# CVEs published 2005-11-22

52 CVEs were published on November 22, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2005-3760](https://cve.now/CVE-2005-3760.md): Double free vulnerability in the BBOORB module in IBM WebSphere Application Server for z/OS 5.0 allows attackers to cause a denial of servic (no CVSS)
- [CVE-2005-3761](https://cve.now/CVE-2005-3761.md): Cross-site scripting (XSS) vulnerability in Exponent CMS 0.96.3 and later versions allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2005-3762](https://cve.now/CVE-2005-3762.md): SQL injection vulnerability in the navigation module (navigationmodule) in Exponent CMS 0.96.3 and later versions allows remote attackers to (no CVSS)
- [CVE-2005-3763](https://cve.now/CVE-2005-3763.md): Exponent CMS 0.96.3 and later versions includes the full installation path in the base parameter to thumb.php, which allows remote attackers (no CVSS)
- [CVE-2005-3764](https://cve.now/CVE-2005-3764.md): The image gallery (imagegallery) component in Exponent CMS 0.96.3 and later versions does not properly check the MIME type of uploaded files (no CVSS)
- [CVE-2005-3765](https://cve.now/CVE-2005-3765.md): Exponent CMS 0.96.3 and later versions performs a chmod on uploaded files to give them execute permissions, which allows remote attackers to (no CVSS)
- [CVE-2005-3766](https://cve.now/CVE-2005-3766.md): Exponent CMS 0.96.3 and later versions stores sensitive user pages under the web document root with insufficient access control even though (no CVSS)
- [CVE-2005-3767](https://cve.now/CVE-2005-3767.md): Exponent CMS 0.96.3 and later versions does not properly restrict the types of uploaded files, which allows remote attackers to upload and e (no CVSS)
- [CVE-2005-3754](https://cve.now/CVE-2005-3754.md): Cross-site scripting (XSS) vulnerability in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to i (no CVSS)
- [CVE-2005-3755](https://cve.now/CVE-2005-3755.md): Directory traversal vulnerability in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to determin (no CVSS)
- [CVE-2005-3756](https://cve.now/CVE-2005-3756.md): Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to port scan arbitrary hosts via URLs with modif (no CVSS)
- [CVE-2005-3757](https://cve.now/CVE-2005-3757.md): The Saxon XSLT parser in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to obtain sensitive inf (no CVSS)
- [CVE-2005-3758](https://cve.now/CVE-2005-3758.md): Cross-site scripting (XSS) vulnerability in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to i (no CVSS)
- [CVE-2005-3759](https://cve.now/CVE-2005-3759.md): Multiple cross-site scripting (XSS) vulnerabilities in Horde before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2005-3751](https://cve.now/CVE-2005-3751.md): HTTP request smuggling vulnerability in Pound before 1.9.4 allows remote attackers to poison web caches, bypass web application firewall pro (no CVSS)
- [CVE-2005-3752](https://cve.now/CVE-2005-3752.md): Unspecified vulnerability in ldapdiff before 1.1.1 has unknown impact and attack vectors, related to "ldapdiff.conf path construction". (no CVSS)
- [CVE-2005-3753](https://cve.now/CVE-2005-3753.md): Linux kernel before after 2.6.12 and before 2.6.13.1 might allow attackers to cause a denial of service (Oops) via certain IPSec packets tha (no CVSS)
- [CVE-2005-3750](https://cve.now/CVE-2005-3750.md): Opera before 8.51 on Linux and Unix systems allows remote attackers to execute arbitrary code via shell metacharacters (backticks) in a URL (no CVSS)
- [CVE-2005-3738](https://cve.now/CVE-2005-3738.md): globals.php in Mambo Site Server 4.0.14 and earlier, when register\_globals is disabled, allows remote attackers to overwrite variables in th (no CVSS)
- [CVE-2005-3739](https://cve.now/CVE-2005-3739.md): Unspecified vulnerability in subheader.php in PHP-Fusion 6.00.206 and earlier allows remote attackers to obtain the full path via unspecifie (no CVSS)
- [CVE-2005-3740](https://cve.now/CVE-2005-3740.md): Multiple SQL injection vulnerabilities in PHP-Fusion 6.00.206 and earlier allow remote attackers to execute arbitrary SQL commands via (1) t (no CVSS)
- [CVE-2005-3741](https://cve.now/CVE-2005-3741.md): Almond Classifieds does not properly verify the password, which allows attackers to bypass access restrictions. (no CVSS)
- [CVE-2005-3742](https://cve.now/CVE-2005-3742.md): Cross-site scripting (XSS) vulnerability in popup.php in Advanced Poll 2.0.3 and earlier allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2005-3743](https://cve.now/CVE-2005-3743.md): SQL injection vulnerability in results.php in SimplePoll allows remote attackers to execute arbitrary SQL commands via the pollid parameter. (no CVSS)
- [CVE-2005-3744](https://cve.now/CVE-2005-3744.md): SQL injection vulnerability in index.php in phpComasy 0.7.5 and earlier allows remote attackers to execute arbitrary SQL commands via the id (no CVSS)
- [CVE-2005-3745](https://cve.now/CVE-2005-3745.md): Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web (no CVSS, org.apache.struts:struts-core)
- [CVE-2005-3746](https://cve.now/CVE-2005-3746.md): SQL injection vulnerability in thread.php in APBoard allows remote attackers to execute arbitrary SQL commands via the start parameter. (no CVSS)
- [CVE-2005-3747](https://cve.now/CVE-2005-3747.md): Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, possibly involving requests for (no CVSS, org.mortbay.jetty:jetty)
- [CVE-2005-3748](https://cve.now/CVE-2005-3748.md): SQL injection vulnerability in the Search module in Tru-Zone Nuke ET 3.2, and possibly earlier versions, allows remote attackers to execute (no CVSS)
- [CVE-2005-3749](https://cve.now/CVE-2005-3749.md): Unspecified "absolute path vulnerabilities" in the diagela command (diagela.sh) in IBM AIX 5.2 and 5.3 have unknown impact and attack vector (no CVSS)
- [CVE-2003-1284](https://cve.now/CVE-2003-1284.md): Sambar Server before 6.0 beta 6 allows remote attackers to obtain sensitive information via direct requests to the default scripts (1) envir (no CVSS)
- [CVE-2003-1285](https://cve.now/CVE-2003-1285.md): Multiple cross-site scripting (XSS) vulnerabilities in Sambar Server before 6.0 beta 6 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2003-1286](https://cve.now/CVE-2003-1286.md): HTTP Proxy in Sambar Server before 6.0 beta 6, when security.ini lacks a 127.0.0.1 proxydeny entry, allows remote attackers to send proxy HT (no CVSS)
- [CVE-2003-1287](https://cve.now/CVE-2003-1287.md): Sambar Server before 6.0 beta 3 allows attackers with physical access to execute arbitrary code via a request with an MS-DOS device name suc (no CVSS)
- [CVE-2004-2559](https://cve.now/CVE-2004-2559.md): DokuWiki before 2004-10-19 allows remote attackers to access administrative functionality including (1) Mediaselectiondialog, (2) Recent cha (no CVSS)
- [CVE-2004-2560](https://cve.now/CVE-2004-2560.md): DokuWiki before 2004-10-19, when used on a web server that permits execution based on file extension, allows remote attackers to execute arb (no CVSS)
- [CVE-2004-2561](https://cve.now/CVE-2004-2561.md): Multiple SQL injection vulnerabilities in Internet Software Sciences Web+Center 4.0.1 allow remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2004-2562](https://cve.now/CVE-2004-2562.md): SQL injection vulnerability in jobedit.asp in Leigh Business Enterprises (LBE) Web Helpdesk before 4.0.0.81 allows remote attackers to execu (no CVSS)
- [CVE-2004-2563](https://cve.now/CVE-2004-2563.md): Serena TeamTrack 6.1.1 allows remote attackers to obtain sensitive information such as user names, versions, and database information, and c (no CVSS)
- [CVE-2004-2564](https://cve.now/CVE-2004-2564.md): Multiple cross-site scripting (XSS) vulnerabilities in Sambar Server 6.1 Beta 2 on Windows, and possibly other versions on Linux, allow remo (no CVSS)
- [CVE-2004-2565](https://cve.now/CVE-2004-2565.md): Multiple directory traversal vulnerabilities in Sambar Server 6.1 Beta 2 on Windows, and possibly other versions on Linux, when the administ (no CVSS)
- [CVE-2004-2566](https://cve.now/CVE-2004-2566.md): Multiple cross-site scripting (XSS) vulnerabilities in LiveWorld products, possibly including (1) LiveForum, (2) LiveQ&A, (3) LiveChat, and (no CVSS)
- [CVE-2004-2567](https://cve.now/CVE-2004-2567.md): Multiple SQL injection vulnerabilities in ReciPants 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) user id, (2) (no CVSS)
- [CVE-2004-2568](https://cve.now/CVE-2004-2568.md): Multiple cross-site scripting (XSS) vulnerabilities in ReciPants 1.1.1 allow remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2004-2569](https://cve.now/CVE-2004-2569.md): ipmenu 0.0.3 before Debian GNU/Linux ipmenu\_0.0.3-5 allows local users to overwrite arbitrary files via a symlink attack on the ipmenu.log t (no CVSS)
- [CVE-2004-2570](https://cve.now/CVE-2004-2570.md): Opera before 7.54 allows remote attackers to modify properties and methods of the location object and execute Javascript to read arbitrary f (no CVSS)
- [CVE-2004-2571](https://cve.now/CVE-2004-2571.md): Multiple buffer overflows in EnderUNIX isoqlog 2.1.1 allow remote attackers to execute arbitrary code via the (1) parseQmailFromBytesLine, ( (no CVSS)
- [CVE-2004-2572](https://cve.now/CVE-2004-2572.md): AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering (1) invalid characters such as "()" or (2) (no CVSS)
- [CVE-2005-3734](https://cve.now/CVE-2005-3734.md): Cross-site scripting (XSS) vulnerability in the "add content" page in phpMyFAQ 1.5.3 and earlier allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2005-3735](https://cve.now/CVE-2005-3735.md): Multiple SQL injection vulnerabilities in e-Quick Cart allow remote attackers to execute arbitrary SQL commands via the (1) productid parame (no CVSS)
- [CVE-2005-3736](https://cve.now/CVE-2005-3736.md): Multiple cross-site scripting (XSS) vulnerabilities in e-Quick Cart allow remote attackers to inject arbitrary web script or HTML via the (1 (no CVSS)
- [CVE-2005-3737](https://cve.now/CVE-2005-3737.md): Buffer overflow in the SVG importer (style.cpp) of inkscape 0.41 through 0.42.2 might allow remote attackers to execute arbitrary code via a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-11-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.