# CVEs published 2005-12-20

76 CVEs were published on December 20, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2005-4427](https://cve.now/CVE-2005-4427.md): Multiple SQL injection vulnerabilities in Cerberus Helpdesk allow remote attackers to execute arbitrary SQL commands via the (1) file\_id par (no CVSS)
- [CVE-2005-4428](https://cve.now/CVE-2005-4428.md): Cross-site scripting (XSS) vulnerability in index.php in Cerberus Helpdesk allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2005-4390](https://cve.now/CVE-2005-4390.md): SQL injection vulnerability in index.php in ContentServ 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the St (no CVSS)
- [CVE-2005-4391](https://cve.now/CVE-2005-4391.md): Cross-site scripting (XSS) vulnerability in damoon allows remote attackers to inject arbitrary web script or HTML via unspecified search par (no CVSS)
- [CVE-2005-4392](https://cve.now/CVE-2005-4392.md): SQL injection vulnerability in printer\_friendly.cfm in e-publish CMS 2.0 and earlier allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2005-4393](https://cve.now/CVE-2005-4393.md): Cross-site scripting (XSS) vulnerability in show.cfm in e-publish CMS 2.0 and earlier allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2005-4394](https://cve.now/CVE-2005-4394.md): Cross-site scripting (XSS) vulnerability in EPiX 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspec (no CVSS)
- [CVE-2005-4395](https://cve.now/CVE-2005-4395.md): Cross-site scripting (XSS) vulnerability in FarCry 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspec (no CVSS)
- [CVE-2005-4396](https://cve.now/CVE-2005-4396.md): Cross-site scripting (XSS) vulnerability in admin/Default.asp in iCMS allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2005-4397](https://cve.now/CVE-2005-4397.md): SQL injection vulnerability in RunScript.asp iCMS allows remote attackers to execute arbitrary SQL commands via the Event\_ID parameter. (no CVSS)
- [CVE-2005-4398](https://cve.now/CVE-2005-4398.md): NOTE: the vendor has disputed this issue. (no CVSS)
- [CVE-2005-4399](https://cve.now/CVE-2005-4399.md): Cross-site scripting (XSS) vulnerability in search/index.php in Libertas Enterprise CMS 3.0 and earlier allows remote attackers to inject ar (no CVSS)
- [CVE-2005-4400](https://cve.now/CVE-2005-4400.md): Cross-site scripting (XSS) vulnerability in downloads/portal\_ent in Liferay Portal Enterprise 3.6.1 and earlier allows remote attackers to i (no CVSS)
- [CVE-2005-4401](https://cve.now/CVE-2005-4401.md): Cross-site scripting (XSS) vulnerability in Lutece 1.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unsp (no CVSS)
- [CVE-2005-4402](https://cve.now/CVE-2005-4402.md): Buffer overflow in MailEnable Professional 1.71 and earlier, and Enterprise 1.1 and earlier, allows remote authenticated users to execute ar (no CVSS)
- [CVE-2005-4403](https://cve.now/CVE-2005-4403.md): SQL injection vulnerability in index.php in Marwel 2.7 and earlier allows remote attackers to execute arbitrary SQL commands via the show pa (no CVSS)
- [CVE-2005-4404](https://cve.now/CVE-2005-4404.md): SQL injection vulnerability in default.asp in Media2 CMS Shop 18.x allows remote attackers to execute arbitrary SQL commands via the item pa (no CVSS)
- [CVE-2005-4405](https://cve.now/CVE-2005-4405.md): redqueen.cgi in Red Queen 1.02 and earlier allows remote attackers to obtain the full server path via invalid (1) yellowpage\_id, (2) skin\_id (no CVSS)
- [CVE-2005-4406](https://cve.now/CVE-2005-4406.md): SQL injection vulnerability in index.cfm in Mercury CMS 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the pa (no CVSS)
- [CVE-2005-4407](https://cve.now/CVE-2005-4407.md): Cross-site scripting (XSS) vulnerability in index.cfm in Mercury CMS 4.0 and earlier allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2005-4408](https://cve.now/CVE-2005-4408.md): Multiple SQL injection vulnerabilities in Miraserver 1.0 RC4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1 (no CVSS)
- [CVE-2005-4409](https://cve.now/CVE-2005-4409.md): Cross-site scripting (XSS) vulnerability in MMBase 1.7.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unsp (no CVSS)
- [CVE-2005-4410](https://cve.now/CVE-2005-4410.md): Cross-site scripting (XSS) vulnerability in NQcontent 3 allows remote attackers to inject arbitrary web script or HTML via unspecified searc (no CVSS)
- [CVE-2005-4411](https://cve.now/CVE-2005-4411.md): Buffer overflow in Mercury Mail Transport System 4.01b allows remote attackers to execute arbitrary code via a long request to TCP port 105. (no CVSS)
- [CVE-2005-4412](https://cve.now/CVE-2005-4412.md): Citrix Program Neighborhood client before 9.150 caches the user password in plaintext in the GUI while asterisks are used to visually obfusc (no CVSS)
- [CVE-2005-4413](https://cve.now/CVE-2005-4413.md): Multiple cross-site scripting (XSS) vulnerabilities in sample scripts in IBM WebSphere Application Server 6 allow remote attackers to inject (no CVSS)
- [CVE-2005-4414](https://cve.now/CVE-2005-4414.md): Unspecified vulnerability in Teamwork 3 before alpha 1.7 has unknown impact and attack vectors, related to "a menu security bug." (no CVSS)
- [CVE-2005-4415](https://cve.now/CVE-2005-4415.md): Cross-site scripting (XSS) vulnerability in index.php in TML CMS 0.5 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2005-4416](https://cve.now/CVE-2005-4416.md): SQL injection vulnerability in index.php in TML CMS 0.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. (no CVSS)
- [CVE-2005-4417](https://cve.now/CVE-2005-4417.md): The default configuration of Widcomm Bluetooth for Windows (BTW) 4.0.1.1500 and earlier, as installed on Belkin Bluetooth Software 1.4.2 Bui (no CVSS)
- [CVE-2005-4419](https://cve.now/CVE-2005-4419.md): Multiple SQL injection vulnerabilities in CategoryResults.cfm in Honeycomb Archive and Honeycomb Archive Enterprise 3.0 allow remote attacke (no CVSS)
- [CVE-2005-4420](https://cve.now/CVE-2005-4420.md): Cross-site scripting (XSS) vulnerability in Honeycomb Archive Enterprise 3.0 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2005-4421](https://cve.now/CVE-2005-4421.md): Dev-Editor 3.0 allows remote attackers to access any directory outside the web root whose name is a substring of the web root directory name (no CVSS)
- [CVE-2005-4422](https://cve.now/CVE-2005-4422.md): Unrestricted file upload vulnerability in toendaCMS before 0.6.2 Stable allows remote authenticated administrators to execute arbitrary code (no CVSS)
- [CVE-2005-4423](https://cve.now/CVE-2005-4423.md): Unrestricted file upload vulnerability in PHPFM before 0.2.3 allows remote authenticated users to execute arbitrary code by uploading a file (no CVSS)
- [CVE-2005-4424](https://cve.now/CVE-2005-4424.md): Directory traversal vulnerability in PHPKIT 1.6.1 R2 and earlier might allow remote authenticated users to execute arbitrary PHP code via a (no CVSS)
- [CVE-2005-4425](https://cve.now/CVE-2005-4425.md): Unspecified vulnerability in Kerio WinRoute Firewall before 6.1.3 allows remote attackers to cause a denial of service (crash) via certain R (no CVSS)
- [CVE-2005-4426](https://cve.now/CVE-2005-4426.md): Interpretation conflict in YaBB before 2.1 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with (no CVSS)
- [CVE-2005-4368](https://cve.now/CVE-2005-4368.md): roundcube webmail Alpha, with a default high verbose level ($rcmail\_config\['debug\_level'\] = 1), allows remote attackers to obtain the full p (no CVSS)
- [CVE-2005-4369](https://cve.now/CVE-2005-4369.md): Cross-site scripting (XSS) vulnerability in Acuity CMS 2.6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified (no CVSS)
- [CVE-2005-4370](https://cve.now/CVE-2005-4370.md): SQL injection vulnerability in main\_content.asp in Acidcat 2.1.13 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2005-4371](https://cve.now/CVE-2005-4371.md): Acidcat 2.1.13 and earlier stores the database under the web root with insufficient access control, which allows remote attackers to obtain (no CVSS)
- [CVE-2005-4372](https://cve.now/CVE-2005-4372.md): Cross-site scripting (XSS) vulnerability in account.html in Adaptive Website Framework (AWF) 2.10 and earlier allows remote attackers to inj (no CVSS)
- [CVE-2005-4373](https://cve.now/CVE-2005-4373.md): Adaptive Website Framework (AWF) 2.10 and earlier allows remote attackers to obtain the full path of the application via an invalid mode par (no CVSS)
- [CVE-2005-4374](https://cve.now/CVE-2005-4374.md): Multiple cross-site scripting (XSS) vulnerabilities in Allinta 2.3.2 and earlier allow remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2005-4375](https://cve.now/CVE-2005-4375.md): Cross-site scripting (XSS) vulnerability in Amaxus 3 and earlier allows remote attackers to inject arbitrary web script or HTML via the chan (no CVSS)
- [CVE-2005-4376](https://cve.now/CVE-2005-4376.md): Directory traversal vulnerability in Amaxus 3 and earlier allows remote attackers to access arbitrary files via ".." sequences in the change (no CVSS)
- [CVE-2005-4377](https://cve.now/CVE-2005-4377.md): Cross-site scripting (XSS) vulnerability in Page.asp in Baseline CMS 1.95 and earlier allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2005-4378](https://cve.now/CVE-2005-4378.md): SQL injection vulnerability in Page.asp in Baseline CMS 1.95 and earlier allows remote attackers to execute arbitrary SQL commands via the S (no CVSS)
- [CVE-2005-4379](https://cve.now/CVE-2005-4379.md): Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2005-4380](https://cve.now/CVE-2005-4380.md): Multiple SQL injection vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2005-4381](https://cve.now/CVE-2005-4381.md): Multiple cross-site scripting (XSS) vulnerabilities in Caravel CMS 3.0 Beta 1 and earlier allow remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2005-4382](https://cve.now/CVE-2005-4382.md): SQL injection vulnerability in CitySoft Community Enterprise 4.x allows remote attackers to execute arbitrary SQL commands via the (1) nodeI (no CVSS)
- [CVE-2005-4383](https://cve.now/CVE-2005-4383.md): Cross-site scripting (XSS) vulnerability in index.cfm in CitySoft Community Enterprise 4.x allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2005-4384](https://cve.now/CVE-2005-4384.md): CitySoft Community Enterprise 4.x allows remote attackers to obtain the full path of the server via an invalid (1) fuseaction parameter to i (no CVSS)
- [CVE-2005-4385](https://cve.now/CVE-2005-4385.md): Cross-site scripting (XSS) vulnerability in search.htm in Cofax 2.0 RC3 and earlier allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2005-4386](https://cve.now/CVE-2005-4386.md): Cross-site scripting (XSS) vulnerability in Colony CMS 2.75 and earlier allows remote attackers to inject arbitrary web script or HTML via u (no CVSS)
- [CVE-2005-4387](https://cve.now/CVE-2005-4387.md): Cross-site scripting (XSS) vulnerability in home.php in contenite 0.11 and earlier allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2005-4388](https://cve.now/CVE-2005-4388.md): Cross-site scripting (XSS) vulnerability in search.cfm in CONTENS 3.0 and earlier allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2005-4389](https://cve.now/CVE-2005-4389.md): search.cfm in CONTENS 3.0 and earlier allows remote attackers to obtain the full server path via invalid (1) submit.y, (2) bool, (3) itemspe (no CVSS)
- [CVE-2005-4354](https://cve.now/CVE-2005-4354.md): Cross-site scripting (XSS) vulnerability in webglimpse.cgi in Webglimpse 2.14.1 and earlier allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2005-4355](https://cve.now/CVE-2005-4355.md): Multiple cross-site scripting (XSS) vulnerabilities in UStore allow remote attackers to inject arbitrary web script or HTML via the (1) Cat (no CVSS)
- [CVE-2005-4356](https://cve.now/CVE-2005-4356.md): SQL injection vulnerability in UStore allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields (no CVSS)
- [CVE-2005-4357](https://cve.now/CVE-2005-4357.md): Cross-site scripting (XSS) vulnerability in phpBB 2.0.18, when "Allowed HTML tags" is enabled, allows remote attackers to inject arbitrary J (no CVSS)
- [CVE-2005-4358](https://cve.now/CVE-2005-4358.md): admin/admin\_disallow.php in phpBB 2.0.18 allows remote attackers to obtain the installation path via a direct request with a non-empty setmo (no CVSS)
- [CVE-2005-4359](https://cve.now/CVE-2005-4359.md): SQL injection vulnerability in includes/core.inc.php in ODFaq 2.1.0 allows remote attackers to execute arbitrary SQL commands via the (1) ca (no CVSS)
- [CVE-2005-4360](https://cve.now/CVE-2005-4360.md): The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2005-4361](https://cve.now/CVE-2005-4361.md): Cross-site scripting (XSS) vulnerability in search.html in Magnolia Content Management Suite 2.1 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2005-4362](https://cve.now/CVE-2005-4362.md): SQL injection vulnerability in page.php in Komodo CMS 2.1 allows remote attackers to execute arbitrary SQL commands via the page parameter. (no CVSS)
- [CVE-2005-4363](https://cve.now/CVE-2005-4363.md): Cross-site scripting (XSS) vulnerability in the search engine in Komodo CMS 2.1 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2005-4364](https://cve.now/CVE-2005-4364.md): Cross-site scripting (XSS) vulnerability in index.cfm in Hot Banana Web Content Management Suite 5.3 allows remote attackers to inject arbit (no CVSS)
- [CVE-2005-4365](https://cve.now/CVE-2005-4365.md): Multiple cross-site scripting (XSS) vulnerabilities in FLIP 0.9.0.1029 allow remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2005-4366](https://cve.now/CVE-2005-4366.md): Multiple SQL injection vulnerabilities in DRZES HMS 3.2 allow remote attackers to execute arbitrary SQL commands via the (1) plan\_id paramet (no CVSS)
- [CVE-2005-4367](https://cve.now/CVE-2005-4367.md): Cross-site scripting (XSS) vulnerability in register\_domain.php in DRZES HMS 3.2 allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2005-4350](https://cve.now/CVE-2005-4350.md): Unspecified vulnerability in WBEM Services A.01.x before A.01.05.12 and A.02.x before A.02.00.08 on HP-UX B.11.00 through B.11.23 allows rem (no CVSS)
- [CVE-2005-4353](https://cve.now/CVE-2005-4353.md): SQL injection vulnerability in index.php in toendaCMS 0.6.2.1, when configured to use a SQL database, allows remote attackers to execute arb (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-12-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.