# CVEs published 2005-11-01

44 CVEs were published on November 1, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2005-3423](https://cve.now/CVE-2005-3423.md): Multiple SQL injection vulnerabilities in Subdreamer 2.2.1 allow remote attackers to execute arbitrary SQL commands via (1) the loginusernam (no CVSS)
- [CVE-2005-3424](https://cve.now/CVE-2005-3424.md): Cross-site scripting (XSS) vulnerability in GNUMP3D before 2.9.5 allows remote attackers to inject arbitrary web script or HTML via 404 erro (no CVSS)
- [CVE-2005-3425](https://cve.now/CVE-2005-3425.md): Cross-site scripting (XSS) vulnerability in GNUMP3D before 2.9.6 allows remote attackers to inject arbitrary web script or HTML via unspecif (no CVSS)
- [CVE-2005-3415](https://cve.now/CVE-2005-3415.md): phpBB 2.0.17 and earlier allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GET/POST (no CVSS)
- [CVE-2005-3416](https://cve.now/CVE-2005-3416.md): phpBB 2.0.17 and earlier, when register\_globals is enabled and the session\_start function has not been called to handle a session, allows re (no CVSS)
- [CVE-2005-3417](https://cve.now/CVE-2005-3417.md): phpBB 2.0.17 and earlier, when the register\_long\_arrays directive is disabled, allows remote attackers to modify global variables and bypass (no CVSS)
- [CVE-2005-3418](https://cve.now/CVE-2005-3418.md): Multiple cross-site scripting (XSS) vulnerabilities in phpBB 2.0.17 and earlier allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2005-3419](https://cve.now/CVE-2005-3419.md): SQL injection vulnerability in usercp\_register.php in phpBB 2.0.17 allows remote attackers to execute arbitrary SQL commands via the signatu (no CVSS)
- [CVE-2005-3420](https://cve.now/CVE-2005-3420.md): usercp\_register.php in phpBB 2.0.17 allows remote attackers to modify regular expressions and execute PHP code via the signature\_bbcode\_uid (no CVSS)
- [CVE-2005-3421](https://cve.now/CVE-2005-3421.md): estcmd in Hyper Estraier 1.0.1 on Windows systems allows remote attackers to read unauthorized files via a crafted search request for a file (no CVSS)
- [CVE-2005-3422](https://cve.now/CVE-2005-3422.md): Cross-site scripting (XSS) vulnerability in error.asp in ASP Fast Forum allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2005-3411](https://cve.now/CVE-2005-3411.md): Cross-site scripting (XSS) vulnerability in post.asp in Snitz Forums 2000 3.4.05 allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2005-3412](https://cve.now/CVE-2005-3412.md): Cross-site scripting (XSS) vulnerability in Elite Forum 1.0.0.0 allows remote attackers to inject arbitrary web script or HTML via a Post Re (no CVSS)
- [CVE-2005-3413](https://cve.now/CVE-2005-3413.md): Cross-site scripting (XSS) vulnerability in desktop.php in eyeOS 0.8.4 allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2005-3414](https://cve.now/CVE-2005-3414.md): eyeOS 0.8.4 stores usrinfo.xml under the web document root with insufficient access control, which allows remote attackers to obtain user cr (no CVSS)
- [CVE-2005-2739](https://cve.now/CVE-2005-2739.md): Keychain Access in Mac OS X 10.4.2 and earlier keeps a password visible even if a keychain times out while the password is being viewed, whi (no CVSS)
- [CVE-2005-2749](https://cve.now/CVE-2005-2749.md): Unspecified vulnerability in the Finder Get Info window for Mac OS X 10.4 up to 10.4.2 causes Finder to misrepresent file and group ownershi (no CVSS)
- [CVE-2005-2750](https://cve.now/CVE-2005-2750.md): Software Update in Mac OS X 10.4.2, when the user marks all updates to be ignored, exits without asking the user to reset the status of the (no CVSS)
- [CVE-2005-2751](https://cve.now/CVE-2005-2751.md): memberd in Mac OS X 10.4 up to 10.4.2, in certain situations, does not quickly synchronize access control checks with changes in group membe (no CVSS)
- [CVE-2005-2752](https://cve.now/CVE-2005-2752.md): An unspecified kernel interface in Mac OS X 10.4.2 and earlier does not properly clear memory before reusing it, which could allow attackers (no CVSS)
- [CVE-2005-3313](https://cve.now/CVE-2005-3313.md): The IRC protocol dissector in Ethereal 0.10.13 allows remote attackers to cause a denial of service (infinite loop). (no CVSS)
- [CVE-2005-3391](https://cve.now/CVE-2005-3391.md): Multiple vulnerabilities in PHP before 4.4.1 allow remote attackers to bypass safe\_mode and open\_basedir restrictions via unknown attack vec (no CVSS)
- [CVE-2005-3392](https://cve.now/CVE-2005-3392.md): Unspecified vulnerability in PHP before 4.4.1, when using the virtual function on Apache 2, allows remote attackers to bypass safe\_mode and (no CVSS)
- [CVE-2005-3393](https://cve.now/CVE-2005-3393.md): Format string vulnerability in the foreign\_option function in options.c for OpenVPN 2.0.x allows remote clients to execute arbitrary code vi (no CVSS)
- [CVE-2005-3394](https://cve.now/CVE-2005-3394.md): Multiple SQL injection vulnerabilities in forum.php in oaboard forum 1.0 allow remote attackers to execute arbitrary SQL commands via the (1 (no CVSS)
- [CVE-2005-3395](https://cve.now/CVE-2005-3395.md): SQL injection vulnerability in Invision Gallery 2.0.3 allows remote attackers to execute arbitrary SQL commands via the st parameter. (no CVSS)
- [CVE-2005-3396](https://cve.now/CVE-2005-3396.md): Buffer overflow in the chcons (chcon) command in IBM AIX 5.2 and 5.3, when DEBUG MALLOC is enabled, might allow attackers to execute arbitra (no CVSS)
- [CVE-2005-3397](https://cve.now/CVE-2005-3397.md): Cross-site scripting (XSS) vulnerability in Comersus BackOffice allows remote attackers to inject arbitrary web script or HTML via the error (no CVSS)
- [CVE-2005-3398](https://cve.now/CVE-2005-3398.md): The default configuration of the web server for the Solaris Management Console (SMC) in Solaris 8, 9, and 10 enables the HTTP TRACE method, (no CVSS)
- [CVE-2005-3399](https://cve.now/CVE-2005-3399.md): Multiple interpretation error in CAT-QuickHeal 8.0 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML wi (no CVSS)
- [CVE-2005-3400](https://cve.now/CVE-2005-3400.md): Multiple interpretation error in Fortinet 2.48.0.0 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML wi (no CVSS)
- [CVE-2005-3401](https://cve.now/CVE-2005-3401.md): Multiple interpretation error in TheHacker 5.8.4.128 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML (no CVSS)
- [CVE-2005-3402](https://cve.now/CVE-2005-3402.md): The SMTP client in Mozilla Thunderbird 1.0.5 BETA, 1.0.7, and possibly other versions, does not notify users when it cannot establish a secu (no CVSS)
- [CVE-2005-3403](https://cve.now/CVE-2005-3403.md): Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2005-3404](https://cve.now/CVE-2005-3404.md): Multiple PHP file inclusion vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to include arbitrary files via the sect (no CVSS)
- [CVE-2005-3405](https://cve.now/CVE-2005-3405.md): ATutor 1.4.1 through 1.5.1-pl1 allows remote attackers to execute arbitrary PHP functions via a direct request to forum.inc.php with a modif (no CVSS)
- [CVE-2005-3406](https://cve.now/CVE-2005-3406.md): Cross-site scripting (XSS) vulnerability in phpESP 1.7.5 and earlier allows remote attackers to inject arbitrary web script or HTML via unkn (no CVSS)
- [CVE-2005-3407](https://cve.now/CVE-2005-3407.md): SQL injection vulnerability in phpESP 1.7.5 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors. (no CVSS)
- [CVE-2005-3408](https://cve.now/CVE-2005-3408.md): SQL injection vulnerability in news.php in gCards version 1.43 allows remote attackers to execute arbitrary SQL commands via the limit param (no CVSS)
- [CVE-2005-2977](https://cve.now/CVE-2005-2977.md): The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unix\_chkpwd, which does no (no CVSS)
- [CVE-2005-3387](https://cve.now/CVE-2005-3387.md): The startup script in packages/RedHat/ntop.init in ntop before 3.2, when ntop.conf is writable by users besides root, creates temporary file (no CVSS)
- [CVE-2005-3388](https://cve.now/CVE-2005-3388.md): Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5 allows remote attackers to injec (no CVSS)
- [CVE-2005-3389](https://cve.now/CVE-2005-3389.md): The parse\_str function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when called with only one parameter, allows remote attackers to enable th (no CVSS)
- [CVE-2005-3390](https://cve.now/CVE-2005-3390.md): The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register\_globals is enabled, allows remote attackers to mod (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-11-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.