# CVEs published 2005-04-28

21 CVEs were published on April 28, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2005-1270](https://cve.now/CVE-2005-1270.md): The (1) check\_update.sh and (2) rkhunter script in Rootkit Hunter before 1.2.3-r1 create temporary files with predictable file names, which (no CVSS)
- [CVE-2005-1345](https://cve.now/CVE-2005-1345.md): Squid 2.5.STABLE9 and earlier does not trigger a fatal error when it identifies missing or invalid ACLs in the http\_access configuration, wh (no CVSS)
- [CVE-2005-1346](https://cve.now/CVE-2005-1346.md): Multiple Symantec AntiVirus products, including Norton AntiVirus 2005 11.0.0, Web Security Web Security 3.0.1.72, Mail Security for SMTP 4.0 (no CVSS)
- [CVE-2005-1347](https://cve.now/CVE-2005-1347.md): \*\* UNVERIFIABLE \*\* NOTE: this issue describes a problem that can not be independently verified as of 20050421. (no CVSS)
- [CVE-2005-1348](https://cve.now/CVE-2005-1348.md): Buffer overflow in HTTPMail in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to execute a (no CVSS)
- [CVE-2005-1349](https://cve.now/CVE-2005-1349.md): Buffer overflow in Convert-UUlib (Convert::UUlib) before 1.051 allows remote attackers to execute arbitrary code via a malformed parameter t (no CVSS)
- [CVE-2005-1350](https://cve.now/CVE-2005-1350.md): The ad.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument. (no CVSS)
- [CVE-2005-1351](https://cve.now/CVE-2005-1351.md): The ad.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument. (no CVSS)
- [CVE-2005-1352](https://cve.now/CVE-2005-1352.md): Cross-site scripting (XSS) vulnerability in the ad.cgi script allows remote attackers to inject arbitrary web script or HTML via the argumen (no CVSS)
- [CVE-2005-1353](https://cve.now/CVE-2005-1353.md): The forum.pl script allows remote attackers to read arbitrary files via a full pathname in the argument. (no CVSS)
- [CVE-2005-1354](https://cve.now/CVE-2005-1354.md): The forum.pl script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument. (no CVSS)
- [CVE-2005-1355](https://cve.now/CVE-2005-1355.md): includer.cgi in The Includer allows remote attackers to read arbitrary files via a full pathname in the argument, a similar vulnerability to (no CVSS)
- [CVE-2005-1356](https://cve.now/CVE-2005-1356.md): Cross-site scripting (XSS) vulnerability in includer.cgi script in The Includer allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2005-1357](https://cve.now/CVE-2005-1357.md): text.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument. (no CVSS)
- [CVE-2005-1358](https://cve.now/CVE-2005-1358.md): text.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument. (no CVSS)
- [CVE-2005-1359](https://cve.now/CVE-2005-1359.md): Cross-site scripting (XSS) vulnerability in text.cgi script allows remote attackers to inject arbitrary web script or HTML via the argument. (no CVSS)
- [CVE-2005-1360](https://cve.now/CVE-2005-1360.md): PHP remote file inclusion vulnerability in error.php in GrayCMS 1.1 allows remote attackers to execute arbitrary PHP code by modifying the p (no CVSS)
- [CVE-2005-1361](https://cve.now/CVE-2005-1361.md): Multiple SQL injection vulnerabilities in MetaCart e-Shop 8.0 allow remote attackers to execute arbitrary SQL commands via the (1) intProdID (no CVSS)
- [CVE-2005-1362](https://cve.now/CVE-2005-1362.md): Multiple SQL injection vulnerabilities in MetaCart 2.0 for Paypal allow remote attackers to execute arbitrary SQL commands via the (1) intPr (no CVSS)
- [CVE-2005-1363](https://cve.now/CVE-2005-1363.md): Multiple SQL injection vulnerabilities in MetaCart 2.0 for PayFlow allow remote attackers to execute arbitrary commands via (1) intCatalogID (no CVSS)
- [CVE-2005-1364](https://cve.now/CVE-2005-1364.md): Multiple SQL injection vulnerabilities in MetaBid Auctions allow remote attackers to execute arbitrary SQL commands via the (1) username or (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-04-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.