2005

Contrexx before 1.0.5 allows remote attackers to obtain sensitive information via a direct request to /config/version.xm

Beehive Forum allows remote attackers to obtain sensitive information via (1) an invalid final_uri or sort_by parameter

Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hid

Firefox, when opening Microsoft Word documents, does not properly set the permissions on shared sections, which allows r

The (1) lost password and (2) account pending features in GForge 4.5 do not properly set a limit on the number of e-mail

PhpList allows remote attackers to obtain sensitive information via a direct request to (1) about.php, (2) connect.php,

Linksys WRT54G router uses the same private key and certificate for every router, which allows remote attackers to sniff

browse.php in Website Baker Project allows remote attackers to obtain sensitive data via (1) a directory that does not e

Website Baker Project does not properly verify the file extensions of uploaded files, which allows remote attackers to u

Cross-Application Scripting (XAS) vulnerability in SPI Dynamics WebInspect 5.0.196 allows remote attackers to inject Jav

Kshout 2.x and 3.x stores settings.dat under the web document root with insufficient access control, which allows remote

Multiple "endianness errors" in libgadu in ekg before 1.6rc2 allow remote attackers to cause a denial of service (invali

libtiff up to 3.7.0 allows remote attackers to cause a denial of service (application crash) via a TIFF image header wit

Multiple cross-site scripting (XSS) vulnerabilities in Contrexx before 1.0.5 allow remote attackers to inject arbitrary

Cross-site scripting (XSS) vulnerability in index.php in Beehive Forum allows remote attackers to inject arbitrary web s

Cross-site scripting (XSS) vulnerability in viewCart.asp in CartWIZ allows remote attackers to inject arbitrary web scri

Multiple cross-site scripting (XSS) vulnerabilities in GForge 4.5 allow remote attackers to inject arbitrary web script

Cross-site scripting (XSS) vulnerability in browse.php in Website Baker Project allows remote attackers to inject arbitr

Cross-site scripting (XSS) vulnerability in UseBB 0.5.1 and earlier allows remote attackers to inject arbitrary Javascri

Multiple cross-site scripting (XSS) vulnerabilities in VBzoom allow remote attackers to inject arbitrary web script and

Race condition in the xpcom library, as used by web browsers such as Firefox, Mozilla, Netscape, and Galeon, allows remo

RPC portmapper (rpcbind) in SCO UnixWare 7.1.1 m5, 7.1.3 mp5, and 7.1.4 mp2 allows remote attackers or local users to ca

FTPshell Server 3.38 allows remote authenticated users to cause a denial of service (application crash) by multiple conn

Trillian Pro 3.1 build 121, when checking Yahoo e-mail, stores the password in plaintext in a world readable file and do

Cisco IOS 12.0 through 12.4 and IOS XR before 3.2, with IPv6 enabled, allows remote attackers on a local network segment

Race condition in sandbox before 1.2.11 allows local users to create or overwrite arbitrary files via symlink attack on

Heap-based buffer overflow in the Admin Plus Pack Option for VERITAS Backup Exec 9.0 through 10.0 for Windows Servers al

The ptrace call in the Linux kernel 2.6.8.1 and 2.6.10 for the AMD64 platform allows local users to cause a denial of se

Format string vulnerability in util.c in nbsmtp 0.99 and earlier, while running in debug mode, allows remote attackers t

Format string vulnerability in the nm_info_handler function in Network Manager may allow remote attackers to execute arb

A design error in Opera 8.01 and earlier allows user-assisted attackers to execute arbitrary code by overlaying a malici

Cross-Site Request Forgery (CSRF) vulnerability in tDiary 2.1.1, and tDiary 2.0.1 and earlier, allows remote attackers t

Opera 8.01, when the "Arial Unicode MS" font (ARIALUNI.TTF) is installed, does not properly handle extended ASCII charac

Opera 8.01 allows remote attackers to conduct cross-site scripting (XSS) attacks or modify which files are uploaded by t

Buffer overflow in a third-party compression library (UNACEV2.DLL), as used in avast! Antivirus Home/Professional Editio

Multiple stack-based buffer overflows in GoodTech SMTP server 5.16 allow remote attackers to execute arbitrary code via

Multiple SQL injection vulnerabilities in PHP Surveyor 0.98 allows remote attackers to execute arbitrary SQL commands vi

PHP Surveyor 0.98 allows remote attackers to trigger SQL errors via missing parameters to (1) browse.php, (2) export.php

The inc.login.php scripts in PHPFinance 0.3 allows remote attackers to bypass the login and gain privileges.

SQL injection vulnerability in sendcard.php in Sendcard 3.2.3 allows remote attackers to execute arbitrary SQL commands

Buffer overflow in a certain USB driver, as used on Microsoft Windows, allows attackers to execute arbitrary code.

Multiple format string vulnerabilities in ProFTPD before 1.3.0rc2 allow attackers to cause a denial of service or obtain

Buffer overflow in the POP3 client in Fetchmail before 6.2.5.2 allows remote POP3 servers to cause a denial of service a

Directory traversal vulnerability in a third-party compression library (UNACEV2.DLL), as used in avast! Antivirus Home/P

NDMP server in Veritas NetBackup 5.1 allows attackers to cause a denial of service via a CONFIG message with an out-of-r

Unknown vulnerability in 3Com OfficeConnect Wireless 11g Access Point before 1.03.12 allows remote attackers to obtain s

show_news.php in CuteNews 1.3.6 allows remote attackers to obtain the full path of the server via an invalid archive par

Mozilla Firefox 1.0.4 and 1.0.5 does not choose the challenge with the strongest authentication scheme available as requ

PHP-Fusion allows remote attackers to inject arbitrary Cascading Style Sheets (CSS) via the BBCode color tag.

The login protocol in RealChat 3.5.1b does not use authentication, which allows remote attackers to log on as other user