# CVEs published 2005-07-10

75 CVEs were published on July 10, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2004-2155](https://cve.now/CVE-2004-2155.md): Online-bookmarks before 0.4.6 allows remote attackers to bypass its authentication mechanism via a direct request to (1) config/\*, (2) bookm (no CVSS)
- [CVE-2004-2156](https://cve.now/CVE-2004-2156.md): Multiple unknown vulnerabilities in Online Recruitment Agency 1.0 have unknown impact and attack vectors. (no CVSS)
- [CVE-2004-2157](https://cve.now/CVE-2004-2157.md): Cross-site scripting (XSS) vulnerability in Comment.php in Serendipity 0.7 beta1, and possibly other versions before 0.7-beta3, allows remot (no CVSS)
- [CVE-2004-2158](https://cve.now/CVE-2004-2158.md): SQL injection vulnerability in Serendipity 0.7-beta1 allows remote attackers to execute arbitrary SQL commands via the entry\_id parameter to (no CVSS)
- [CVE-2004-2159](https://cve.now/CVE-2004-2159.md): Multiple buffer overflows in XMLStarlet Command Line XML Toolkit 0.9.3 have unknown impact and attack vectors via (1) xml\_elem.c and (2) xml (no CVSS)
- [CVE-2004-2160](https://cve.now/CVE-2004-2160.md): Format string vulnerability in xml\_elem.c for XMLStarlet Command Line XML Toolkit 0.9.3 may allow attackers to cause a denial of service or (no CVSS)
- [CVE-2004-2161](https://cve.now/CVE-2004-2161.md): SQL injection vulnerability in file\_overview.php in TUTOS 1.1 allows remote attackers to execute arbitrary SQL commands via the link\_id para (no CVSS)
- [CVE-2004-2162](https://cve.now/CVE-2004-2162.md): Multiple cross-site scripting (XSS) vulnerabilities in TUTOS 1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the s (no CVSS)
- [CVE-2004-2163](https://cve.now/CVE-2004-2163.md): login\_radius on OpenBSD 3.2, 3.5, and possibly other versions does not verify the shared secret in a response packet from a RADIUS server, w (no CVSS)
- [CVE-2004-2164](https://cve.now/CVE-2004-2164.md): shoprestoreorder.asp in VP-ASP 5.0 does not close the database connection when a user restores a previous order, which allows remote attacke (no CVSS)
- [CVE-2004-2165](https://cve.now/CVE-2004-2165.md): Lords of the Realm III 1.01 and earlier, when in the lobby stage, allows remote attackers to cause a denial of service (crash from unallocat (no CVSS)
- [CVE-2004-2166](https://cve.now/CVE-2004-2166.md): The print-from-email feature in the Canon ImageRUNNER (iR) 5000i and C3200 digital printer, when not using IP address range filtering, allow (no CVSS)
- [CVE-2004-2167](https://cve.now/CVE-2004-2167.md): Multiple buffer overflows in LaTeX2rtf 1.9.15, and possibly other versions, allow remote attackers to execute arbitrary code via (1) the exp (no CVSS)
- [CVE-2004-2168](https://cve.now/CVE-2004-2168.md): BaSoMail 1.24 allows remote attackers to cause a denial of service (CPU consumption) via multiple connections to TCP port (1) 25 (SMTP) or ( (no CVSS)
- [CVE-2004-2169](https://cve.now/CVE-2004-2169.md): Application Access Server (A-A-S) 1.0.37 and earlier allows remote authenticated users to cause a denial of service (application crash) via (no CVSS)
- [CVE-2004-2170](https://cve.now/CVE-2004-2170.md): Directory traversal vulnerability in sample\_showcode.html in Caravan 2.00/03d and earlier allows remote attackers to read arbitrary files vi (no CVSS)
- [CVE-2004-2171](https://cve.now/CVE-2004-2171.md): Cross-site scripting (XSS) vulnerability in Cherokee before 0.4.8 allows remote attackers to inject arbitrary web script or HTML via the URL (no CVSS)
- [CVE-2004-2172](https://cve.now/CVE-2004-2172.md): EarlyImpact ProductCart uses a weak encryption scheme to encrypt passwords, which allows remote attackers to obtain the password via a chose (no CVSS)
- [CVE-2004-2173](https://cve.now/CVE-2004-2173.md): SQL injection vulnerability in advSearch\_h.asp in EarlyImpact ProductCart allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2004-2174](https://cve.now/CVE-2004-2174.md): Cross-site scripting (XSS) vulnerability in Custva.asp in EarlyImpact ProductCart allows remote attackers to inject arbitrary Javascript via (no CVSS)
- [CVE-2004-2175](https://cve.now/CVE-2004-2175.md): Multiple SQL injection vulnerabilities in ReviewPost PHP Pro allow remote attackers to execute arbitrary SQL commands via the (1) product pa (no CVSS)
- [CVE-2004-2176](https://cve.now/CVE-2004-2176.md): The Internet Connection Firewall (ICF) in Microsoft Windows XP SP2 is configured by default to trust sessmgr.exe, which allows local users t (no CVSS)
- [CVE-2004-2177](https://cve.now/CVE-2004-2177.md): Cross-site scripting (XSS) vulnerability in DevoyBB Web Forum 1.0.0 allows remote attackers to inject arbitrary web script or HTML via unkno (no CVSS)
- [CVE-2004-2178](https://cve.now/CVE-2004-2178.md): SQL injection vulnerability in DevoyBB Web Forum 1.0.0 allows remote attackers to execute arbitrary SQL commands via unknown vectors. (no CVSS)
- [CVE-2004-2179](https://cve.now/CVE-2004-2179.md): asycpict.dll, as used in Microsoft products such as Front Page 97 and 98, allows remote attackers to cause a denial of service (hang) via a (no CVSS)
- [CVE-2004-2180](https://cve.now/CVE-2004-2180.md): Multiple cross-site scripting (XSS) vulnerabilities in WowBB Forum 1.61 allow remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2004-2181](https://cve.now/CVE-2004-2181.md): Multiple SQL injection vulnerabilities in WowBB Forum 1.61 allow remote attackers to execute arbitrary SQL commands via the (1) sort\_by or ( (no CVSS)
- [CVE-2004-2182](https://cve.now/CVE-2004-2182.md): Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID inf (no CVSS)
- [CVE-2004-2183](https://cve.now/CVE-2004-2183.md): Unknown vulnerability in WeHelpBUS 0.1 allows remote attackers to execute arbitrary shell commands via the query string. (no CVSS)
- [CVE-2004-2184](https://cve.now/CVE-2004-2184.md): Directory traversal vulnerability in Digicraft Yak! server 2.0 through 2.1.2 allows remote attackers to read or write arbitrary files via ". (no CVSS)
- [CVE-2004-2185](https://cve.now/CVE-2004-2185.md): Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki 1.3.5 allow remote attackers to execute arbitrary scripts and/or SQL querie (no CVSS)
- [CVE-2004-2186](https://cve.now/CVE-2004-2186.md): SQL injection vulnerability in MediaWiki 1.3.5 allows remote attackers to execute arbitrary SQL commands via SpecialMaintenance. (no CVSS)
- [CVE-2004-2187](https://cve.now/CVE-2004-2187.md): Unknown vulnerability in ImagePage for MediaWiki 1.3.5, related to "filename validation," has unknown impact and attack vectors. (no CVSS)
- [CVE-2004-2188](https://cve.now/CVE-2004-2188.md): Cross-site scripting (XSS) vulnerability in DMXReady Site Chassis Manager allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2004-2189](https://cve.now/CVE-2004-2189.md): SQL injection vulnerability in DMXReady Site Chassis Manager allows remote attackers to execute arbitrary SQL commands via unknown vectors. (no CVSS)
- [CVE-2004-2190](https://cve.now/CVE-2004-2190.md): Directory traversal vulnerability in Unzoo 4.4-2 has unknown impact and attack vectors. (no CVSS)
- [CVE-2004-2191](https://cve.now/CVE-2004-2191.md): Cross-site scripting (XSS) vulnerability in ttt-webmaster.php in Turbo Traffic Trader PHP 1.0 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2004-2192](https://cve.now/CVE-2004-2192.md): SQL injection vulnerability in tttadmin/settings.php in Turbo Traffic Trader PHP 1.0 allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2004-2193](https://cve.now/CVE-2004-2193.md): Cross-site scripting (XSS) vulnerability in trade.php for CJOverkill 4.0.3 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2004-2194](https://cve.now/CVE-2004-2194.md): MailEnable Professional Edition before 1.53 and Enterprise Edition before 1.02 allows remote attackers to cause a denial of service (crash) (no CVSS)
- [CVE-2004-2195](https://cve.now/CVE-2004-2195.md): PHP remote file inclusion vulnerability in index.php in Zanfi CMS lite 1.1 allows remote attackers to execute arbitrary PHP code via the inc (no CVSS)
- [CVE-2004-2196](https://cve.now/CVE-2004-2196.md): Zanfi CMS lite 1.1 allows remote attackers to obtain the full path of the web server via direct requests without required arguments to (1) a (no CVSS)
- [CVE-2004-2197](https://cve.now/CVE-2004-2197.md): kdocker.cpp in kdocker 0.1 through 0.8 does not properly check the ownership of files, which could allow local users to execute arbitrary pr (no CVSS)
- [CVE-2004-2198](https://cve.now/CVE-2004-2198.md): account.asp in DUware DUclassmate 1.0 through 1.1 allows remote attackers to change the passwords for arbitrary users by modifying the MM\_re (no CVSS)
- [CVE-2004-2199](https://cve.now/CVE-2004-2199.md): Cross-site scripting (XSS) vulnerability in DUware DUclassified 4.0 allows remote attackers to inject arbitrary web script or HTML via the m (no CVSS)
- [CVE-2004-2200](https://cve.now/CVE-2004-2200.md): Cross-site scripting (XSS) vulnerability in DUware DUforum 3.0 through 3.1 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2004-2201](https://cve.now/CVE-2004-2201.md): SQL injection vulnerability in DUware DUforum 3.0 through 3.1 allows remote attackers to execute arbitrary SQL commands via the FOR\_ID param (no CVSS)
- [CVE-2004-2202](https://cve.now/CVE-2004-2202.md): Multiple SQL injection vulnerabilities in DUware DUclassified 4.0 through 4.2 allows remote attackers to bypass authentication and execute o (no CVSS)
- [CVE-2004-2203](https://cve.now/CVE-2004-2203.md): Ansel 1.2 through 2.0 uses insecure default permissions, which allows remote attackers to gain access to web readable directories. (no CVSS)
- [CVE-2004-2204](https://cve.now/CVE-2004-2204.md): Macromedia ColdFusion MX 6.0 and 6.1 application server, when running with the CreateObject function or CFOBJECT tag enabled, allows local u (no CVSS)
- [CVE-2004-2205](https://cve.now/CVE-2004-2205.md): Unknown vulnerability in Veritas Cluster Server 1.0.1 through 4.0 allows local users to gain root access via unspecified vectors. (no CVSS)
- [CVE-2004-2206](https://cve.now/CVE-2004-2206.md): SQL injection vulnerability in NatterChat 1.12 allows remote attackers to execute arbitrary SQL commands via unknown vectors. (no CVSS)
- [CVE-2004-2207](https://cve.now/CVE-2004-2207.md): Cross-site scripting (XSS) vulnerability in Ideal Science IdealBB 1.4.9 through 1.5.3 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2004-2208](https://cve.now/CVE-2004-2208.md): CRLF injection vulnerability in Ideal Science IdealBB 1.4.9 through 1.5.3 allows remote attackers to conduct HTTP response splitting attacks (no CVSS)
- [CVE-2004-2209](https://cve.now/CVE-2004-2209.md): SQL injection vulnerability in Ideal Science IdealBB 1.4.9 through 1.5.3 allows remote attackers to execute arbitrary SQL commands via unkno (no CVSS)
- [CVE-2004-2210](https://cve.now/CVE-2004-2210.md): Multiple cross-site scripting (XSS) vulnerabilities in Express-Web Content Management System (CMS) allow remote attackers to steal cookie-ba (no CVSS)
- [CVE-2004-2211](https://cve.now/CVE-2004-2211.md): Cross-site scripting (XSS) vulnerability in AliveSites Forums 2.0 allows remote attackers to inject arbitrary web script or HTML via the (1) (no CVSS)
- [CVE-2004-2212](https://cve.now/CVE-2004-2212.md): SQL injection vulnerability in forum.asp in AliveSites Forums 2.0 allows remote attackers to execute arbitrary SQL commands via the forum\_id (no CVSS)
- [CVE-2005-2177](https://cve.now/CVE-2005-2177.md): Net-SNMP 5.0.x before 5.0.10.2, 5.2.x before 5.2.1.2, and 5.1.3, when net-snmp is using stream sockets such as TCP, allows remote attackers (no CVSS)
- [CVE-2005-2178](https://cve.now/CVE-2005-2178.md): probe.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the olddat parameter. (no CVSS)
- [CVE-2005-2179](https://cve.now/CVE-2005-2179.md): PHP remote file inclusion vulnerability in BlogModel.php in Jaws 0.5.2 and earlier allows remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2005-2180](https://cve.now/CVE-2005-2180.md): gen-index in GNATS 4.0, 4.1.0, and possibly earlier versions, when installed setuid, does not properly check files passed to the -o argument (no CVSS)
- [CVE-2005-2181](https://cve.now/CVE-2005-2181.md): Cisco 7940/7960 Voice over IP (VoIP) phones do not properly check the Call-ID, branch, and tag values in a NOTIFY message to verify a subscr (no CVSS)
- [CVE-2005-2182](https://cve.now/CVE-2005-2182.md): Grandstream BudgeTone (BT) 100 Voice over IP (VoIP) phones do not properly check the Call-ID, branch, and tag values in a NOTIFY message to (no CVSS)
- [CVE-2005-2183](https://cve.now/CVE-2005-2183.md): class.xmail.php in PhpXmail 0.7 through 1.1 does not properly handle large passwords, which prevents an error message from being returned an (no CVSS)
- [CVE-2005-2184](https://cve.now/CVE-2005-2184.md): eRoom 6.x does not properly restrict files that can be attached, which allows remote attackers to execute arbitrary commands via a .lnk file (no CVSS)
- [CVE-2005-2185](https://cve.now/CVE-2005-2185.md): eRoom does not set an expiration for Cookies, which allows remote attackers to capture cookies and conduct replay attacks. (no CVSS)
- [CVE-2005-2186](https://cve.now/CVE-2005-2186.md): Multiple cross-site scripting (XSS) vulnerabilities in McAfee IntruShield Security Management System allow remote authenticated users to inj (no CVSS)
- [CVE-2005-2187](https://cve.now/CVE-2005-2187.md): McAfee IntruShield Security Management System allows remote authenticated users to access the "Generate Reports" feature and modify alerts b (no CVSS)
- [CVE-2005-2188](https://cve.now/CVE-2005-2188.md): McAfee IntruShield Security Management System obtains the user ID from the URL, which allows remote attackers to guess the Manager account a (no CVSS)
- [CVE-2005-2189](https://cve.now/CVE-2005-2189.md): Lantronix SecureLinx console server running firmware 2.0 and 3.0 stores /etc/ssh under the web document root with insufficient access contro (no CVSS)
- [CVE-2005-2190](https://cve.now/CVE-2005-2190.md): Multiple SQL injection vulnerabilities in Comersus shopping cart allow remote attackers to execute arbitrary SQL commands via the (1) email (no CVSS)
- [CVE-2005-2191](https://cve.now/CVE-2005-2191.md): Multiple cross-site scripting (XSS) vulnerabilities in Comersus shopping cart allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2005-2192](https://cve.now/CVE-2005-2192.md): SimplePHPBlog 0.4.0 stores password hashes in config/password.txt with insufficient access control, which allows remote attackers to obtain (no CVSS)
- [CVE-2005-2193](https://cve.now/CVE-2005-2193.md): SQL injection vulnerability in the user profile edit module in profile.php for PunBB 1.2.5 and earlier allows remote attackers to execute ar (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-07-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.