# CVEs published 2005-12-04

55 CVEs were published on December 4, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2005-3991](https://cve.now/CVE-2005-3991.md): Multiple cross-site scripting (XSS) vulnerabilities in phpMyChat 0.14.6 allow remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2005-3992](https://cve.now/CVE-2005-3992.md): Multiple buffer overflows in WinEggDropShell remote access trojan (RAT) 1.7 allow remote attackers to execute arbitrary code via (1) a long (no CVSS)
- [CVE-2004-2619](https://cve.now/CVE-2004-2619.md): ripMIME 1.3.2.3 and earlier allows remote attackers to bypass e-mail protection via a base64 MIME encoded attachment containing invalid char (no CVSS)
- [CVE-2004-2620](https://cve.now/CVE-2004-2620.md): The MIMEH\_read\_headers function in ripMIME 1.3.1.0 does not properly handle trailing "\\r" and "\\n" characters in headers, which leads to a b (no CVSS)
- [CVE-2004-2621](https://cve.now/CVE-2004-2621.md): Nortel Contivity VPN Client 2.1.7, 3.00, 3.01, 4.91, and 5.01, when opening a VPN tunnel, does not check the gateway certificate until after (no CVSS)
- [CVE-2004-2622](https://cve.now/CVE-2004-2622.md): AClient.exe in Altiris Deployment Solution 6.x and 5.x does not require authentication from the first Deployment Server that it connects to, (no CVSS)
- [CVE-2004-2623](https://cve.now/CVE-2004-2623.md): Unknown vulnerability in Rippy the Aggregator before 0.10, when register\_globals is enabled, has unknown attack vectors and impact, possibly (no CVSS)
- [CVE-2004-2624](https://cve.now/CVE-2004-2624.md): Cross-site scripting (XSS) vulnerability in "TextSearch" in WackoWiki 3.5 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2004-2625](https://cve.now/CVE-2004-2625.md): Cross-site scripting (XSS) vulnerability in Outblaze Email allows remote attackers to inject arbitrary web script or HTML via Javascript in (no CVSS)
- [CVE-2004-2626](https://cve.now/CVE-2004-2626.md): GUI overlay vulnerability in the Java API in Siemens S55 cellular phones allows remote attackers to send unauthorized SMS messages by overla (no CVSS)
- [CVE-2004-2627](https://cve.now/CVE-2004-2627.md): Java 2 Micro Edition (J2ME) does not properly validate bytecode, which allows remote attackers to escape the Kilobyte Virtual Machine (KVM) (no CVSS)
- [CVE-2004-2628](https://cve.now/CVE-2004-2628.md): Multiple directory traversal vulnerabilities in thttpd 2.07 beta 0.4, when running on Windows, allow remote attackers to read arbitrary file (no CVSS)
- [CVE-2004-2629](https://cve.now/CVE-2004-2629.md): Multiple vulnerabilities in the H.323 protocol implementation for First Virtual Communications Click to Meet Express (when used with H.323 c (no CVSS)
- [CVE-2004-2630](https://cve.now/CVE-2004-2630.md): The MIME transformation system (transformations/text\_plain\_\_external.inc.php) in phpMyAdmin 2.5.0 up to 2.6.0-pl1 allows remote attackers to (no CVSS)
- [CVE-2004-2631](https://cve.now/CVE-2004-2631.md): Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute a (no CVSS)
- [CVE-2004-2632](https://cve.now/CVE-2004-2632.md): phpMyAdmin 2.5.1 up to 2.5.7 allows remote attackers to modify configuration settings and gain unauthorized access to MySQL servers via modi (no CVSS)
- [CVE-2004-2633](https://cve.now/CVE-2004-2633.md): Unspecified vulnerability in Sesamie 1.0 allows remote anonymous attackers to gain access to repositories of other users via unknown vectors (no CVSS)
- [CVE-2004-2634](https://cve.now/CVE-2004-2634.md): The (1) bos.rte.serv\_aid or (2) bos.rte.console filesets in IBM AIX 5.1 and 5.2 allow local users to overwrite arbitrary files via a symlink (no CVSS)
- [CVE-2004-2635](https://cve.now/CVE-2004-2635.md): An ActiveX control for McAfee Security Installer Control System 4.0.0.81 allows remote attackers to access the Windows registry via web page (no CVSS)
- [CVE-2004-2636](https://cve.now/CVE-2004-2636.md): TinyWeb 1.9 allows remote attackers to read source code of scripts via "/./" in the URL. (no CVSS)
- [CVE-2004-2637](https://cve.now/CVE-2004-2637.md): The NAT implementation in Zonet ZSR1104WE Wireless Router Runtime Code Version 2.41 converts IP addresses of inbound connections to the IP a (no CVSS)
- [CVE-2004-2638](https://cve.now/CVE-2004-2638.md): The Admin Access With Levels plugin in osCommerce 1.5.1 allows remote attackers to access files in the "admin/" directory by modifying the i (no CVSS)
- [CVE-2004-2639](https://cve.now/CVE-2004-2639.md): Unspecified vulnerability in Journalness 3.0.7 and earlier allows remote attackers to create or modify posts via unknown attack vectors. (no CVSS)
- [CVE-2004-2640](https://cve.now/CVE-2004-2640.md): Directory traversal vulnerability in lstat.cgi in LinuxStat before 2.3.1 allows remote attackers to read arbitrary files via (1) .. (no CVSS)
- [CVE-2004-2641](https://cve.now/CVE-2004-2641.md): Unspecified vulnerability in Sun Fire 3800/4800/4810/6800, Sun Fire V1280, and Netra 1280 allows remote attackers to cause a denial of servi (no CVSS)
- [CVE-2004-2642](https://cve.now/CVE-2004-2642.md): Yeemp 0.9.9 and earlier does not properly encrypt inbound files, which allows remote attackers to spoof the identity of the sender. (no CVSS)
- [CVE-2004-2643](https://cve.now/CVE-2004-2643.md): Directory traversal vulnerability in Microsoft cabarc allows remote attackers to overwrite files via "../" sequences in file names in a CAB (no CVSS)
- [CVE-2004-2644](https://cve.now/CVE-2004-2644.md): Unspecified vulnerability in ASN.1 Compiler (asn1c) before 0.9.7 has unknown impact and attack vectors when processing "ANY" type tags. (no CVSS)
- [CVE-2004-2645](https://cve.now/CVE-2004-2645.md): Unspecified vulnerability in ASN.1 Compiler (asn1c) before 0.9.7 has unknown impact and attack vectors when processing "CHOICE" types with " (no CVSS)
- [CVE-2004-2646](https://cve.now/CVE-2004-2646.md): The addUser function in UserManager.java in Free Web Chat 2.0 allows remote attackers to cause a denial of service (uncaught NullPointerExce (no CVSS)
- [CVE-2004-2647](https://cve.now/CVE-2004-2647.md): Free Web Chat 2.0 allows remote attackers to cause a denial of service (CPU consumption) via multiple connections from the same user. (no CVSS)
- [CVE-2004-2648](https://cve.now/CVE-2004-2648.md): FreezeX 1.00.100.0666 allows local users with administrator privileges to cause a denial of service (FreezeX application) by overwriting the (no CVSS)
- [CVE-2004-2649](https://cve.now/CVE-2004-2649.md): Eudora 6.1.0.6 allows remote attackers to obfuscate URLs displayed in the status bar by inserting a large number of characters (e.g. (no CVSS)
- [CVE-2005-3985](https://cve.now/CVE-2005-3985.md): The Internet Key Exchange version 1 (IKEv1) implementation in Astaro Security Linux before 6.102 allows remote attackers to cause a denial o (no CVSS)
- [CVE-2005-3986](https://cve.now/CVE-2005-3986.md): Multiple SQL injection vulnerabilities in Instant Photo Gallery 1 and earlier allow remote attackers to execute arbitrary SQL commands via t (no CVSS)
- [CVE-2005-3987](https://cve.now/CVE-2005-3987.md): Multiple SQL injection vulnerabilities in Tradesoft CMS allow remote attackers to execute arbitrary SQL commands via unspecified attack vect (no CVSS)
- [CVE-2005-3988](https://cve.now/CVE-2005-3988.md): SQL injection vulnerability in article.php in Pineapple Technologies Lore 1.5.4 allows remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2005-3989](https://cve.now/CVE-2005-3989.md): Memory leak in Avaya TN2602AP IP Media Resource 320 circuit pack before vintage 9 firmware allows remote attackers to cause a denial of serv (no CVSS)
- [CVE-2003-1288](https://cve.now/CVE-2003-1288.md): Multiple race conditions in Linux-VServer 1.22 with Linux kernel 2.4.23 and SMP allow local users to cause a denial of service (kernel oops) (no CVSS)
- [CVE-2004-2608](https://cve.now/CVE-2004-2608.md): SmartWebby Smart Guest Book stores SmartGuestBook.mdb (aka the "news database") under the web document root with insufficient access control (no CVSS)
- [CVE-2004-2609](https://cve.now/CVE-2004-2609.md): The stuffit.com executable on Symantec PowerQuest DeployCenter 5.5 boot disks allows local users to obtain sensitive information (an unencry (no CVSS)
- [CVE-2004-2610](https://cve.now/CVE-2004-2610.md): mntd\_mount.c in mntd before 0.4.2 might allow local users to gain privileges via shell metacharacters in a remount option in the configurati (no CVSS)
- [CVE-2004-2611](https://cve.now/CVE-2004-2611.md): The Change Permissions function in the Sophster suite before 0.9.6 28 May 2004 (aka 0.9.6-r5), possibly including Sophster, FreeSophster, an (no CVSS)
- [CVE-2004-2612](https://cve.now/CVE-2004-2612.md): BNC 2.9.0 only grants access when an incorrect password is provided, which allows remote attackers to use the functionality intended for aut (no CVSS)
- [CVE-2004-2613](https://cve.now/CVE-2004-2613.md): Unspecified vulnerability in procfs in the Linux-VServer stable branch for the 2.4 kernel before 1.23 and Linux-VServer development branch f (no CVSS)
- [CVE-2004-2614](https://cve.now/CVE-2004-2614.md): Buffer overflow in MyWeb 3.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTT (no CVSS)
- [CVE-2004-2615](https://cve.now/CVE-2004-2615.md): The documentation for CuteNews 1.3.6 and possibly other versions specifies that files under cutenews/data must be manually given world-writa (no CVSS)
- [CVE-2004-2616](https://cve.now/CVE-2004-2616.md): The file server in ActivePost Standard 3.1 and earlier allows remote authenticated users to obtain sensitive information by uploading a file (no CVSS)
- [CVE-2004-2617](https://cve.now/CVE-2004-2617.md): Directory traversal vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to read files outside of the web root via a .. (no CVSS)
- [CVE-2004-2618](https://cve.now/CVE-2004-2618.md): Cross-site scripting (XSS) vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2005-3980](https://cve.now/CVE-2005-3980.md): SQL injection vulnerability in the ticket query module in Edgewall Trac 0.9 and possibly earlier allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2005-3981](https://cve.now/CVE-2005-3981.md): NOTE: this issue has been disputed by third parties. (no CVSS)
- [CVE-2005-3982](https://cve.now/CVE-2005-3982.md): CRLF injection vulnerability in layers\_toggle.php in WebCalendar 1.0.1 might allow remote attackers to modify HTTP headers and conduct HTTP (no CVSS)
- [CVE-2005-3983](https://cve.now/CVE-2005-3983.md): Unknown vulnerability in the login page for HP Systems Insight Manager (SIM) 4.0 and 4.1, when accessed by Microsoft Internet Explorer with (no CVSS)
- [CVE-2005-3984](https://cve.now/CVE-2005-3984.md): SQL injection vulnerability in WebCalendar 1.0.1 allows remote attackers to execute arbitrary SQL commands via the time\_range parameter to e (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-12-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.