# CVEs published 2005-11-16

191 CVEs were published on November 16, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2000-1238](https://cve.now/CVE-2000-1238.md): BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet (no CVSS)
- [CVE-2002-2137](https://cve.now/CVE-2002-2137.md): GlobalSunTech Wireless Access Points (1) WISECOM GL2422AP-0T, and possibly OEM products such as (2) D-Link DWL-900AP+ B1 2.1 and 2.2, (3) AL (no CVSS)
- [CVE-2002-2138](https://cve.now/CVE-2002-2138.md): RFC-NETBIOS in HP Advanced Server/9000 B.04.05 through B.04.09, when running HP-UX 11.00 or 11.11, allows remote attackers to cause a denial (no CVSS)
- [CVE-2002-2139](https://cve.now/CVE-2002-2139.md): Cisco PIX Firewall 6.0.3 and earlier, and 6.1.x to 6.1.3, do not delete the duplicate ISAKMP SAs for a user's VPN session, which allows loca (no CVSS)
- [CVE-2002-2140](https://cve.now/CVE-2002-2140.md): Buffer overflow in Cisco PIX Firewall 5.2.x to 5.2.8, 6.0.x to 6.0.3, 6.1.x to 6.1.3, and 6.2.x to 6.2.1 allows remote attackers to cause a (no CVSS)
- [CVE-2002-2141](https://cve.now/CVE-2002-2141.md): BEA WebLogic Server and Express 7.0 and 7.0.0.1, when running Servlets and Enterprise JavaBeans (EJB) on more than one server, will remove t (no CVSS)
- [CVE-2002-2142](https://cve.now/CVE-2002-2142.md): An undocumented extension for the Servlet mappings in the Servlet 2.3 specification, when upgrading to WebLogic Server and Express 7.0 Servi (no CVSS)
- [CVE-2002-2143](https://cve.now/CVE-2002-2143.md): The admin.html file in MySimple News 1.0 stores its administrative password in plaintext, which allows remote attackers to gain unauthorized (no CVSS)
- [CVE-2002-2144](https://cve.now/CVE-2002-2144.md): Directory traversal vulnerability in BearShare 4.0.5 and 4.0.6 allows remote attackers to read files outside of the web root by hex-encoding (no CVSS)
- [CVE-2002-2145](https://cve.now/CVE-2002-2145.md): Savant Web Server 3.1 and earlier allows remote attackers to bypass authentication for password protected user folders via a URL with a hex (no CVSS)
- [CVE-2002-2146](https://cve.now/CVE-2002-2146.md): cgitest.exe in Savant Web Server 3.1 and earlier allows remote attackers to cause a denial of service (crash) via a long HTTP request. (no CVSS)
- [CVE-2002-2148](https://cve.now/CVE-2002-2148.md): Lucent Ascend MAX Router 5.0 and earlier, Lucent Ascend Pipeline Router 6.0.2 and earlier and Lucent DSLTerminator allows remote attackers t (no CVSS)
- [CVE-2002-2149](https://cve.now/CVE-2002-2149.md): Buffer overflow in Lucent Access Point 300, 600, and 1500 Service Routers allows remote attackers to cause a denial of service (reboot) via (no CVSS)
- [CVE-2002-2150](https://cve.now/CVE-2002-2150.md): Firewalls from multiple vendors empty state tables more slowly than they are filled, which allows remote attackers to flood state tables wit (no CVSS)
- [CVE-2002-2152](https://cve.now/CVE-2002-2152.md): The Czech edition of Software602's Web Server before 2002.0.02.0916 allows remote attackers to gain administrator privileges via direct HTTP (no CVSS)
- [CVE-2002-2153](https://cve.now/CVE-2002-2153.md): Format string vulnerability in the administrative pages of the PL/SQL module for Oracle Application Server 4.0.8 and 4.0.8 2 allows remote a (no CVSS)
- [CVE-2002-2154](https://cve.now/CVE-2002-2154.md): Directory traversal vulnerability in Monkey HTTP Daemon 0.1.4 allows remote attackers to read arbitrary files via .. (no CVSS)
- [CVE-2002-2155](https://cve.now/CVE-2002-2155.md): Format string vulnerability in the error handling of IRC invite responses for Trillian 0.725 and 0.73 allows remote IRC servers to execute a (no CVSS)
- [CVE-2002-2156](https://cve.now/CVE-2002-2156.md): Buffer overflow in Trillian 0.73 allows remote IRC servers to execute arbitrary code via a long PING response. (no CVSS)
- [CVE-2002-2158](https://cve.now/CVE-2002-2158.md): zenTrack 2.0.3 and earlier allows remote attackers to obtain the full path to the web root via an invalid ticket ID, which leaks the path in (no CVSS)
- [CVE-2002-2159](https://cve.now/CVE-2002-2159.md): Linksys EtherFast Cable/DSL BEFSR11, BEFSR41 and BEFSRU31 with the firmware 1.42.7 upgrade installed opens TCP port 5678 for remote administ (no CVSS)
- [CVE-2002-2161](https://cve.now/CVE-2002-2161.md): Kerio Personal Firewall (KPF) 2.1.4 and earlier allows remote attackers to cause a denial of service (hang and CPU consumption) via a SYN pa (no CVSS)
- [CVE-2002-2162](https://cve.now/CVE-2002-2162.md): Cerulean Studios Trillian 0.73 and earlier use weak encrypttion (XOR) for storing user passwords in .ini files in the Trillian directory, wh (no CVSS)
- [CVE-2002-2163](https://cve.now/CVE-2002-2163.md): KvPoll 1.1 allows remote authenticated users to vote more than once by setting the "already\_voted" cookie by various methods, including a di (no CVSS)
- [CVE-2002-2164](https://cve.now/CVE-2002-2164.md): Buffer overflow in Microsoft Outlook Express 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (crash) via a long \<A HR (no CVSS)
- [CVE-2002-2165](https://cve.now/CVE-2002-2165.md): The IMHO Webmail module 0.97.3 and earlier for Roxen leaks the REFERER from the browser's previous login session in an error page, which all (no CVSS)
- [CVE-2002-2166](https://cve.now/CVE-2002-2166.md): Cross-site scripting (XSS) vulnerability in FuseTalk 2.0 and 3.0 allows remote attackers to insert arbitrary HTML and web script. (no CVSS)
- [CVE-2002-2167](https://cve.now/CVE-2002-2167.md): Directory traversal vulnerability in function\_foot\_1.inc.php for Thorsten Korner 123tkShop before 0.3.1 allows remote attackers to read arbi (no CVSS)
- [CVE-2002-2168](https://cve.now/CVE-2002-2168.md): SQL injection vulnerability in Thorsten Korner 123tkShop before 0.3.1 allows remote attackers to execute arbitrary SQL queries via various p (no CVSS)
- [CVE-2002-2169](https://cve.now/CVE-2002-2169.md): Cross-site scripting vulnerability AOL Instant Messenger (AIM) 4.5 and 4.7 for MacOS and Windows allows remote attackers to conduct unauthor (no CVSS)
- [CVE-2002-2170](https://cve.now/CVE-2002-2170.md): Working Resources Inc. (no CVSS)
- [CVE-2002-2171](https://cve.now/CVE-2002-2171.md): Cross-site scripting (XSS) vulnerability in acWEB 1.8 and 1.14 allows remote attackers to insert arbitrary HTML and web script via a URL, po (no CVSS)
- [CVE-2002-2172](https://cve.now/CVE-2002-2172.md): Informed (1) Designer and (2) Filler 3.05 does not zero out newly allocated disk blocks as an encrypted file grows in size, which may allow (no CVSS)
- [CVE-2002-2173](https://cve.now/CVE-2002-2173.md): Buffer overflow in the IRC module of Trillian 0.725 and 0.73 allowing remote attackers to execute arbitrary code via a long DCC Chat message (no CVSS)
- [CVE-2002-2174](https://cve.now/CVE-2002-2174.md): The Telnet proxy of 602Pro LAN SUITE 2002 does not restrict the number of outstanding connections to the local host, which allows remote att (no CVSS)
- [CVE-2002-2175](https://cve.now/CVE-2002-2175.md): phpSquidPass before 0.2 uses an incomplete regular expression to find a matching username in its database, which allows remote authenticated (no CVSS)
- [CVE-2002-2176](https://cve.now/CVE-2002-2176.md): SQL injection vulnerability in Gender MOD 1.1.3 allows remote attackers to gain administrative access via the user\_level parameter in the Us (no CVSS)
- [CVE-2002-2177](https://cve.now/CVE-2002-2177.md): BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two diff (no CVSS)
- [CVE-2002-2178](https://cve.now/CVE-2002-2178.md): Cross-site scripting (XSS) vulnerability in article.php module for phpWebSite 0.8.3 allows remote attackers to execute arbitrary Javascript (no CVSS)
- [CVE-2002-2179](https://cve.now/CVE-2002-2179.md): The dynamic initialization feature of the ClearPath MCP environment allows remote attackers to cause a denial of service (crash) via a TCP p (no CVSS)
- [CVE-2002-2180](https://cve.now/CVE-2002-2180.md): The setitimer(2) system call in OpenBSD 2.0 through 3.1 does not properly check certain arguments, which allows local users to write to kern (no CVSS)
- [CVE-2002-2181](https://cve.now/CVE-2002-2181.md): SonicWall Content Filtering allows local users to access prohibited web sites via requests to the web site's IP address instead of the domai (no CVSS)
- [CVE-2002-2182](https://cve.now/CVE-2002-2182.md): Buffer overflow in Seunghyun Seo's MSN666 MSN Sniffer 1.0 and 1.0.1 allows remote attackers to execute arbitrary code via a long MSN packet. (no CVSS)
- [CVE-2002-2183](https://cve.now/CVE-2002-2183.md): phpShare.php in phpShare before 0.6 beta 3 allows remote attackers to include and execute arbitrary PHP scripts from remote servers. (no CVSS)
- [CVE-2002-2184](https://cve.now/CVE-2002-2184.md): Digi-Net Technologies DigiChat 3.5 allows chat users to obtain the IP addresses of other chat users via a "Showip" parameter in the chat app (no CVSS)
- [CVE-2002-2185](https://cve.now/CVE-2002-2185.md): The Internet Group Management Protocol (IGMP) allows local users to cause a denial of service via an IGMP membership report to a target's Et (no CVSS)
- [CVE-2002-2186](https://cve.now/CVE-2002-2186.md): Macromedia JRun 3.0, 3.1, and 4.0 allow remote attackers to view the source code of .JSP files via Unicode encoded character values in a URL (no CVSS)
- [CVE-2002-2187](https://cve.now/CVE-2002-2187.md): Unknown "file disclosure" vulnerability in Macromedia JRun 3.0, 3.1, and 4.0, related to a log file or jrun.ini, with unknown impact. (no CVSS)
- [CVE-2002-2188](https://cve.now/CVE-2002-2188.md): OpenBSD before 3.2 allows local users to cause a denial of service (kernel crash) via a call to getrlimit(2) with invalid arguments, possibl (no CVSS)
- [CVE-2002-2189](https://cve.now/CVE-2002-2189.md): Cross-site scripting (XSS) vulnerability in ActiveXperts Software ActiveWebserver allows remote attackers to execute arbitrary web script vi (no CVSS)
- [CVE-2002-2190](https://cve.now/CVE-2002-2190.md): ArtsCore Studios CuteCast Forum 1.2 stores passwords in plaintext under the web document root, which allows remote attackers to obtain the p (no CVSS)
- [CVE-2002-2191](https://cve.now/CVE-2002-2191.md): Lotus Domino 5.0.9a and earlier, even when configured with the 'DominoNoBanner=1' option, allows remote attackers to obtain potential sensit (no CVSS)
- [CVE-2002-2192](https://cve.now/CVE-2002-2192.md): Cross-site scripting (XSS) vulnerability in Perception LiteServe 2.0.1 allows remote attackers to execute arbitrary web script via (1) a Hos (no CVSS)
- [CVE-2002-2193](https://cve.now/CVE-2002-2193.md): Cross-site scripting (XSS) vulnerability in mojo.cgi for Mojo Mail 2.7 allows remote attackers to inject arbitrary web script via the email (no CVSS)
- [CVE-2002-2195](https://cve.now/CVE-2002-2195.md): Buffer overflow in the version update check for Winamp 2.80 and earlier allows remote attackers who can spoof www.winamp.com to execute arbi (no CVSS)
- [CVE-2002-2196](https://cve.now/CVE-2002-2196.md): Samba before 2.2.5 does not properly terminate the enum\_csc\_policy data structure, which may allow remote attackers to execute arbitrary cod (no CVSS)
- [CVE-2002-2197](https://cve.now/CVE-2002-2197.md): Unknown vulnerability in Sun Solaris 8.0 allows local users to cause a denial of service (kernel panic) via a program that uses /dev/poll, t (no CVSS)
- [CVE-2002-2198](https://cve.now/CVE-2002-2198.md): Buffer overflow in ZMailer before 2.99.51\_1 allows remote attackers to execute arbitrary code during HELO processing from an IPv6 address, p (no CVSS)
- [CVE-2002-2199](https://cve.now/CVE-2002-2199.md): The default aide.conf file in Advanced Intrusion Detection Environment (AIDE) before 0.7\_1 on FreeBSD before 2002-08-28 does not properly ch (no CVSS)
- [CVE-2002-2200](https://cve.now/CVE-2002-2200.md): Benjamin Lefevre Dobermann FORUM 0.5 and earlier allows remote attackers to remotely include and execute malicious PHP files via the "subpat (no CVSS)
- [CVE-2002-2201](https://cve.now/CVE-2002-2201.md): The Printer Administration module for Webmin 0.990 and earlier allows remote attackers to execute arbitrary commands via shell metacharacter (no CVSS)
- [CVE-2002-2202](https://cve.now/CVE-2002-2202.md): Outlook Express 6.0 does not delete messages from dbx files, even when a user empties the Deleted items folder, which allows local users to (no CVSS)
- [CVE-2002-2203](https://cve.now/CVE-2002-2203.md): Unknown vulnerability in the System Serial Console terminal in Solaris 2.5.1, 2.6, and 7 allows local users to monitor keystrokes and possib (no CVSS)
- [CVE-2002-2204](https://cve.now/CVE-2002-2204.md): The default --checksig setting in RPM Package Manager 4.0.4 checks that a package's signature is valid without listing who signed it, which (no CVSS)
- [CVE-2002-2205](https://cve.now/CVE-2002-2205.md): Buffer overflow in Webresolve 0.1.0 and earlier allows remote attackers to execute arbitrary code by connecting to the server from an IP add (no CVSS)
- [CVE-2002-2206](https://cve.now/CVE-2002-2206.md): The POP3 proxy service (POPROXY.EXE) in Norton AntiVirus 2001 allows local users to cause a denial of service (CPU consumption and crash) vi (no CVSS)
- [CVE-2002-2207](https://cve.now/CVE-2002-2207.md): Buffer overflow in ssldump 0.9b2 and earlier, when running in decryption mode, allows remote attackers to execute arbitrary code via a long (no CVSS)
- [CVE-2005-3633](https://cve.now/CVE-2005-3633.md): HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to injec (no CVSS)
- [CVE-2005-3634](https://cve.now/CVE-2005-3634.md): frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect (no CVSS)
- [CVE-2005-3635](https://cve.now/CVE-2005-3635.md): Multiple cross-site scripting (XSS) vulnerabilities in SAP Web Application Server (WAS) 6.10 through 7.00 allow remote attackers to inject a (no CVSS)
- [CVE-2005-3636](https://cve.now/CVE-2005-3636.md): Cross-site scripting (XSS) vulnerability in SAP Web Application Server (WAS) 6.10 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2005-3638](https://cve.now/CVE-2005-3638.md): Cross-site scripting (XSS) vulnerabilities in Ekinboard 1.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) id p (no CVSS)
- [CVE-2005-3639](https://cve.now/CVE-2005-3639.md): PHP file inclusion vulnerability in the osTicket module in Help Center Live before 2.0.3 allows remote attackers to access or include arbitr (no CVSS)
- [CVE-2005-3640](https://cve.now/CVE-2005-3640.md): Multiple buffer overflows in the IMAP Groupware Mail server of Floosietek FTGate (FTGate4) 4.1 allow remote attackers to execute arbitrary c (no CVSS)
- [CVE-2005-3641](https://cve.now/CVE-2005-3641.md): Oracle Databases running on Windows XP with Simple File Sharing enabled, allows remote attackers to bypass authentication by supplying a val (no CVSS)
- [CVE-2005-3642](https://cve.now/CVE-2005-3642.md): IBM Informix Dynamic Database server running on Windows XP with Simple File Sharing enabled, allows remote attackers to bypass authenticatio (no CVSS)
- [CVE-2005-3643](https://cve.now/CVE-2005-3643.md): IBM DB2 Database server running on Windows XP with Simple File Sharing enabled, allows remote attackers to bypass authentication and log on (no CVSS)
- [CVE-2005-3621](https://cve.now/CVE-2005-3621.md): CRLF injection vulnerability in phpMyAdmin before 2.6.4-pl4 allows remote attackers to conduct HTTP response splitting attacks via unspecifi (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2005-3622](https://cve.now/CVE-2005-3622.md): phpMyAdmin 2.7.0-beta1 and earlier allows remote attackers to obtain the full path of the server via direct requests to multiple scripts in (no CVSS)
- [CVE-2002-2125](https://cve.now/CVE-2002-2125.md): Internet Explorer 6.0 does not warn users when an expired certificate authority (CA) certificate is submitted to the user and a newer CA cer (no CVSS)
- [CVE-2002-2126](https://cve.now/CVE-2002-2126.md): restrictEnabled in Integrity Protection Driver (IPD) 1.2 delays driver installation for 20 minutes, which allows local users to insert malic (no CVSS)
- [CVE-2002-2127](https://cve.now/CVE-2002-2127.md): Integrity Protection Driver (IPD) 1.2 and earlier blocks access to \\Device\\PhysicalMemory by its name, which could allow local privileged pr (no CVSS)
- [CVE-2002-2128](https://cve.now/CVE-2002-2128.md): editform.php in w-Agora 4.1.5 allows local users to execute arbitrary PHP code via .. (no CVSS)
- [CVE-2002-2129](https://cve.now/CVE-2002-2129.md): Cross-site scripting vulnerability (XSS) in editform.php for w-Agora 4.1.5 allows remote attackers to execute arbitrary web script via an ar (no CVSS)
- [CVE-2002-2130](https://cve.now/CVE-2002-2130.md): publish\_xp\_docs.php in Gallery 1.3.2 allows remote attackers to execute arbitrary PHP code by modifying the GALLERY\_BASEDIR parameter to ref (no CVSS)
- [CVE-2002-2131](https://cve.now/CVE-2002-2131.md): Directory traversal vulnerability in Perl-HTTPd before 1.0.2 allows remote attackers to view arbitrary files via a .. (no CVSS)
- [CVE-2002-2132](https://cve.now/CVE-2002-2132.md): Windows File Protection (WFP) in Windows 2000 and XP does not remove old security catalog .CAT files, which could allow local users to repla (no CVSS)
- [CVE-2002-2133](https://cve.now/CVE-2002-2133.md): Telindus 1100 ASDL router running firmware 6.0.x uses weak encryption for UDP session traffic, which allows remote attackers to gain unautho (no CVSS)
- [CVE-2002-2134](https://cve.now/CVE-2002-2134.md): haut.php in PEEL 1.0b allows remote attackers to execute arbitrary PHP code by modifying the dirroot parameter to reference a URL on a remot (no CVSS)
- [CVE-2003-1234](https://cve.now/CVE-2003-1234.md): Integer overflow in the f\_count counter in FreeBSD before 4.2 through 5.0 allows local users to cause a denial of service (crash) and possib (no CVSS)
- [CVE-2003-1235](https://cve.now/CVE-2003-1235.md): BRW WebWeaver 1.03 allows remote attackers to obtain sensitive server environment information via a URL request for testcgi.exe, which lists (no CVSS)
- [CVE-2003-1236](https://cve.now/CVE-2003-1236.md): Multiple format string vulnerabilities in the logger function in netzio.c for Tanne 0.6.17 allows remote attackers to execute arbitrary code (no CVSS)
- [CVE-2003-1237](https://cve.now/CVE-2003-1237.md): Cross-site scripting vulnerability (XSS) in WWWBoard 2.0A2.1 and earlier allows remote attackers to inject arbitrary HTML or web script via (no CVSS)
- [CVE-2003-1238](https://cve.now/CVE-2003-1238.md): Cross-site scripting vulnerability (XSS) in Nuked-Klan 1.3 beta and earlier allows remote attackers to steal authentication information via (no CVSS)
- [CVE-2003-1239](https://cve.now/CVE-2003-1239.md): Directory traversal vulnerability in sendphoto.php in WihPhoto 0.86 allows remote attackers to read arbitrary files via .. (no CVSS)
- [CVE-2003-1240](https://cve.now/CVE-2003-1240.md): PHP remote file inclusion vulnerability in CuteNews 0.88 allows remote attackers to execute arbitrary PHP code via a URL in the cutepath par (no CVSS)
- [CVE-2003-1241](https://cve.now/CVE-2003-1241.md): Cross-site scripting vulnerability (XSS) in (1) admin\_index.php, (2) admin\_pass.php, (3) admin\_modif.php, and (4) admin\_suppr.php in MyGuest (no CVSS)
- [CVE-2003-1242](https://cve.now/CVE-2003-1242.md): Sage 1.0 b3 allows remote attackers to obtain the root web server path via a URL request for a non-existent module, which returns the path i (no CVSS)
- [CVE-2003-1243](https://cve.now/CVE-2003-1243.md): Cross-site scripting vulnerability (XSS) in Sage 1.0 b3 allows remote attackers to insert arbitrary HTML or web script via the mod parameter (no CVSS)
- [CVE-2003-1244](https://cve.now/CVE-2003-1244.md): SQL injection vulnerability in page\_header.php in phpBB 2.0, 2.0.1 and 2.0.2 allows remote attackers to brute force user passwords and possi (no CVSS)
- [CVE-2003-1245](https://cve.now/CVE-2003-1245.md): index2.php in Mambo 4.0.12 allows remote attackers to gain administrator access via a URL request where session\_id is set to the MD5 hash of (no CVSS)
- [CVE-2003-1246](https://cve.now/CVE-2003-1246.md): NtCreateSymbolicLinkObject in ntdll.dll in Integrity Protection Driver (IPD) 1.2 and 1.3 allows local users to create and overwrite arbitrar (no CVSS)
- [CVE-2003-1247](https://cve.now/CVE-2003-1247.md): Multiple buffer overflows in H-Sphere WebShell 2.3 allow remote attackers to execute arbitrary code via (1) a long URL content type in CGI:: (no CVSS)
- [CVE-2003-1248](https://cve.now/CVE-2003-1248.md): H-Sphere WebShell 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) mode and (2) zipfile paramet (no CVSS)
- [CVE-2003-1249](https://cve.now/CVE-2003-1249.md): WebIntelligence 2.7.1 uses guessable user session cookies, which allows remote attackers to hijack sessions. (no CVSS)
- [CVE-2003-1250](https://cve.now/CVE-2003-1250.md): Efficient Networks 5861 DSL router, when running firmware 5.3.80 configured to block incoming TCP SYN, packets allows remote attackers to ca (no CVSS)
- [CVE-2003-1251](https://cve.now/CVE-2003-1251.md): The (1) menu.inc.php, (2) datasets.php and (3) mass\_operations.inc.php (mistakenly referred to as mass\_opeations.inc.php) scripts in N/X 200 (no CVSS)
- [CVE-2003-1252](https://cve.now/CVE-2003-1252.md): register.php in S8Forum 3.0 allows remote attackers to execute arbitrary PHP commands by creating a user whose name ends in a .php extension (no CVSS)
- [CVE-2003-1253](https://cve.now/CVE-2003-1253.md): PHP remote file inclusion vulnerability in Bookmark4U 1.8.3 allows remote attackers to execute arbitrary PHP code viaa URL in the prefix par (no CVSS)
- [CVE-2003-1254](https://cve.now/CVE-2003-1254.md): Active PHP Bookmarks (APB) 1.1.01 allows remote attackers to execute arbitrary PHP code via (1) head.php, (2) apb\_common.php, or (3) apb\_vie (no CVSS)
- [CVE-2003-1255](https://cve.now/CVE-2003-1255.md): add\_bookmark.php in Active PHP Bookmarks (APB) 1.1.01 allows remote attackers to add arbitrary bookmarks as other users using a modified aut (no CVSS)
- [CVE-2003-1256](https://cve.now/CVE-2003-1256.md): aff\_liste\_langue.php in E-theni allows remote attackers to execute arbitrary PHP code by modifying the rep\_include parameter to reference a (no CVSS)
- [CVE-2003-1257](https://cve.now/CVE-2003-1257.md): find\_theni\_home.php in E-theni allows remote attackers to obtain sensitive system information via a URL request which executes phpinfo. (no CVSS)
- [CVE-2003-1258](https://cve.now/CVE-2003-1258.md): activate.php in versatileBulletinBoard (vBB) 0.9.5 and 0.9.6 allows remote attackers to gain unauthorized administrative access via a URL re (no CVSS)
- [CVE-2003-1259](https://cve.now/CVE-2003-1259.md): Buffer overflow in CuteFTP 4.2 and 5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (no CVSS)
- [CVE-2003-1260](https://cve.now/CVE-2003-1260.md): Buffer overflow in CuteFTP 5.0 allows remote attackers to execute arbitrary code via a long response to a LIST command. (no CVSS)
- [CVE-2003-1261](https://cve.now/CVE-2003-1261.md): Buffer overflow in CuteFTP 5.0 and 5.0.1 allows local users to cause a denial of service (crash) by copying a long URL into a clipboard. (no CVSS)
- [CVE-2003-1262](https://cve.now/CVE-2003-1262.md): Buffer overflow in the http\_fetch function of HTTP Fetcher 1.0.0 and 1.0.1 allows remote attackers to cause a denial of service (crash) and (no CVSS)
- [CVE-2003-1263](https://cve.now/CVE-2003-1263.md): ICAL.EXE in iCal 3.7 allows remote attackers to cause a denial of service (crash) via a malformed HTTP request, possibly due to an invalid m (no CVSS)
- [CVE-2003-1264](https://cve.now/CVE-2003-1264.md): TFTP server in Longshine Wireless Access Point (WAP) LCS-883R-AC-B, and in D-Link DI-614+ 2.0 which is based on it, allows remote attackers (no CVSS)
- [CVE-2003-1265](https://cve.now/CVE-2003-1265.md): Netscape 7.0 and Mozilla 5.0 do not immediately delete messages in the trash folder when users select the 'Empty Trash' option, which could (no CVSS)
- [CVE-2003-1266](https://cve.now/CVE-2003-1266.md): The (1) FTP, (2) POP3, (3) SMTP, and (4) NNTP servers in EServer 2.92 through 2.97, and possibly 2.98, allow remote attackers to cause a den (no CVSS)
- [CVE-2003-1267](https://cve.now/CVE-2003-1267.md): GuildFTPd 0.999 allows remote attackers to cause a denial of service (crash) via a GET request for MS-DOS device names such as lpt1. (no CVSS)
- [CVE-2003-1268](https://cve.now/CVE-2003-1268.md): Multiple SQL injection vulnerabilities in (1) addcustomer.asp, (2) addprod.asp, and (3) process.asp in a.shopKart 2.0.3 allow remote attacke (no CVSS)
- [CVE-2003-1269](https://cve.now/CVE-2003-1269.md): AN HTTP 1.41e allows remote attackers to obtain the root web server path via an HTTP request with a long argument to a script, which leaks t (no CVSS)
- [CVE-2003-1270](https://cve.now/CVE-2003-1270.md): AN HTTP 1.41e allows remote attackers to cause a denial of service (borken pipe) via an HTTP request to aux.cgi with a long argument, possib (no CVSS)
- [CVE-2003-1271](https://cve.now/CVE-2003-1271.md): Cross-site scripting vulnerability (XSS) in AN HTTP 1.41e allows remote attackers to execute arbitrary web script or HTML as other users via (no CVSS)
- [CVE-2003-1272](https://cve.now/CVE-2003-1272.md): Multiple buffer overflows in Winamp 3.0 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (no CVSS)
- [CVE-2003-1273](https://cve.now/CVE-2003-1273.md): Winamp 3.0 allows remote attackers to cause a denial of service (crash) via a .b4s file with a playlist name that contains some non-English (no CVSS)
- [CVE-2003-1274](https://cve.now/CVE-2003-1274.md): Winamp 3.0 allows remote attackers to cause a denial of service (crash) via .b4s file with a file: argument to the Playstring parameter that (no CVSS)
- [CVE-2003-1275](https://cve.now/CVE-2003-1275.md): Pocket Internet Explorer (PIE) 3.0 allows remote attackers to cause a denial of service (crash) via a Javascript function that uses the obje (no CVSS)
- [CVE-2003-1276](https://cve.now/CVE-2003-1276.md): Netfone.exe of NetTelephone 3.5.6 uses weak encryption for user PIN's and stores user account numbers in plaintext in the HKEY\_CURRENT\_USER\\ (no CVSS)
- [CVE-2003-1277](https://cve.now/CVE-2003-1277.md): Cross-site scripting (XSS) vulnerabilities in Yet Another Bulletin Board (YaBB) 1.5.0 allow remote attackers to execute arbitrary script as (no CVSS)
- [CVE-2003-1278](https://cve.now/CVE-2003-1278.md): Cross-site scripting vulnerability (XSS) in OpenTopic 2.3.1 allows remote attackers to execute arbitrary script as other users and possibly (no CVSS)
- [CVE-2003-1279](https://cve.now/CVE-2003-1279.md): S-PLUS 6.0 allows local users to overwrite arbitrary files and possibly elevate privileges via a symlink attack on (1) /tmp/\_\_F8499 by Sqpe, (no CVSS)
- [CVE-2003-1280](https://cve.now/CVE-2003-1280.md): Directory traversal vulnerability in cgihtml 1.69 allows remote attackers to overwrite and create arbitrary files via a .. (no CVSS)
- [CVE-2003-1281](https://cve.now/CVE-2003-1281.md): cgihtml 1.69 allows local users to overwrite arbitrary files via a symlink attack on certain temporary files. (no CVSS)
- [CVE-2003-1282](https://cve.now/CVE-2003-1282.md): IBM Net.Data allows remote attackers to obtain sensitive information such as path names, server names and possibly user names and passwords (no CVSS)
- [CVE-2003-1283](https://cve.now/CVE-2003-1283.md): KaZaA Media Desktop (KMD) 2.0 launches advertisements in the Internet Explorer (IE) local security zone, which could allow remote attackers (no CVSS)
- [CVE-2004-2540](https://cve.now/CVE-2004-2540.md): readObject in (1) Java Runtime Environment (JRE) and (2) Software Development Kit (SDK) 1.4.0 through 1.4.2\_05 allows remote attackers to ca (no CVSS)
- [CVE-2005-2659](https://cve.now/CVE-2005-2659.md): Buffer overflow in the LZX decompression in CHM Lib (chmlib) 0.35, as used in products such as KchmViewer, has unknown impact and attack vec (no CVSS)
- [CVE-2005-3344](https://cve.now/CVE-2005-3344.md): The default installation of Horde 3.0.4 contains an administrative account with a blank password, which allows remote attackers to gain acce (no CVSS)
- [CVE-2005-3543](https://cve.now/CVE-2005-3543.md): SQL injection vulnerability in search.php in Phorum 5.0.0alpha through 5.0.20, when register\_globals is enabled, allows remote attackers to (no CVSS)
- [CVE-2005-3544](https://cve.now/CVE-2005-3544.md): Cross-site scripting (XSS) vulnerability in u2u.php in XMB 1.9.3 allows remote attackers to inject arbitrary web script or HTML via the user (no CVSS)
- [CVE-2005-3545](https://cve.now/CVE-2005-3545.md): SQL injection vulnerability in index.php of the report module in ibProArcade 2.5.2 and earlier allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2005-3546](https://cve.now/CVE-2005-3546.md): suid.cgi scripts in F-Secure (1) Internet Gatekeeper for Linux before 2.15.484 and (2) Anti-Virus Linux Gateway before 2.16 are installed SU (no CVSS)
- [CVE-2005-3547](https://cve.now/CVE-2005-3547.md): Cross-site scripting (XSS) vulnerability in Invision Power Board 2.1 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2005-3548](https://cve.now/CVE-2005-3548.md): Directory traversal vulnerability in Task Manager in Invision Power Board (IP.Board) 2.0.1 allows limited remote attackers to include files (no CVSS)
- [CVE-2005-3549](https://cve.now/CVE-2005-3549.md): Direct code injection vulnerability in Task Manager in Invision Power Board 2.0.1 allows limited remote attackers to execute arbitrary code (no CVSS)
- [CVE-2005-3550](https://cve.now/CVE-2005-3550.md): Directory traversal vulnerability in admin.php in toendaCMS before 0.6.2 allows remote attackers to access arbitrary files via a .. (no CVSS)
- [CVE-2005-3551](https://cve.now/CVE-2005-3551.md): toendaCMS before 0.6.2 stores user account and session data in the web root directory, which allows remote attackers to obtain sensitive inf (no CVSS)
- [CVE-2005-3552](https://cve.now/CVE-2005-3552.md): Multiple cross-site scripting (XSS) vulnerabilities in PHPKIT 1.6.1 R2 and earlier allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2005-3553](https://cve.now/CVE-2005-3553.md): Multiple SQL injection vulnerabilities in include.php in PHPKIT 1.6.1 R2 and earlier allow remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2005-3554](https://cve.now/CVE-2005-3554.md): Multiple eval injection vulnerabilities in the help function in PHPKIT 1.6.1 R2 and earlier, when register\_globals is enabled, allow remote (no CVSS)
- [CVE-2005-3555](https://cve.now/CVE-2005-3555.md): Multiple SQL injection vulnerabilities in PHPlist 2.10.1 and earlier allow authenticated remote attackers with administrator privileges to e (no CVSS)
- [CVE-2005-3556](https://cve.now/CVE-2005-3556.md): Multiple cross-site scripting (XSS) vulnerabilities in PHPlist 2.10.1 and earlier allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2005-3557](https://cve.now/CVE-2005-3557.md): Directory traversal vulnerability in admin/defaults.php in PHPlist 2.10.1 and earlier allows remote attackers to access arbitrary files via (no CVSS)
- [CVE-2005-3558](https://cve.now/CVE-2005-3558.md): PHP file inclusion vulnerability in index.php in OSTE 1.0 allows remote attackers to execute arbitrary code via the (1) page and (2) site pa (no CVSS)
- [CVE-2005-3559](https://cve.now/CVE-2005-3559.md): Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a .. (no CVSS)
- [CVE-2005-3560](https://cve.now/CVE-2005-3560.md): Zone Labs (1) ZoneAlarm Pro 6.0, (2) ZoneAlarm Internet Security Suite 6.0, (3) ZoneAlarm Anti-Virus 6.0, (4) ZoneAlarm Anti-Spyware 6.0 thr (no CVSS)
- [CVE-2005-3564](https://cve.now/CVE-2005-3564.md): envd daemon in HP-UX B.11.00 through B.11.11 allows local users to obtain privileges via unknown attack vectors. (no CVSS)
- [CVE-2005-3565](https://cve.now/CVE-2005-3565.md): Unknown vulnerability in remshd daemon in HP-UX B.11.00, B.11.11, and B.11.23 while running in "Trusted Mode" allows remote attackers to gai (no CVSS)
- [CVE-2005-3566](https://cve.now/CVE-2005-3566.md): Buffer overflow in various ha commands of VERITAS Cluster Server for UNIX before 4.0MP2 allows local users to execute arbitrary code via a l (no CVSS)
- [CVE-2005-3567](https://cve.now/CVE-2005-3567.md): slapd daemon in IBM Tivoli Directory Server (ITDS) 5.2.0 and 6.0.0 binds using SASL EXTERNAL, which allows attackers to bypass authenticatio (no CVSS)
- [CVE-2005-3568](https://cve.now/CVE-2005-3568.md): db2fmp process in IBM DB2 Content Manager before 8.2 Fix Pack 10 allows local users to cause a denial of service (CPU consumption) by import (no CVSS)
- [CVE-2005-3569](https://cve.now/CVE-2005-3569.md): INSO service in IBM DB2 Content Manager before 8.2 Fix Pack 10 on AIX allows attackers to cause a denial of service (application crash) via (no CVSS)
- [CVE-2005-3570](https://cve.now/CVE-2005-3570.md): Unspecified cross-site scripting (XSS) vulnerability in Horde before 2.2.9 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2005-3571](https://cve.now/CVE-2005-3571.md): PHP file inclusion vulnerability in protection.php in CodeGrrl (a) PHPCalendar 1.0, (b) PHPClique 1.0, (c) PHPCurrently 2.0, (d) PHPFanBase (no CVSS)
- [CVE-2005-3572](https://cve.now/CVE-2005-3572.md): SQL injection vulnerability in index.php in Peel 2.6 through 2.7 allows remote attackers to execute arbitrary SQL commands via the rubid par (no CVSS)
- [CVE-2005-3573](https://cve.now/CVE-2005-3573.md): Scrubber.py in Mailman 2.1.5-8 does not properly handle UTF8 character encodings in filenames of e-mail attachments, which allows remote att (no CVSS)
- [CVE-2005-3574](https://cve.now/CVE-2005-3574.md): PHP file inclusion vulnerability in index.php of iCMS allows remote attackers to include arbitrary files via the page parameter. (no CVSS)
- [CVE-2005-3575](https://cve.now/CVE-2005-3575.md): SQL injection vulnerability in show.php in Cyphor 0.19 and earlier allows remote attackers to execute arbitrary SQL commands via the id para (no CVSS)
- [CVE-2005-3576](https://cve.now/CVE-2005-3576.md): ts.exe in Walla TeleSite 3.0 and earlier allows remote attackers to access privileged information by entering the article number in tsurl pa (no CVSS)
- [CVE-2005-3577](https://cve.now/CVE-2005-3577.md): Cross-site scripting vulnerability (XSS) in ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2005-3578](https://cve.now/CVE-2005-3578.md): SQL injection vulnerability in ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to inject arbitrary SQL command (no CVSS)
- [CVE-2005-3579](https://cve.now/CVE-2005-3579.md): ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to access arbitrary local files via the querystring. (no CVSS)
- [CVE-2005-3580](https://cve.now/CVE-2005-3580.md): QDBM before 1.8.33-r2 allows local users in the portage group to increase privileges via a shared object in the Portage temporary build dire (no CVSS)
- [CVE-2005-3581](https://cve.now/CVE-2005-3581.md): GDAL before 1.3.0-r1 allows local users in the portage group to increase privileges via a shared object in the Portage temporary build direc (no CVSS)
- [CVE-2005-3582](https://cve.now/CVE-2005-3582.md): ImageMagick before 6.2.4.2-r1 allows local users in the portage group to increase privileges via a shared object in the Portage temporary bu (no CVSS)
- [CVE-2005-3583](https://cve.now/CVE-2005-3583.md): (1) Java Runtime Environment (JRE) and (2) Software Development Kit (SDK) 1.4.2\_08, 1.4.2\_09, and 1.5.0\_05 and possibly other versions allow (no CVSS)
- [CVE-2005-3584](https://cve.now/CVE-2005-3584.md): Cross-site scripting (XSS) vulnerability in forum.php in PhpWebThings 1.4.4 allows remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2005-3585](https://cve.now/CVE-2005-3585.md): SQL injection vulnerability in forum.php in PhpWebThings 1.4.4 allows remote attackers to execute arbitrary SQL commands via the forum param (no CVSS)
- [CVE-2005-3586](https://cve.now/CVE-2005-3586.md): content.php in Mambo 4.5.2 through 4.5.2.3 allows remote attackers to obtain the installation path of the application via a URL that causes (no CVSS)
- [CVE-2005-3587](https://cve.now/CVE-2005-3587.md): Improper boundary checks in petite.c in Clam AntiVirus (ClamAV) before 0.87.1 allows attackers to perform unknown attacks via unknown vector (no CVSS)
- [CVE-2005-3588](https://cve.now/CVE-2005-3588.md): SQL injection vulnerability in admin.php in Advanced Guestbook 2.2 allows remote attackers to execute arbitrary SQL commands and gain privil (no CVSS)
- [CVE-2005-3589](https://cve.now/CVE-2005-3589.md): Buffer overflow in FileZilla Server Terminal 0.9.4d may allow remote attackers to cause a denial of service (terminal crash) via a long USER (no CVSS)
- [CVE-2005-3591](https://cve.now/CVE-2005-3591.md): Macromedia Flash plugin (1) Flash.ocx 7.0.19.0 (Windows) and earlier and (2) libflashplayer.so before 7.0.25.0 (Unix) allows remote attacker (no CVSS)
- [CVE-2005-3592](https://cve.now/CVE-2005-3592.md): index.php CuteNews 1.4.0 and earlier allows remote attackers to obtain the path of the installation path of the application by triggering an (no CVSS)
- [CVE-2005-3594](https://cve.now/CVE-2005-3594.md): game\_score.php in e107 allows remote attackers to insert high scores via HTTP POST methods utilizing the $player\_name, $player\_score, and $g (no CVSS)
- [CVE-2005-3595](https://cve.now/CVE-2005-3595.md): By default Microsoft Windows XP Home Edition installs with a blank password for the Administrator account, which allows remote attackers to (no CVSS)
- [CVE-2005-3596](https://cve.now/CVE-2005-3596.md): SQL injection vulnerability in ASPKnowledgebase allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-11-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.