# CVEs published 2005-05-11

45 CVEs were published on May 11, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2005-1261](https://cve.now/CVE-2005-1261.md): Stack-based buffer overflow in the URL parsing function in Gaim before 1.3.0 allows remote attackers to execute arbitrary code via an instan (no CVSS)
- [CVE-2005-1262](https://cve.now/CVE-2005-1262.md): Gaim 1.2.1 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed MSN message. (no CVSS)
- [CVE-2005-1263](https://cve.now/CVE-2005-1263.md): The elf\_core\_dump function in binfmt\_elf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4 allows local (no CVSS)
- [CVE-2005-1478](https://cve.now/CVE-2005-1478.md): Format string vulnerability in dSMTP (dsmtp.exe) in DMail 3.1a allows remote attackers to execute arbitrary code via format string specifier (no CVSS)
- [CVE-2005-1479](https://cve.now/CVE-2005-1479.md): SQL injection vulnerability in jgs\_portal.php in JGS-Portal 3.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2005-1480](https://cve.now/CVE-2005-1480.md): Directory traversal vulnerability in RaidenFTPD before 2.4.2241 allows remote attackers to read arbitrary files via a "..\\\\" (dot dot backsl (no CVSS)
- [CVE-2005-1481](https://cve.now/CVE-2005-1481.md): Multiple SQL injection vulnerabilities in Aaron Outpost ASP Inline Corporate Calendar allow remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2005-1482](https://cve.now/CVE-2005-1482.md): ArticleLive 2005 allows remote attackers to gain privileges by modifying the (1) auth and (2) userId fields in a cookie. (no CVSS)
- [CVE-2005-1483](https://cve.now/CVE-2005-1483.md): Multiple cross-site scripting (XSS) vulnerabilities in ArticleLive 2005 allow remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2005-1484](https://cve.now/CVE-2005-1484.md): Directory traversal vulnerability in Golden FTP server pro 2.52 allows remote attackers to read arbitrary files via a "\\.." (backward slash (no CVSS)
- [CVE-2005-1485](https://cve.now/CVE-2005-1485.md): Golden FTP Server Pro 2.52 allows remote attackers to obtain sensitive information via a GET request for a file that does not exist, which r (no CVSS)
- [CVE-2005-1486](https://cve.now/CVE-2005-1486.md): Multiple cross-site scripting vulnerabilities in FishCart 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) trac (no CVSS)
- [CVE-2005-1487](https://cve.now/CVE-2005-1487.md): Multiple SQL injection vulnerabilities in FishCart 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) cartid parameter (no CVSS)
- [CVE-2005-1488](https://cve.now/CVE-2005-1488.md): Multiple cross-site scripting (XSS) vulnerabilities in Merak Mail Server 8.0.3 with Icewarp Web Mail 5.4.2 allow remote authenticated users (no CVSS)
- [CVE-2005-1489](https://cve.now/CVE-2005-1489.md): Unknown vulnerability in Merak Mail Server 8.0.3 with Icewarp Web Mail 5.4.2 allows remote authenticated users to obtain the full path of th (no CVSS)
- [CVE-2005-1490](https://cve.now/CVE-2005-1490.md): Merak Mail Server 8.0.3 with Icewarp Web Mail 5.4.2, when the mailbox.dat file does not exist, allows remote authenticated users to determin (no CVSS)
- [CVE-2005-1491](https://cve.now/CVE-2005-1491.md): Merak Mail Server 8.0.3 with Icewarp Web Mail 5.4.2 allows remote authenticated users to (1) move their home directory via viewaction.html o (no CVSS)
- [CVE-2005-1492](https://cve.now/CVE-2005-1492.md): Cross-site scripting (XSS) vulnerability in user.cgi in Gossamer Threads Links SQL 2.x and 3.0 allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2005-1493](https://cve.now/CVE-2005-1493.md): Directory traversal vulnerability in SimpleCam 1.2 allows remote attackers to read arbitrary files via a ..\\ (dot dot backslash) in the URL. (no CVSS)
- [CVE-2005-1494](https://cve.now/CVE-2005-1494.md): Multiple cross-site scripting (XSS) vulnerabilities in admin.cgi in MegaBook 2.0 and 2.1 allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2005-1495](https://cve.now/CVE-2005-1495.md): Oracle Database 9i and 10g disables Fine Grained Audit (FGA) after the SYS user executes a SELECT statement on an FGA object, which makes it (no CVSS)
- [CVE-2005-1496](https://cve.now/CVE-2005-1496.md): The DBMS\_Scheduler in Oracle 10g allows remote attackers with CREATE JOB privileges to gain additional privileges by changing SESSION\_USER t (no CVSS)
- [CVE-2005-1497](https://cve.now/CVE-2005-1497.md): index.php in myBloggie 2.1.1 allows remote attackers to obtain sensitive information via an invalid post\_id parameter, which reveals the pat (no CVSS)
- [CVE-2005-1498](https://cve.now/CVE-2005-1498.md): Multiple cross-site scripting (XSS) vulnerabilities in myBloggie 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2005-1499](https://cve.now/CVE-2005-1499.md): delcomment.php in myBloggie 2.1.1 allows remote attackers to delete arbitrary comments by modifying the comment\_id parameter. (no CVSS)
- [CVE-2005-1500](https://cve.now/CVE-2005-1500.md): Multiple SQL injection vulnerabilities in myBloggie 2.1.1 allow remote attackers to execute arbitrary SQL commands via (1) the keyword param (no CVSS)
- [CVE-2005-1501](https://cve.now/CVE-2005-1501.md): MidiCart PHP Shopping Cart allows remote attackers to obtain sensitive information via a direct request to (1) search\_list.php, (2) item\_lis (no CVSS)
- [CVE-2005-1502](https://cve.now/CVE-2005-1502.md): Cross-site scripting (XSS) vulnerability in MidiCart PHP Shopping Cart allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2005-1503](https://cve.now/CVE-2005-1503.md): Multiple SQL injection vulnerabilities in MidiCart PHP Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) se (no CVSS)
- [CVE-2005-1504](https://cve.now/CVE-2005-1504.md): GameSpy SDK CD-Key Validation Toolkit, as used by many online games, allows remote attackers to bypass the CD key validation by sending a sp (no CVSS)
- [CVE-2005-1505](https://cve.now/CVE-2005-1505.md): The new account wizard in Mail.app 2.0 in Mac OS 10.4, when configuring an IMAP mail account and checking the credentials, does not prompt t (no CVSS)
- [CVE-2005-1506](https://cve.now/CVE-2005-1506.md): SQL injection vulnerability in out.php in CJ Ultra (CJUltra) Plus 1.0.3 and 1.0.4 allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2005-1507](https://cve.now/CVE-2005-1507.md): Buffer overflow in the Tomcat plugin in 4d WebSTAR 5.33 and 5.4 allows remote attackers to cause a denial of service and possibly execute ar (no CVSS)
- [CVE-2005-1508](https://cve.now/CVE-2005-1508.md): Multiple cross-site scripting (XSS) vulnerabilities in PwsPHP 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1 (no CVSS)
- [CVE-2005-1509](https://cve.now/CVE-2005-1509.md): SQL injection vulnerability in profil.php in PwsPHP 1.2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter. (no CVSS)
- [CVE-2005-1510](https://cve.now/CVE-2005-1510.md): PwsPHP 1.2.2 allows remote attackers to obtain sensitive information via a direct request to the admin directory, which reveals the path in (no CVSS)
- [CVE-2005-1511](https://cve.now/CVE-2005-1511.md): PwsPHP 1.2.2 allows remote attackers to bypass authentication and post arbitrary comments via the Pseudo cookie. (no CVSS)
- [CVE-2005-1512](https://cve.now/CVE-2005-1512.md): The Admin panel in PwsPHP 1.2.2 does not properly verify uploaded picture files, which allows remote attackers to upload and possibly execut (no CVSS)
- [CVE-2005-1514](https://cve.now/CVE-2005-1514.md): commands.c in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2005-1515](https://cve.now/CVE-2005-1515.md): Integer signedness error in the qmail\_put and substdio\_put functions in qmail, when running on 64 bit platforms with a large amount of virtu (no CVSS)
- [CVE-2005-1516](https://cve.now/CVE-2005-1516.md): DList (dlist.exe) in DMail 3.1a allows remote attackers to bypass authentication, read log files, and shutdown the system via a sendlog comm (no CVSS)
- [CVE-2005-1517](https://cve.now/CVE-2005-1517.md): Unknown vulnerability in Cisco Firewall Services Module (FWSM) 2.3.1 and earlier, when using URL, FTP, or HTTPS filtering exceptions, allows (no CVSS)
- [CVE-2005-1518](https://cve.now/CVE-2005-1518.md): Unknown vulnerability in Solaris 7 through 9, when using Federated Naming Services (FNS), autofs, and FNS X.500 configuration, allows local (no CVSS)
- [CVE-2005-1519](https://cve.now/CVE-2005-1519.md): Squid 2.5 STABLE9 and earlier, when the DNS client port is unfiltered and the environment does not prevent IP spoofing, allows remote attack (no CVSS)
- [CVE-2005-1513](https://cve.now/CVE-2005-1513.md): Integer overflow in the stralloc\_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-05-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.