# CVEs published 2005-02-06

65 CVEs were published on February 6, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2003-1021](https://cve.now/CVE-2003-1021.md): The scosession program in OpenServer 5.0.6 and 5.0.7 allows local users to gain privileges via crafted strings on the commandline. (no CVSS)
- [CVE-2004-0491](https://cve.now/CVE-2004-0491.md): The linux-2.4.21-mlock.patch in Red Hat Enterprise Linux 3 does not properly maintain the mlock page count when one process unlocks pages th (no CVSS)
- [CVE-2004-1382](https://cve.now/CVE-2004-1382.md): The glibcbug script in glibc 2.3.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files, a di (no CVSS)
- [CVE-2004-1383](https://cve.now/CVE-2004-1383.md): Multiple SQL injection vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to execute arbitrary SQL statements via (no CVSS)
- [CVE-2004-1384](https://cve.now/CVE-2004-1384.md): Multiple cross-site scripting (XSS) vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2004-1385](https://cve.now/CVE-2004-1385.md): phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpected characters in the session ID su (no CVSS)
- [CVE-2004-1386](https://cve.now/CVE-2004-1386.md): TikiWiki before 1.8.4.1 does not properly verify uploaded images, which could allow remote attackers to upload and execute arbitrary PHP scr (no CVSS)
- [CVE-2004-1387](https://cve.now/CVE-2004-1387.md): The check\_forensic script in apache-utils package 1.3.31 allows local users to overwrite or create arbitrary files via a symlink attack on t (no CVSS)
- [CVE-2004-1388](https://cve.now/CVE-2004-1388.md): Format string vulnerability in the gpsd\_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1.9.0 through 2.7 allows remote attack (no CVSS)
- [CVE-2004-1389](https://cve.now/CVE-2004-1389.md): Unknown vulnerability in the Veritas NetBackup Administrative Assistant interface for NetBackup BusinesServer 3.4, 3.4.1, and 4.5, DataCente (no CVSS)
- [CVE-2004-1390](https://cve.now/CVE-2004-1390.md): Multiple buffer overflows in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allow remote attackers to execute arbitrary code via a long argument t (no CVSS)
- [CVE-2004-1391](https://cve.now/CVE-2004-1391.md): Untrusted execution path vulnerability in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allows local users to execute arbitrary programs by modif (no CVSS)
- [CVE-2004-1392](https://cve.now/CVE-2004-1392.md): PHP 4.0 with cURL functions allows remote attackers to bypass the open\_basedir setting and read arbitrary files via a file: URL argument to (no CVSS)
- [CVE-2005-0013](https://cve.now/CVE-2005-0013.md): nwclient.c in ncpfs before 2.2.6 does not drop root privileges before executing utilities using the NetWare client functions, which allows l (no CVSS)
- [CVE-2005-0014](https://cve.now/CVE-2005-0014.md): Buffer overflow in ncplogin in ncpfs before 2.2.6 allows remote malicious NetWare servers to execute arbitrary code on the NetWare client. (no CVSS)
- [CVE-2005-0017](https://cve.now/CVE-2005-0017.md): The f2c translator in the f2c package 3.1 allows local users to read arbitrary files via a symlink attack on temporary files. (no CVSS)
- [CVE-2005-0018](https://cve.now/CVE-2005-0018.md): The f2 shell script in the f2c package 3.1 allows local users to read arbitrary files via a symlink attack on temporary files. (no CVSS)
- [CVE-2005-0075](https://cve.now/CVE-2005-0075.md): prefs.php in SquirrelMail before 1.4.4, with register\_globals enabled, allows remote attackers to inject local code into the SquirrelMail co (no CVSS)
- [CVE-2005-0089](https://cve.now/CVE-2005-0089.md): The SimpleXMLRPCServer library module in Python 2.2, 2.3 before 2.3.5, and 2.4, when used by XML-RPC servers that use the register\_instance (no CVSS)
- [CVE-2005-0101](https://cve.now/CVE-2005-0101.md): Buffer overflow in the socket\_getline function in Newspost 2.1.1 and earlier allows remote malicious NNTP servers to execute arbitrary code (no CVSS)
- [CVE-2005-0103](https://cve.now/CVE-2005-0103.md): PHP remote file inclusion vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to execute arbitrary PHP code by (no CVSS)
- [CVE-2005-0104](https://cve.now/CVE-2005-0104.md): Cross-site scripting (XSS) vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2005-0133](https://cve.now/CVE-2005-0133.md): ClamAV 0.80 and earlier allows remote attackers to cause a denial of service (clamd daemon crash) via a ZIP file with malformed headers. (no CVSS)
- [CVE-2005-0152](https://cve.now/CVE-2005-0152.md): PHP remote file inclusion vulnerability in Squirrelmail 1.2.6 allows remote attackers to execute arbitrary code via "URL manipulation." (no CVSS)
- [CVE-2005-0173](https://cve.now/CVE-2005-0173.md): squid\_ldap\_auth in Squid 2.5 and earlier allows remote authenticated users to bypass username-based Access Control Lists (ACLs) via a userna (no CVSS)
- [CVE-2005-0174](https://cve.now/CVE-2005-0174.md): Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP s (no CVSS)
- [CVE-2005-0175](https://cve.now/CVE-2005-0175.md): Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache via an HTTP response splitting attack. (no CVSS)
- [CVE-2005-0179](https://cve.now/CVE-2005-0179.md): Linux kernel 2.4.x and 2.6.x allows local users to cause a denial of service (CPU and memory consumption) and bypass RLIM\_MEMLOCK limits via (no CVSS)
- [CVE-2005-0180](https://cve.now/CVE-2005-0180.md): Multiple integer signedness errors in the sg\_scsi\_ioctl function in scsi\_ioctl.c for Linux 2.6.x allow local users to read or modify kernel (no CVSS)
- [CVE-2005-0182](https://cve.now/CVE-2005-0182.md): The mod\_dosevasive module 1.9 and earlier for Apache creates temporary files with predictable filenames, which could allow remote attackers (no CVSS)
- [CVE-2005-0183](https://cve.now/CVE-2005-0183.md): ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to execute arbitrary commands via shell metacharacters i (no CVSS)
- [CVE-2005-0184](https://cve.now/CVE-2005-0184.md): Directory traversal vulnerability in ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to read arbitrary f (no CVSS)
- [CVE-2005-0185](https://cve.now/CVE-2005-0185.md): Stack-based buffer overflow in NodeManager Professional 2.00 allows remote attackers to execute arbitrary commands via a LinkDown-Trap packe (no CVSS)
- [CVE-2005-0186](https://cve.now/CVE-2005-0186.md): Cisco IOS 12.1YD, 12.2T, 12.3 and 12.3T, when configured for the IOS Telephony Service (ITS), CallManager Express (CME) or Survivable Remote (no CVSS)
- [CVE-2005-0187](https://cve.now/CVE-2005-0187.md): Stack-based buffer overflow in the SetSkin function in AtHoc toolbar allows remote attackers to execute arbitrary code via a long skin name. (no CVSS)
- [CVE-2005-0188](https://cve.now/CVE-2005-0188.md): Format string vulnerability in the SetBaseURL function in AtHoc toolbar allows remote attackers to execute arbitrary code via format string (no CVSS)
- [CVE-2005-0189](https://cve.now/CVE-2005-0189.md): Stack-based buffer overflow in the HandleAction function in RealPlayer 10.5 (6.0.12.1040) and earlier allows remote attackers to execute arb (no CVSS)
- [CVE-2005-0190](https://cve.now/CVE-2005-0190.md): Directory traversal vulnerability in RealPlayer 10.5 (6.0.12.1040) and earlier allows remote attackers to delete arbitrary files via a Real (no CVSS)
- [CVE-2005-0191](https://cve.now/CVE-2005-0191.md): Off-by-one buffer overflow in the processing of tags in Real Metadata Package (RMP) files in RealPlayer 10.5 (6.0.12.1040) and earlier could (no CVSS)
- [CVE-2005-0192](https://cve.now/CVE-2005-0192.md): Directory traversal vulnerability in the parsing of Skin file names in RealPlayer 10.5 (6.0.12.1040) and earlier allows remote attackers to (no CVSS)
- [CVE-2005-0193](https://cve.now/CVE-2005-0193.md): Buffer overflow in the (1) -v and (2) -a switches in mRouter in iSync 1.5 in Mac OS X 10.3.7 and earlier allows local users to execute arbit (no CVSS)
- [CVE-2005-0194](https://cve.now/CVE-2005-0194.md): Squid 2.5, when processing the configuration file, parses empty Access Control Lists (ACLs), including proxy\_auth ACLs without defined auth (no CVSS)
- [CVE-2005-0195](https://cve.now/CVE-2005-0195.md): Cisco IOS 12.0S through 12.3YH allows remote attackers to cause a denial of service (device restart) via a crafted IPv6 packet. (no CVSS)
- [CVE-2005-0196](https://cve.now/CVE-2005-0196.md): Cisco IOS 12.0 through 12.3YL, with BGP enabled and running the bgp log-neighbor-changes command, allows remote attackers to cause a denial (no CVSS)
- [CVE-2005-0197](https://cve.now/CVE-2005-0197.md): Cisco IOS 12.1T, 12.2, 12.2T, 12.3 and 12.3T, with Multi Protocol Label Switching (MPLS) installed but disabled, allows remote attackers to (no CVSS)
- [CVE-2005-0198](https://cve.now/CVE-2005-0198.md): A logic error in the CRAM-MD5 code for the University of Washington IMAP (UW-IMAP) server, when Challenge-Response Authentication Mechanism (no CVSS)
- [CVE-2005-0199](https://cve.now/CVE-2005-0199.md): Integer underflow in the Lists\_MakeMask() function in lists.c in ngIRCd before 0.8.2 allows remote attackers to cause a denial of service (a (no CVSS)
- [CVE-2005-0200](https://cve.now/CVE-2005-0200.md): TikiWiki before 1.8.5 does not properly validate files that have been uploaded to the temp directory, which could allow remote attackers to (no CVSS)
- [CVE-2005-0211](https://cve.now/CVE-2005-0211.md): Buffer overflow in wccp.c in Squid 2.5 before 2.5.STABLE7 allows remote attackers to cause a denial of service and possibly execute arbitrar (no CVSS)
- [CVE-2005-0212](https://cve.now/CVE-2005-0212.md): The Amp II engine as used by Gore: Ultimate Soldier 1.50 and earlier allows remote attackers to cause a denial of service (infinite loop) vi (no CVSS)
- [CVE-2005-0213](https://cve.now/CVE-2005-0213.md): Directory traversal vulnerability in WinHKI 1.4d allows remote attackers to overwrite arbitrary files via a .. (no CVSS)
- [CVE-2005-0214](https://cve.now/CVE-2005-0214.md): Directory traversal vulnerability in Simple PHP Blog (SPHPBlog) 0.3.7c allows remote attackers to read or create arbitrary files via a .. (no CVSS)
- [CVE-2005-0215](https://cve.now/CVE-2005-0215.md): Mozilla 1.6 and possibly other versions allows remote attackers to cause a denial of service (application crash) via a XBM (X BitMap) file w (no CVSS)
- [CVE-2005-0216](https://cve.now/CVE-2005-0216.md): Cross-site scripting (XSS) vulnerability in formmail.php in Woltlab Burning Board Lite 1.0.0, 1.0.1e, and possibly other versions, allows re (no CVSS)
- [CVE-2005-0217](https://cve.now/CVE-2005-0217.md): SQL injection vulnerability in index.php in Invision Community Blog allows remote attackers to execute arbitrary SQL commands via the eid pa (no CVSS)
- [CVE-2005-0218](https://cve.now/CVE-2005-0218.md): ClamAV 0.80 and earlier allows remote attackers to bypass virus scanning via a base64 encoded image in a data: (RFC 2397) URL. (no CVSS)
- [CVE-2005-0219](https://cve.now/CVE-2005-0219.md): Multiple cross-site scripting (XSS) vulnerabilities in Gallery 1.3.4-pl1 allow remote attackers to inject arbitrary web script or HTML via ( (no CVSS)
- [CVE-2005-0220](https://cve.now/CVE-2005-0220.md): Cross-site scripting vulnerability in login.php in Gallery 1.4.4-pl2 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2005-0221](https://cve.now/CVE-2005-0221.md): Cross-site scripting (XSS) vulnerability in login.php in Gallery 2.0 Alpha allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2005-0222](https://cve.now/CVE-2005-0222.md): main.php in Gallery 2.0 Alpha allows remote attackers to gain sensitive information by changing the value of g2\_subView parameter, which rev (no CVSS)
- [CVE-2005-0223](https://cve.now/CVE-2005-0223.md): The Software Development Kit (SDK) and Run Time Environment (RTE) 1.4.1 and 1.4.2 for Tru64 UNIX allows remote attackers to cause a denial o (no CVSS)
- [CVE-2005-0224](https://cve.now/CVE-2005-0224.md): Unknown vulnerability in HP-UX B.11.04 running Virtualvault 4.5 through 4.7, when running the TGA daemon, allows remote attackers to cause a (no CVSS)
- [CVE-2005-0225](https://cve.now/CVE-2005-0225.md): firehol.sh in FireHOL before 1.224 creates temporary files with predictable file names, which could allow local users to overwrite arbitrary (no CVSS)
- [CVE-2005-0226](https://cve.now/CVE-2005-0226.md): Format string vulnerability in the Log\_Resolver function in log.c for ngIRCd 0.8.2 and earlier, when compiled with IDENT, logging to SYSLOG, (no CVSS)
- [CVE-2005-0227](https://cve.now/CVE-2005-0227.md): PostgreSQL (pgsql) 7.4.x, 7.2.x, and other versions allows local users to load arbitrary shared libraries and execute code via the LOAD exte (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-02-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.