# CVEs published 2005-05-14

45 CVEs were published on May 14, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2005-1544](https://cve.now/CVE-2005-1544.md): Stack-based buffer overflow in libTIFF before 3.7.2 allows remote attackers to execute arbitrary code via a TIFF file with a malformed BitsP (no CVSS)
- [CVE-2005-1545](https://cve.now/CVE-2005-1545.md): Integer overflow in the ELF parser in HT Editor before 0.8.0 allows remote attackers to execute arbitrary code via a crafted ELF file, which (no CVSS)
- [CVE-2005-1546](https://cve.now/CVE-2005-1546.md): Buffer overflow in the PE parser in HT Editor before 0.8.0 allows remote attackers to execute arbitrary code via a crafted PE file. (no CVSS)
- [CVE-2005-1547](https://cve.now/CVE-2005-1547.md): Heap-based buffer overflow in the demo version of Bakbone Netvault, and possibly other versions, allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2005-1548](https://cve.now/CVE-2005-1548.md): SQL injection vulnerability in index.php in Advanced Guestbook 2.3.1 allows remote attackers to execute arbitrary SQL commands via the entry (no CVSS)
- [CVE-2005-1549](https://cve.now/CVE-2005-1549.md): Directory traversal vulnerability in easymsgb.pl in Easy Message Board allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2005-1550](https://cve.now/CVE-2005-1550.md): easymsgb.pl in Easy Message Board allows remote attackers to execute arbitrary commands via shell metacharacters in the print parameter. (no CVSS)
- [CVE-2005-1551](https://cve.now/CVE-2005-1551.md): Sophos Anti-Virus 3.93 does not check downloaded files for viruses when they have only been written, which creates a race condition and may (no CVSS)
- [CVE-2005-1552](https://cve.now/CVE-2005-1552.md): GeoVision Digital Video Surveillance System 6.04, 6.1 and 7.0, when set to create JPEG images, does not properly protect an image even when (no CVSS)
- [CVE-2005-1553](https://cve.now/CVE-2005-1553.md): GeoVision Digital Video Surveillance System 6.04, 6.1 and 7.0 uses a weak encryption scheme to encrypt passwords, which allows remote attack (no CVSS)
- [CVE-2005-1554](https://cve.now/CVE-2005-1554.md): SQL injection vulnerability in view\_user.php in WowBB 1.6, 1.61, and 1.62 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2005-1555](https://cve.now/CVE-2005-1555.md): Cross-site scripting (XSS) vulnerability in the JRun Web Server in ColdFusion MX 7.0 allows remote attackers to inject arbitrary script or H (no CVSS)
- [CVE-2005-1556](https://cve.now/CVE-2005-1556.md): Gamespy cd-key validation system allows remote attackers to cause a denial of service (cd-key already in use) by capturing and replaying a c (no CVSS)
- [CVE-2005-1557](https://cve.now/CVE-2005-1557.md): Multiple cross-site scripting (XSS) vulnerabilities in WebApp Guestbook PRO 3.2.1 and earlier allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2005-1558](https://cve.now/CVE-2005-1558.md): The web module in Neteyes Nexusway allows remote attackers to bypass authentication and gain administrator privileges by setting the cyclone (no CVSS)
- [CVE-2005-1559](https://cve.now/CVE-2005-1559.md): The web module in Neteyes Nexusway allows remote attackers to execute arbitrary commands via hex-encoded shell metacharacters in the ip para (no CVSS)
- [CVE-2005-1560](https://cve.now/CVE-2005-1560.md): The SSH module in Neteyes Nexusway allows remote attackers to execute arbitrary commands via shell metacharacters in arguments to certain co (no CVSS)
- [CVE-2005-1561](https://cve.now/CVE-2005-1561.md): Multiple cross-site scripting (XSS) vulnerabilities in post.asp in MaxWebPortal 1.3.5 and earlier allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2005-1562](https://cve.now/CVE-2005-1562.md): Multiple SQL injection vulnerabilities in MaxWebPortal 1.3.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1 (no CVSS)
- [CVE-2005-1563](https://cve.now/CVE-2005-1563.md): Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 displays a different error message depending on whether a product exists or not, which allows (no CVSS)
- [CVE-2005-1564](https://cve.now/CVE-2005-1564.md): post\_bug.cgi in Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 allows remote authenticated users to "enter bugs into products that are close (no CVSS)
- [CVE-2005-1565](https://cve.now/CVE-2005-1565.md): Bugzilla 2.17.1 through 2.18, 2.19.1, and 2.19.2, when a user is prompted to log in while attempting to view a chart, displays the password (no CVSS)
- [CVE-2005-1566](https://cve.now/CVE-2005-1566.md): Acrowave AAP-3100AR wireless router allows remote attackers to bypass authentication by pressing CTRL-C at the username or password prompt i (no CVSS)
- [CVE-2005-1567](https://cve.now/CVE-2005-1567.md): SQL injection vulnerability in topic.php in DirectTopics 2.1 and 2.2 allows remote attackers to execute arbitrary SQL commands via the topic (no CVSS)
- [CVE-2005-1568](https://cve.now/CVE-2005-1568.md): topic.php in DirectTopics 2.1 and 2.2 allows remote attackers to obtain sensitive information via an invalid topic parameter, which reveals (no CVSS)
- [CVE-2005-1569](https://cve.now/CVE-2005-1569.md): Cross-site scripting (XSS) vulnerability in DirectTopics 2.1 and 2.2 allows remote attackers to inject arbitrary web script via a javascript (no CVSS)
- [CVE-2005-1570](https://cve.now/CVE-2005-1570.md): forum.asp in bttlxeForum 2.0 allows remote attackers to obtain full path information via a certain hex-encoded argument to the page paramete (no CVSS)
- [CVE-2005-1571](https://cve.now/CVE-2005-1571.md): Multiple directory traversal vulnerabilities in ShowOff! 1.5.4 allow remote attackers to read arbitrary files via ".." sequences in argument (no CVSS)
- [CVE-2005-1572](https://cve.now/CVE-2005-1572.md): ShowOff! 1.5.4 allows remote attackers to cause a denial of service (server crash) via a malformed request to port 8083. (no CVSS)
- [CVE-2005-1573](https://cve.now/CVE-2005-1573.md): SQL injection vulnerability in admin\_login.asp for ASP Virtual News Manager allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2005-1574](https://cve.now/CVE-2005-1574.md): Windows Media Player 9 and 10, in certain cases, allows content protected by Windows Media Digital Rights Management (WMDRM) to redirect the (no CVSS)
- [CVE-2005-1575](https://cve.now/CVE-2005-1575.md): The file download dialog in Mozilla Firefox 0.10.1 and 1.0 for Windows allows remote attackers to hide the real file types of downloaded fil (no CVSS)
- [CVE-2005-1576](https://cve.now/CVE-2005-1576.md): The file download dialog in Mozilla Firefox 0.10.1 and 1.0 for Windows uses the Content-Type HTTP header to determine the file type, but sav (no CVSS)
- [CVE-2005-1577](https://cve.now/CVE-2005-1577.md): APG Technology ClassMaster does not properly restrict access to sensitive folders, which allows remote attackers to access folders via a net (no CVSS)
- [CVE-2005-1578](https://cve.now/CVE-2005-1578.md): EnCase Forensic Edition 4.18a does not support Device Configuration Overlays (DCO), which allows attackers to hide information without detec (no CVSS)
- [CVE-2005-1579](https://cve.now/CVE-2005-1579.md): Apple QuickTime Player 7.0 on Mac OS X 10.4 allows remote attackers to obtain sensitive information via a .mov file with a Quartz Composer c (no CVSS)
- [CVE-2005-1580](https://cve.now/CVE-2005-1580.md): users.ini.php in BoastMachine 3.0 does not properly restrict the types of files that can be uploaded, which allows remote attackers to execu (no CVSS)
- [CVE-2005-1581](https://cve.now/CVE-2005-1581.md): Cross-site scripting (XSS) vulnerability in Bug Report 1.0 allows remote attackers to inject arbitrary web script or HTML via various fields (no CVSS)
- [CVE-2005-1582](https://cve.now/CVE-2005-1582.md): Cross-site scripting (XSS) vulnerability in index.php for 1Two News 1.0 allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2005-1583](https://cve.now/CVE-2005-1583.md): 1Two News 1.0 allows remote attackers to (1) delete images for new stories via a direct request to admin/delete.php or (2) upload arbitrary (no CVSS)
- [CVE-2005-1584](https://cve.now/CVE-2005-1584.md): Cross-site scripting (XSS) vulnerability in index.php for Quick.Forum 2.1.6 allows remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2005-1585](https://cve.now/CVE-2005-1585.md): Multiple SQL injection vulnerabilities in Quick.Forum 2.1.6 allow remote attackers to execute arbitrary SQL commands via the (1) iCategory o (no CVSS)
- [CVE-2005-1586](https://cve.now/CVE-2005-1586.md): Quick.Forum 2.1.6 stores potentially sensitive information such as usernames, banned IP addresses, censored words, and backups under the web (no CVSS)
- [CVE-2005-1587](https://cve.now/CVE-2005-1587.md): Cross-site scripting (XSS) vulnerability in index.php for Quick.cart 0.3.0 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2005-1588](https://cve.now/CVE-2005-1588.md): SQL injection vulnerability in index.php for Quick.cart 0.3.0 allows remote attackers to execute arbitrary SQL commands via the iCategory pa (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-05-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.