# CVEs published 2005-08-17

49 CVEs were published on August 17, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2003-1229](https://cve.now/CVE-2003-1229.md): X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0\_01, (2) JSSE before 1.0.3, (3) Java Plug-in S (no CVSS)
- [CVE-2003-1230](https://cve.now/CVE-2003-1230.md): The implementation of SYN cookies (syncookies) in FreeBSD 4.5 through 5.0-RELEASE-p3 uses only 32-bit internal keys when generating syncooki (no CVSS)
- [CVE-2004-2389](https://cve.now/CVE-2004-2389.md): Unknown vulnerability in Jabber Gadu-Gadu Transport (a.k.a. (no CVSS)
- [CVE-2004-2390](https://cve.now/CVE-2004-2390.md): The roster import functionality in Jabber Gadu-Gadu Transport (a.k.a. (no CVSS)
- [CVE-2004-2391](https://cve.now/CVE-2004-2391.md): Jabber Gadu-Gadu Transport (a.k.a. (no CVSS)
- [CVE-2004-2392](https://cve.now/CVE-2004-2392.md): libuser 0.51.7 allows attackers to cause a denial of service (crash or disk consumption) via unknown attack vectors, related to read failure (no CVSS)
- [CVE-2004-2393](https://cve.now/CVE-2004-2393.md): Java Secure Socket Extension (JSSE) 1.0.3 through 1.0.3\_2 does not properly validate the certificate chain of a client or server, which allo (no CVSS)
- [CVE-2004-2394](https://cve.now/CVE-2004-2394.md): Off-by-one error in passwd 0.68 and earlier, when using the --stdin option, causes passwd to use the first 78 characters of a password inste (no CVSS)
- [CVE-2004-2395](https://cve.now/CVE-2004-2395.md): Memory leak in passwd 0.68 allows local users to cause a denial of service (memory consumption) via a large number of failed read attempts f (no CVSS)
- [CVE-2004-2396](https://cve.now/CVE-2004-2396.md): passwd 0.68 does not check the return code for the pam\_start function, which has unknown impact and attack vectors that may prevent "safe an (no CVSS)
- [CVE-2004-2397](https://cve.now/CVE-2004-2397.md): The web-based Management Console in Blue Coat Security Gateway OS 3.0 through 3.1.3.13 and 3.2.1, when importing a private key, stores the k (no CVSS)
- [CVE-2004-2398](https://cve.now/CVE-2004-2398.md): Netenberg Fantastico De Luxe 2.8 uses database file names that contain the associated usernames, which allows local users to determine valid (no CVSS)
- [CVE-2004-2399](https://cve.now/CVE-2004-2399.md): Secure Computing Corporation Sidewinder G2 6.1.0.01 allows remote attackers to cause a denial of service (CPU consumption) via delayed respo (no CVSS)
- [CVE-2004-2400](https://cve.now/CVE-2004-2400.md): WinFTP Server 1.6 stores username and password credentials in plaintext in the data\\user.wfd file, which allows local users to gain access t (no CVSS)
- [CVE-2004-2401](https://cve.now/CVE-2004-2401.md): Stack-based buffer overflow in Ipswitch IMail Express Web Messaging before 8.05 might allow remote attackers to execute arbitrary code via a (no CVSS)
- [CVE-2004-2402](https://cve.now/CVE-2004-2402.md): Cross-site scripting (XSS) vulnerability in YaBB.pl in YaBB 1 GOLD SP 1.3.2 allows remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2004-2403](https://cve.now/CVE-2004-2403.md): Cross-site request forgery (CSRF) vulnerability in YaBB 1 GOLD SP 1.3.2 allows remote attackers to perform unauthorized actions as the admin (no CVSS)
- [CVE-2005-2101](https://cve.now/CVE-2005-2101.md): langen2kvtml in KDE 3.0 to 3.4.2 creates insecure temporary files in /tmp with predictable names, which allows local users to overwrite arbi (no CVSS)
- [CVE-2005-2588](https://cve.now/CVE-2005-2588.md): Multiple cross-site scripting (XSS) vulnerabilities in DVBBS 7.1 SP2 and earlier allow remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2005-2589](https://cve.now/CVE-2005-2589.md): Unknown vulnerability in Linksys WRT54GS wireless router with firmware 4.50.6, with WPA Personal/TKIP authentication enabled, allows remote (no CVSS)
- [CVE-2005-2590](https://cve.now/CVE-2005-2590.md): Cross-site scripting (XSS) vulnerability in Parlano MindAlign 5.0 and later versions allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2005-2591](https://cve.now/CVE-2005-2591.md): Parlano MindAlign 5.0 and later versions allows remote attackers to list valid users via unknown vectors, aka the "User Enumeration" vulnera (no CVSS)
- [CVE-2005-2592](https://cve.now/CVE-2005-2592.md): Unknown vulnerability in Parlano MindAlign 5.0 and later versions allows remote attackers to bypass authentication via unknown vectors. (no CVSS)
- [CVE-2005-2593](https://cve.now/CVE-2005-2593.md): Parlano MindAlign 5.0 and later versions uses weak encryption, with unknown impact and attack vectors. (no CVSS)
- [CVE-2005-2594](https://cve.now/CVE-2005-2594.md): Apple Safari 1.3 (132) on Mac OS X 1.3.9 allows remote attackers to cause a denial of service (crash) via certain Javascript, possibly invol (no CVSS)
- [CVE-2005-2595](https://cve.now/CVE-2005-2595.md): Cross-site scripting (XSS) vulnerability in Dada Mail before 2.10 Alpha 1 allows remote attackers to execute arbitrary Javascript via archiv (no CVSS)
- [CVE-2005-2596](https://cve.now/CVE-2005-2596.md): User.php in Gallery, as used in Postnuke, allows users with any Admin privileges to gain access to all galleries. (no CVSS)
- [CVE-2005-2597](https://cve.now/CVE-2005-2597.md): AOL Client Software 9.0 uses insecure permissions for its installation path, which allows local users to execute arbitrary code with SYSTEM (no CVSS)
- [CVE-2005-2598](https://cve.now/CVE-2005-2598.md): Multiple directory traversal vulnerabilities in Dokeos 1.6 and earlier, and possibly Claroline, allow remote attackers to (1) delete arbitra (no CVSS)
- [CVE-2005-2599](https://cve.now/CVE-2005-2599.md): Hummingbird FTP for Connectivity 10.0 uses weak encryption (trivial encoding) to store the user's password in the FTP profile, which allows (no CVSS)
- [CVE-2005-2600](https://cve.now/CVE-2005-2600.md): FUDForum 2.6.15 with "Tree View" enabled, as used in other products such as phpgroupware and egroupware, allows remote attackers to read pri (no CVSS)
- [CVE-2005-2601](https://cve.now/CVE-2005-2601.md): SQL injection vulnerability in MidiCart allows remote attackers to execute arbitrary SQL commands via the code\_no parameter to (1) Item\_Show (no CVSS)
- [CVE-2005-2602](https://cve.now/CVE-2005-2602.md): Mozilla Thunderbird 1.0 and Firefox 1.0.6 allows remote attackers to obfuscate URIs via a long URI, which causes the address bar to go blank (no CVSS)
- [CVE-2005-2603](https://cve.now/CVE-2005-2603.md): Cross-site scripting (XSS) vulnerability in index.php for My Image Gallery (Mig ) 1.4.1 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2005-2604](https://cve.now/CVE-2005-2604.md): index.php for My Image Gallery (Mig ) 1.4.1 allows remote attackers to obtain the web server path via certain currDir and image arguments, w (no CVSS)
- [CVE-2005-2605](https://cve.now/CVE-2005-2605.md): Unknown vulnerability in Lasso Professional Server8.0.4 and 8.0.5 allows attackers to bypass authentication, related to \[Auth\] tags. (no CVSS)
- [CVE-2005-2606](https://cve.now/CVE-2005-2606.md): Unknown vulnerability in the "frontend authentication" in PHlyMail 3.02.00 has unknown impact and attack vectors. (no CVSS)
- [CVE-2005-2607](https://cve.now/CVE-2005-2607.md): PHP file include vulnerability in download.php in PHPSimplicity Simplicity oF Upload before 1.3.1 allows remote attackers to include arbitra (no CVSS)
- [CVE-2005-2608](https://cve.now/CVE-2005-2608.md): SafeHTML before 1.3.5 does not properly filter script in UTF-7 and CSS comments, which allows remote attackers to conduct cross-site scripti (no CVSS)
- [CVE-2005-2609](https://cve.now/CVE-2005-2609.md): index.php in VegaDNS 0.8.1, 0.9.8, and possibly other versions, allows remote attackers to obtain the full server path via an invalid VDNS\_S (no CVSS)
- [CVE-2005-2610](https://cve.now/CVE-2005-2610.md): Cross-site scripting (XSS) vulnerability in index.php in VegaDNS 0.8.1, 0.9.8, and possibly other versions, allows remote attackers to injec (no CVSS)
- [CVE-2005-2611](https://cve.now/CVE-2005-2611.md): VERITAS Backup Exec for Windows Servers 8.6 through 10.0, Backup Exec for NetWare Servers 9.0 and 9.1, and NetBackup for NetWare Media Serve (no CVSS)
- [CVE-2005-2612](https://cve.now/CVE-2005-2612.md): Direct code injection vulnerability in WordPress 1.5.1.3 and earlier allows remote attackers to execute arbitrary PHP code via the cache\_las (no CVSS)
- [CVE-2005-2613](https://cve.now/CVE-2005-2613.md): Unknown vulnerability in CPAINT Ajax Toolkit before 1.3-SP allows attackers to execute arbitrary PHP or ASP code or read files via unknown v (no CVSS)
- [CVE-2005-2614](https://cve.now/CVE-2005-2614.md): Discuz! 4.0 rc4 does not properly restrict types of files that are uploaded to the server, which allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2005-2615](https://cve.now/CVE-2005-2615.md): Unknown vulnerability in session.php in EQdkp before 1.3.0 has unknown impact and attack vectors, possibly involving auto\_login\_id. (no CVSS)
- [CVE-2005-2616](https://cve.now/CVE-2005-2616.md): Multiple PHP file include vulnerabilities in ezUpload 2.2 allow remote attackers to execute arbitrary code via the path parameter to (1) ini (no CVSS)
- [CVE-2005-2617](https://cve.now/CVE-2005-2617.md): The syscall32\_setup\_pages function in syscall32.c for Linux kernel 2.6.12 and later, on the 64-bit x86 platform, does not check the return v (no CVSS)
- [CVE-2005-2620](https://cve.now/CVE-2005-2620.md): grpWise.exe for Novell GroupWise client 5.5 through 6.5.2 stores the password in plaintext in memory, which allows attackers to obtain the p (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-08-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.