# CVEs published 2005-10-25

80 CVEs were published on October 25, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2004-2484](https://cve.now/CVE-2004-2484.md): Cross-site scripting (XSS) vulnerability in PHP Gift Registry 1.3.5 and earlier allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2004-2485](https://cve.now/CVE-2004-2485.md): Unspecified vulnerability in PHP Live! before 2.8.2, due to a "major security problem," allows remote attackers to include arbitrary files a (no CVSS)
- [CVE-2004-2486](https://cve.now/CVE-2004-2486.md): The DSS verification code in Dropbear SSH Server before 0.43 frees uninitialized variables, which might allow remote attackers to gain acces (no CVSS)
- [CVE-2004-2487](https://cve.now/CVE-2004-2487.md): Directory traversal vulnerability in Nexgen FTP Server before 2.2.3.23 allows remote authenticated users to read or list arbitrary files via (no CVSS)
- [CVE-2004-2488](https://cve.now/CVE-2004-2488.md): Directory traversal vulnerability in Nexgen FTP Server before 2.2.3.23 allows remote authenticated users to read or list arbitrary files via (no CVSS)
- [CVE-2004-2489](https://cve.now/CVE-2004-2489.md): Format string vulnerability in IBM Informix Dynamic Server (IDS) before 9.40.xC3 allows local users to execute arbitrary code via a modified (no CVSS)
- [CVE-2004-2490](https://cve.now/CVE-2004-2490.md): Buffer overflow in IBM Informix Dynamic Server (IDS) 9.40.xC1 and 9.40.xC2 allows local users to execute arbitrary code via a long GL\_PATH e (no CVSS)
- [CVE-2004-2491](https://cve.now/CVE-2004-2491.md): A race condition in Opera web browser 7.53 Build 3850 causes Opera to fill in the address bar before the page has been loaded, which allows (no CVSS)
- [CVE-2004-2492](https://cve.now/CVE-2004-2492.md): Cross-site scripting (XSS) vulnerability in Groupmax World Wide Web (GmaxWWW) Desktop 5, 6, and Desktop for Jichitai 6, allows remote attack (no CVSS)
- [CVE-2004-2493](https://cve.now/CVE-2004-2493.md): Directory traversal vulnerability in Groupmax World Wide Web (GmaxWWW) 2 and 3, and Desktop 5, 6, and Desktop for Jichitai allows remote aut (no CVSS)
- [CVE-2004-2494](https://cve.now/CVE-2004-2494.md): Cross-site scripting (XSS) vulnerability in \_error in Ability Mail Server 1.18 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2004-2495](https://cve.now/CVE-2004-2495.md): The (1) Webmail, (2) admin, and (3) SMTP services in Ability Mail Server 1.18 allow remote attackers to cause a denial of service (CPU consu (no CVSS)
- [CVE-2004-2496](https://cve.now/CVE-2004-2496.md): The HTTP daemon in OpenText FirstClass 7.1 and 8.0 allows remote attackers to cause a denial of service (service availability loss) via a la (no CVSS)
- [CVE-2004-2497](https://cve.now/CVE-2004-2497.md): Cross-site scripting (XSS) vulnerability in the error handler in Hitachi Web Page Generator and Web Page Generator Enterprise 4.01 and earli (no CVSS)
- [CVE-2004-2498](https://cve.now/CVE-2004-2498.md): Unspecified vulnerability in the error handler in Hitachi Web Page Generator and Web Page Generator Enterprise 4.01 and earlier, when using (no CVSS)
- [CVE-2004-2499](https://cve.now/CVE-2004-2499.md): Unspecified vulnerability in Hitachi Web Page Generator and Web Page Generator Enterprise 4.01 and earlier allows remote attackers to cause (no CVSS)
- [CVE-2004-2500](https://cve.now/CVE-2004-2500.md): Unknown vulnerability in IlohaMail before 0.8.14-rc1 has unknown impact and attack vectors. (no CVSS)
- [CVE-2004-2501](https://cve.now/CVE-2004-2501.md): Buffer overflow in the IMAP service of MailEnable Professional Edition 1.52 and Enterprise Edition 1.01 allows remote attackers to execute a (no CVSS)
- [CVE-2004-2502](https://cve.now/CVE-2004-2502.md): im-switch before 11.4-46.1 in Fedora Core 2 allows local users to overwrite arbitrary files via a symlink attack on the imswitcher\[PID\] temp (no CVSS)
- [CVE-2004-2503](https://cve.now/CVE-2004-2503.md): INweb Mail Server 2.40 allows remote attackers to cause a denial of service (crash) via a large number of connect/disconnect actions to the (no CVSS)
- [CVE-2004-2504](https://cve.now/CVE-2004-2504.md): The GUI in Alt-N Technologies MDaemon 7.2 and earlier, including 6.8, executes child processes such as NOTEPAD.EXE with SYSTEM privileges wh (no CVSS)
- [CVE-2004-2505](https://cve.now/CVE-2004-2505.md): Macromedia ColdFusion MX before 6.1 does not restrict the size of error messages, which allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2004-2506](https://cve.now/CVE-2004-2506.md): Unparsed web content delivery vulnerability in WIKINDX before 0.9.9g allows remote attackers to obtain sensitive information via a direct HT (no CVSS)
- [CVE-2004-2507](https://cve.now/CVE-2004-2507.md): Absolute path traversal vulnerability in main.cgi in Linksys WVC11B Wireless-B Internet Video Camera allows remote attackers to read arbitra (no CVSS)
- [CVE-2004-2508](https://cve.now/CVE-2004-2508.md): Cross-site scripting (XSS) vulnerability in main.cgi in Linksys WVC11B Wireless-B Internet Video Camera allows remote attackers to inject ar (no CVSS)
- [CVE-2004-2509](https://cve.now/CVE-2004-2509.md): Cross-site scripting (XSS) vulnerabilities in (1) calendar.php, (2) login.php, and (3) online.php in Infopop UBB.Threads 6.2.3 and 6.5 allow (no CVSS)
- [CVE-2004-2510](https://cve.now/CVE-2004-2510.md): Cross-site scripting (XSS) vulnerability in showflat.php in Infopop UBB.Threads before 6.5 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2004-2511](https://cve.now/CVE-2004-2511.md): Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 5.3.2 and earlier allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2004-2512](https://cve.now/CVE-2004-2512.md): CRLF injection vulnerability in calendar.php in DCP-Portal 5.3.2 and earlier allows remote attackers to conduct HTTP response splitting atta (no CVSS)
- [CVE-2004-2513](https://cve.now/CVE-2004-2513.md): Buffer overflow in the IMAP service of Mercury (Pegasus) Mail 4.01 allows remote attackers to execute arbitrary code via a long SELECT comma (no CVSS)
- [CVE-2004-2514](https://cve.now/CVE-2004-2514.md): Cross-site scripting (XSS) vulnerability in modules/private\_messages/index.php in PowerPortal 1.x allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2004-2515](https://cve.now/CVE-2004-2515.md): Format string vulnerability in VMware Workstation 4.5.2 build-8848, if running with elevated privileges, might allow local users to execute (no CVSS)
- [CVE-2004-2516](https://cve.now/CVE-2004-2516.md): Directory traversal vulnerability in myServer 0.7 allows remote attackers to list arbitrary directories via an HTTP GET command with a large (no CVSS)
- [CVE-2004-2517](https://cve.now/CVE-2004-2517.md): myServer 0.7.1 allows remote attackers to cause a denial of service (crash) via a long HTTP POST request in a View=Logon operation to index. (no CVSS)
- [CVE-2004-2518](https://cve.now/CVE-2004-2518.md): Gattaca Server 2003 1.1.10.0 allows remote attackers to obtain sensitive information via (1) a trailing null byte ("%00") to a URL or (2) an (no CVSS)
- [CVE-2004-2519](https://cve.now/CVE-2004-2519.md): Gattaca Server 2003 1.1.10.0 allows remote attackers to cause a denial of service (CPU consumption) via directory specifiers in the LANGUAGE (no CVSS)
- [CVE-2004-2520](https://cve.now/CVE-2004-2520.md): POP3 protocol in Gattaca Server 2003 1.1.10.0 allows remote authenticated users to cause a denial of service (application crash) via a large (no CVSS)
- [CVE-2004-2521](https://cve.now/CVE-2004-2521.md): Mail server in Gattaca Server 2003 1.1.10.0 allows remote attackers to perform a denial of service (application crash) via a large number of (no CVSS)
- [CVE-2004-2522](https://cve.now/CVE-2004-2522.md): Cross-site scripting (XSS) vulnerability in web.tmpl in Gattaca Server 2003 1.1.10.0 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2004-2523](https://cve.now/CVE-2004-2523.md): Format string vulnerability in the msg command (cat\_message function in msg.c) in OpenFTPD 0.30.2 and earlier allows remote authenticated us (no CVSS)
- [CVE-2004-2524](https://cve.now/CVE-2004-2524.md): clogin.php in Benchmark Designs' WHM AutoPilot 2.4.5 and earlier allows remote attackers to obtain plaintext username and password credentia (no CVSS)
- [CVE-2004-2525](https://cve.now/CVE-2004-2525.md): Cross-site scripting (XSS) vulnerability in compat.php in Serendipity before 0.7.1 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2004-2526](https://cve.now/CVE-2004-2526.md): Directory traversal vulnerability in ldacgi.exe in IBM Tivoli Directory Server 4.1 and earlier allows remote attackers to view arbitrary fil (no CVSS)
- [CVE-2004-2527](https://cve.now/CVE-2004-2527.md): The local and remote desktop login screens in Microsoft Windows XP before SP2 and 2003 allow remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2004-2528](https://cve.now/CVE-2004-2528.md): Cross-site scripting (XSS) vulnerability in sresult.exe in Webcam Watchdog 4.0.1a allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2004-2529](https://cve.now/CVE-2004-2529.md): Gadu-Gadu allows remote attackers to bypass the "image send" option by sending a very small image file, which could be used in conjunction w (no CVSS)
- [CVE-2004-2530](https://cve.now/CVE-2004-2530.md): Visual truncation vulnerability in Gadu-Gadu allows remote attackers to spoof the file extension on transmitted files via a filename with a (no CVSS)
- [CVE-2004-2531](https://cve.now/CVE-2004-2531.md): X.509 Certificate Signature Verification in Gnu transport layer security library (GnuTLS) 1.0.16 allows remote attackers to cause a denial o (no CVSS)
- [CVE-2004-2532](https://cve.now/CVE-2004-2532.md): Serv-U FTP server before 5.1.0.0 has a default account and password for local administration, which allows local users to execute arbitrary (no CVSS)
- [CVE-2004-2533](https://cve.now/CVE-2004-2533.md): Serv-U FTP Server 4.1 (possibly 4.0) allows remote attackers to cause a denial of service (application crash) via a SITE CHMOD command with (no CVSS)
- [CVE-2004-2534](https://cve.now/CVE-2004-2534.md): Fastream NETFile Server 7.1.2 does not properly handle keep-alive connection timeouts and does not close the connection after a HEAD request (no CVSS)
- [CVE-2004-2535](https://cve.now/CVE-2004-2535.md): The person-to-person secure messaging feature in Sticker before 3.1.0 beta 2 allows remote attackers to post messages to unauthorized privat (no CVSS)
- [CVE-2004-2536](https://cve.now/CVE-2004-2536.md): The exit\_thread function (process.c) in Linux kernel 2.6 through 2.6.5 does not invalidate the per-TSS io\_bitmap pointers if a process obtai (no CVSS)
- [CVE-2004-2537](https://cve.now/CVE-2004-2537.md): Unspecified vulnerability in SurgeMail before 2.2c10 has unknown impact and attack vectors, related to a "Webmail security bug." (no CVSS)
- [CVE-2004-2538](https://cve.now/CVE-2004-2538.md): Direct static code injection vulnerability in the PCG simple application generation in phpCodeGenie before 3.0.2 allows remote authenticated (no CVSS)
- [CVE-2004-2539](https://cve.now/CVE-2004-2539.md): Unknown vulnerability in Network Appliance NetCache 5.2 and Data ONTAP 6.0 allows remote attackers to cause a denial of service (panic and r (no CVSS)
- [CVE-2005-2100](https://cve.now/CVE-2005-2100.md): The rw\_vm function in usercopy.c in the 4GB split patch for the Linux kernel in Red Hat Enterprise Linux 4 does not perform proper bounds ch (no CVSS)
- [CVE-2005-2524](https://cve.now/CVE-2005-2524.md): Safari after 2.0 in Apple Mac OS X 10.3.9 allows remote attackers to bypass domain restrictions via crafted web archives that cause Safari t (no CVSS)
- [CVE-2005-2708](https://cve.now/CVE-2005-2708.md): The search\_binary\_handler function in exec.c in Linux 2.4 kernel on 64-bit x86 architectures does not check a return code for a particular f (no CVSS)
- [CVE-2005-2741](https://cve.now/CVE-2005-2741.md): Authorization Services in securityd for Apple Mac OS X 10.3.9 allows local users to gain privileges by granting themselves certain rights th (no CVSS)
- [CVE-2005-2742](https://cve.now/CVE-2005-2742.md): SecurityAgent in Apple Mac OS X 10.4.2, under certain circumstances, can cause the "Switch User..." button to appear even though the "Enable (no CVSS)
- [CVE-2005-2743](https://cve.now/CVE-2005-2743.md): The Java extensions for QuickTime 6.52 and earlier in Apple Mac OS X 10.3.9 allow untrusted applets to call arbitrary functions in system li (no CVSS)
- [CVE-2005-2744](https://cve.now/CVE-2005-2744.md): Buffer overflow in QuickDraw Manager for Apple OS X 10.3.9 and 10.4.2, as used by applications such as Safari, Mail, and Finder, allows remo (no CVSS)
- [CVE-2005-2745](https://cve.now/CVE-2005-2745.md): Mail.app in Mail for Apple Mac OS X 10.3.9, when using Kerberos 5 for SMTP authentication, can include uninitialized memory in a message, wh (no CVSS)
- [CVE-2005-2746](https://cve.now/CVE-2005-2746.md): Mail.app in Mail for Apple Mac OS X 10.3.9 and 10.4.2 includes message contents when using auto-reply rules, which could cause Mail.app to i (no CVSS)
- [CVE-2005-2747](https://cve.now/CVE-2005-2747.md): Buffer overflow in ImageIO for Apple Mac OS X 10.4.2, as used by applications such as WebCore and Safari, allows remote attackers to execute (no CVSS)
- [CVE-2005-2748](https://cve.now/CVE-2005-2748.md): The malloc function in the libSystem library in Apple Mac OS X 10.3.9 and 10.4.2 allows local users to overwrite arbitrary files by setting (no CVSS)
- [CVE-2005-2926](https://cve.now/CVE-2005-2926.md): Stack-based buffer overflow in (1) backupsh and (2) authsh in SCO Openserver 5.0.7 allows local users to execute arbitrary code via a long H (no CVSS)
- [CVE-2005-2927](https://cve.now/CVE-2005-2927.md): Stack-based buffer overflow in ppp in SCO Unixware 7.1.3 and 7.1.4, and possibly earlier versions, allows local users to execute arbitrary c (no CVSS)
- [CVE-2005-2958](https://cve.now/CVE-2005-2958.md): Multiple format string vulnerabilities in the GNOME Data Access library for GNOME2 (libgda2) 1.2.1 and earlier allow attackers to execute ar (no CVSS)
- [CVE-2005-2959](https://cve.now/CVE-2005-2959.md): Incomplete blacklist vulnerability in sudo 1.6.8 and earlier allows local users to gain privileges via the (1) SHELLOPTS and (2) PS4 environ (no CVSS)
- [CVE-2005-2970](https://cve.now/CVE-2005-2970.md): Memory leak in the worker MPM (worker.c) for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service (memor (no CVSS)
- [CVE-2005-3304](https://cve.now/CVE-2005-3304.md): Multiple SQL injection vulnerabilities in PHP-Nuke 7.8 allow remote attackers to modify SQL queries and execute arbitrary PHP code via (1) t (no CVSS)
- [CVE-2005-3305](https://cve.now/CVE-2005-3305.md): Multiple SQL injection vulnerabilities in Nuked Klan 1.7 allow remote attackers to execute arbitrary SQL commands via the (1) forum\_id or (2 (no CVSS)
- [CVE-2005-3306](https://cve.now/CVE-2005-3306.md): Cross-site scripting (XSS) vulnerability in index.php for FlatNuke 2.5.6 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2005-3307](https://cve.now/CVE-2005-3307.md): Directory traversal vulnerability in index.php for FlatNuke 2.5.6 allows remote attackers to read arbitrary files via ".." sequences in the (no CVSS)
- [CVE-2005-3308](https://cve.now/CVE-2005-3308.md): Multiple cross-site scripting (XSS) vulnerabilities in Zomplog 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) (no CVSS)
- [CVE-2005-3309](https://cve.now/CVE-2005-3309.md): Multiple SQL injection vulnerabilities in Zomplog 3.4 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in d (no CVSS)
- [CVE-2005-3310](https://cve.now/CVE-2005-3310.md): Interpretation conflict in phpBB 2.0.17, with remote avatars and avatar uploading enabled, allows remote authenticated users to inject arbit (no CVSS)
- [CVE-2005-3311](https://cve.now/CVE-2005-3311.md): BMC Software Control-M 6.1.03 for Solaris, and possibly other platforms, allows local users to overwrite arbitrary files via a symlink attac (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-10-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.