# CVEs published 2005-02-10

92 CVEs were published on February 10, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2005-0076](https://cve.now/CVE-2005-0076.md): Multiple buffer overflows in the XView library 3.2 may allow local users to execute arbitrary code via setuid applications that use the libr (no CVSS)
- [CVE-2005-0088](https://cve.now/CVE-2005-0088.md): The publisher handler for mod\_python 2.7.8 and earlier allows remote attackers to obtain access to restricted objects via a crafted URL. (no CVSS)
- [CVE-2005-0230](https://cve.now/CVE-2005-0230.md): Firefox 1.0 does not prevent the user from dragging an executable file to the desktop when it has an image/gif content type but has a danger (no CVSS)
- [CVE-2005-0260](https://cve.now/CVE-2005-0260.md): Stack-based buffer overflow in the Discovery Service for BrightStor ARCserve Backup 11.1 and earlier allows remote attackers to execute arbi (no CVSS)
- [CVE-2005-0261](https://cve.now/CVE-2005-0261.md): lspath in AIX 5.2, 5.3, and possibly earlier versions, does not drop privileges before processing the -f option, which allows local users to (no CVSS)
- [CVE-2005-0262](https://cve.now/CVE-2005-0262.md): Buffer overflow in ipl\_varyon on AIX 5.1, 5.2, and 5.3 allows local users to execute arbitrary code via a long -d argument. (no CVSS)
- [CVE-2005-0263](https://cve.now/CVE-2005-0263.md): Buffer overflow in netpmon on AIX 5.1, 5.2, and 5.3 allows local users to execute arbitrary code via a long -O argument. (no CVSS)
- [CVE-2005-0264](https://cve.now/CVE-2005-0264.md): Multiple cross-site scripting (XSS) vulnerabilities in browse.php in OWL 0.7 and 0.8 allow remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2005-0265](https://cve.now/CVE-2005-0265.md): Multiple SQL injection vulnerabilities in browse.php in OWL 0.7 and 0.8 allow remote attackers to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2005-0266](https://cve.now/CVE-2005-0266.md): Cross-site scripting (XSS) vulnerability in index.php in SugarCRM 1.X allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2005-0267](https://cve.now/CVE-2005-0267.md): index.php in FlatNuke 2.5.1 allows remote attackers to create an administrator account via carriage returns and #10 in the url\_avatar field, (no CVSS)
- [CVE-2005-0268](https://cve.now/CVE-2005-0268.md): Direct code injection vulnerability in FlatNuke 2.5.1 allows remote attackers to execute arbitrary PHP code by placing the code into the url (no CVSS)
- [CVE-2005-0269](https://cve.now/CVE-2005-0269.md): The file extension check in GNUBoard 3.40 and earlier only verifies extensions that contain all lowercase letters, which allows remote attac (no CVSS)
- [CVE-2005-0270](https://cve.now/CVE-2005-0270.md): Multiple cross-site scripting (XSS) vulnerabilities in ReviewPost PHP Pro before 2.84 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2005-0271](https://cve.now/CVE-2005-0271.md): Multiple SQL injection vulnerabilities in ReviewPost PHP Pro before 2.84 allow remote attackers to execute arbitrary SQL commands via the (1 (no CVSS)
- [CVE-2005-0272](https://cve.now/CVE-2005-0272.md): ReviewPost PHP Pro before 2.84 allows remote attackers to upload and execute arbitrary PHP files by posting a review file with multiple exte (no CVSS)
- [CVE-2005-0273](https://cve.now/CVE-2005-0273.md): Multiple SQL injection vulnerabilities in showgallery.php in PhotoPost before 4.86 allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2005-0274](https://cve.now/CVE-2005-0274.md): Multiple cross-site scripting (XSS) vulnerabilities in showgallery.php in PhotoPost before 4.86 allow remote attackers to inject arbitrary w (no CVSS)
- [CVE-2005-0275](https://cve.now/CVE-2005-0275.md): TFTP in 3Com 3CDaemon 2.0 revision 10 allows remote attackers to cause a denial of service (application crash) via a GET request containing (no CVSS)
- [CVE-2005-0276](https://cve.now/CVE-2005-0276.md): Multiple format string vulnerabilities in the FTP service in 3Com 3CDaemon 2.0 revision 10 allow remote attackers to cause a denial of servi (no CVSS)
- [CVE-2005-0277](https://cve.now/CVE-2005-0277.md): Buffer overflow in the FTP service in 3Com 3CDaemon 2.0 revision 10 allows remote attackers to cause a denial of service (application crash) (no CVSS)
- [CVE-2005-0278](https://cve.now/CVE-2005-0278.md): The FTP service in 3Com 3CDaemon 2.0 revision 10 allows remote attackers to gain sensitive information via a cd command that contains an MS- (no CVSS)
- [CVE-2005-0279](https://cve.now/CVE-2005-0279.md): Soldner Secret Wars 30830 and earlier does not properly handle the "message too long" socket error, which allows remote attackers to cause a (no CVSS)
- [CVE-2005-0280](https://cve.now/CVE-2005-0280.md): Format string vulnerability in Soldner Secret Wars 30830 and earlier allows remote attackers to cause a denial of service (server crash) and (no CVSS)
- [CVE-2005-0281](https://cve.now/CVE-2005-0281.md): Cross-site scripting (XSS) vulnerability in the web interface in Soldner Secret Wars 30830 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2005-0282](https://cve.now/CVE-2005-0282.md): SQL injection vulnerability in member.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the uid pa (no CVSS)
- [CVE-2005-0283](https://cve.now/CVE-2005-0283.md): Directory traversal vulnerability in index.php in QwikiWiki allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2005-0284](https://cve.now/CVE-2005-0284.md): SQL injection vulnerability in addentry.php in Woltlab Burning Book 1.0 Gold, 1.1.1e, and possibly other versions, allows remote attackers t (no CVSS)
- [CVE-2005-0285](https://cve.now/CVE-2005-0285.md): Webseries Payment Application does not properly restrict privileged operations, which allows remote authenticated users to gain privileges b (no CVSS)
- [CVE-2005-0286](https://cve.now/CVE-2005-0286.md): eMotion MediaPartner Web Server 5.0 and 5.1 allows remote attackers to obtain sensitive information via an HTTP request for a .bhtml file th (no CVSS)
- [CVE-2005-0287](https://cve.now/CVE-2005-0287.md): Bottomline Webseries Payment Application allows remote attackers to read arbitrary files on the network via a report template with modified (no CVSS)
- [CVE-2005-0288](https://cve.now/CVE-2005-0288.md): The change password functionality in Bottomline Webseries Payment Application does not require the old password when users enter a new passw (no CVSS)
- [CVE-2005-0289](https://cve.now/CVE-2005-0289.md): Apple AirPort Express prior to 6.1.1 and Extreme prior to 5.5.1, configured as a Wireless Data Service (WDS), allows remote attackers to cau (no CVSS)
- [CVE-2005-0290](https://cve.now/CVE-2005-0290.md): NETGEAR FVS318 running firmware 2.4, and possibly other versions, allows remote attackers to bypass the filters using hex encoded URLs, as d (no CVSS)
- [CVE-2005-0291](https://cve.now/CVE-2005-0291.md): Cross-site scripting (XSS) vulnerability in the log viewer in NETGEAR FVS318 running firmware 2.4, and possibly other versions, allows remot (no CVSS)
- [CVE-2005-0292](https://cve.now/CVE-2005-0292.md): Multiple SQL injection vulnerabilities in index.php in PHP Gift Registry (phpGiftReg) 1.4.0, and possibly other versions before 1.5.0b1, all (no CVSS)
- [CVE-2005-0293](https://cve.now/CVE-2005-0293.md): Directory traversal vulnerability in minis.php in Minis 0.2.1 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2005-0294](https://cve.now/CVE-2005-0294.md): minis.php in Minis 0.2.1 allows remote attackers to cause a denial of service (infinite loop) via an HTTP request for a file that the web se (no CVSS)
- [CVE-2005-0295](https://cve.now/CVE-2005-0295.md): npptnt2.sys in nProtect Gameguard provides unrestricted I/O to any process that calls it, which allows local users to gain privileges. (no CVSS)
- [CVE-2005-0296](https://cve.now/CVE-2005-0296.md): NOTE: this issue has been disputed by the vendor. (no CVSS)
- [CVE-2005-0297](https://cve.now/CVE-2005-0297.md): SQL injection vulnerability in Oracle Database 9i and 10g allows remote attackers to execute arbitrary SQL commands and gain privileges. (no CVSS)
- [CVE-2005-0298](https://cve.now/CVE-2005-0298.md): The DIRECTORY objects in Oracle 8i through Oracle 10g contain the location of a specific operating system directory, which allows users with (no CVSS)
- [CVE-2005-0299](https://cve.now/CVE-2005-0299.md): Directory traversal vulnerability in GForge 3.3 and earlier allows remote attackers to list arbitrary directories via a .. (no CVSS)
- [CVE-2005-0300](https://cve.now/CVE-2005-0300.md): Directory traversal vulnerability in session.php in JSBoard 2.0.9 and earlier allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2005-0301](https://cve.now/CVE-2005-0301.md): comersus\_backoffice\_install10.asp in BackOffice Lite 6.0 and 6.01 allows remote attackers to bypass authentication and gain privileges via a (no CVSS)
- [CVE-2005-0302](https://cve.now/CVE-2005-0302.md): SQL injection vulnerability in default.asp in BackOffice Lite 6.0 and 6.01 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2005-0303](https://cve.now/CVE-2005-0303.md): Multiple cross-site scripting (XSS) vulnerabilities in (1) comersus\_supportError.asp or (2) comersus\_backofficelite\_supportError.asp in Back (no CVSS)
- [CVE-2005-0304](https://cve.now/CVE-2005-0304.md): Directory traversal vulnerability in DivX Player 2.6 and earlier allows remote attackers to overwrite arbitrary files via a .. (no CVSS)
- [CVE-2005-0305](https://cve.now/CVE-2005-0305.md): CRLF injection vulnerability in users.php in Siteman 1.1.10 and earlier allows remote attackers to add arbitrary users and gain privileges v (no CVSS)
- [CVE-2005-0306](https://cve.now/CVE-2005-0306.md): MercuryBoard 1.1.1 allows remote attackers to gain sensitive information via an HTTP request with the n parameter set to 0, which causes a d (no CVSS)
- [CVE-2005-0307](https://cve.now/CVE-2005-0307.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in MercuryBoard 1.1.1 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2005-0308](https://cve.now/CVE-2005-0308.md): Buffer overflow in the wsprintf function in W32Dasm 8.93 and earlier allows remote attackers to execute arbitrary code via a large import or (no CVSS)
- [CVE-2005-0309](https://cve.now/CVE-2005-0309.md): Multiple cross-site scripting (XSS) vulnerabilities in (1) index.php or (2) mod.php in Exponent 0.95 allow remote attackers to inject arbitr (no CVSS)
- [CVE-2005-0310](https://cve.now/CVE-2005-0310.md): Exponent 0.95 allows remote attackers to obtain sensitive information via a direct HTTP request to (1) search.info.php, (2) permissions.info (no CVSS)
- [CVE-2005-0311](https://cve.now/CVE-2005-0311.md): Ingate Firewall 4.1.3 and earlier does not terminate the PPTP session for an active user when the administrator disables that user from a re (no CVSS)
- [CVE-2005-0312](https://cve.now/CVE-2005-0312.md): WarFTPD 1.82 RC9, when running as an NT service, allows remote authenticated users to cause a denial of service (access violation) via a CWD (no CVSS)
- [CVE-2005-0313](https://cve.now/CVE-2005-0313.md): Multiple directory traversal vulnerabilities in Magic Winmail Server 4.0 Build 1112 allow remote attackers to (1) upload arbitrary files via (no CVSS)
- [CVE-2005-0314](https://cve.now/CVE-2005-0314.md): Cross-site scripting (XSS) vulnerability in user.php in Magic Winmail Server 4.0 Build 1112 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2005-0315](https://cve.now/CVE-2005-0315.md): The FTP service in Magic Winmail Server 4.0 Build 1112 does not verify that the IP address in a PORT command is the same as the IP address o (no CVSS)
- [CVE-2005-0316](https://cve.now/CVE-2005-0316.md): WebWasher Classic 2.2.1 and 3.3, when running in server mode, does not properly drop CONNECT requests to the localhost from external systems (no CVSS)
- [CVE-2005-0317](https://cve.now/CVE-2005-0317.md): Cross-site scripting (XSS) vulnerability in useredit\_account.wdm in Alt-N WebAdmin 3.0.4 allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2005-0318](https://cve.now/CVE-2005-0318.md): useredit\_account.wdm in Alt-N WebAdmin 3.0.4 does not properly validate account edits by the logged in user, which allows remote authenticat (no CVSS)
- [CVE-2005-0319](https://cve.now/CVE-2005-0319.md): Direct remote injection vulnerability in modalfram.wdm in Alt-N WebAdmin 3.0.4 allows remote attackers to load external webpages that appear (no CVSS)
- [CVE-2005-0320](https://cve.now/CVE-2005-0320.md): Multiple cross-site scripting vulnerabilities in MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 allow remote attackers to inject arbitr (no CVSS)
- [CVE-2005-0321](https://cve.now/CVE-2005-0321.md): MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 allows remote authenticated users to gain sensitive information via an HTTP request to ( (no CVSS)
- [CVE-2005-0322](https://cve.now/CVE-2005-0322.md): MERAK Mail Server 7.6.0 with Icewarp Web Mail 5.3.0 and Mail Server 7.6.4r with Icewarp Mail Server 5.3.2 uses weak encryption in the (1) us (no CVSS)
- [CVE-2005-0323](https://cve.now/CVE-2005-0323.md): Cross-site scripting (XSS) vulnerability in Infinite Mobile Delivery Webmail 2.6 allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2005-0324](https://cve.now/CVE-2005-0324.md): Infinite Mobile Delivery Webmail 2.6 allows remote attackers to gain sensitive information via an HTTP request that contains invalid charact (no CVSS)
- [CVE-2005-0325](https://cve.now/CVE-2005-0325.md): Xpand Rally 1.0.0.0 allows remote attackers or remote malicious game servers to cause a denial of service (application crash) via a packet w (no CVSS)
- [CVE-2005-0326](https://cve.now/CVE-2005-0326.md): pafiledb.php in PaFileDB 3.1 allows remote attackers to gain sensitive information via an invalid or missing action parameter, which reveals (no CVSS)
- [CVE-2005-0327](https://cve.now/CVE-2005-0327.md): pafiledb.php in Pafiledb 3.1 may allow remote attackers to execute arbitrary PHP code via a modified action parameter that is used in an inc (no CVSS)
- [CVE-2005-0328](https://cve.now/CVE-2005-0328.md): Zyxel P310, P314, P324 and Netgear RT311, RT314 running the latest firmware, allows remote attackers on the WAN to obtain the IP address of (no CVSS)
- [CVE-2005-0329](https://cve.now/CVE-2005-0329.md): Directory traversal vulnerability in ZipGenius 5.5 and earlier allows remote attackers to create and possibly modify arbitrary files via a Z (no CVSS)
- [CVE-2005-0330](https://cve.now/CVE-2005-0330.md): Buffer overflow in Painkiller 1.35 and earlier, and possibly other versions before 1.61, allows remote authenticated users to cause a denial (no CVSS)
- [CVE-2005-0331](https://cve.now/CVE-2005-0331.md): Directory traversal vulnerability in WinRAR 3.42 and earlier, when the user clicks on the ZIP file to extract it, allows remote attackers to (no CVSS)
- [CVE-2005-0332](https://cve.now/CVE-2005-0332.md): Directory traversal vulnerability in DeskNow Mail and Collaboration Server 2.5.12 allows remote attackers to (1) upload and possibly execute (no CVSS)
- [CVE-2005-0333](https://cve.now/CVE-2005-0333.md): LANChat Pro Revival 1.666c allows remote attackers to cause a denial of service (application crash) via a malformed UDP packet. (no CVSS)
- [CVE-2005-0334](https://cve.now/CVE-2005-0334.md): Linksys PSUS4 running firmware 6032 allows remote attackers to cause a denial of service (device crash) via an HTTP POST request containing (no CVSS)
- [CVE-2005-0335](https://cve.now/CVE-2005-0335.md): Directory traversal vulnerability in EMotion MediaPartner Web Server 5.0 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2005-0336](https://cve.now/CVE-2005-0336.md): Cross-site scripting (XSS) vulnerability in EMotion MediaPartner Web Server 5.0 allows remote attackers to inject arbitrary HTML or web scri (no CVSS)
- [CVE-2005-0337](https://cve.now/CVE-2005-0337.md): Postfix 2.1.3, when /proc/net/if\_inet6 is not available and permit\_mx\_backup is enabled in smtpd\_recipient\_restrictions, allows remote attac (no CVSS)
- [CVE-2005-0338](https://cve.now/CVE-2005-0338.md): Buffer overflow in Savant Web Server 3.1 allows remote attackers to execute arbitrary code via a long HTTP request. (no CVSS)
- [CVE-2005-0339](https://cve.now/CVE-2005-0339.md): Buffer overflow in Foxmail 2.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long MAIL FROM (no CVSS)
- [CVE-2005-0340](https://cve.now/CVE-2005-0340.md): Integer signedness error in Apple File Service (AFP Server) allows remote attackers to cause a denial of service (application crash) via a n (no CVSS)
- [CVE-2005-0341](https://cve.now/CVE-2005-0341.md): Apple Safari 1.2.4 does not obey the Content-type field in the HTTP header and renders text as HTML, which allows remote attackers to inject (no CVSS)
- [CVE-2005-0342](https://cve.now/CVE-2005-0342.md): The Finder in Mac OS X and earlier allows local users to overwrite arbitrary files and gain privileges by creating a hard link from the .DS\_ (no CVSS)
- [CVE-2005-0343](https://cve.now/CVE-2005-0343.md): SQL injection vulnerability in PerlDesk 1.x allows remote attackers to inject arbitrary SQL commands via the view parameter. (no CVSS)
- [CVE-2005-0344](https://cve.now/CVE-2005-0344.md): Directory traversal vulnerability in 602LAN SUITE 2004.0.04.1221 allows remote authenticated users to upload and execute arbitrary files via (no CVSS)
- [CVE-2005-0345](https://cve.now/CVE-2005-0345.md): viewthread.php in php-fusion 4.x does not check the (1) forum\_id or (2) forum\_cat parameters, which allows remote attackers to view protecte (no CVSS)
- [CVE-2005-0346](https://cve.now/CVE-2005-0346.md): SafeNet SoftRemote VPN Client stores the VPN password (pre-shared key) in cleartext in memory of the IreIKE.exe process, which allows local (no CVSS)
- [CVE-2005-0347](https://cve.now/CVE-2005-0347.md): Integer overflow in RealArcade 1.2.0.994 and earlier allows remote attackers to execute arbitrary code via an RGS file with an invalid size (no CVSS)
- [CVE-2005-0348](https://cve.now/CVE-2005-0348.md): Directory traversal vulnerability in RealArcade 1.2.0.994 allows remote attackers to delete arbitrary files via an RGP file with a .. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-02-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.