# CVEs published 2005-03-20

63 CVEs were published on March 20, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2001-1416](https://cve.now/CVE-2001-1416.md): Multiple cross-site scripting (XSS) vulnerabilities in the log messages in certain Alpha versions of AOL Instant Messenger (AIM) 4.4 allow r (no CVSS)
- [CVE-2001-1417](https://cve.now/CVE-2001-1417.md): AOL Instant Messenger (AIM) 4.7 allows remote attackers to cause a denial of service (application hang or crash) via a buddy icon GIF file w (no CVSS)
- [CVE-2001-1418](https://cve.now/CVE-2001-1418.md): AOL Instant Messenger (AIM) 4.7 allows remote attackers to cause a denial of service (application crash) via a malformed WAV file. (no CVSS)
- [CVE-2001-1419](https://cve.now/CVE-2001-1419.md): AOL Instant Messenger (AIM) 4.7.2480 and earlier allows remote attackers to cause a denial of service (application crash) via an instant mes (no CVSS)
- [CVE-2001-1420](https://cve.now/CVE-2001-1420.md): AOL Instant Messenger (AIM) 4.7 allows remote attackers to cause a denial of service (application crash) via a long filename, possibly cause (no CVSS)
- [CVE-2001-1421](https://cve.now/CVE-2001-1421.md): AOL Instant Messenger (AIM) 4.7 and earlier allows remote attackers to cause a denial of service (application crash) via a large number of d (no CVSS)
- [CVE-2001-1422](https://cve.now/CVE-2001-1422.md): WinVNC 3.3.3 and earlier generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentic (no CVSS)
- [CVE-2001-1423](https://cve.now/CVE-2001-1423.md): Advanced Poll before 1.61, when using a flat file database, allows remote attackers to gain privileges by setting the logged\_in parameter. (no CVSS)
- [CVE-2002-1601](https://cve.now/CVE-2002-1601.md): The Connectables feature in Adobe PhotoDeluxe 3.1 prepends the Adobe directory to the CLASSPATH environment variable, which allows applets t (no CVSS)
- [CVE-2003-1131](https://cve.now/CVE-2003-1131.md): PHP remote file inclusion vulnerability in index.php in KnowledgeBuilder, referred to as KnowledgeBase, allows remote attackers to execute a (no CVSS)
- [CVE-2005-0352](https://cve.now/CVE-2005-0352.md): Servers Alive 4.1 and 5.0, when running as a service, does not drop SYSTEM privileges before loading local manual under the help menu, which (no CVSS)
- [CVE-2005-0643](https://cve.now/CVE-2005-0643.md): Buffer overflow in McAfee Scan Engine 4320 with DAT version before 4357 allows remote attackers to execute arbitrary code via crafted LHA fi (no CVSS)
- [CVE-2005-0644](https://cve.now/CVE-2005-0644.md): Buffer overflow in McAfee Scan Engine 4320 with DAT version before 4436 allows remote attackers to execute arbitrary code via a malformed LH (no CVSS)
- [CVE-2005-0774](https://cve.now/CVE-2005-0774.md): SQL injection vulnerability in member.php and possibly other scripts in PhotoPost PHP 5.0 RC3 allows remote attackers to execute arbitrary S (no CVSS)
- [CVE-2005-0775](https://cve.now/CVE-2005-0775.md): The reportpost action in misc.php for PhotoPost PHP 5.0 RC3 does not limit the logging data that is sent to the administrator, which allows (no CVSS)
- [CVE-2005-0776](https://cve.now/CVE-2005-0776.md): adm-photo.php in PhotoPost PHP 5.0 RC3 does not properly verify administrative privileges before manipulating photos, which could allow remo (no CVSS)
- [CVE-2005-0777](https://cve.now/CVE-2005-0777.md): Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP 5.0 RC3 allow remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2005-0778](https://cve.now/CVE-2005-0778.md): PhotoPost PHP 5.0 RC3 does not fully verify that an uploaded file is an image file, which allows remote attackers to inject arbitrary Javasc (no CVSS)
- [CVE-2005-0779](https://cve.now/CVE-2005-0779.md): PlatinumFTP 1.0.18, and possibly earlier versions, allows remote attackers to cause a denial of service (server crash) via multiple connecti (no CVSS)
- [CVE-2005-0780](https://cve.now/CVE-2005-0780.md): paFileDB 3.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) auth.php, (2) login.php, (3) ca (no CVSS)
- [CVE-2005-0781](https://cve.now/CVE-2005-0781.md): SQL injection vulnerability in (1) viewall.php and (2) category.php in paFileDB 3.1 and earlier allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2005-0782](https://cve.now/CVE-2005-0782.md): Cross-site scripting (XSS) vulnerability in (1) viewall.php and (2) category.php for paFileDB 3.1 and earlier allows remote attackers to inj (no CVSS)
- [CVE-2005-0783](https://cve.now/CVE-2005-0783.md): Cross-site scripting (XSS) vulnerability in Phorum before 5.0.14a allows remote attackers to inject arbitrary web script or HTML via the fil (no CVSS)
- [CVE-2005-0784](https://cve.now/CVE-2005-0784.md): Multiple cross-site scripting (XSS) vulnerabilities in Phorum before 5.0.15 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2005-0785](https://cve.now/CVE-2005-0785.md): Cross-site scripting (XSS) vulnerability in usersrecentposts in YaBB 2.0 rc1 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2005-0786](https://cve.now/CVE-2005-0786.md): SQL injection vulnerability in gb\_new.inc in SimpGB allows remote attackers to execute arbitrary SQL commands via the quote parameter to gue (no CVSS)
- [CVE-2005-0787](https://cve.now/CVE-2005-0787.md): Wine 20050211 and earlier creates temp files with world readable permissions and predictable file names, which allows local users to obtain (no CVSS)
- [CVE-2005-0788](https://cve.now/CVE-2005-0788.md): LimeWire 4.1.2 through 4.5.6 allows remote attackers to read arbitrary files by specifying the full pathname in a Gnutella GET request. (no CVSS)
- [CVE-2005-0789](https://cve.now/CVE-2005-0789.md): Directory traversal vulnerability in LimeWire 3.9.6 through 4.6.0 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2005-0790](https://cve.now/CVE-2005-0790.md): phpAdsNew 2.0.4 allows remote attackers to obtain sensitive information via a direct request to (1) lib-xmlrpcs.inc.php, (2) maintenance-act (no CVSS)
- [CVE-2005-0791](https://cve.now/CVE-2005-0791.md): Cross-site scripting (XSS) vulnerability in adframe.php in phpAdsNew 2.0.4-pr1, when register\_globals is enabled, allows remote attackers to (no CVSS)
- [CVE-2005-0792](https://cve.now/CVE-2005-0792.md): SQL injection vulnerability in ZPanel 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) uname parameter to index.php (no CVSS)
- [CVE-2005-0793](https://cve.now/CVE-2005-0793.md): PHP remote file inclusion vulnerability in zpanel.php in ZPanel allows remote attackers to (1) execute arbitrary PHP code in ZPanel 2.0 or ( (no CVSS)
- [CVE-2005-0794](https://cve.now/CVE-2005-0794.md): ZPanel 2.0 and 2.5 beta 10 does not remove or protect installation scripts after they have been used, which allows remote attackers to reins (no CVSS)
- [CVE-2005-0795](https://cve.now/CVE-2005-0795.md): HolaCMS 1.4.9 does not restrict file access to the holaDB/votes directory, which allows remote attackers to overwrite arbitrary files via a (no CVSS)
- [CVE-2005-0796](https://cve.now/CVE-2005-0796.md): Directory traversal vulnerability in HolaCMS 1.4.9-1 allows remote attackers to overwrite arbitrary files via a "holaDB/votes" followed by a (no CVSS)
- [CVE-2005-0797](https://cve.now/CVE-2005-0797.md): Novell iChain Mini FTP Server 2.3 displays different error messages if a user exists or not, which allows remote attackers to obtain sensiti (no CVSS)
- [CVE-2005-0798](https://cve.now/CVE-2005-0798.md): Novell iChain Mini FTP Server 2.3, and possibly earlier versions, does not limit the number of incorrect logins, which makes it easier for r (no CVSS)
- [CVE-2005-0799](https://cve.now/CVE-2005-0799.md): MySQL 4.1.9, and possibly earlier versions, allows remote attackers with certain privileges to cause a denial of service (application crash) (no CVSS)
- [CVE-2005-0800](https://cve.now/CVE-2005-0800.md): PHP remote file inclusion vulnerability in install.php in mcNews 1.3 and earlier allows remote attackers to execute arbitrary PHP code by mo (no CVSS)
- [CVE-2005-0801](https://cve.now/CVE-2005-0801.md): Directory traversal vulnerability in includer.cgi in The Includer allows remote attackers to read arbitrary files via (1) a .. (no CVSS)
- [CVE-2005-0802](https://cve.now/CVE-2005-0802.md): Cross-site scripting (XSS) vulnerability in search.asp in ACS Blog 0.8 through 1.1b allows remote attackers to execute arbitrary web script (no CVSS)
- [CVE-2005-0803](https://cve.now/CVE-2005-0803.md): The GetEnhMetaFilePaletteEntries API in GDI32.DLL in Windows 2000 allows remote attackers to cause a denial of service (application crash) v (no CVSS)
- [CVE-2005-0804](https://cve.now/CVE-2005-0804.md): Format string vulnerability in MailEnable 1.8 allows remote attackers to cause a denial of service (application crash) via format string spe (no CVSS)
- [CVE-2005-0805](https://cve.now/CVE-2005-0805.md): SQL injection vulnerability in index.php in Subdreamer Light, when magic\_quotes\_gpc is enabled, allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2005-0806](https://cve.now/CVE-2005-0806.md): Evolution 2.0.3 allows remote attackers to cause a denial of service (application crash or hang) via crafted messages, possibly involving ch (no CVSS)
- [CVE-2005-0807](https://cve.now/CVE-2005-0807.md): Multiple buffer overflows in Cain & Abel before 2.67 allow remote attackers to cause a denial of service (application crash) and possibly ex (no CVSS)
- [CVE-2005-0808](https://cve.now/CVE-2005-0808.md): Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 800 (no CVSS)
- [CVE-2005-0809](https://cve.now/CVE-2005-0809.md): NotifyLink, when configured for client key retrieval, allows remote attackers to obtain AES keys via a direct request to /hwp/get.asp, then (no CVSS)
- [CVE-2005-0810](https://cve.now/CVE-2005-0810.md): SQL injection vulnerability in NotifyLink before 3.0 allows remote attackers to execute arbitrary SQL commands via the URL. (no CVSS)
- [CVE-2005-0811](https://cve.now/CVE-2005-0811.md): The web interface in NotifyLink 3.0 does not properly restrict access to functions that have been disabled in the GUI, which allows remote a (no CVSS)
- [CVE-2005-0812](https://cve.now/CVE-2005-0812.md): The web interface in NotifyLink 3.0 displays passwords in cleartext on the administrative page, which could allow remote attackers or local (no CVSS)
- [CVE-2005-0813](https://cve.now/CVE-2005-0813.md): Buffer overflow in Initial Redirect (ir) Squid Proxy Plug-In 0.1 and 0.2 may allow attackers to cause a denial of service and execute arbitr (no CVSS)
- [CVE-2005-0814](https://cve.now/CVE-2005-0814.md): Unknown vulnerability in lshd in Lysator LSH 1.x and 2.x before 2.0.1 allows remote attackers to cause a denial of service via unknown vecto (no CVSS)
- [CVE-2005-0815](https://cve.now/CVE-2005-0815.md): Multiple "range checking flaws" in the ISO9660 filesystem handler in Linux 2.6.11 and earlier may allow attackers to cause a denial of servi (no CVSS)
- [CVE-2005-0816](https://cve.now/CVE-2005-0816.md): Buffer overflow in newgrp in Solaris 7 through 9 allows local users to gain root privileges. (no CVSS)
- [CVE-2005-0817](https://cve.now/CVE-2005-0817.md): Unknown vulnerability in the DNSd proxy, as used in Symantec Gateway Security 5400 2.x and 5300 1.x, Enterprise Firewall 7.0.x and 8.x, and (no CVSS)
- [CVE-2005-0818](https://cve.now/CVE-2005-0818.md): Cross-site scripting (XSS) vulnerability in PunBB 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the (1) email or (no CVSS)
- [CVE-2005-0819](https://cve.now/CVE-2005-0819.md): The xvesa code in Novell Netware 6.5 SP2 and SP3 allows remote attackers to redirect the xsession without authentication via a direct reques (no CVSS)
- [CVE-2005-0820](https://cve.now/CVE-2005-0820.md): Microsoft Office InfoPath 2003 SP1 includes sensitive information in the Manifest.xsf file in a custom .xsn form, which allows attackers to (no CVSS)
- [CVE-2005-0821](https://cve.now/CVE-2005-0821.md): Unknown vulnerability in Citrix MetaFrame Conferencing Manager 3.0 allows conference members to bypass organizer restrictions to control the (no CVSS)
- [CVE-2005-0822](https://cve.now/CVE-2005-0822.md): Citrix Metaframe Password Manager 2.5 and earlier stores a password in cleartext although it is obfuscated when presented to a user, which a (no CVSS)
- [CVE-2005-0823](https://cve.now/CVE-2005-0823.md): ThePoolClub (1) iPool and (2) iSnooker 1.6.81 and earlier stores usernames and passwords in cleartext in the MyDetails.txt file, which allow (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-03-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.