# CVEs published 2005-04-03 25 CVEs were published on April 3, 2005: 0 critical, 0 high. Days are UTC. - [CVE-2005-0524](https://cve.now/CVE-2005-0524.md): The php\_handle\_iff function in image.c for PHP 4.2.2, 4.3.9, 4.3.10 and 5.0.3, as reachable by the getimagesize PHP function, allows remote (no CVSS) - [CVE-2005-0525](https://cve.now/CVE-2005-0525.md): The php\_next\_marker function in image.c for PHP 4.2.2, 4.3.9, 4.3.10 and 5.0.3, as reachable by the getimagesize PHP function, allows remote (no CVSS) - [CVE-2005-0750](https://cve.now/CVE-2005-0750.md): The bluez\_sock\_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users (no CVSS) - [CVE-2005-0942](https://cve.now/CVE-2005-0942.md): The XP Server process (xp\_server) in Sybase Adaptive Server Enterprise (ASE) XP Server 12.x before 12.5.3 ESD#1 allows attackers to cause a (no CVSS) - [CVE-2005-0943](https://cve.now/CVE-2005-0943.md): Cisco VPN 3000 series Concentrator running firmware 4.1.7.A and earlier allows remote attackers to cause a denial of service (device reload (no CVSS) - [CVE-2005-0944](https://cve.now/CVE-2005-0944.md): Unknown vulnerability in Microsoft Jet DB engine (msjet40.dll) 4.00.8618.0, related to insufficient data validation, allows remote attackers (no CVSS) - [CVE-2005-0945](https://cve.now/CVE-2005-0945.md): Cross-site scripting (XSS) vulnerability in ACS Blog 1.1.1 allows remote attackers to inject arbitrary web script or HTML via onmouseover or (no CVSS) - [CVE-2005-0946](https://cve.now/CVE-2005-0946.md): SQL injection vulnerability in phpCoin 1.2.1b and earlier allows remote attackers to execute arbitrary SQL commands via the (1) term/keyword (no CVSS) - [CVE-2005-0947](https://cve.now/CVE-2005-0947.md): Directory traversal vulnerability in auxpage.php in phpCoin 1.2.1b and earlier allows remote attackers to read and execute arbitrary files v (no CVSS) - [CVE-2005-0948](https://cve.now/CVE-2005-0948.md): SQL injection vulnerability in ad\_click.asp for PortalApp allows remote attackers to execute arbitrary SQL commands via the banner\_id parame (no CVSS) - [CVE-2005-0949](https://cve.now/CVE-2005-0949.md): Multiple cross-site scripting (XSS) vulnerabilities in content.asp in Iatek PortalApp allow remote attackers to inject arbitrary web script (no CVSS) - [CVE-2005-0950](https://cve.now/CVE-2005-0950.md): Directory traversal vulnerability in FastStone 4in1 Browser 1.2 allows remote attackers to read arbitrary files via a (1) ... (no CVSS) - [CVE-2005-0952](https://cve.now/CVE-2005-0952.md): Cross-site scripting vulnerability in pafiledb.php in PaFileDB 3.1 allows remote attackers to inject arbitrary web script or HTML via the id (no CVSS) - [CVE-2005-0953](https://cve.now/CVE-2005-0953.md): Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while (no CVSS) - [CVE-2005-0954](https://cve.now/CVE-2005-0954.md): Windows Explorer and Internet Explorer in Windows 2000 SP1 allows remote attackers to cause a denial of service (CPU consumption) via a malf (no CVSS) - [CVE-2005-0955](https://cve.now/CVE-2005-0955.md): SQL injection vulnerability in InterAKT MX Shop 1.1.1 allows remote attackers to execute arbitrary SQL commands via the id\_ctg parameter. (no CVSS) - [CVE-2005-0956](https://cve.now/CVE-2005-0956.md): Multiple SQL injection vulnerabilities in index.php in InterAKT MX Kart 1.1.2 allow remote attackers to execute arbitrary SQL commands via t (no CVSS) - [CVE-2005-0957](https://cve.now/CVE-2005-0957.md): Bay Technical Associates RPC-3 Telnet Host 3.05 allows remote attackers to bypass authentication by pressing the escape and enter keys at th (no CVSS) - [CVE-2005-0958](https://cve.now/CVE-2005-0958.md): Format string vulnerability in the log\_do function in log.c for YepYep mtftpd 0.0.3, when the statistics option is enabled, allows remote at (no CVSS) - [CVE-2005-0959](https://cve.now/CVE-2005-0959.md): Buffer overflow in the mt\_do\_dir function in YepYep mtftpd 0.0.3 may allow attackers to execute arbitrary code via a long path. (no CVSS) - [CVE-2005-0960](https://cve.now/CVE-2005-0960.md): Multiple vulnerabilities in the SACK functionality in (1) tcp\_input.c and (2) tcp\_usrreq.c OpenBSD 3.5 and 3.6 allow remote attackers to cau (no CVSS) - [CVE-2005-0961](https://cve.now/CVE-2005-0961.md): Cross-site scripting (XSS) vulnerability in Horde 3.0.4 before 3.0.4-RC2 allows remote attackers to inject arbitrary web script or HTML via (no CVSS) - [CVE-2005-0962](https://cve.now/CVE-2005-0962.md): SQL injection vulnerability in index.php for Lighthouse Squirrelcart allows remote attackers to execute arbitrary SQL commands via the (1) c (no CVSS) - [CVE-2005-0963](https://cve.now/CVE-2005-0963.md): An error in the Toshiba ACPI BIOS 1.6 causes the BIOS to only examine the first slot in the Master Boot Record (MBR) table for an active par (no CVSS) - [CVE-2005-0964](https://cve.now/CVE-2005-0964.md): Unknown vulnerability in Kerio Personal Firewall 4.1.2 and earlier allows local users to bypass firewall rules via a malicious process that (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2005-04-03 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.