# CVEs published 2005-12-21

39 CVEs were published on December 21, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2005-4462](https://cve.now/CVE-2005-4462.md): PHP remote file include vulnerability in usermods.php in Tolva PHP website system 0.1.0 allows remote attackers to execute arbitrary code vi (no CVSS)
- [CVE-2005-4463](https://cve.now/CVE-2005-4463.md): WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to (1) wp-includes/vars.php, (2) wp-cont (no CVSS)
- [CVE-2005-4459](https://cve.now/CVE-2005-4459.md): Heap-based buffer overflow in the NAT networking components vmnat.exe and vmnet-natd in VMWare Workstation 5.5, GSX Server 3.2, ACE 1.0.1, a (no CVSS)
- [CVE-2005-4460](https://cve.now/CVE-2005-4460.md): Cross-site scripting (XSS) vulnerability in Beehive Forum 0.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2005-4461](https://cve.now/CVE-2005-4461.md): SQL injection vulnerability in index.php in Beehive Forum 0.6.2 and earlier allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2005-3657](https://cve.now/CVE-2005-3657.md): The ActiveX control in MCINSCTL.DLL for McAfee VirusScan Security Center does not use the IObjectSafetySiteLock API to restrict access to re (no CVSS)
- [CVE-2005-4267](https://cve.now/CVE-2005-4267.md): Stack-based buffer overflow in Qualcomm WorldMail 3.0 allows remote attackers to execute arbitrary code via a long IMAP command that ends wi (no CVSS)
- [CVE-2005-4448](https://cve.now/CVE-2005-4448.md): FlatNuke 2.5.6 verifies authentication credentials based on an MD5 checksum of the admin name and the hashed password rather than the plaint (no CVSS)
- [CVE-2005-4449](https://cve.now/CVE-2005-4449.md): verify.php in FlatNuke 2.5.6 allows remote authenticated administrators to modify arbitrary PHP files by setting the file parameter to an ar (no CVSS)
- [CVE-2005-4450](https://cve.now/CVE-2005-4450.md): Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.7.0 allows remote attackers to perform unauthorized actions as a logged-in u (no CVSS)
- [CVE-2005-4451](https://cve.now/CVE-2005-4451.md): Unspecified vulnerability in Software Distributor in HP-UX B.11.11 allows remote attackers to gain access via unspecified attack vectors. (no CVSS)
- [CVE-2005-4452](https://cve.now/CVE-2005-4452.md): Information Call Center stores the CallCenterData.mdb database under the web root with insufficient access control, which allows remote atta (no CVSS)
- [CVE-2005-4453](https://cve.now/CVE-2005-4453.md): UserProfile.cs in Ultraapps Issue Manager before 2.1 allows remote authenticated users to gain administrator privileges by modifying the ori (no CVSS)
- [CVE-2005-4454](https://cve.now/CVE-2005-4454.md): Validate-before-filter vulnerability in cleanhtml.pl 1.129 in LiveJournal CVS before Dec 7 2005, when the cleancss option is enabled, allows (no CVSS)
- [CVE-2005-4455](https://cve.now/CVE-2005-4455.md): cleanhtml.pl 1.129 in LiveJournal CVS before Dec 13 2005 allows remote attackers to inject scripting languages via the XSL namespace in XML, (no CVSS)
- [CVE-2005-4456](https://cve.now/CVE-2005-4456.md): Multiple buffer overflows in MailEnable Professional 1.71 and Enterprise 1.1 before patch ME-10009 allow remote attackers to cause a denial (no CVSS)
- [CVE-2005-4457](https://cve.now/CVE-2005-4457.md): MailEnable Enterprise 1.1 before patch ME-10009 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary (no CVSS)
- [CVE-2005-4458](https://cve.now/CVE-2005-4458.md): Group.pm in Metadot Portal Server 6.4.4 and earlier does not properly reset the $IS\_OWNER, $IS\_ADMIN, and $IS\_MANAGER global variables when (no CVSS)
- [CVE-2005-4440](https://cve.now/CVE-2005-4440.md): The 802.1q VLAN protocol allows remote attackers to bypass network segmentation and spoof VLAN traffic via a message with two 802.1q tags, w (no CVSS)
- [CVE-2005-4441](https://cve.now/CVE-2005-4441.md): The PVLAN protocol allows remote attackers to bypass network segmentation and spoof PVLAN traffic via a PVLAN message with a target MAC addr (no CVSS)
- [CVE-2005-4442](https://cve.now/CVE-2005-4442.md): Untrusted search path vulnerability in OpenLDAP before 2.2.28-r3 on Gentoo Linux allows local users in the portage group to gain privileges (no CVSS)
- [CVE-2005-4443](https://cve.now/CVE-2005-4443.md): Untrusted search path vulnerability in Gauche before 0.8.6-r1 on Gentoo Linux allows local users in the portage group to gain privileges via (no CVSS)
- [CVE-2005-4444](https://cve.now/CVE-2005-4444.md): Stack-based buffer overflow in the trace message functionality in Pegasus Mail 4.21a through 4.21c and 4.30PB1 allow remote attackers to exe (no CVSS)
- [CVE-2005-4445](https://cve.now/CVE-2005-4445.md): Off-by-one error in Pegasus Mail 4.21a through 4.21c and 4.30PB1 allows remote attackers to execute arbitrary code via a long email message (no CVSS)
- [CVE-2005-4446](https://cve.now/CVE-2005-4446.md): Cross-site scripting (XSS) vulnerability in index.asp in ASPBite 8.x allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2005-4447](https://cve.now/CVE-2005-4447.md): SQL injection vulnerability in articles\\articles\_funcs.php in phpCOIN 1.2.2 allows remote attackers to modify SQL syntax and possibly execut (no CVSS)
- [CVE-2002-2208](https://cve.now/CVE-2002-2208.md): Extended Interior Gateway Routing Protocol (EIGRP), as implemented in Cisco IOS 11.3 through 12.2 and other products, allows remote attacker (no CVSS)
- [CVE-2005-4433](https://cve.now/CVE-2005-4433.md): Cross-site scripting (XSS) vulnerability in search.php in Esselbach Storyteller CMS 1.8 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2005-4434](https://cve.now/CVE-2005-4434.md): Cross-site scripting (XSS) vulnerability in AbleDesign ReSearch 2.x allows remote attackers to inject arbitrary web script or HTML via unkno (no CVSS)
- [CVE-2005-4435](https://cve.now/CVE-2005-4435.md): Cross-site scripting (XSS) vulnerability in index.php AbleDesign D-Man 3.x allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2005-4436](https://cve.now/CVE-2005-4436.md): Extended Interior Gateway Routing Protocol (EIGRP) 1.2, as implemented in Cisco IOS after 12.3(2), 12.3(3)B, and 12.3(2)T and other products (no CVSS)
- [CVE-2005-4437](https://cve.now/CVE-2005-4437.md): MD5 Neighbor Authentication in Extended Interior Gateway Routing Protocol (EIGRP) 1.2, as implemented in Cisco IOS 11.3 and later, does not (no CVSS)
- [CVE-2005-4438](https://cve.now/CVE-2005-4438.md): Heap-based buffer overflow in Dec2Rar.dll 3.2.14.3, as distributed in the Symantec Antivirus Library and used by various Symantec products, (no CVSS)
- [CVE-2005-4439](https://cve.now/CVE-2005-4439.md): Buffer overflow in ELOG elogd 2.6.0-beta4 allows remote attackers to cause a denial of service (application crash) and possibly execute arbi (no CVSS)
- [CVE-2005-4348](https://cve.now/CVE-2005-4348.md): fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (applica (no CVSS)
- [CVE-2005-4429](https://cve.now/CVE-2005-4429.md): SQL injection vulnerability in CS-Cart 1.3.0 allows remote attackers to execute arbitrary SQL commands via the (1) sort\_by and (2) sort\_orde (no CVSS)
- [CVE-2005-4430](https://cve.now/CVE-2005-4430.md): SQL injection vulnerability in LogicBill 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) \_\_mode and (2 (no CVSS)
- [CVE-2005-4431](https://cve.now/CVE-2005-4431.md): SQL injection vulnerability in WowBB 1.65 allows remote attackers to execute arbitrary SQL commands via the q parameter to search.php. (no CVSS)
- [CVE-2005-4432](https://cve.now/CVE-2005-4432.md): Cross-site scripting (XSS) vulnerability in index.php in PlaySMS 0.8 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-12-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.