# CVEs published 2005-11-29

61 CVEs were published on November 29, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2005-3902](https://cve.now/CVE-2005-3902.md): Cross-site scripting (XSS) vulnerability in gui/errordocs/index.php in Virtual Hosting Control System (VHCS) 2.2.0 through 2.4.6.2 allows re (no CVSS)
- [CVE-2005-3900](https://cve.now/CVE-2005-3900.md): Macromedia Breeze Communication Server and Breeze Live Server does 5.1 and earlier not sufficiently validate certain RTMP data, which allows (no CVSS)
- [CVE-2005-3901](https://cve.now/CVE-2005-3901.md): Macromedia Flash Communication Server MX 1.0 and 1.5 does not sufficiently validate certain RTMP data, which allows attackers to cause a den (no CVSS)
- [CVE-2005-2123](https://cve.now/CVE-2005-2123.md): Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remot (no CVSS)
- [CVE-2005-2124](https://cve.now/CVE-2005-2124.md): Unspecified vulnerability in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1, related to (no CVSS)
- [CVE-2005-3887](https://cve.now/CVE-2005-3887.md): Gadu-Gadu 7.20 does not properly handle MS-DOS device names in filenames, which allows remote attackers to (1) cause a denial of service (ha (no CVSS)
- [CVE-2005-3888](https://cve.now/CVE-2005-3888.md): Memory leak in Gadu-Gadu 7.20 allows remote attackers to cause a denial of service via multiple DCC packets with a code other than 2 and a l (no CVSS)
- [CVE-2005-3889](https://cve.now/CVE-2005-3889.md): Gadu-Gadu 7.20 allows remote attackers to cause a denial of service via multiple DCC packets with a code of 6 or 7, which triggers a large n (no CVSS)
- [CVE-2005-3890](https://cve.now/CVE-2005-3890.md): Gadu-Gadu 7.20 allows remote attackers to cause a denial of service (crash and configuration loss) via a page with a large number of gg: URI (no CVSS)
- [CVE-2005-3891](https://cve.now/CVE-2005-3891.md): Stack-based buffer overflow in Gadu-Gadu 7.20 allows remote attackers to cause a denial of service (crash) via an image filename between exa (no CVSS)
- [CVE-2005-3892](https://cve.now/CVE-2005-3892.md): Gadu-Gadu 7.20 allows remote attackers to eavesdrop on a user via a web page that accesses the EasycallLite.oce ActiveX control, which can i (no CVSS)
- [CVE-2005-3893](https://cve.now/CVE-2005-3893.md): Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow re (no CVSS)
- [CVE-2005-3894](https://cve.now/CVE-2005-3894.md): Multiple cross-site scripting (XSS) vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2 (no CVSS)
- [CVE-2005-3895](https://cve.now/CVE-2005-3895.md): Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, when AttachmentDownloadType is set to inline, renders text/ht (no CVSS)
- [CVE-2005-3896](https://cve.now/CVE-2005-3896.md): Mozilla allows remote attackers to cause a denial of service (CPU consumption) via a Javascript BODY onload event that calls the window func (no CVSS)
- [CVE-2005-3897](https://cve.now/CVE-2005-3897.md): Apple Safari 2.0.2 allows remote attackers to cause a denial of service (system slowdown) via a Javascript BODY onload event that calls the (no CVSS)
- [CVE-2005-3899](https://cve.now/CVE-2005-3899.md): The automatic update feature in Google Talk allows remote attackers to cause a denial of service (CPU and memory consumption) by poisoning a (no CVSS)
- [CVE-2005-3886](https://cve.now/CVE-2005-3886.md): Unspecified vulnerability in Cisco Security Agent (CSA) 4.5.0 and 4.5.1 agents, when running on Windows systems, allows local users to bypas (no CVSS)
- [CVE-2005-3885](https://cve.now/CVE-2005-3885.md): The ps2epsi extension shell script (ps2epsi.sh) in Inkscape before 0.41 allows local users to overwrite arbitrary files via a symlink attack (no CVSS)
- [CVE-2005-3859](https://cve.now/CVE-2005-3859.md): PHP remote file inclusion vulnerability in q-news.php in Q-News 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the i (no CVSS)
- [CVE-2005-3860](https://cve.now/CVE-2005-3860.md): PHP remote file inclusion vulnerability in athena.php in Oliver May Athena PHP Website Administration 0.1a allows remote attackers to execut (no CVSS)
- [CVE-2005-3861](https://cve.now/CVE-2005-3861.md): PHP remote file inclusion vulnerability in content.php in phpGreetz 0.99 and earlier allows remote attackers to execute arbitrary PHP code v (no CVSS)
- [CVE-2005-3862](https://cve.now/CVE-2005-3862.md): Buffer overflow in unalz before 0.53 allows remote attackers to execute arbitrary code via long file names in ALZ archives. (no CVSS)
- [CVE-2005-3863](https://cve.now/CVE-2005-3863.md): Stack-based buffer overflow in kkstrtext.h in ktools library 0.3 and earlier, as used in products such as (1) centericq, (2) orpheus, (3) mo (no CVSS)
- [CVE-2005-3864](https://cve.now/CVE-2005-3864.md): SQL injection vulnerability in index.php in SourceWell 1.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the c (no CVSS)
- [CVE-2005-3865](https://cve.now/CVE-2005-3865.md): SQL injection vulnerability in index.php in AllWeb search 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2005-3866](https://cve.now/CVE-2005-3866.md): Cross-site scripting (XSS) vulnerability in SearchFeed Search Engine 1.3.2 and earlier allows remote attackers to inject arbitrary HTML and (no CVSS)
- [CVE-2005-3867](https://cve.now/CVE-2005-3867.md): Cross-site scripting (XSS) vulnerability in RevenuePilot Search Engine Script 1.2.0 and earlier allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2005-3868](https://cve.now/CVE-2005-3868.md): Multiple SQL injection vulnerabilities in K-Search 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) term (no CVSS)
- [CVE-2005-3869](https://cve.now/CVE-2005-3869.md): Cross-site scripting (XSS) vulnerability in index.php in Google API Search 1.3.1 and earlier allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2005-3870](https://cve.now/CVE-2005-3870.md): Multiple SQL injection vulnerabilities in edmobbs9r.php in edmoBBS 0.9 and earlier allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2005-3871](https://cve.now/CVE-2005-3871.md): Multiple SQL injection vulnerabilities in Joels Bulletin board (JBB) 0.9.9rc3 and earlier allow remote attackers to execute arbitrary SQL co (no CVSS)
- [CVE-2005-3872](https://cve.now/CVE-2005-3872.md): Multiple SQL injection vulnerabilities in Ugroup 2.6.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) FORU (no CVSS)
- [CVE-2005-3873](https://cve.now/CVE-2005-3873.md): SQL injection vulnerability in topic.php in ShockBoard 3.0 and 4.0 allows remote attackers to execute arbitrary SQL commands via the offset (no CVSS)
- [CVE-2005-3874](https://cve.now/CVE-2005-3874.md): SQL injection vulnerability in netzbr.php in Netzbrett 1.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the p (no CVSS)
- [CVE-2005-3875](https://cve.now/CVE-2005-3875.md): Multiple SQL injection vulnerabilities in Enterprise Connector 1.0.2 and earlier allow remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2005-3876](https://cve.now/CVE-2005-3876.md): Multiple SQL injection vulnerabilities in adcbrowres.php in AD Center ADC2000 NG Pro 1.2 and NG Pro Lite allow remote attackers to execute a (no CVSS)
- [CVE-2005-3877](https://cve.now/CVE-2005-3877.md): Multiple SQL injection vulnerabilities in Simple Document Management System (SDMS) 2.0-CVS and earlier allow remote attackers to execute arb (no CVSS)
- [CVE-2005-3878](https://cve.now/CVE-2005-3878.md): Directory traversal vulnerability in index.php in PHP Doc System 1.5.1 and earlier allows remote attackers to access or include arbitrary fi (no CVSS)
- [CVE-2005-3879](https://cve.now/CVE-2005-3879.md): Multiple SQL injection vulnerabilities in Softbiz Resource Repository Script 1.1 and earlier allow remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2005-3880](https://cve.now/CVE-2005-3880.md): Multiple SQL injection vulnerabilities in Omnistar KBase 4.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1 (no CVSS)
- [CVE-2005-3881](https://cve.now/CVE-2005-3881.md): SQL injection vulnerability in search.php in AtlantisFAQ Knowledge Base Software 2.03 and earlier allows remote attackers to execute arbitra (no CVSS)
- [CVE-2005-3882](https://cve.now/CVE-2005-3882.md): SQL injection vulnerability in answer.php in FAQSystems FAQRing Knowledge Base Software 3.0 and earlier allows remote attackers to execute a (no CVSS)
- [CVE-2005-3883](https://cve.now/CVE-2005-3883.md): CRLF injection vulnerability in the mb\_send\_mail function in PHP before 5.1.0 might allow remote attackers to inject arbitrary e-mail header (no CVSS)
- [CVE-2005-3884](https://cve.now/CVE-2005-3884.md): Multiple SQL injection vulnerabilities in the search action in Zainu 2.0 and earlier allow remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2004-2591](https://cve.now/CVE-2004-2591.md): The data-overwrite capability of ButtUglySoftware CleanCache 2.19 does not properly overwrite data in files, which allows attackers to recov (no CVSS)
- [CVE-2004-2592](https://cve.now/CVE-2004-2592.md): Quake II server before R1Q2, as used in multiple products, allows remote attackers to cause a denial of service (application crash) via a mo (no CVSS)
- [CVE-2004-2593](https://cve.now/CVE-2004-2593.md): Buffer overflow in command-packet processing of Quake II server before R1Q2, as used in multiple products, allows remote attackers to cause (no CVSS)
- [CVE-2004-2594](https://cve.now/CVE-2004-2594.md): Absolute path traversal vulnerability in Quake II server before R1Q2 on Windows, as used in multiple products, allows remote attackers to re (no CVSS)
- [CVE-2004-2595](https://cve.now/CVE-2004-2595.md): Absolute path traversal vulnerability in Quake II server before R1Q2 on Linux, as used in multiple products, allows remote attackers to caus (no CVSS)
- [CVE-2004-2596](https://cve.now/CVE-2004-2596.md): Quake II server before R1Q2, as used in multiple products, allows remote attackers to cause a denial of service (exhaustion of connection sl (no CVSS)
- [CVE-2004-2597](https://cve.now/CVE-2004-2597.md): Quake II server before R1Q2, as used in multiple products, allows remote attackers to bypass IP-based access control rules via a userinfo st (no CVSS)
- [CVE-2004-2598](https://cve.now/CVE-2004-2598.md): Quake II server before R1Q2, as used in multiple products, allows remote attackers to corrupt the server's client state data structure by ex (no CVSS)
- [CVE-2004-2599](https://cve.now/CVE-2004-2599.md): Multiple buffer overflows in Quake II server before R1Q2, as used in multiple products, allow local users to cause a denial of service (appl (no CVSS)
- [CVE-2004-2600](https://cve.now/CVE-2004-2600.md): The firmware for Intelligent Platform Management Interface (IPMI) 1.5-based Intel Server Boards and Platforms is shipped with an Authenticat (no CVSS)
- [CVE-2004-2601](https://cve.now/CVE-2004-2601.md): PHP remote file inclusion vulnerability in UberTec Help Center Live (HCL) allows remote attackers to read local files and possibly execute P (no CVSS)
- [CVE-2004-2602](https://cve.now/CVE-2004-2602.md): PHP remote file inclusion vulnerability in UberTec Help Center Live (HCL) before 1.2.7 allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2004-2603](https://cve.now/CVE-2004-2603.md): Cross-site scripting (XSS) vulnerability in the Search module in UberTec Help Center Live (HCL) allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2004-2604](https://cve.now/CVE-2004-2604.md): Cross-site scripting (XSS) vulnerability in index.php in PHProxy allows remote attackers to inject arbitrary web script or HTML via the erro (no CVSS)
- [CVE-2004-2605](https://cve.now/CVE-2004-2605.md): aStats 1.6.5 allows local users to overwrite arbitrary files via a symlink attack on (1) the aStats-Graphic-Signature-Generation file and (2 (no CVSS)
- [CVE-2004-2606](https://cve.now/CVE-2004-2606.md): The Web interface in Linksys WRT54G 2.02.7 and BEFSR41 version 3, with the firewall disabled, allows remote attackers to attempt to login to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-11-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.