006-01-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346854
|
4.3 |
MEDIUM
|
simpbook
|
simpbook
|
Cross-site scripting (XSS) vulnerability in SimpBook 1.0, with html_enable on (the default), allows remote attackers to inject arbitrary web script or HTML via the message field.
|
NVD-CWE-Other
|
CVE-2006-0149
|
2008-09-6 05:58 |
2006-01-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346855
|
5.0 |
MEDIUM
|
reamday_enterprises
|
magic_news_plus
|
settings.php in Reamday Enterprises Magic News Plus 1.0.3 allows remote attackers to change the administrator password via a change action that specifies identical values for the passwd and admin_pas…
|
NVD-CWE-Other
|
CVE-2006-0157
|
2008-09-6 05:58 |
2006-01-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346856
|
4.3 |
MEDIUM
|
qualityebiz
|
quality_ppc
|
Cross-site scripting (XSS) vulnerability in admin.php in QualityEBiz Quality PPC (QPPC) 1.0 build 1644 allows remote attackers to inject arbitrary web script or HTML via the cpage parameter. NOTE: t…
|
NVD-CWE-Other
|
CVE-2006-0215
|
2008-09-6 05:58 |
2006-01-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346857
|
5.0 |
MEDIUM
|
qualityebiz
|
quality_ppc
|
admin.php in QualityEBiz Quality PPC (QPPC) 1.0 build 1644 allows remote attackers to obtain sensitive information, possibly the installation path of the application, via unspecified "meta characters…
|
NVD-CWE-Other
|
CVE-2006-0216
|
2008-09-6 05:58 |
2006-01-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346858
|
10.0 |
HIGH
|
joomla
|
joomla
|
Multiple unspecified vulnerabilities in the (1) publishing component, (2) Contact Component, (3) TinyMCE Compressor, and (4) other components in Joomla! 1.0.5 and earlier have unknown impact and atta…
|
NVD-CWE-Other
|
CVE-2006-0303
|
2008-09-6 05:58 |
2006-01-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346859
|
4.3 |
MEDIUM
|
chitta
|
mimicboard_2
|
Multiple cross-site scripting (XSS) vulnerabilities in mimic2.cgi in mimicboard2 (Mimic2) 086 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters asso…
|
NVD-CWE-Other
|
CVE-2005-4858
|
2008-09-6 05:58 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346860
|
4.3 |
MEDIUM
|
chitta
|
mimicboard_2
|
In addition to the sites referenced. http://secunia.com/product/5681/ gives an advisory for the vulnerability as well as additional descripton.
|
NVD-CWE-Other
|
CVE-2005-4858
|
2008-09-6 05:58 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346861
|
6.4 |
MEDIUM
|
chitta
|
mimicboard
|
mimicboard2 (Mimic2) 086 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for mi…
|
NVD-CWE-Other
|
CVE-2005-4859
|
2008-09-6 05:58 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346862
|
7.5 |
HIGH
|
jasio.net
|
ragnarok_online_control_panel
|
functions.php in Ragnarok Online Control Panel (ROCP) 4.3.4a allows remote attackers to bypass authentication by requesting account_manage.php with a trailing "/login.php" PHP_SELF value, which is no…
|
CWE-287
Improper Authentication
|
CVE-2005-4861
|
2008-09-6 05:58 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346863
|
5.0 |
MEDIUM
|
xwiki
|
xwiki
|
The search functionality in XWiki 0.9.793 indexes cleartext user passwords, which allows remote attackers to obtain sensitive information via a search string that matches a password.
|
CWE-255
Credentials Management
|
CVE-2005-4862
|
2008-09-6 05:58 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346864
|
7.5 |
HIGH
|
hitachi
|
business_logic
|
Multiple SQL injection vulnerabilities in Hitachi Business Logic - Container (BLC) P-2443-9114 01-00 through 02-06 on Windows, and P-1M43-9111 01-01 through 02-00 on AIX, allow remote attackers to ex…
|
NVD-CWE-Other
|
CVE-2005-4578
|
2008-09-6 05:57 |
2005-12-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346865
|
7.5 |
HIGH
|
phpsurveyor
|
phpsurveyor
|
Multiple SQL injection vulnerabilities in PHPSurveyor before 0.991 allow remote attackers to execute arbitrary SQL commands via the (1) sql parameter in browse.php and the (2) sid, (3) lid, (4) gid, …
|
NVD-CWE-Other
|
CVE-2005-4586
|
2008-09-6 05:57 |
2005-12-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346866
|
7.8 |
HIGH
|
juniper
|
netscreen-security_manager_2004
|
Juniper NetScreen-Security Manager (NSM) 2004 FP2 and FP3 allow remote attackers to cause a denial of service (crash or hang of server components that are automatically restarted) via a long crafted …
|
NVD-CWE-Other
|
CVE-2005-4587
|
2008-09-6 05:57 |
2005-12-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346867
|
7.5 |
HIGH
|
efilego
|
efilego
|
Directory traversal vulnerability in eFileGo 3.01 allows remote attackers to execute arbitrary code, read arbitrary files, and upload arbitrary files via a ... (triple dot) in (1) the URL on port 608…
|
NVD-CWE-Other
|
CVE-2005-4622
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346868
|
5.0 |
MEDIUM
|
efilego
|
efilego
|
upload.exe in eFileGo 3.01 allows remote attackers to cause a denial of service (CPU consumption) via an argument with an invalid directory name.
|
NVD-CWE-Other
|
CVE-2005-4623
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346869
|
5.0 |
MEDIUM
|
ptnet
|
ptnet_ircd
|
The m_join function in channel.c for PTnet ircd 1.5 and 1.6 allows remote attackers to cause a denial of service (memory exhaustion that triggers a daemon restart) via a large number of requests to j…
|
NVD-CWE-Other
|
CVE-2005-4624
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346870
|
7.5 |
HIGH
|
3cfr
|
3cfr
|
SQL injection vulnerability in index.php in 3CFR allows remote attackers to execute arbitrary SQL commands via the LangueID parameter.
|
NVD-CWE-Other
|
CVE-2005-4645
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346871
|
5.1 |
MEDIUM
|
illustrate
|
dbpoweramp_music_converter
|
Buffer overflow in Illustrate dBpowerAMP Music Converter 11.5 and earlier, possibly including (1) MusicConverter.exe, (2) playlist.exe, and (3) amp.exe, allows user-assisted attackers to cause a deni…
|
NVD-CWE-Other
|
CVE-2005-4648
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346872
|
4.3 |
MEDIUM
|
advanced_guestbook
|
advanced_guestbook
|
Multiple cross-site scripting (XSS) vulnerabilities in Advanced Guestbook 2.2 and 2.3.1 allow remote attackers to inject arbitrary web script or HTML via (1) the entry parameter in index.php and (2) …
|
NVD-CWE-Other
|
CVE-2005-4649
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346873
|
7.5 |
HIGH
|
ocean12_technologies
|
calendar_manager_pro
|
Ocean12 Calendar Manager Pro 1.01 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to /admin/view.asp. NOTE: the provenance of this information …
|
NVD-CWE-Other
|
CVE-2005-4657
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346874
|
1.2 |
LOW
|
ipcop
|
ipcop
|
Race condition in IPCop (aka IPCop Firewall) before 1.4.10 might allow local users to overwrite system configuration files and gain privileges by replacing a backup archive during the time window whe…
|
NVD-CWE-Other
|
CVE-2005-4660
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346875
|
4.6 |
MEDIUM
|
parosproxy
|
parosproxy
|
The embedded HSQLDB in ParosProxy before 3.2.7, when running with JDK 1.4.2 before 1.4.2_08, allows local users to execute arbitrary comands via crafted SQL commands that interact with HSQLDB through…
|
NVD-CWE-Other
|
CVE-2005-4668
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346876
|
7.5 |
HIGH
|
rt_internet_solutions
|
rt_internet_solutions_webadmin
|
SQL injection vulnerability in RT Internet Solutions (RTIS) WebAdmin allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields.
|
NVD-CWE-Other
|
CVE-2005-4669
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346877
|
5.0 |
MEDIUM
|
inicom_networks
|
ioftpd
|
ioFTPD 0.5.84 u responds with different messages depending on whether or not a username exists, which allows remote attackers to enumerate valid usernames.
|
NVD-CWE-Other
|
CVE-2005-4673
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346878
|
5.0 |
MEDIUM
|
apple
|
safari
|
Apple Safari 2.0.2 (aka 416.12) allows remote attackers to spoof the URL in the status bar via the title in an image in a link to a trusted site within a form to the malicious site. NOTE: the proven…
|
NVD-CWE-Other
|
CVE-2005-4678
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346879
|
5.0 |
MEDIUM
|
microsoft
|
ie
|
Internet Explorer 6 for Windows XP Service Pack 2 allows remote attackers to spoof the URL in the status bar via the title in an image in a link to a trusted site within a form to the malicious site.
|
NVD-CWE-Other
|
CVE-2005-4679
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346880
|
5.0 |
MEDIUM
|
punbb
|
punbb
|
PunBB 1.2.9, when used alone or with F-ART BLOG:CMS, includes config.php before calling the unregister_globals function, which allows attackers to obtain unspecified sensitive information.
|
NVD-CWE-Other
|
CVE-2005-4686
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346881
|
5.0 |
MEDIUM
|
f-art_agency
punbb
|
blog_cms
punbb
|
PunBB 1.2.9, used alone or with F-ART BLOG:CMS, may trust a client's IP address as specified in the X-Forwarded-For HTTP header rather than the TCP/IP stack, which allows remote attackers to misrepre…
|
NVD-CWE-Other
|
CVE-2005-4687
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346882
|
5.0 |
MEDIUM
|
punbb
|
punbb
|
PunBB 1.2.9 does not require password entry when changing the e-mail address in an account's profile, which might allow an attacker to make an address change via a hijacked login session.
|
NVD-CWE-Other
|
CVE-2005-4688
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346883
|
5.0 |
MEDIUM
|
-
|
-
|
Six Apart Movable Type 3.16 stores account names and password hashes in a cookie, which allows remote attackers to login to an account by sniffing the cookie.
|
NVD-CWE-Other
|
CVE-2005-4689
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346884
|
2.1 |
LOW
|
six_apart
|
movable_type
|
Six Apart Movable Type 3.16 allows local users with blog-creation privileges to create or overwrite arbitrary files of certain types (such as HTML and image files) by selecting an arbitrary directory…
|
NVD-CWE-Other
|
CVE-2005-4690
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346885
|
2.1 |
LOW
|
netbsd
|
netbsd
|
imake in NetBSD before 2.0.3, NetBSD-current before 12 September 2005, certain versions of X.Org, and certain versions of XFree86 allows local users to overwrite arbitrary files via a symlink attack …
|
NVD-CWE-Other
|
CVE-2005-4691
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346886
|
7.5 |
HIGH
|
mroovca
|
mroovca_stats
|
Unspecified vulnerability in mroovca stats (mroovcastats) before 0.4.5b has unknown attack vectors and impact, related to cookies.
|
NVD-CWE-Other
|
CVE-2005-4692
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346887
|
5.0 |
MEDIUM
|
gaim-encryption
|
gaim-encryption
|
Gaim-Encryption 2.38-1 on Debian Linux allows remote attackers to cause a denial of service (crash) via a crafted message from an ICQ buddy, possibly involving the GE_received_key function in keys.c.
|
NVD-CWE-Other
|
CVE-2005-4693
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346888
|
6.4 |
MEDIUM
|
ipbproarcade
|
ipbproarcade
|
SQL injection vulnerability in the favorites module in index.php in IPBProArcade 2.5.2 allows remote attackers to inject arbitrary SQL commands via the gameid parameter. NOTE: the provenance of this…
|
NVD-CWE-Other
|
CVE-2005-4702
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346889
|
5.0 |
MEDIUM
|
bea
|
weblogic_server
|
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 through SP3, 7.0 through SP6, and 6.1 through SP7, when SSL is intended to be used, causes an unencrypted protocol to be used…
|
NVD-CWE-Other
|
CVE-2005-4704
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346890
|
5.0 |
MEDIUM
|
bea
|
weblogic_server
|
BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7, when a Java client application creates an SSL connection to the server after it has already created an …
|
NVD-CWE-Other
|
CVE-2005-4705
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346891
|
5.0 |
MEDIUM
|
php_handicapper
|
php_handicapper
|
CRLF injection vulnerability in process_signup.php in PHP Handicapper allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the login parameter. NOTE: the vendor has dispute…
|
NVD-CWE-Other
|
CVE-2005-4712
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346892
|
5.0 |
MEDIUM
|
-
|
-
|
Hitachi TP1/Server Base and TP1/NET/Library 2 on IBM AIX allow remote attackers to (1) cause a denial of service (OpenTP1 system outage) via invalid data to a port used by a system-server process, an…
|
NVD-CWE-Other
|
CVE-2005-4716
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346893
|
5.0 |
MEDIUM
|
mozilla
|
firefox
|
Mozilla Firefox 1.0.7 and earlier on Linux allows remote attackers to cause a denial of service (client crash) via an IFRAME element with a large value of the WIDTH attribute, which triggers a proble…
|
NVD-CWE-Other
|
CVE-2005-4720
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346894
|
7.5 |
HIGH
|
geeklog
|
geeklog
|
Geeklog before 1.3.11sr3 allows remote attackers to bypass intended access restrictions and comment on an arbitrary story or topic by guessing the story ID.
|
NVD-CWE-Other
|
CVE-2005-4725
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346895
|
5.0 |
MEDIUM
|
mute
|
mute
|
MUTE 0.4 uses improper flood protection algorithms, which allows remote attackers to obtain sensitive information (privacy leak and search result data) by controlling a drop chain neighbor that is ne…
|
NVD-CWE-Other
|
CVE-2005-4726
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346896
|
4.6 |
MEDIUM
|
debian
|
amaya
|
Untrusted search path vulnerability (RPATH) in amaya 9.2.1 on Debian GNU/Linux allows local users to gain privileges via a malicious Mesa library in the /home/anand directory.
|
NVD-CWE-Other
|
CVE-2005-4728
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346897
|
10.0 |
HIGH
|
pear
|
text_password
|
Unspecified vulnerability in PEAR Text_Password 1.0 has unknown impact and attack vectors, related to "problematic seeding" of the random number generator, possibly predictable seeds.
|
NVD-CWE-Other
|
CVE-2005-4730
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346898
|
5.0 |
MEDIUM
|
the_php_group
|
pear_html_quickform_controller
|
The Next action in PEAR HTML_QuickForm_Controller 1.0.4 includes the SID in the URL even when session.use_only_cookies is configured, which allows remote attackers to obtain the SID via an HTTP Refer…
|
NVD-CWE-Other
|
CVE-2005-4731
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346899
|
5.0 |
MEDIUM
|
the_php_group
|
pear_html_quickform_controller
|
Upgrade to version 1.0.5 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
|
NVD-CWE-Other
|
CVE-2005-4731
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346900
|
4.3 |
MEDIUM
|
tux_racer
|
tuxbank
|
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Tux Racer TuxBank 0.7x and 0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) description p…
|
NVD-CWE-Other
|
CVE-2005-4732
|
2008-09-6 05:57 |
2005-12-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
