# CVEs published 2005-05-18 27 CVEs were published on May 18, 2005: 0 critical, 0 high. Days are UTC. - [CVE-2005-0134](https://cve.now/CVE-2005-0134.md): The X server in SCO UnixWare 7.1.1, 7.1.3, and 7.1.4 does not properly create socket directories in /tmp, which could allow attackers to hij (no CVSS) - [CVE-2005-0757](https://cve.now/CVE-2005-0757.md): The xattr file system code, as backported in Red Hat Enterprise Linux 3 on 64-bit systems, does not properly handle certain offsets, which a (no CVSS) - [CVE-2005-1644](https://cve.now/CVE-2005-1644.md): Cross-site scripting (XSS) vulnerability in guestbook.php for 1Two Livre d'Or 1.0 allows remote attackers to inject arbitrary web script or (no CVSS) - [CVE-2005-1645](https://cve.now/CVE-2005-1645.md): Keyvan1 ImageGallery stores the image.mdb database under the web document root with insufficient access control, which allows remote attacke (no CVSS) - [CVE-2005-1646](https://cve.now/CVE-2005-1646.md): The default installation of Fastream NETFile FTP/Web Server 7.4.6, which supports FXP, does not require that the IP address in a PORT comman (no CVSS) - [CVE-2005-1647](https://cve.now/CVE-2005-1647.md): Gurgens (GASoft) Guest Book 2.1 stores the db/Genid.dat database file under the web document root with insufficient access control, which al (no CVSS) - [CVE-2005-1648](https://cve.now/CVE-2005-1648.md): Gurgens (GASoft) Ultimate Forum 1.0 stores the db/Genid.dat database file under the web document root with insufficient access control, whic (no CVSS) - [CVE-2005-1649](https://cve.now/CVE-2005-1649.md): The IPv6 support in Windows XP SP2, 2003 Server SP1, and Longhorn, with Windows Firewall turned off, allows remote attackers to cause a deni (no CVSS) - [CVE-2005-1650](https://cve.now/CVE-2005-1650.md): The web mail service in Woppoware PostMaster 4.2.2 (build 3.2.5) generates different error messages depending on whether a user exists or no (no CVSS) - [CVE-2005-1651](https://cve.now/CVE-2005-1651.md): Directory traversal vulnerability in message.htm for Woppoware PostMaster 4.2.2 (build 3.2.5) allows remote attackers to determine the exist (no CVSS) - [CVE-2005-1652](https://cve.now/CVE-2005-1652.md): message.htm for Woppoware PostMaster 4.2.2 (build 3.2.5) allows remote attackers to bypass authentication by modifying the email parameter. (no CVSS) - [CVE-2005-1653](https://cve.now/CVE-2005-1653.md): Cross-site scripting (XSS) vulnerability in message.htm for Woppoware PostMaster 4.2.2 (build 3.2.5) allows remote attackers to inject arbit (no CVSS) - [CVE-2005-1654](https://cve.now/CVE-2005-1654.md): Hosting Controller 6.1 Hotfix 1.9 and earlier allows remote attackers to register arbitrary users via a direct request to addsubsite.asp wit (no CVSS) - [CVE-2005-1655](https://cve.now/CVE-2005-1655.md): AOL Instant Messenger 5.5.x and earlier allows remote attackers to cause a denial of service (client crash) via an invalid smiley icon locat (no CVSS) - [CVE-2005-1656](https://cve.now/CVE-2005-1656.md): Mercur Messaging 2005 SP2 allows remote attackers to read the source code of .ctml files via a URL with a trailing hex-encoded space ("%20") (no CVSS) - [CVE-2005-1657](https://cve.now/CVE-2005-1657.md): Multiple directory traversal vulnerabilities in Mercur Messaging 2005 SP2 allow remote attackers to perform unauthorized file operations via (no CVSS) - [CVE-2005-1658](https://cve.now/CVE-2005-1658.md): Directory traversal vulnerability in filemanager.cpp in MyServer 0.8 allows remote attackers to list the parent directory of the web root vi (no CVSS) - [CVE-2005-1659](https://cve.now/CVE-2005-1659.md): Cross-site scripting (XSS) vulnerability in filemanager.cpp in MyServer 0.8 allows remote attackers to inject arbitrary Javascript via a URL (no CVSS) - [CVE-2005-1660](https://cve.now/CVE-2005-1660.md): HTMLJunction EZGuestbook stores the guestbook.mdb file under the web document root with insufficient access control, which allows remote att (no CVSS) - [CVE-2005-1661](https://cve.now/CVE-2005-1661.md): Jeuce Personal Webserver 2.13 allows remote attackers to cause a denial of service (server crash) via a long GET request, possibly triggerin (no CVSS) - [CVE-2005-1662](https://cve.now/CVE-2005-1662.md): Directory traversal vulnerability in Jeuce Personal Web Server 2.13 allows remote attackers to read arbitrary files via a .. (no CVSS) - [CVE-2005-1663](https://cve.now/CVE-2005-1663.md): Jeuce Personal Web Server 2.13 allows remote attackers to cause a denial of service (server crash) via a GET request beginning with "://". (no CVSS) - [CVE-2005-1664](https://cve.now/CVE-2005-1664.md): The \_\_VIEWSTATE functionality in Microsoft ASP.NET 1.x allows remote attackers to conduct replay attacks to (1) apply a ViewState generated (no CVSS) - [CVE-2005-1665](https://cve.now/CVE-2005-1665.md): The \_\_VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not cryptographically signed, allows remote attackers to cause a denial of serv (no CVSS) - [CVE-2005-1666](https://cve.now/CVE-2005-1666.md): Multiple buffer overflows in Orenosv HTTP/FTP Server 0.8.1 allow remote authenticated users to cause a denial of service (server crash) and (no CVSS) - [CVE-2005-1667](https://cve.now/CVE-2005-1667.md): DataTrac Activity Console 1.1 allows remote attackers to cause a denial of service via a long HTTP GET request. (no CVSS) - [CVE-2005-1668](https://cve.now/CVE-2005-1668.md): YusASP Web Asset Manager 1.0 allows remote attackers to gain privileges via a direct request to assetmanager.asp. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2005-05-18 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.