# CVEs published 2005-07-17

68 CVEs were published on July 17, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2004-2213](https://cve.now/CVE-2004-2213.md): Mbedthis AppWeb HTTP server before 1.1.3 allows remote attackers to obtain the source code for scripts via a (1) trailing dot (".") or (2) t (no CVSS)
- [CVE-2004-2214](https://cve.now/CVE-2004-2214.md): Mbedthis AppWeb HTTP server before 1.1.3 allows remote attackers to bypass access restrictions via a URI with mixed case characters. (no CVSS)
- [CVE-2004-2215](https://cve.now/CVE-2004-2215.md): RXVT-Unicode 3.4 and 3.5 does not properly close file descriptors, which allows local users to access the terminals of other users and possi (no CVSS)
- [CVE-2004-2216](https://cve.now/CVE-2004-2216.md): Unknown vulnerability in Sun Java System Web Server 6.0 SP7 and earlier and 6.1 SP1 and earlier, and Application Server 7 Update 4 and earli (no CVSS)
- [CVE-2004-2217](https://cve.now/CVE-2004-2217.md): Multiple unknown vulnerabilities in yhttpd in yChat before 0.7 allow remote attackers to cause a denial of service (segmentation fault) via (no CVSS)
- [CVE-2004-2218](https://cve.now/CVE-2004-2218.md): SQL injection vulnerability in pmwh.php in PHPMyWebHosting 0.3.4 and earlier allows remote attackers to modify SQL statements via the passwo (no CVSS)
- [CVE-2004-2219](https://cve.now/CVE-2004-2219.md): Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar to facilitate phishing attacks via Javascript that uses an in (no CVSS)
- [CVE-2004-2220](https://cve.now/CVE-2004-2220.md): F-Secure Anti-Virus for Microsoft Exchange 6.30 and 6.31 does not properly detect certain password-protected files in a ZIP file, which allo (no CVSS)
- [CVE-2004-2221](https://cve.now/CVE-2004-2221.md): Buffer overflow in SoftCart.exe in Mercantec SoftCart 4.00b allows remote attackers to execute arbitrary code via a long parameter in an HTT (no CVSS)
- [CVE-2004-2222](https://cve.now/CVE-2004-2222.md): Directory traversal vulnerability in index.php in FsPHPGallery before 1.2 allows remote attackers to list arbitrary directories via the dir (no CVSS)
- [CVE-2004-2223](https://cve.now/CVE-2004-2223.md): FsPHPGallery before 1.2 allows remote attackers to cause a denial of service via an image with a large size attribute, which causes a crash (no CVSS)
- [CVE-2004-2224](https://cve.now/CVE-2004-2224.md): Appfoundry Message Foundry 2.75 .0003 allows remote attackers to cause a denial of service (crash) via an HTTP GET request that contains MS- (no CVSS)
- [CVE-2004-2225](https://cve.now/CVE-2004-2225.md): Mozilla Firefox before 0.10.1 allows remote attackers to delete arbitrary files in the download directory via a crafted data: URI that is no (no CVSS)
- [CVE-2004-2226](https://cve.now/CVE-2004-2226.md): Mozilla Mail 1.7.1 and 1.7.3, and Thunderbird before 0.9, when HTML-Mails is enabled, allows remote attackers to determine valid e-mail addr (no CVSS)
- [CVE-2004-2227](https://cve.now/CVE-2004-2227.md): Mozilla Firefox before 1.0 truncates long filenames in the file download dialog box, which makes it easier for remote attackers to trick use (no CVSS)
- [CVE-2004-2228](https://cve.now/CVE-2004-2228.md): Mozilla Firefox before 1.0 is installed with world-writable permissions on Mac OS X, which allows local users to gain privileges. (no CVSS)
- [CVE-2004-2229](https://cve.now/CVE-2004-2229.md): Multiple unknown vulnerabilities in Oracle 9i Lite Mobile Server 5.0.0.0.0 through 5.0.2.9.0 allow remote authenticated users to gain privil (no CVSS)
- [CVE-2004-2230](https://cve.now/CVE-2004-2230.md): Heap-based buffer overflow in isakmpd on OpenBSD 3.4 through 3.6 allows local users to cause a denial of service (panic) and corrupt memory (no CVSS)
- [CVE-2004-2231](https://cve.now/CVE-2004-2231.md): Zero G Software InstallAnywhere 5.0.6, 5.0.7, and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) pe (no CVSS)
- [CVE-2004-2232](https://cve.now/CVE-2004-2232.md): SQL injection vulnerability in sql.php in the Glossary module in Moodle 1.4.1 and earlier allows remote attackers to modify SQL statements. (no CVSS)
- [CVE-2004-2233](https://cve.now/CVE-2004-2233.md): Unknown "front page vulnerability with Moodle servers" for Moodle before 1.3.2 has unknown impact and attack vectors. (no CVSS)
- [CVE-2004-2234](https://cve.now/CVE-2004-2234.md): Unknown vulnerability in Moodle before 1.2 allows teachers to log in as administrators. (no CVSS)
- [CVE-2004-2235](https://cve.now/CVE-2004-2235.md): Unknown vulnerability in Moodle before 1.2 has unknown impact and attack vectors, related to improper filtering of text. (no CVSS)
- [CVE-2004-2236](https://cve.now/CVE-2004-2236.md): Unknown vulnerability in Moodle before 1.3.3 has unknown impact and attack vectors, related to language setting. (no CVSS)
- [CVE-2004-2237](https://cve.now/CVE-2004-2237.md): Unknown vulnerability in Moodle before 1.3.4 has unknown impact and attack vectors, related to "strings in Moodle texts." (no CVSS)
- [CVE-2004-2238](https://cve.now/CVE-2004-2238.md): Format string vulnerability in vsybase.c in vpopmail 5.4.2 and earlier has unknown impact and attack vectors. (no CVSS)
- [CVE-2004-2239](https://cve.now/CVE-2004-2239.md): Buffer overflow in vsybase.c in vpopmail 5.4.2 and earlier might allow attackers to cause a denial of service or execute arbitrary code. (no CVSS)
- [CVE-2004-2240](https://cve.now/CVE-2004-2240.md): Multiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via (1) the query string (no CVSS)
- [CVE-2004-2241](https://cve.now/CVE-2004-2241.md): Cross-site scripting (XSS) vulnerability in Phorum 5.0.11 and earlier allows remote attackers to inject arbitrary HTML or web script via sea (no CVSS)
- [CVE-2004-2242](https://cve.now/CVE-2004-2242.md): Cross-site scripting (XSS) vulnerability in search.php in Phorum, possibly 5.0.7 beta and earlier, allows remote attackers to inject arbitra (no CVSS)
- [CVE-2004-2243](https://cve.now/CVE-2004-2243.md): Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorum\_uriauth parameter, (no CVSS)
- [CVE-2004-2244](https://cve.now/CVE-2004-2244.md): The XML parser in Oracle 9i Application Server Release 2 9.0.3.0 and 9.0.3.1, 9.0.2.3 and earlier, and Release 1 1.0.2.2 and 1.0.2.2.2, and (no CVSS)
- [CVE-2004-2245](https://cve.now/CVE-2004-2245.md): Cross-site scripting (XSS) vulnerability in Goollery 0.03 allows remote attackers to inject arbitrary HTML or web script via the (1) page pa (no CVSS)
- [CVE-2004-2246](https://cve.now/CVE-2004-2246.md): Cross-site scripting (XSS) vulnerability in Goollery before 0.04b allows remote attackers to inject arbitrary HTML or web script via the con (no CVSS)
- [CVE-2004-2247](https://cve.now/CVE-2004-2247.md): Unknown vulnerability in the "admin of paypal email addresses" in AudienceConnect before 1.0.beta.21 has unknown impact and attack vectors. (no CVSS)
- [CVE-2004-2248](https://cve.now/CVE-2004-2248.md): Unknown vulnerability in RemoteEditor before 0.1.1 has unknown impact and attack vectors, related to "oversize submissions." (no CVSS)
- [CVE-2004-2249](https://cve.now/CVE-2004-2249.md): Unknown vulnerability in the "access code" in SecureEditor before 0.1.2 has unknown impact and attack vectors, possibly involving a bypass o (no CVSS)
- [CVE-2004-2250](https://cve.now/CVE-2004-2250.md): Unknown vulnerability in the "access code" in RemoteEditor before 0.1.6 has unknown impact and attack vectors, possibly involving a bypass o (no CVSS)
- [CVE-2004-2251](https://cve.now/CVE-2004-2251.md): The PPTP server in Astaro Security Linux before 4.024 provides information about its version, which makes it easier for remote attackers to (no CVSS)
- [CVE-2004-2252](https://cve.now/CVE-2004-2252.md): The firewall in Astaro Security Linux before 4.024 sends responses to SYN-FIN packets, which makes it easier for remote attackers to obtain (no CVSS)
- [CVE-2004-2253](https://cve.now/CVE-2004-2253.md): Directory traversal vulnerability in user.cgi in SurgeLDAP 1.0g and earlier allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2004-2254](https://cve.now/CVE-2004-2254.md): SurgeLDAP 1.0g (Build 12), and possibly other versions before 1.0h, allows remote attackers to bypass authentication for the administration (no CVSS)
- [CVE-2004-2255](https://cve.now/CVE-2004-2255.md): Directory traversal vulnerability in phpMyFAQ 1.3.12 allows remote attackers to read arbitrary files, and possibly execute local PHP files, (no CVSS)
- [CVE-2004-2256](https://cve.now/CVE-2004-2256.md): Directory traversal vulnerability in phpMyFAQ 1.4.0 alpha allows remote attackers to read arbitrary files, and possibly execute local PHP fi (no CVSS)
- [CVE-2004-2257](https://cve.now/CVE-2004-2257.md): phpMyFAQ 1.4.0 allows remote attackers to access the Image Manager to upload or delete images without authorization via a direct request. (CVSS 5.3)
- [CVE-2005-1175](https://cve.now/CVE-2005-1175.md): Heap-based buffer overflow in the Key Distribution Center (KDC) in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to cause (no CVSS)
- [CVE-2005-1689](https://cve.now/CVE-2005-1689.md): Double free vulnerability in the krb5\_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitr (no CVSS)
- [CVE-2005-1914](https://cve.now/CVE-2005-1914.md): CenterICQ 4.20.0 and earlier creates temporary files with predictable file names, which allows local users to overwrite arbitrary files via (no CVSS)
- [CVE-2005-2195](https://cve.now/CVE-2005-2195.md): Apple Darwin Streaming Server 5.5 and earlier allows remote attackers to cause a denial of service (application crash) via a URL with a file (no CVSS)
- [CVE-2005-2278](https://cve.now/CVE-2005-2278.md): Stack-based buffer overflow in the IMAP daemon (imapd) in MailEnable Professional 1.54 allows remote authenticated users to execute arbitrar (no CVSS)
- [CVE-2005-2279](https://cve.now/CVE-2005-2279.md): Cisco ONS 15216 Optical Add/Drop Multiplexer (OADM) running firmware 2.2.2 and earlier allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2005-2280](https://cve.now/CVE-2005-2280.md): Cisco Security Agent (CSA) 4.5 allows remote attackers to cause a denial of service (system crash) via a crafted IP packet. (no CVSS)
- [CVE-2005-2281](https://cve.now/CVE-2005-2281.md): WebEOC before 6.0.2 uses a weak encryption scheme for passwords, which makes it easier for attackers to crack passwords. (no CVSS)
- [CVE-2005-2282](https://cve.now/CVE-2005-2282.md): Multiple cross-site scripting (XSS) vulnerabilities in WebEOC before 6.0.2 allow remote attackers to inject arbitrary web script and HTML vi (no CVSS)
- [CVE-2005-2283](https://cve.now/CVE-2005-2283.md): WebEOC before 6.0.2 does not properly restrict the size of an uploaded file, which allows remote authenticated users to cause a denial of se (no CVSS)
- [CVE-2005-2284](https://cve.now/CVE-2005-2284.md): Multiple SQL injection vulnerabilities in WebEOC before 6.0.2 allow remote attackers to modify SQL statements via unknown attack vectors. (no CVSS)
- [CVE-2005-2285](https://cve.now/CVE-2005-2285.md): WebEOC before 6.0.2 stores sensitive information in locations such as URIs, web pages, and configuration files, which allows remote attacker (no CVSS)
- [CVE-2005-2286](https://cve.now/CVE-2005-2286.md): WebEOC before 6.0.2 does not properly check user authorization, which allows remote attackers to gain privileges via a direct request to a r (no CVSS)
- [CVE-2005-2287](https://cve.now/CVE-2005-2287.md): SoftiaCom wMailServer 1.0 and 2.0 allows remote attackers to cause a denial of service (application crash) via a large TCP packet with a lea (no CVSS)
- [CVE-2005-2288](https://cve.now/CVE-2005-2288.md): Cross-site scripting (XSS) vulnerability in PHPCounter 7.2 allows remote attackers to inject arbitrary web script or HTML via the EpochPrefi (no CVSS)
- [CVE-2005-2289](https://cve.now/CVE-2005-2289.md): PHPCounter 7.2 allows remote attackers to obtain sensitive information via a direct request to prelims.php, which reveals the path in an err (no CVSS)
- [CVE-2005-2290](https://cve.now/CVE-2005-2290.md): wps\_shop.cgi in WPS Web Portal System 0.7.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) art an (no CVSS)
- [CVE-2005-2291](https://cve.now/CVE-2005-2291.md): Oracle JDeveloper 9.0.4, 9.0.5, and 10.1.2 passes the cleartext password as a parameter when starting sqlplus, which allows local users to g (no CVSS)
- [CVE-2005-2292](https://cve.now/CVE-2005-2292.md): Oracle JDeveloper 9.0.4, 9.0.5, and 10.1.2 stores cleartext passwords in (1) IDEConnections.xml, (2) XSQLConfig.xml and (3) settings.xml, wh (no CVSS)
- [CVE-2005-2293](https://cve.now/CVE-2005-2293.md): Oracle Formsbuilder 9.0.4 stores database usernames and passwords in a temporary file, which is not deleted after it is used, which allows l (no CVSS)
- [CVE-2005-2294](https://cve.now/CVE-2005-2294.md): Oracle Forms 4.5, 6.0, 6i, and 9i on Unix, when a large number of records are retrieved by an Oracle form, stores a copy of the database tab (no CVSS)
- [CVE-2005-2295](https://cve.now/CVE-2005-2295.md): NetPanzer 0.8 and earlier allows remote attackers to cause a denial of service (infinite loop) via a packet with a zero datablock size. (no CVSS)
- [CVE-2005-2296](https://cve.now/CVE-2005-2296.md): YabbSE 1.5.5c allows remote attackers to obtain sensitive information via a direct request to ssi\_examples.php, which reveals the path. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-07-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.