# CVEs published 2005-03-04

24 CVEs were published on March 4, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2005-0605](https://cve.now/CVE-2005-0605.md): scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmap\_unit value that leads to a buffer overflow. (no CVSS)
- [CVE-2005-0627](https://cve.now/CVE-2005-0627.md): Qt before 3.3.4 searches the BUILD\_PREFIX directory, which could be world-writable, to load shared libraries regardless of the LD\_LIBRARY\_PA (no CVSS)
- [CVE-2005-0628](https://cve.now/CVE-2005-0628.md): Multiple cross-site scripting (XSS) vulnerabilities in Forumwa 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the (no CVSS)
- [CVE-2005-0629](https://cve.now/CVE-2005-0629.md): Multiple cross-site scripting (XSS) vulnerabilities in profile.php in 427BB 2.2 allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2005-0630](https://cve.now/CVE-2005-0630.md): sendpm.php in PBLang 4.63 allows remote authenticated users to read arbitrary files via a full pathname in the orig parameter. (no CVSS)
- [CVE-2005-0631](https://cve.now/CVE-2005-0631.md): delpm.php in PBLang 4.63 allows remote authenticated users to delete arbitrary PM files by modifying the "id" and "a" parameters. (no CVSS)
- [CVE-2005-0632](https://cve.now/CVE-2005-0632.md): PHP remote file inclusion vulnerability in auth.php in PHPNews 1.2.4 and possibly 1.2.3, allows remote attackers to execute arbitrary PHP co (no CVSS)
- [CVE-2005-0633](https://cve.now/CVE-2005-0633.md): Buffer overflow in Trillian 3.0 and Pro 3.0 allows remote attackers to execute arbitrary code via a crafted PNG image file. (no CVSS)
- [CVE-2005-0634](https://cve.now/CVE-2005-0634.md): Buffer overflow in Golden FTP Server 1.92 allows remote attackers to execute arbitrary code via a long USER command. (no CVSS)
- [CVE-2005-0635](https://cve.now/CVE-2005-0635.md): Buffer overflow in Foxmail Server 2.0 allows remote attackers to execute arbitrary code via a long USER command. (no CVSS)
- [CVE-2005-0636](https://cve.now/CVE-2005-0636.md): Format string vulnerability in Foxmail Server 2.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrar (no CVSS)
- [CVE-2005-0637](https://cve.now/CVE-2005-0637.md): The copy functions in locore.s such as copyout in OpenBSD 3.5 and 3.6, and possibly other BSD based operating systems, may allow attackers t (no CVSS)
- [CVE-2005-0638](https://cve.now/CVE-2005-0638.md): xloadimage before 4.1-r2, and xli before 1.17, allows attackers to execute arbitrary commands via shell metacharacters in filenames for comp (no CVSS)
- [CVE-2005-0639](https://cve.now/CVE-2005-0639.md): Multiple vulnerabilities in xli before 1.17 may allow remote attackers to execute arbitrary code via "buffer management errors" from certain (no CVSS)
- [CVE-2005-0640](https://cve.now/CVE-2005-0640.md): Computer Associates (CA) Unicenter Asset Management (UAM) 4.0 does not properly initialize the "Change Credentials for Database" window, whi (no CVSS)
- [CVE-2005-0641](https://cve.now/CVE-2005-0641.md): Cross-site scripting (XSS) vulnerability in the Reporter for Computer Associates (CA) Unicenter Asset Management (UAM) 4.0 allows remote att (no CVSS)
- [CVE-2005-0642](https://cve.now/CVE-2005-0642.md): SQL injection vulnerability in the Query Designer for Computer Associates (CA) Unicenter Asset Management (UAM) 4.0 allows remote attackers (no CVSS)
- [CVE-2005-0645](https://cve.now/CVE-2005-0645.md): Cross-site scripting (XSS) vulnerability in show.inc.php in cuteNews 1.3.6 allows remote attackers to inject arbitrary HTML, web script, and (no CVSS)
- [CVE-2005-0646](https://cve.now/CVE-2005-0646.md): SQL injection vulnerability in auth.php in paNews 2.0.4b allows remote attackers to execute arbitrary SQL via the mysql\_prefix parameter. (no CVSS)
- [CVE-2005-0647](https://cve.now/CVE-2005-0647.md): admin\_setup.php in paNews 2.0.4b allows remote attackers to inject arbitrary PHP code via the (1) $form\[comments\] or (2) $form\[autoapprove\] (no CVSS)
- [CVE-2005-0648](https://cve.now/CVE-2005-0648.md): Multiple vulnerabilities in Pixel-Apes SafeHTML before 1.3.0 allow remote attackers to bypass cross-site scripting (XSS) protection via (1) (no CVSS)
- [CVE-2005-0649](https://cve.now/CVE-2005-0649.md): Pixel-Apes SafeHTML before 1.2.1 allows remote attackers to bypass cross-site scripting (XSS) protection via "hexadecimal HTML entities." (no CVSS)
- [CVE-2005-0650](https://cve.now/CVE-2005-0650.md): Multiple cross-site scripting (XSS) vulnerabilities in ProjectBB 0.4.5.1 allow remote attackers to inject arbitrary web script or HTML via ( (no CVSS)
- [CVE-2005-0651](https://cve.now/CVE-2005-0651.md): Multiple SQL injection vulnerabilities in ProjectBB 0.4.5.1 allow remote attackers to execute arbitrary SQL commands via (1) liste or (2) de (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-03-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.