# CVEs published 2005-08-16

132 CVEs were published on August 16, 2005: 1 critical, 1 high. Days are UTC.

- [CVE-2002-2123](https://cve.now/CVE-2002-2123.md): PHP remote file inclusion vulnerability in publish\_xp\_docs.php for Gallery 1.3.2 allows remote attackers to inject arbitrary PHP code by spe (no CVSS)
- [CVE-2003-1220](https://cve.now/CVE-2003-1220.md): BEA WebLogic Server proxy plugin for BEA Weblogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of servi (no CVSS)
- [CVE-2003-1221](https://cve.now/CVE-2003-1221.md): BEA WebLogic Express and Server 7.0 through 8.1 SP 1, under certain circumstances when a request to use T3 over SSL (t3s) is made to the ins (no CVSS)
- [CVE-2003-1222](https://cve.now/CVE-2003-1222.md): BEA Weblogic Express and Server 8.0 through 8.1 SP 1, when using a foreign Java Message Service (JMS) provider, echoes the password for the (no CVSS)
- [CVE-2003-1223](https://cve.now/CVE-2003-1223.md): The Node Manager for BEA WebLogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (Node Manager (no CVSS)
- [CVE-2003-1224](https://cve.now/CVE-2003-1224.md): Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cle (no CVSS)
- [CVE-2003-1225](https://cve.now/CVE-2003-1225.md): The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local u (no CVSS)
- [CVE-2003-1226](https://cve.now/CVE-2003-1226.md): BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.pr (no CVSS)
- [CVE-2003-1227](https://cve.now/CVE-2003-1227.md): PHP remote file include vulnerability in index.php for Gallery 1.4 and 1.4-pl1, when running on Windows or in Configuration mode on Unix, al (no CVSS)
- [CVE-2003-1228](https://cve.now/CVE-2003-1228.md): Buffer overflow in the prepare\_reply function in request.c for Mathopd 1.2 through 1.5b13, and possibly earlier versions, allows remote atta (no CVSS)
- [CVE-2004-2303](https://cve.now/CVE-2004-2303.md): MTools Mformat before 3.9.9, when installed setuid root, creates files with world-readable and world-writable permissions, which allows loca (no CVSS)
- [CVE-2004-2304](https://cve.now/CVE-2004-2304.md): Integer overflow in Trillian 0.74 and earlier, and Trillian Pro 2.01 and earlier, allows remote attackers to cause a denial of service and p (no CVSS)
- [CVE-2004-2305](https://cve.now/CVE-2004-2305.md): Computer Associates eTrust Antivirus EE 6.0 through 7.0 allows remote attackers to bypass virus scanning by including a password-protected f (no CVSS)
- [CVE-2004-2306](https://cve.now/CVE-2004-2306.md): Sun Solaris 7 through 9, when Basic Security Module (BSM) is enabled and the SUNWscpu package has been removed as a result of security harde (no CVSS)
- [CVE-2004-2307](https://cve.now/CVE-2004-2307.md): Microsoft Internet Explorer 6.0.2600 on Windows XP allows remote attackers to cause a denial of service (browser crash) via a shell: URI wit (no CVSS)
- [CVE-2004-2308](https://cve.now/CVE-2004-2308.md): Cross-site scripting (XSS) vulnerability in cPanel 9.1.0 and possibly earlier allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2004-2309](https://cve.now/CVE-2004-2309.md): Directory traversal vulnerability in Crob FTP Server 3.5.1 allows local users to browse outside the FTP root via multiple ../ (dot dot slash (no CVSS)
- [CVE-2004-2310](https://cve.now/CVE-2004-2310.md): Cross-site scripting (XSS) vulnerability in webadmin.nsf in Lotus Domino R6 6.5.1 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2004-2311](https://cve.now/CVE-2004-2311.md): Directory traversal vulnerability in webadmin.nsf in Lotus Domino R6 6.5.1 allows local users to create folders or determine the existence o (no CVSS)
- [CVE-2004-2312](https://cve.now/CVE-2004-2312.md): Buffer overflow in GNU make for IBM AIX 4.3.3, when installed setgid, allows local users to gain privileges via a long CC argument. (no CVSS)
- [CVE-2004-2313](https://cve.now/CVE-2004-2313.md): Inter7 SqWebMail 3.4.1 through 3.6.1 generates different error messages for incorrect passwords versus correct passwords on non-mail-enabled (no CVSS)
- [CVE-2004-2314](https://cve.now/CVE-2004-2314.md): The Telnet listener for Novell iChain Server before 2.2 Field Patch 3b 2.2.116 does not have a password by default, which allows remote atta (no CVSS)
- [CVE-2004-2315](https://cve.now/CVE-2004-2315.md): Mbedthis AppWeb HTTP server before 1.0.2 allows remote attackers to cause a denial of service (crash) via an empty OPTIONS request. (no CVSS)
- [CVE-2004-2316](https://cve.now/CVE-2004-2316.md): Mbedthis AppWeb HTTP server before 1.0.2 allows remote attackers to cause a denial of service (crash) via a GET request containing an MS-DOS (no CVSS)
- [CVE-2004-2317](https://cve.now/CVE-2004-2317.md): Information leak in Mbedthis AppWeb HTTP server 1.0 through 1.1.2 allows remote attackers to obtain sensitive information via a user message (no CVSS)
- [CVE-2004-2318](https://cve.now/CVE-2004-2318.md): The administrative interface (surgeftpmgr.cgi) for SurgeFTP Server 1.0b through 2.2k1 allows remote attackers to cause a temporary denial of (no CVSS)
- [CVE-2004-2319](https://cve.now/CVE-2004-2319.md): IBM Informix Dynamic Server (IDS) before 9.40.xC3 allows local users to (1) create or overwrite files via the /001 log file to onedcu or (2) (no CVSS)
- [CVE-2004-2320](https://cve.now/CVE-2004-2320.md): The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 (CVSS 5.3)
- [CVE-2004-2321](https://cve.now/CVE-2004-2321.md): BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attr (no CVSS)
- [CVE-2004-2322](https://cve.now/CVE-2004-2322.md): SQL injection vulnerability in the (1) announce and (2) notes modules of phpWebSite before 0.9.3-2 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2004-2323](https://cve.now/CVE-2004-2323.md): DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to obtain sensitive information, including the SQL serv (no CVSS)
- [CVE-2004-2324](https://cve.now/CVE-2004-2324.md): SQL injection vulnerability in DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to modify the backend da (no CVSS)
- [CVE-2004-2325](https://cve.now/CVE-2004-2325.md): Cross-site scripting (XSS) vulnerability in EditModule.aspx for DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote a (no CVSS)
- [CVE-2004-2326](https://cve.now/CVE-2004-2326.md): SQL injection vulnerability in IP3 Networks NetAccess Appliance before firmware 3.1.18b13 allows remote attackers to bypass authentication v (no CVSS)
- [CVE-2004-2327](https://cve.now/CVE-2004-2327.md): Vizer Web Server 1.9.1 allows remote attackers to cause a denial of service (crash) via multiple malformed requests including (1) requests w (no CVSS)
- [CVE-2004-2328](https://cve.now/CVE-2004-2328.md): Clearswift MAILsweeper for SMTP before 4.3\_13 allows remote attackers to cause a denial of service (infinite loop) via an e-mail with a craf (no CVSS)
- [CVE-2004-2329](https://cve.now/CVE-2004-2329.md): Kerio Personal Firewall (KPF) 2.1.5 allows local users to execute arbitrary code with SYSTEM privileges via the Load button in the Firewall (no CVSS)
- [CVE-2004-2330](https://cve.now/CVE-2004-2330.md): ColdFusion MX 6.1 and 6.1 J2EE allows remote attackers to cause a denial of service via an HTTP request containing a large number of form fi (no CVSS)
- [CVE-2004-2331](https://cve.now/CVE-2004-2331.md): ColdFusion MX 6.1 and 6.1 J2EE allows local users to bypass sandbox security restrictions and obtain sensitive information by using Java ref (no CVSS)
- [CVE-2004-2332](https://cve.now/CVE-2004-2332.md): Multiple cross-site scripting (XSS) vulnerabilities in CPAN WWW::Form before 1.13 allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2004-2333](https://cve.now/CVE-2004-2333.md): Bodington 2.1.0 RC1 and earlier does not secure the file upload area, which allows remote attackers to read uploaded files. (no CVSS)
- [CVE-2004-2334](https://cve.now/CVE-2004-2334.md): Multiple cross-site scripting (XSS) vulnerabilities in EMU Webmail 5.2.7 allow remote attackers to inject arbitrary web script or HTML via ( (no CVSS)
- [CVE-2004-2335](https://cve.now/CVE-2004-2335.md): The Macromedia installers and e-licensing client on Mac OS X, as used for Macromedia Contribute 2, Director, Dreamweaver, Fireworks, Flash, (no CVSS)
- [CVE-2004-2336](https://cve.now/CVE-2004-2336.md): Unknown vulnerability in Novell GroupWise and GroupWise WebAccess 6.0 through 6.5, when running with Apache Web Server 1.3 for NetWare where (no CVSS)
- [CVE-2004-2337](https://cve.now/CVE-2004-2337.md): The /.inlook/.crypt file for inlook 0.7.3 and earlier is installed with world readable permissions, which allows local users to obtain user (no CVSS)
- [CVE-2004-2338](https://cve.now/CVE-2004-2338.md): OpenBSD 3.3 and 3.4 does not properly parse Accept and Deny rules without netmasks on big-endian 64-bit platforms such as SPARC64, which may (no CVSS)
- [CVE-2004-2339](https://cve.now/CVE-2004-2339.md): Microsoft Windows 2000, XP, and possibly 2003 allows local users with the SeDebugPrivilege privilege to execute arbitrary code as kernel and (CVSS 8.4)
- [CVE-2004-2340](https://cve.now/CVE-2004-2340.md): \*\* UNVERIFIABLE \*\* SQL injection vulnerability in PunkBuster Screenshot Database (PB-DB) Alpha 6 allows remote attackers to execute arbitra (no CVSS)
- [CVE-2004-2341](https://cve.now/CVE-2004-2341.md): PHP file include injection vulnerability in isearch.inc.php for iSearch allows remote attackers to execute arbitrary code via the isearch\_pa (no CVSS)
- [CVE-2004-2342](https://cve.now/CVE-2004-2342.md): ChatterBox 2.0 allows remote attackers to cause a denial of service (server crash) via a malformed request to the server, as demonstrated us (no CVSS)
- [CVE-2004-2343](https://cve.now/CVE-2004-2343.md): Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives s (no CVSS)
- [CVE-2004-2344](https://cve.now/CVE-2004-2344.md): Unknown vulnerability in the ASN.1/H.323/H.225 stack of VocalTec VGW120 and VGW480 allows remote attackers to cause a denial of service. (no CVSS)
- [CVE-2004-2345](https://cve.now/CVE-2004-2345.md): Unknown multiple vulnerabilities in Oracle9i Database Server 9.0.1.4, 9.0.1.5, 9.2.0.3, and 9.2.0.4 allow local users with the ability to in (no CVSS)
- [CVE-2004-2346](https://cve.now/CVE-2004-2346.md): Multiple cross-site scripting (XSS) vulnerabilities in Forum Web Server 1.6 and earlier allow remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2004-2347](https://cve.now/CVE-2004-2347.md): blog.cgi in Leif M. (no CVSS)
- [CVE-2004-2348](https://cve.now/CVE-2004-2348.md): Sybari AntiGen for Domino 7.0 Build 722 SR2 allows remote attackers to cause a denial of service (hang) via an encrypted ZIP file with the " (no CVSS)
- [CVE-2004-2349](https://cve.now/CVE-2004-2349.md): Multiple SQL injection vulnerabilities in Tunez before 1.20-pre2 allow remote attackers to execute arbitrary SQL queries. (no CVSS)
- [CVE-2004-2350](https://cve.now/CVE-2004-2350.md): SQL injection vulnerability in search.php for phpBB 1.0 through 2.0.6 allows remote attackers to execute arbitrary SQL and gain privileges v (no CVSS)
- [CVE-2004-2351](https://cve.now/CVE-2004-2351.md): Cross-site scripting (XSS) vulnerability in GBook for Php-Nuke 1.0 allows remote attackers to inject arbitrary web script or HTML via multip (no CVSS)
- [CVE-2004-2352](https://cve.now/CVE-2004-2352.md): Cross-site scripting (XSS) vulnerability in GBook for PHP-Nuke 1.0 allows remote attackers to inject arbitrary web script or HTML via cookie (no CVSS)
- [CVE-2004-2353](https://cve.now/CVE-2004-2353.md): BugPort before 1.099 stores its configuration file (conf/config.conf) under the web document root with a file extension that is not normally (no CVSS)
- [CVE-2004-2354](https://cve.now/CVE-2004-2354.md): SQL injection vulnerability in 4nGuestbook 0.92 for PHP-Nuke 6.5 through 6.9 allows remote attackers to modify SQL statements via the entry (no CVSS)
- [CVE-2004-2355](https://cve.now/CVE-2004-2355.md): Cross-site scripting (XSS) vulnerability in Crafty Syntax Live Help (CSLH) before 2.7.4 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2004-2356](https://cve.now/CVE-2004-2356.md): Early termination vulnerability in Fizmez Web Server 1.0 allows remote attackers to cause a denial of service (crash) by connecting to the s (no CVSS)
- [CVE-2004-2357](https://cve.now/CVE-2004-2357.md): The embedded MySQL 4.0 server for Proofpoint Protection Server does not require a password for the root user of MySQL, which allows remote a (no CVSS)
- [CVE-2004-2358](https://cve.now/CVE-2004-2358.md): Cross-site scripting (XSS) vulnerability in admin\_words.php for phpBB 2.0.6c allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2004-2359](https://cve.now/CVE-2004-2359.md): Dell TrueMobile 1300 WLAN Mini-PCI Card Util TrayApplet 3.10.39.0 does not properly drop SYSTEM privileges when started from the systray app (no CVSS)
- [CVE-2004-2360](https://cve.now/CVE-2004-2360.md): Targem Battle Mages 1.0 allows remote attackers to cause a denial of service (infinite loop) via a UDP packet with incomplete data, which ca (no CVSS)
- [CVE-2004-2361](https://cve.now/CVE-2004-2361.md): Digital Reality game engine, as used in Haegemonia 1.0 through 1.0.7 and Desert Rats vs. (no CVSS)
- [CVE-2004-2362](https://cve.now/CVE-2004-2362.md): PHPX 3.2.6 and earlier allows remote attackers to obtain the physical path of PHPX via a null or invalid value in the limit parameter, which (no CVSS)
- [CVE-2004-2363](https://cve.now/CVE-2004-2363.md): Validate-Before-Canonicalize vulnerability in the checkURI function in functions.inc.php in PHPX 3.0 through 3.2.6 allows remote attackers t (no CVSS)
- [CVE-2004-2364](https://cve.now/CVE-2004-2364.md): Cross-site request forgery (CSRF) vulnerability in PHPX 3.0 through 3.2.6 allows remote attackers to execute arbitrary commands via URLs tha (no CVSS)
- [CVE-2004-2365](https://cve.now/CVE-2004-2365.md): Memory leak in Microsoft Windows XP and Windows Server 2003 allows local users to cause a denial of service (memory exhaustion) by repeatedl (no CVSS)
- [CVE-2004-2366](https://cve.now/CVE-2004-2366.md): Buffer overflow in GlobalSCAPE Secure FTP Server 2.0 B03.11.2004.2 allows remote attackers to cause a denial of service (crash) via a SITE c (no CVSS)
- [CVE-2004-2367](https://cve.now/CVE-2004-2367.md): The Control Panel applet in WFTPD and WFTPD Pro 3.21 R1 and R2 allows remote authenticated users to cause a denial of service (crash) via a (no CVSS)
- [CVE-2004-2368](https://cve.now/CVE-2004-2368.md): PHP remote file inclusion vulnerability in header.php in Opt-X 0.7.2 allows remote attackers to execute arbitrary PHP code via the systempat (no CVSS)
- [CVE-2004-2369](https://cve.now/CVE-2004-2369.md): Directory traversal vulnerability in webadmin.nsf for Lotus Domino R6 6.5.1 allows attackers to create and detect directories via a .. (no CVSS)
- [CVE-2004-2370](https://cve.now/CVE-2004-2370.md): Stack-based buffer overflow in Trillian 0.71 through 0.74f and Trillian Pro 1.0 through 2.01 allows remote attackers to execute arbitrary co (no CVSS)
- [CVE-2004-2371](https://cve.now/CVE-2004-2371.md): Multiple Red Storm web-based games, including Ghost Recon 1.4 and earlier, Desert Siege, and The Sum of all Fears 1.1.1.0 and earlier, do no (no CVSS)
- [CVE-2004-2372](https://cve.now/CVE-2004-2372.md): Buffer overflow in Bochs before 2.1.1, if installed setuid, allows local users to execute arbitrary code via a long HOME environment variabl (no CVSS)
- [CVE-2004-2373](https://cve.now/CVE-2004-2373.md): The Buddy icon file for AOL Instant Messenger (AIM) 4.3 through 5.5 is created in a predictable location, which may allow remote attackers t (no CVSS)
- [CVE-2004-2374](https://cve.now/CVE-2004-2374.md): BadBlue 2.4 allows remote attackers to obtain the location of the server installation path via a request for phptest.php, which includes the (no CVSS)
- [CVE-2004-2375](https://cve.now/CVE-2004-2375.md): Buffer overflow in the POP3 server in 1st Class Mail Server 4.0 allows remote attackers to cause a denial of service (crash) and possibly ex (no CVSS)
- [CVE-2004-2376](https://cve.now/CVE-2004-2376.md): Buffer overflow in postfile.exe for Twilight Utilities Web Server 2.0.0.0 allows remote attackers to cause a denial of service (crash) and p (no CVSS)
- [CVE-2004-2377](https://cve.now/CVE-2004-2377.md): Alcatel OmniSwitch 7000 and 7800 allows remote attackers to cause a denial of service (reboot) via certain network scans, as demonstrated us (no CVSS)
- [CVE-2004-2378](https://cve.now/CVE-2004-2378.md): @Mail 3.64 for Windows allows remote attackers to cause a denial of service ("unusable" server) via a large number of POP3 connections to th (no CVSS)
- [CVE-2004-2379](https://cve.now/CVE-2004-2379.md): Multiple cross-site scripting (XSS) vulnerabilities in @Mail 3.64 for Windows allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2004-2380](https://cve.now/CVE-2004-2380.md): Directory traversal vulnerability in postfile.exe for Twilight Utilities Web Server 2.0.0.0 allows remote attackers to write arbitrary files (no CVSS)
- [CVE-2004-2381](https://cve.now/CVE-2004-2381.md): HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause denial of service (memory usage and application crash) (no CVSS, org.mortbay.jetty:jetty)
- [CVE-2004-2382](https://cve.now/CVE-2004-2382.md): The PerfectNav plugin for Microsoft Internet Explorer allows remote attackers to cause a denial of service (browser crash) via a malformed U (no CVSS)
- [CVE-2004-2383](https://cve.now/CVE-2004-2383.md): Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to bypass cross-frame scripting restrictions and capture keyboard events (no CVSS)
- [CVE-2004-2384](https://cve.now/CVE-2004-2384.md): NullSoft Winamp 5.02 allows remote attackers to cause a denial of service (crash) by creating a file with a long filename, which causes the (no CVSS)
- [CVE-2004-2385](https://cve.now/CVE-2004-2385.md): EMU Webmail 5.2.7 allows remote attackers to obtain sensitive path information (home directory) via an HTTP request for init.emu. (no CVSS)
- [CVE-2004-2386](https://cve.now/CVE-2004-2386.md): Format string vulnerability in the LogMsg function in sercd before 2.3.1 and sredird 2.2.1 and earlier allows remote attackers to execute ar (no CVSS)
- [CVE-2004-2387](https://cve.now/CVE-2004-2387.md): Buffer overflow in the HandleCPCCommand function of sercd before 2.3.1 and sredird 2.2.1 and earlier allows remote attackers to execute arbi (no CVSS)
- [CVE-2004-2388](https://cve.now/CVE-2004-2388.md): rexecd for AIX 4.3.3 does not properly use a local copy of the pwd structure when calling getpwnam, which may cause the structure to be over (no CVSS)
- [CVE-2005-2097](https://cve.now/CVE-2005-2097.md): xpdf and kpdf do not properly validate the "loca" table in PDF files, which allows local users to cause a denial of service (disk consumptio (no CVSS)
- [CVE-2005-2102](https://cve.now/CVE-2005-2102.md): The AIM/ICQ module in Gaim before 1.5.0 allows remote attackers to cause a denial of service (application crash) via a filename that contain (no CVSS)
- [CVE-2005-2103](https://cve.now/CVE-2005-2103.md): Buffer overflow in the AIM and ICQ module in Gaim before 1.5.0 allows remote attackers to cause a denial of service (application crash) and (CVSS 9.8)
- [CVE-2005-2357](https://cve.now/CVE-2005-2357.md): Directory traversal vulnerability in EMC Navisphere Manager 6.4.1.0.0 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2005-2358](https://cve.now/CVE-2005-2358.md): EMC Navisphere Manager 6.4.1.0.0 allows remote attackers to list arbitrary directories via an HTTP request for a directory that ends in a ". (no CVSS)
- [CVE-2005-2470](https://cve.now/CVE-2005-2470.md): Buffer overflow in a "core application plug-in" for Adobe Reader 5.1 through 7.0.2 and Acrobat 5.0 through 7.0.2 allows attackers to cause a (no CVSS)
- [CVE-2005-2555](https://cve.now/CVE-2005-2555.md): Linux kernel 2.6.x does not properly restrict socket policy access to users with the CAP\_NET\_ADMIN capability, which could allow local users (no CVSS)
- [CVE-2005-2558](https://cve.now/CVE-2005-2558.md): Stack-based buffer overflow in the init\_syms function in MySQL 4.0 before 4.0.25, 4.1 before 4.1.13, and 5.0 before 5.0.7-beta allows remote (no CVSS)
- [CVE-2005-2559](https://cve.now/CVE-2005-2559.md): doping.php in ePing plugin 1.02 and earlier for e107 portal allows remote attackers to execute arbitrary code or overwrite files via (1) she (no CVSS)
- [CVE-2005-2560](https://cve.now/CVE-2005-2560.md): Cross-site scripting (XSS) vulnerability in index.cfm in CFBB 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the p (no CVSS)
- [CVE-2005-2561](https://cve.now/CVE-2005-2561.md): Multiple SQL injection vulnerabilities in MYFAQ 1.0 allow remote attackers to execute arbitrary SQL commands via the Theme parameter to (1) (no CVSS)
- [CVE-2005-2562](https://cve.now/CVE-2005-2562.md): SQL injection vulnerability in Gravity Board X (GBX) 1.1 allows remote attackers to execute arbitrary SQL commands and bypass authentication (no CVSS)
- [CVE-2005-2563](https://cve.now/CVE-2005-2563.md): Multiple cross-site scripting (XSS) vulnerabilities in Gravity Board X (GBX) 1.1 allow remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2005-2564](https://cve.now/CVE-2005-2564.md): Direct static code injection vulnerability in editcss.php in Gravity Board X (GBX) 1.1 allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2005-2565](https://cve.now/CVE-2005-2565.md): Gravity Board X (GBX) 1.1 allows remote attackers to obtain sensitive information via (1) a 1 in the perm parameter to deletethread.php or a (no CVSS)
- [CVE-2005-2566](https://cve.now/CVE-2005-2566.md): Multiple SQL injection vulnerabilities in Open Bulletin Board (OpenBB) allow remote attackers to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2005-2567](https://cve.now/CVE-2005-2567.md): PHP remote file inclusion vulnerability in SysCP 1.2.10 and earlier allows remote attackers to execute arbitrary PHP code via the language p (no CVSS)
- [CVE-2005-2568](https://cve.now/CVE-2005-2568.md): Eval injection vulnerability in the template engine for SysCP 1.2.10 and earlier allows remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2005-2569](https://cve.now/CVE-2005-2569.md): Multiple cross-site scripting (XSS) vulnerabilities in FunkBoard 0.66CF, and possibly earlier versions, allow remote attackers to inject arb (no CVSS)
- [CVE-2005-2570](https://cve.now/CVE-2005-2570.md): FunkBoard 0.66CF, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to forums.php, (no CVSS)
- [CVE-2005-2571](https://cve.now/CVE-2005-2571.md): FunkBoard 0.66CF, and possibly earlier versions, does not properly restrict access to the (1) admin/mysql\_install.php and (2) admin/pg\_insta (no CVSS)
- [CVE-2005-2572](https://cve.now/CVE-2005-2572.md): MySQL, when running on Windows, allows remote authenticated users with insert privileges on the mysql.func table to cause a denial of servic (no CVSS)
- [CVE-2005-2573](https://cve.now/CVE-2005-2573.md): The mysql\_create\_function function in sql\_udf.cc for MySQL 4.0 before 4.0.25, 4.1 before 4.1.13, and 5.0 before 5.0.7-beta, when running on (no CVSS)
- [CVE-2005-2574](https://cve.now/CVE-2005-2574.md): xmb.php in XMB Forum 1.9.1 extracts and defines all provided variables, which allows remote attackers to modify arbitrary server variables s (no CVSS)
- [CVE-2005-2575](https://cve.now/CVE-2005-2575.md): SQL injection vulnerability in u2u.inc.php in XMB Forum 1.9.1 allows remote attackers to execute arbitrary SQL commands via certain values t (no CVSS)
- [CVE-2005-2576](https://cve.now/CVE-2005-2576.md): CaLogic 1.22, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to (1) doclsqlres. (no CVSS)
- [CVE-2005-2577](https://cve.now/CVE-2005-2577.md): Wyse Winterm 1125SE running firmware 4.2.09f or 4.4.061f allows remote attackers to cause a denial of service (device crash) via a packet wi (no CVSS)
- [CVE-2005-2579](https://cve.now/CVE-2005-2579.md): Nortel Contivity VPN Client V05\_01.030, when configuring a certificate to be used as authentication, does not properly drop system privilege (no CVSS)
- [CVE-2005-2580](https://cve.now/CVE-2005-2580.md): Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) 1.00 RC4 with Security Patch allow remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2005-2581](https://cve.now/CVE-2005-2581.md): Grandstream BudgeTone 101 and 102 running firmware 1.0.6.7 and possibly earlier versions, allows remote attackers to cause a denial of servi (no CVSS)
- [CVE-2005-2582](https://cve.now/CVE-2005-2582.md): Kaspersky Anti-Virus for Unix/Linux File Servers 5.0-5 uses world-writable permissions for the (1) log and (2) license directory, which allo (no CVSS)
- [CVE-2005-2583](https://cve.now/CVE-2005-2583.md): Mentor ADSL-FR4II router running firmware 2.00.0111 has an undocumented web server running on TCP port 5678, which allows local users to gai (no CVSS)
- [CVE-2005-2584](https://cve.now/CVE-2005-2584.md): The web administration interface in Mentor ADSL-FR4II router running firmware 2.00.0111 does not set a default password, which allows local (no CVSS)
- [CVE-2005-2585](https://cve.now/CVE-2005-2585.md): Mentor ADSL-FR4II router running firmware 2.00.0111 allows remote attackers to cause a denial of service (active TCP connections state table (no CVSS)
- [CVE-2005-2586](https://cve.now/CVE-2005-2586.md): Mentor ADSL-FR4II router running firmware 2.00.0111 stores the web administration password in cleartext in the backup configuration file, wh (no CVSS)
- [CVE-2005-2587](https://cve.now/CVE-2005-2587.md): SQL injection vulnerability in emailvalidate.php in PHPTB Topic Boards 2.0 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-08-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.