# CVEs published 2005-04-09

16 CVEs were published on April 9, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2005-0351](https://cve.now/CVE-2005-0351.md): Buffer overflow in (1) termsh, (2) atcronsh, and (3) auditsh in SCO OpenServer 5.0.6 and 5.0.7 might allow local users to execute arbitrary (no CVSS)
- [CVE-2005-1019](https://cve.now/CVE-2005-1019.md): Buffer overflow in the getConfig function in Aeon 0.2a and earlier allows local users to gain privileges via a long HOME environment variabl (no CVSS)
- [CVE-2005-1020](https://cve.now/CVE-2005-1020.md): Secure Shell (SSH) 2 in Cisco IOS 12.0 through 12.3 allows remote attackers to cause a denial of service (device reload) (1) via a username (no CVSS)
- [CVE-2005-1021](https://cve.now/CVE-2005-1021.md): Memory leak in Secure Shell (SSH) in Cisco IOS 12.0 through 12.3, when authenticating against a TACACS+ server, allows remote attackers to c (no CVSS)
- [CVE-2005-1022](https://cve.now/CVE-2005-1022.md): ColdFusion 6.1 Updater 1 places Java .class files under the web root in the /WEB-INF/cfclasses directory, which allows remote attackers to o (no CVSS)
- [CVE-2005-1023](https://cve.now/CVE-2005-1023.md): Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.x to 7.6 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2005-1024](https://cve.now/CVE-2005-1024.md): modules.php in PHP-Nuke 6.x to 7.6 allows remote attackers to obtain sensitive information via a direct request to (1) my\_headlines, (2) use (no CVSS)
- [CVE-2005-1025](https://cve.now/CVE-2005-1025.md): The FTP server in AS/400 4.3, when running in IFS mode, allows remote attackers to obtain sensitive information via a symlink attack using R (no CVSS)
- [CVE-2005-1026](https://cve.now/CVE-2005-1026.md): Multiple SQL injection vulnerabilities in SnailSource phpBB 2.0.x mods allow remote attackers to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2005-1027](https://cve.now/CVE-2005-1027.md): Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.x through 7.6 allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2005-1028](https://cve.now/CVE-2005-1028.md): PHP-Nuke 6.x through 7.6 allows remote attackers to obtain sensitive information via a direct request to (1) index.php with the forum\_admin (no CVSS)
- [CVE-2005-1029](https://cve.now/CVE-2005-1029.md): Multiple SQL injection vulnerabilities in Active Auction House allow remote attackers to execute arbitrary SQL commands via the (1) catid, ( (no CVSS)
- [CVE-2005-1030](https://cve.now/CVE-2005-1030.md): Multiple cross-site scripting (XSS) vulnerabilities in Active Auction House allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2005-1031](https://cve.now/CVE-2005-1031.md): RUNCMS 1.1A, and possibly other products based on e-Xoops (exoops), when "Allow custom avatar upload" is enabled, does not properly verify u (no CVSS)
- [CVE-2005-1033](https://cve.now/CVE-2005-1033.md): CubeCart 2.0.6 allows remote attackers to obtain sensitive information via an invalid (1) language parameter to index.php, (2) PHPSESSID par (no CVSS)
- [CVE-2005-1034](https://cve.now/CVE-2005-1034.md): SurgeFTP 2.2m1 allows remote attackers to cause a denial of service (application hang) via the LEAK command. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-04-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.