# CVEs published 2005-05-03

53 CVEs were published on May 3, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2004-1777](https://cve.now/CVE-2004-1777.md): A "range check error" in Skype for Windows before 0.98.0.28 allows local and remote attackers to cause a denial of service (application cras (no CVSS)
- [CVE-2004-1778](https://cve.now/CVE-2004-1778.md): Skype 0.92.0.12 and 1.0.0.1 for Linux, and possibly other versions, creates the /usr/share/skype/lang directory with world-writable permissi (no CVSS)
- [CVE-2005-0106](https://cve.now/CVE-2005-0106.md): SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGD\_PATH variable, which al (no CVSS)
- [CVE-2005-0157](https://cve.now/CVE-2005-0157.md): The confirm add-on in SmartList 3.15 and earlier allows attackers to subscribe arbitrary e-mail addresses by using a valid cookie that speci (no CVSS)
- [CVE-2005-1401](https://cve.now/CVE-2005-1401.md): Format string vulnerability in the client for Mtp-Target 1.2.2 and earlier allows remote attackers to execute arbitrary code via game messag (no CVSS)
- [CVE-2005-1402](https://cve.now/CVE-2005-1402.md): Integer signedness error in certain older versions of the NeL library, as used in Mtp-Target 1.2.2 and earlier, and possibly other products, (no CVSS)
- [CVE-2005-1403](https://cve.now/CVE-2005-1403.md): Multiple cross-site scripting (XSS) vulnerabilities in JustWilliam's Amazon Webstore 04050100 allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2005-1404](https://cve.now/CVE-2005-1404.md): MyPHP Forum 1.0 allows remote attackers to spoof the username by modifying the (1) nbuser parameter to post.php or (2) sender parameter to p (no CVSS)
- [CVE-2005-1405](https://cve.now/CVE-2005-1405.md): HTTP response splitting vulnerability in the @SetHTTPHeader function in Lotus Domino 6.5.x before 6.5.4 and 6.0.x before 6.0.5 allows attack (no CVSS)
- [CVE-2005-1407](https://cve.now/CVE-2005-1407.md): Skype for Windows 1.2.0.0 to 1.2.0.46 allows local users to bypass the identity check for an authorized application, then call arbitrary Sky (no CVSS)
- [CVE-2005-1409](https://cve.now/CVE-2005-1409.md): PostgreSQL 7.3.x through 8.0.x gives public EXECUTE access to certain character conversion functions, which allows unprivileged users to cal (no CVSS)
- [CVE-2005-1410](https://cve.now/CVE-2005-1410.md): The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex\_init, (2) snb\_en\_init, (3) snb\_ru\_init, (4) spell\_init, and (5) syn (no CVSS)
- [CVE-2005-1411](https://cve.now/CVE-2005-1411.md): Cybration ICUII 7.0 stores passwords in plaintext in the world-readable icuii.ini file, which allows local users to gain privileges. (no CVSS)
- [CVE-2005-1412](https://cve.now/CVE-2005-1412.md): SQL injection vulnerability in verify.asp for Ecomm Professional Guestbook 3.x allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2005-1413](https://cve.now/CVE-2005-1413.md): Multiple SQL injection vulnerabilities in enVivo!CMS allow remote attackers to execute arbitrary SQL commands and gain privileges via the (1 (no CVSS)
- [CVE-2005-1414](https://cve.now/CVE-2005-1414.md): ExoticSoft FilePocket 1.2 stores sensitive proxy information, including proxy passwords, in plaintext in the registry, which allows local us (no CVSS)
- [CVE-2005-1415](https://cve.now/CVE-2005-1415.md): Buffer overflow in GlobalSCAPE Secure FTP Server 3.0.2 allows remote authenticated users to execute arbitrary code via a long FTP command. (no CVSS)
- [CVE-2005-1416](https://cve.now/CVE-2005-1416.md): Directory traversal vulnerability in 04WebServer 1.81 allows remote attackers to read files outside of the web root but within the installat (no CVSS)
- [CVE-2005-1417](https://cve.now/CVE-2005-1417.md): Multiple SQL injection vulnerabilities in MaxWebPortal 2.x, 1.35, and other versions allow remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2005-1418](https://cve.now/CVE-2005-1418.md): NetLeaf Limited NotJustBrowsing 1.0.3 stores the View Lock Password in plaintext in the notjustbrowsing.prf file, which allows local users t (no CVSS)
- [CVE-2005-1419](https://cve.now/CVE-2005-1419.md): SQL injection vulnerability in the admin login panel for Ocean12 Mailing List Manager 1.06 allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2005-1420](https://cve.now/CVE-2005-1420.md): Raysoft/Raybase Video Cam Server 1.0.0 beta allows remote attackers to determine the full pathname of the server via a request for an invali (no CVSS)
- [CVE-2005-1421](https://cve.now/CVE-2005-1421.md): Directory traversal vulnerability in Raysoft/Raybase Video Cam Server 1.0.0 beta allows remote attackers to read arbitrary files via ".." (d (no CVSS)
- [CVE-2005-1422](https://cve.now/CVE-2005-1422.md): Raysoft/Raybase Video Cam Server 1.0.0 beta allows remote attackers to conduct administrator operations and cause a denial of service (serve (no CVSS)
- [CVE-2005-1423](https://cve.now/CVE-2005-1423.md): Directory traversal vulnerability in the mail program in 602LAN SUITE 2004.0.05.0413 allows remote attackers to cause a denial of service an (no CVSS)
- [CVE-2005-1424](https://cve.now/CVE-2005-1424.md): StumbleInside GoText 1.01 stores sensitive username, mail address,and phone number information in plaintext in the GoText.bin file, which al (no CVSS)
- [CVE-2005-1425](https://cve.now/CVE-2005-1425.md): Uapplication Uguestbook 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers (no CVSS)
- [CVE-2005-1426](https://cve.now/CVE-2005-1426.md): Uapplication Ublog Reload stores sensitive information under the web root with insufficient access control, which allows remote attackers to (no CVSS)
- [CVE-2005-1427](https://cve.now/CVE-2005-1427.md): Uapplication Uphotogallery stores the database under the web document root, which allows remote attackers to obtain sensitive information vi (no CVSS)
- [CVE-2005-1428](https://cve.now/CVE-2005-1428.md): edit\_image.asp in Uapplication Uphotogallery allows remote attackers to upload arbitrary files. (no CVSS)
- [CVE-2005-1429](https://cve.now/CVE-2005-1429.md): SQL injection vulnerability in login.asp in WWWguestbook 1.1 allows remote attackers to execute arbitrary SQL commands via the password para (no CVSS)
- [CVE-2005-1430](https://cve.now/CVE-2005-1430.md): Mac OS X 10.3.x and earlier uses insecure permissions for a pseudo terminal tty (pty) that is managed by a non-setuid program, which allows (no CVSS)
- [CVE-2005-1431](https://cve.now/CVE-2005-1431.md): The "record packet parsing" in GnuTLS 1.2 before 1.2.3 and 1.0 before 1.0.25 allows remote attackers to cause a denial of service, possibly (no CVSS)
- [CVE-2005-1433](https://cve.now/CVE-2005-1433.md): Multiple unknown vulnjerabilities HP OpenView Event Correlation Services (OV ECS) 3.32 and 3.33 allow attackers to cause a denial of service (no CVSS)
- [CVE-2005-1434](https://cve.now/CVE-2005-1434.md): Multiple unknown vulnerabilities in OpenView Network Node Manager (OV NNM) 6.2, 6.4, 7.01, and 7.50 allow attackers to cause a denial of ser (no CVSS)
- [CVE-2005-1435](https://cve.now/CVE-2005-1435.md): Open WebMail (OWM) before 2.51 20050430 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a filena (no CVSS)
- [CVE-2005-1436](https://cve.now/CVE-2005-1436.md): Multiple cross-site scripting (XSS) vulnerabilities in osTicket allow remote attackers to inject arbitrary web script or HTML via (1) the t (no CVSS)
- [CVE-2005-1437](https://cve.now/CVE-2005-1437.md): Multiple SQL injection vulnerabilities in osTicket allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to admi (no CVSS)
- [CVE-2005-1438](https://cve.now/CVE-2005-1438.md): PHP remote file inclusion vulnerability in main.php in osTicket allows remote attackers to execute arbitrary PHP code via the include\_dir pa (no CVSS)
- [CVE-2005-1439](https://cve.now/CVE-2005-1439.md): Directory traversal vulnerability in attachments.php in osTicket allows remote attackers to read arbitrary files via .. (no CVSS)
- [CVE-2005-1440](https://cve.now/CVE-2005-1440.md): Multiple cross-site scripting (XSS) vulnerabilities in ViArt Shop Enterprise 2.1.6 allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2005-1441](https://cve.now/CVE-2005-1441.md): Format string vulnerability in Lotus Domino 6.0.x before 6.0.5 and 6.5.x before 6.5.4 allows remote attackers to cause a denial of service v (no CVSS)
- [CVE-2005-1442](https://cve.now/CVE-2005-1442.md): Buffer overflow in the Lotus Notes client for Domino 6.5 before 6.5.4 and 6.0 before 6.0.5 allows local users to cause a denial of service ( (no CVSS)
- [CVE-2005-1443](https://cve.now/CVE-2005-1443.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php for Invision Power Board (IPB) 2.0.3 and 2.1 Alpha 2 allows remote attacker (no CVSS)
- [CVE-2005-1444](https://cve.now/CVE-2005-1444.md): Multiple cross-site scripting (XSS) vulnerabilities in SitePanel 2.6.1 and earlier (SitePanel2) allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2005-1445](https://cve.now/CVE-2005-1445.md): Multiple directory traversal vulnerabilities in SitePanel 2.6.1 and earlier (SitePanel2) allows remote attackers to (1) delete arbitrary fil (no CVSS)
- [CVE-2005-1446](https://cve.now/CVE-2005-1446.md): SitePanel 2.6.1 and earlier (SitePanel2) allows remote attackers to upload and execute arbitrary files such as PHP scripts via an attachment (no CVSS)
- [CVE-2005-1447](https://cve.now/CVE-2005-1447.md): PHP remote file inclusion vulnerability in main.php in SitePanel 2.6.1 and earlier (SitePanel2) allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2005-1448](https://cve.now/CVE-2005-1448.md): Cross-site scripting (XSS) vulnerability in the BBCode plugin for Serendipity before 0.8 allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2005-1449](https://cve.now/CVE-2005-1449.md): Unknown vulnerability in serendipity\_config\_local.inc.php for Serendipity before 0.8 has unknown impact. (no CVSS)
- [CVE-2005-1450](https://cve.now/CVE-2005-1450.md): Unknown vulnerability in "the function used to validate path-names for uploading media" in Serendipity before 0.8 has unknown impact. (no CVSS)
- [CVE-2005-1451](https://cve.now/CVE-2005-1451.md): The media manager in Serendipity before 0.8 allows remote attackers to upload and execute arbitrary (1) .php or (2) .shtml files. (no CVSS)
- [CVE-2005-1452](https://cve.now/CVE-2005-1452.md): Serendipity before 0.8 allows Chief users to "hide plugins installed by other users." (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-05-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.