# CVEs published 2005-05-02 29 CVEs were published on May 2, 2005: 0 critical, 0 high. Days are UTC. - [CVE-2005-1368](https://cve.now/CVE-2005-1368.md): The key\_user\_lookup function in security/keys/key.c in Linux kernel 2.6.10 to 2.6.11.8 may allow attackers to cause a denial of service (oop (no CVSS) - [CVE-2005-1369](https://cve.now/CVE-2005-1369.md): The (1) it87 and (2) via686a drivers in I2C for Linux 2.6.x before 2.6.11.8, and 2.6.12 before 2.6.12-rc2, create the sysfs "alarms" file wi (no CVSS) - [CVE-2005-1370](https://cve.now/CVE-2005-1370.md): Unknown vulnerability in Radia Management Agent (RMA) in HP OpenView Radia Management Portal (RMP) 1.x and 2.x allows remote attackers to ex (no CVSS) - [CVE-2005-1371](https://cve.now/CVE-2005-1371.md): BPFTPServer service in BulletProof FTP Server 2.4.0.31 does not properly drop privileges before opening files through the Help menu, which a (no CVSS) - [CVE-2005-1372](https://cve.now/CVE-2005-1372.md): nvstatsmngr.exe process in BakBone NetVault 7.1 does not properly drop privileges before opening files, which allows local users to gain pri (no CVSS) - [CVE-2005-1373](https://cve.now/CVE-2005-1373.md): Multiple SQL injection vulnerabilities in index.php in Dream4 Koobi CMS 4.2.3 allow remote attackers to execute arbitrary SQL commands via t (no CVSS) - [CVE-2005-1374](https://cve.now/CVE-2005-1374.md): Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote at (no CVSS) - [CVE-2005-1375](https://cve.now/CVE-2005-1375.md): Multiple SQL injection vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote attackers to ex (no CVSS) - [CVE-2005-1376](https://cve.now/CVE-2005-1376.md): Multiple directory traversal vulnerabilities in (1) document.php or (2) insertMyDoc.php in Claroline 1.5.3 through 1.6 Release Candidate 1, (no CVSS) - [CVE-2005-1377](https://cve.now/CVE-2005-1377.md): Multiple PHP remote file inclusion vulnerabilities in Claroline 1.5.3 through 1.6 Release Candidate 1, and possibly Dokeos, allow remote att (no CVSS) - [CVE-2005-1378](https://cve.now/CVE-2005-1378.md): SQL injection vulnerability in posting\_notes.php in the notes module for phpBB allows remote attackers to execute arbitrary SQL commands via (no CVSS) - [CVE-2005-1379](https://cve.now/CVE-2005-1379.md): The LAM runtime environment package (lam-runtime-7.0.6-2mdk) on Mandrake Linux installs the mpi user without a password, which allows local (no CVSS) - [CVE-2005-1380](https://cve.now/CVE-2005-1380.md): Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the se (no CVSS) - [CVE-2005-1381](https://cve.now/CVE-2005-1381.md): Multiple cross-site scripting (XSS) vulnerabilities in Oracle Webcache 9i allow remote attackers to inject arbitrary web script or HTML via (no CVSS) - [CVE-2005-1382](https://cve.now/CVE-2005-1382.md): The webcacheadmin module in Oracle Webcache 9i allows remote attackers to corrupt arbitrary files via a full pathname in the cache\_dump\_file (no CVSS) - [CVE-2005-1383](https://cve.now/CVE-2005-1383.md): The OHS component 1.0.2 through 10.x, when UseWebcacheIP is disabled, in Oracle Application Server allows remote attackers to bypass HTTP Se (no CVSS) - [CVE-2005-1384](https://cve.now/CVE-2005-1384.md): Multiple SQL injection vulnerabilities in phpCoin 1.2.2 allow remote attackers to execute arbitrary SQL commands via the (1) search paramete (no CVSS) - [CVE-2005-1385](https://cve.now/CVE-2005-1385.md): Safari 1.3 allows remote attackers to cause a denial of service (application crash) via a long https URL that triggers a NULL pointer derefe (no CVSS) - [CVE-2005-1386](https://cve.now/CVE-2005-1386.md): PHP-Nuke 7.6 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) ipban.php, (2) db.php, (3) lang (no CVSS) - [CVE-2005-1387](https://cve.now/CVE-2005-1387.md): Cocktail 3.5.4 and possibly earlier in Mac OS X passes the administrative password on the command line to sudo in cleartext, which allows lo (no CVSS) - [CVE-2005-1388](https://cve.now/CVE-2005-1388.md): Cross-site scripting (XSS) vulnerability in SURVIVOR before 0.9.6 allows remote attackers to inject arbitrary web script or HTML via unknown (no CVSS) - [CVE-2005-1391](https://cve.now/CVE-2005-1391.md): Buffer overflow in the add\_port function in APSIS Pound 1.8.2 and earlier allows remote attackers to execute arbitrary code via a long Host (no CVSS) - [CVE-2005-1392](https://cve.now/CVE-2005-1392.md): The SQL install script in phpMyAdmin 2.6.2 is created with world-readable permissions, which allows local users to obtain the initial databa (no CVSS) - [CVE-2005-1393](https://cve.now/CVE-2005-1393.md): Multiple buffer overflows in ArcGIS for ESRI ArcInfo Workstation 9.0 allow local users to execute arbitrary code via long command line argum (no CVSS) - [CVE-2005-1394](https://cve.now/CVE-2005-1394.md): Format string vulnerability in ArcGIS for ESRI ArcInfo Workstation 9.0 allows local users to gain privileges via format string specifiers in (no CVSS) - [CVE-2005-1395](https://cve.now/CVE-2005-1395.md): Buffer overflow in Ce/Ceterm (aka ARPUS/Ce) 2.5.4 and earlier may allow local users to gain privileges via a long (1) XAPPLRESLANGPATH or (2 (no CVSS) - [CVE-2005-1396](https://cve.now/CVE-2005-1396.md): Race condition in Ce/Ceterm (aka ARPUS/Ce) 2.5.4 and earlier allows local users to write to arbitrary files via a symlink attack on the ce\_e (no CVSS) - [CVE-2005-1397](https://cve.now/CVE-2005-1397.md): SQL injection vulnerability in search.php for PHP-Calendar before 0.10.3 allows remote attackers to execute arbitrary SQL commands via unkno (no CVSS) - [CVE-2005-1398](https://cve.now/CVE-2005-1398.md): phpcart.php in PHPCart 3.2 allows remote attackers to change product price information by modifying the (1) price or (2) postage parameters. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2005-05-02 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.