# CVEs published 2005-08-03

41 CVEs were published on August 3, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2005-1853](https://cve.now/CVE-2005-1853.md): gopher.c in the Gopher client 3.0.5 does not properly create temporary files, which allows local users to gain privileges. (no CVSS)
- [CVE-2005-2132](https://cve.now/CVE-2005-2132.md): RPC portmapper (rpcbind) in SCO UnixWare 7.1.1 m5, 7.1.3 mp5, and 7.1.4 mp2 allows remote attackers or local users to cause a denial of serv (no CVSS)
- [CVE-2005-2346](https://cve.now/CVE-2005-2346.md): Buffer overflow in Novell GroupWise 6.5 Client allows remote attackers to execute arbitrary code via a GWVW02xx.INI language file with a lon (no CVSS)
- [CVE-2005-2412](https://cve.now/CVE-2005-2412.md): PHP remote file inclusion vulnerability in block.php in PHP FirstPost allows remote attackers to execute arbitrary PHP code via the Include (no CVSS)
- [CVE-2005-2413](https://cve.now/CVE-2005-2413.md): PHP remote file inclusion vulnerability in apa\_phpinclude.inc.php in Atomic Photo Album (APA) allows remote attackers to execute arbitrary P (no CVSS)
- [CVE-2005-2414](https://cve.now/CVE-2005-2414.md): Race condition in the xpcom library, as used by web browsers such as Firefox, Mozilla, Netscape, and Galeon, allows remote attackers to caus (no CVSS)
- [CVE-2005-2415](https://cve.now/CVE-2005-2415.md): Multiple SQL injection vulnerabilities in Contrexx before 1.0.5 allow remote attackers to execute arbitrary SQL commands via the (1) value p (no CVSS)
- [CVE-2005-2416](https://cve.now/CVE-2005-2416.md): Multiple cross-site scripting (XSS) vulnerabilities in Contrexx before 1.0.5 allow remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2005-2417](https://cve.now/CVE-2005-2417.md): Contrexx before 1.0.5 allows remote attackers to obtain sensitive information via a direct request to /config/version.xml. (no CVSS)
- [CVE-2005-2419](https://cve.now/CVE-2005-2419.md): B-FOCuS Router 312+ allows remote attackers to bypass authentication and gain unauthorized access via a direct request to firmwarecfg. (no CVSS)
- [CVE-2005-2420](https://cve.now/CVE-2005-2420.md): flsearch.pl in FtpLocate 2.02 allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP GET request. (no CVSS)
- [CVE-2005-2421](https://cve.now/CVE-2005-2421.md): Multiple SQL injection vulnerabilities in index.php and other pages in Beehive Forum allow remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2005-2422](https://cve.now/CVE-2005-2422.md): Cross-site scripting (XSS) vulnerability in index.php in Beehive Forum allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2005-2423](https://cve.now/CVE-2005-2423.md): Beehive Forum allows remote attackers to obtain sensitive information via (1) an invalid final\_uri or sort\_by parameter to index.php or a di (no CVSS)
- [CVE-2005-2424](https://cve.now/CVE-2005-2424.md): The management interface for Siemens SANTIS 50 running firmware 4.2.8.0, and possibly other products including Ericsson HN294dp and Dynalink (no CVSS)
- [CVE-2005-2425](https://cve.now/CVE-2005-2425.md): Stack-based buffer overflow in Ares FileShare 1.1 allows remote attackers or local users to execute arbitrary code via a (1) long history pa (no CVSS)
- [CVE-2005-2426](https://cve.now/CVE-2005-2426.md): FTPshell Server 3.38 allows remote authenticated users to cause a denial of service (application crash) by multiple connections and disconne (no CVSS)
- [CVE-2005-2427](https://cve.now/CVE-2005-2427.md): Cross-site scripting (XSS) vulnerability in viewCart.asp in CartWIZ allows remote attackers to inject arbitrary web script or HTML via the m (no CVSS)
- [CVE-2005-2428](https://cve.now/CVE-2005-2428.md): Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, whi (no CVSS)
- [CVE-2005-2429](https://cve.now/CVE-2005-2429.md): Firefox, when opening Microsoft Word documents, does not properly set the permissions on shared sections, which allows remote attackers to w (no CVSS)
- [CVE-2005-2430](https://cve.now/CVE-2005-2430.md): Multiple cross-site scripting (XSS) vulnerabilities in GForge 4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) (no CVSS)
- [CVE-2005-2431](https://cve.now/CVE-2005-2431.md): The (1) lost password and (2) account pending features in GForge 4.5 do not properly set a limit on the number of e-mails sent to an e-mail (no CVSS)
- [CVE-2005-2432](https://cve.now/CVE-2005-2432.md): SQL injection vulnerability in PhpList allows remote attackers to modify SQL statements via the id argument to admin pages such as (1) membe (no CVSS)
- [CVE-2005-2433](https://cve.now/CVE-2005-2433.md): PhpList allows remote attackers to obtain sensitive information via a direct request to (1) about.php, (2) connect.php, (3) domainstats.php (no CVSS)
- [CVE-2005-2434](https://cve.now/CVE-2005-2434.md): Linksys WRT54G router uses the same private key and certificate for every router, which allows remote attackers to sniff the SSL connection (no CVSS)
- [CVE-2005-2435](https://cve.now/CVE-2005-2435.md): Cross-site scripting (XSS) vulnerability in browse.php in Website Baker Project allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2005-2436](https://cve.now/CVE-2005-2436.md): browse.php in Website Baker Project allows remote attackers to obtain sensitive data via (1) a directory that does not exist in the dir para (no CVSS)
- [CVE-2005-2437](https://cve.now/CVE-2005-2437.md): Website Baker Project does not properly verify the file extensions of uploaded files, which allows remote attackers to upload and execute ar (no CVSS)
- [CVE-2005-2438](https://cve.now/CVE-2005-2438.md): Cross-site scripting (XSS) vulnerability in UseBB 0.5.1 and earlier allows remote attackers to inject arbitrary Javascript via the BBCode co (no CVSS)
- [CVE-2005-2439](https://cve.now/CVE-2005-2439.md): SQL injection vulnerability in UseBB 0.5.1 and earlier, when magic\_quotes\_gpc is disabled, allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2005-2440](https://cve.now/CVE-2005-2440.md): SQL injection vulnerability in login.asp in Thomson Web Skill Vantage Manager allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2005-2441](https://cve.now/CVE-2005-2441.md): Multiple cross-site scripting (XSS) vulnerabilities in VBzoom allow remote attackers to inject arbitrary web script and HTML via the (1) Use (no CVSS)
- [CVE-2005-2442](https://cve.now/CVE-2005-2442.md): Cross-Application Scripting (XAS) vulnerability in SPI Dynamics WebInspect 5.0.196 allows remote attackers to inject Javascript from one app (no CVSS)
- [CVE-2005-2443](https://cve.now/CVE-2005-2443.md): Kshout 2.x and 3.x stores settings.dat under the web document root with insufficient access control, which allows remote attackers to obtain (no CVSS)
- [CVE-2005-2444](https://cve.now/CVE-2005-2444.md): Trillian Pro 3.1 build 121, when checking Yahoo e-mail, stores the password in plaintext in a world readable file and does not delete the fi (no CVSS)
- [CVE-2005-2445](https://cve.now/CVE-2005-2445.md): SQL injection vulnerability in viewPrd.asp in Product Cart 2.6 allows remote attackers to execute arbitrary SQL commands via the idcategory (no CVSS)
- [CVE-2005-2448](https://cve.now/CVE-2005-2448.md): Multiple "endianness errors" in libgadu in ekg before 1.6rc2 allow remote attackers to cause a denial of service (invalid behavior in applic (no CVSS)
- [CVE-2005-2449](https://cve.now/CVE-2005-2449.md): Race condition in sandbox before 1.2.11 allows local users to create or overwrite arbitrary files via symlink attack on sandboxpids.tmp. (no CVSS)
- [CVE-2005-2450](https://cve.now/CVE-2005-2450.md): Multiple integer overflows in the (1) TNEF, (2) CHM, or (3) FSG file format processors in libclamav for Clam AntiVirus (ClamAV) 0.86.1 and e (no CVSS)
- [CVE-2005-2451](https://cve.now/CVE-2005-2451.md): Cisco IOS 12.0 through 12.4 and IOS XR before 3.2, with IPv6 enabled, allows remote attackers on a local network segment to cause a denial o (no CVSS)
- [CVE-2005-2452](https://cve.now/CVE-2005-2452.md): libtiff up to 3.7.0 allows remote attackers to cause a denial of service (application crash) via a TIFF image header with a zero "YCbCr subs (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-08-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.