# CVEs published 2005-09-02

31 CVEs were published on September 2, 2005: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2005-1857](https://cve.now/CVE-2005-1857.md): Format string vulnerability in simpleproxy before 3.4 allows remote malicious HTTP proxies to execute arbitrary code via format string speci (no CVSS)
- [CVE-2005-1915](https://cve.now/CVE-2005-1915.md): The log4sh\_readProperties function in log4sh 1.2.5 and earlier allows local users to overwrite arbitrary files via a symlink attack on predi (no CVSS)
- [CVE-2005-2496](https://cve.now/CVE-2005-2496.md): The xntpd ntp (ntpd) daemon before 4.2.0b, when run with the -u option and using a string to specify the group, uses the group ID of the use (no CVSS)
- [CVE-2005-2766](https://cve.now/CVE-2005-2766.md): Symantec AntiVirus Corporate Edition 9.0.1.x and 9.0.4.x, and possibly other versions, when obtaining updates from an internal LiveUpdate se (no CVSS)
- [CVE-2005-2767](https://cve.now/CVE-2005-2767.md): Buffer overflow in LeapFTP allows remote attackers to execute arbitrary code via a long Host string in a Site Queue (.lsq) file. (no CVSS)
- [CVE-2005-2768](https://cve.now/CVE-2005-2768.md): Heap-based buffer overflow in the Sophos Antivirus Library, as used by Sophos Antivirus, PureMessage, MailMonitor, and other products, allow (no CVSS)
- [CVE-2005-2769](https://cve.now/CVE-2005-2769.md): Cross-site scripting (XSS) vulnerability in SqWebMail 5.0.4 and possibly other versions allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2005-2770](https://cve.now/CVE-2005-2770.md): WRQ Reflection for Secure IT Windows Server 6.0 (formerly known as F-Secure SSH server) does not properly handle when the Windows Administra (no CVSS)
- [CVE-2005-2771](https://cve.now/CVE-2005-2771.md): WRQ Reflection for Secure IT Windows Server 6.0 (formerly known as F-Secure SSH server) processes access and deny lists in a case-sensitive (no CVSS)
- [CVE-2005-2772](https://cve.now/CVE-2005-2772.md): Multiple stack-based buffer overflows in University of Minnesota gopher client 3.0.9 allow remote malicious servers to execute arbitrary cod (no CVSS)
- [CVE-2005-2773](https://cve.now/CVE-2005-2773.md): HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) (CVSS 9.8, KEV)
- [CVE-2005-2774](https://cve.now/CVE-2005-2774.md): Format string vulnerability in Lithium II mod 1.24 for Quake 2 allows remote attackers to cause a denial of service (server crash) and possi (no CVSS)
- [CVE-2005-2775](https://cve.now/CVE-2005-2775.md): php\_api.php in phpWebNotes 2.0.0 uses the extract function to modify key variables such as $t\_path\_core, which leads to a PHP file inclusion (no CVSS)
- [CVE-2005-2776](https://cve.now/CVE-2005-2776.md): Multiple cross-site scripting (XSS) vulnerabilities in Looking Glass 20040427 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2005-2777](https://cve.now/CVE-2005-2777.md): Looking Glass 20040427 allows remote attackers to execute arbitrary commands via shell metacharacters in the DNS lookup query field. (no CVSS)
- [CVE-2005-2778](https://cve.now/CVE-2005-2778.md): SQL injection vulnerability in member.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL statements via the fid (no CVSS)
- [CVE-2005-2779](https://cve.now/CVE-2005-2779.md): The iTAN Online-Banking Security System allows remote attackers to obtain TAN numbers via a man-in-the-middle (MITM) attack while the transa (no CVSS)
- [CVE-2005-2780](https://cve.now/CVE-2005-2780.md): Cross-site scripting (XSS) vulnerability in Land Down Under (LDU) allows remote attackers to inject arbitrary web script or HTML via a signa (no CVSS)
- [CVE-2005-2781](https://cve.now/CVE-2005-2781.md): The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitr (no CVSS)
- [CVE-2005-2782](https://cve.now/CVE-2005-2782.md): PHP remote file inclusion vulnerability in al\_initialize.php for AutoLinks Pro 2.1 allows remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2005-2783](https://cve.now/CVE-2005-2783.md): Cross-site scripting (XSS) vulnerability in PHP-Fusion 6.00.107 and earlier allows remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2005-2784](https://cve.now/CVE-2005-2784.md): SQL injection vulnerability in the login function for the administration login panel in cosmoshop 8.10.78 allows remote attackers to execute (no CVSS)
- [CVE-2005-2785](https://cve.now/CVE-2005-2785.md): cosmoshop 8.10.78 and earlier stores passwords in plaintext in the database, which allows local users to obtain sensitive information. (no CVSS)
- [CVE-2005-2786](https://cve.now/CVE-2005-2786.md): Directory traversal vulnerability in bestmail\_edit.cgi in cosmoshop 8.10.78 and earlier allows remote administrators to read arbitrary files (no CVSS)
- [CVE-2005-2787](https://cve.now/CVE-2005-2787.md): comment\_delete\_cgi.php in Simple PHP Blog allows remote attackers to delete arbitrary files via the comment parameter. (no CVSS)
- [CVE-2005-2788](https://cve.now/CVE-2005-2788.md): Multiple SQL injection vulnerabilities in Land Down Under (LDU) 801 and earlier allow remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2005-2789](https://cve.now/CVE-2005-2789.md): BFCommand & Control Server Manager BFCC 1.22\_A and earlier, and BFVCC 2.14\_B and earlier, allows remote attackers to bypass authentication v (no CVSS)
- [CVE-2005-2790](https://cve.now/CVE-2005-2790.md): BFCommand & Control Server Manager BFCC 1.22\_A and earlier, and BFVCC 2.14\_B and earlier, relies on the client to enforce permissions and pe (no CVSS)
- [CVE-2005-2791](https://cve.now/CVE-2005-2791.md): BFCommand & Control Server Manager BFCC 1.22\_A and earlier, and BFVCC 2.14\_B and earlier, allows remote attackers to cause a denial of servi (no CVSS)
- [CVE-2005-2792](https://cve.now/CVE-2005-2792.md): Directory traversal vulnerability in welcome.php in phpLDAPadmin 0.9.6 and 0.9.7 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2005-2793](https://cve.now/CVE-2005-2793.md): PHP remote file inclusion vulnerability in welcome.php in phpLDAPadmin 0.9.6 and 0.9.7 allows remote attackers to execute arbitrary PHP code (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-09-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.