# CVEs published 2005-06-20 26 CVEs were published on June 20, 2005: 0 critical, 0 high. Days are UTC. - [CVE-2005-1267](https://cve.now/CVE-2005-1267.md): The bgp\_update\_print function in tcpdump 3.x does not properly handle a -1 return value from the decode\_prefix4 function, which allows remot (no CVSS) - [CVE-2005-1729](https://cve.now/CVE-2005-1729.md): Novell eDirectory 8.7.3 allows remote attackers to cause a denial of service (application crash) via a URL containing an MS-DOS device name (no CVSS) - [CVE-2005-1769](https://cve.now/CVE-2005-1769.md): Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.4 allow remote attackers to inject arbitrary web scrip (no CVSS) - [CVE-2005-1992](https://cve.now/CVE-2005-1992.md): The XMLRPC server in utils.rb for the ruby library (libruby) 1.8 sets an invalid default value that prevents "security protection" using han (no CVSS) - [CVE-2005-1993](https://cve.now/CVE-2005-1993.md): Race condition in sudo 1.3.1 up to 1.6.8p8, when the ALL pseudo-command is used after a user entry in the sudoers file, allows local users t (no CVSS) - [CVE-2005-1994](https://cve.now/CVE-2005-1994.md): Finjan SurfinGate 7.0SP2 and SP3 allows remote attackers to download blocked files via hex-encoded characters in a filename, as demonstrated (no CVSS) - [CVE-2005-1995](https://cve.now/CVE-2005-1995.md): Bitrix Site Manager 4.0.x allows remote attackers to obtain sensitive information via direct request to (1) subscr\_form.php or (2) dbquery\_e (no CVSS) - [CVE-2005-1996](https://cve.now/CVE-2005-1996.md): PHP remote file inclusion vulnerability in start.php in Bitrix Site Manager 4.0.x allows remote attackers to execute arbitrary PHP code via (no CVSS) - [CVE-2005-1997](https://cve.now/CVE-2005-1997.md): show.php in McGallery 1.1 allows remote attackers to connect to arbitrary databases, or gain sensitive information by triggering an error, v (no CVSS) - [CVE-2005-1998](https://cve.now/CVE-2005-1998.md): Directory traversal vulnerability in admin.php in McGallery 1.1 allows remote attackers to read arbitrary files via a .. (no CVSS) - [CVE-2005-1999](https://cve.now/CVE-2005-1999.md): Multiple cross-site scripting (XSS) vulnerabilities in pafiledb.php in paFileDB 3.1 allow remote attackers to inject arbitrary web script or (no CVSS) - [CVE-2005-2000](https://cve.now/CVE-2005-2000.md): Multiple SQL injection vulnerabilities in paFileDB 3.1 and earlier allow remote attackers to execute arbitrary SQL commands via the formname (no CVSS) - [CVE-2005-2001](https://cve.now/CVE-2005-2001.md): Directory traversal vulnerability in pafiledb.php in paFileDB 3.1 and earlier allows remote attackers to include arbitrary files via a .. (no CVSS) - [CVE-2005-2002](https://cve.now/CVE-2005-2002.md): SQL injection vulnerability in content.php in Mambo 4.5.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the us (no CVSS) - [CVE-2005-2003](https://cve.now/CVE-2005-2003.md): Ultimate PHP Board (UPB) 1.9.6 GOLD allows remote attackers to obtain sensitive information via an invalid (zero) id parameter to (1) viewto (no CVSS) - [CVE-2005-2004](https://cve.now/CVE-2005-2004.md): Multiple cross-site scripting vulnerabilities in Ultimate PHP Board (UPB) 1.9.6 GOLD and earlier allow remote attackers to inject arbitrary (no CVSS) - [CVE-2005-2005](https://cve.now/CVE-2005-2005.md): Ultimate PHP Board (UPB) 1.9.6 GOLD and earlier stores the users.dat file under the web document root with insufficient access control, whic (no CVSS) - [CVE-2005-2006](https://cve.now/CVE-2005-2006.md): JBOSS 3.2.2 through 3.2.7 and 4.0.2 allows remote attackers to obtain sensitive information via a GET request (1) with a "%." (percent dot), (no CVSS) - [CVE-2005-2007](https://cve.now/CVE-2005-2007.md): Directory traversal vulnerability in Edgewall Trac 0.8.3 and earlier allows remote attackers to read or write arbitrary files via a .. (no CVSS) - [CVE-2005-2008](https://cve.now/CVE-2005-2008.md): Yaws Webserver 1.55 and earlier allows remote attackers to obtain the source code for yaws scripts via a request to a yaw script with a trai (no CVSS) - [CVE-2005-2009](https://cve.now/CVE-2005-2009.md): Multiple SQL injection vulnerabilities in Ublog Reload 1.0.5 allow remote attackers to execute arbitrary SQL commands via the (1) ci, (2) d, (no CVSS) - [CVE-2005-2010](https://cve.now/CVE-2005-2010.md): Cross-site scripting (XSS) vulnerability in trackback.asp in Ublog Reload 1.0.5 allows remote attackers to inject arbitrary web script or HT (no CVSS) - [CVE-2005-2011](https://cve.now/CVE-2005-2011.md): Multiple cross-site scripting (XSS) vulnerabilities in paFAQ 1.0 Beta 4 allow remote attackers to inject arbitrary web script or HTML, as de (no CVSS) - [CVE-2005-2012](https://cve.now/CVE-2005-2012.md): Multiple SQL injection vulnerabilities in login in paFAQ 1.0 Beta 4 allow remote attackers to execute arbitrary SQL commands and bypass auth (no CVSS) - [CVE-2005-2013](https://cve.now/CVE-2005-2013.md): paFAQ 1.0 Beta 4 allows remote attackers to obtain sensitive information via a direct request to admin/backup.php, which contains a backup o (no CVSS) - [CVE-2005-2014](https://cve.now/CVE-2005-2014.md): The "upload a language pack" feature in paFAQ 1.0 Beta 4 allows remote authenticated administrators to execute arbitrary PHP commands by upl (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2005-06-20 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.