# CVEs published 2005-12-28

35 CVEs were published on December 28, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2005-3345](https://cve.now/CVE-2005-3345.md): rssh 2.0.0 through 2.2.3 allows local users to bypass access restrictions and gain root privileges by using the rssh\_chroot\_helper command t (no CVSS)
- [CVE-2005-4560](https://cve.now/CVE-2005-4560.md): The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Wind (no CVSS)
- [CVE-2005-4545](https://cve.now/CVE-2005-4545.md): Cross-site scripting (XSS) vulnerability in search.asp in NetDirect ShopEngine allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2005-4546](https://cve.now/CVE-2005-4546.md): search.php in eggblog 2.0 allows remote attackers to obtain the full path via an invalid q parameter, as used by the Keyword and Search fiel (no CVSS)
- [CVE-2005-4547](https://cve.now/CVE-2005-4547.md): Cross-site scripting (XSS) vulnerability in home/search.php in eggblog 2.0 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2005-4548](https://cve.now/CVE-2005-4548.md): SQL injection vulnerability in the "user area" in RWS Statistics Counter before 2.4.1 allows remote attackers to execute arbitrary SQL comma (no CVSS)
- [CVE-2005-4549](https://cve.now/CVE-2005-4549.md): Cross-site scripting (XSS) vulnerability in Oracle Application Server (OracleAS) Discussion Forum Portlet allows remote attackers to inject (no CVSS)
- [CVE-2005-4550](https://cve.now/CVE-2005-4550.md): The PORTAL schema in Oracle Application Server (OracleAS) Discussion Forum Portlet allows remote attackers to obtain the source code for arb (no CVSS)
- [CVE-2005-4551](https://cve.now/CVE-2005-4551.md): Cross-site scripting (XSS) vulnerability in sign.php in codegrrl SimpBook 1.0, when html\_enable is on, allows remote attackers to inject arb (no CVSS)
- [CVE-2005-4552](https://cve.now/CVE-2005-4552.md): The (1) slsmgr and (2) slsadmin programs in Sun Solaris PC NetLink 2.0 create temporary files insecurely, which allows local users to gain p (no CVSS)
- [CVE-2005-4553](https://cve.now/CVE-2005-4553.md): Buffer overflow in Golden FTP Server 1.92 allows remote attackers to execute arbitrary code via a long APPE command. (no CVSS)
- [CVE-2005-4554](https://cve.now/CVE-2005-4554.md): Multiple SQL injection vulnerabilities in DEV web management system 1.5 and earlier allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2005-4555](https://cve.now/CVE-2005-4555.md): Cross-site scripting (XSS) vulnerability in add.php in DEV web management system 1.5 and earlier allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2005-4556](https://cve.now/CVE-2005-4556.md): PHP remote file include vulnerability in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 (no CVSS)
- [CVE-2005-4557](https://cve.now/CVE-2005-4557.md): dir/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, allows remot (no CVSS)
- [CVE-2005-4558](https://cve.now/CVE-2005-4558.md): IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly restrict accep (no CVSS)
- [CVE-2005-4559](https://cve.now/CVE-2005-4559.md): mail/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not pr (no CVSS)
- [CVE-2005-4534](https://cve.now/CVE-2005-4534.md): The shadow database feature (syncshadowdb) in Bugzilla 2.9 through 2.16.10 allows local users to overwrite arbitrary files via a symlink att (no CVSS)
- [CVE-2005-4516](https://cve.now/CVE-2005-4516.md): Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion 6.00.200 through 6.00.300 allow remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2005-4517](https://cve.now/CVE-2005-4517.md): SQL injection vulnerability in PHP-Fusion 6.00.200 through 6.00.300 allows remote attackers to execute arbitrary SQL commands via the rating (no CVSS)
- [CVE-2005-4518](https://cve.now/CVE-2005-4518.md): Mantis before 0.19.4 allows remote attackers to bypass the file upload size restriction by modifying the max\_file\_size parameter to (1) bug\_ (no CVSS)
- [CVE-2005-4519](https://cve.now/CVE-2005-4519.md): Multiple SQL injection vulnerabilities in the manage user page (manage\_user\_page.php) in Mantis 1.0.0rc3 and earlier allow remote attackers (no CVSS)
- [CVE-2005-4520](https://cve.now/CVE-2005-4520.md): Unspecified "port injection" vulnerabilities in filters in Mantis 1.0.0rc3 and earlier have unknown impact and attack vectors. (no CVSS)
- [CVE-2005-4521](https://cve.now/CVE-2005-4521.md): CRLF injection vulnerability in Mantis 1.0.0rc3 and earlier allows remote attackers to modify HTTP headers and conduct HTTP response splitti (no CVSS)
- [CVE-2005-4522](https://cve.now/CVE-2005-4522.md): Multiple cross-site scripting (XSS) vulnerabilities in the view\_filters\_page.php filters script in Mantis 1.0.0rc3 and earlier allow remote (no CVSS)
- [CVE-2005-4523](https://cve.now/CVE-2005-4523.md): Mantis 1.0.0rc3 and earlier discloses private bugs via public RSS feeds, which allows remote attackers to obtain sensitive information. (no CVSS)
- [CVE-2005-4524](https://cve.now/CVE-2005-4524.md): Mantis 1.0.0rc3 does not properly handle "Make note private" when a bug is being resolved, which has unknown impact and attack vectors, prob (no CVSS)
- [CVE-2005-4525](https://cve.now/CVE-2005-4525.md): SmcGui.exe in Sygate Protection Agent 5.0 build 6144 allows local users to obtain management control over the agent by executing the GUI (Sm (no CVSS)
- [CVE-2005-4526](https://cve.now/CVE-2005-4526.md): Clearswift MIMEsweeper For Web (a.k.a. (no CVSS)
- [CVE-2005-4527](https://cve.now/CVE-2005-4527.md): Multiple SQL injection vulnerabilities in Direct News 4.9 allow remote attackers to execute arbitrary SQL commands via (1) the setLang param (no CVSS)
- [CVE-2005-4528](https://cve.now/CVE-2005-4528.md): SQL injection vulnerability in the Chatspot 2.0.0a7 module for phpBB allows remote attackers to execute arbitrary SQL commands via unknown v (no CVSS)
- [CVE-2005-4529](https://cve.now/CVE-2005-4529.md): The Chatspot 2.0.0a7 module for phpBB might allow remote attackers to impersonate other users via unknown vectors. (no CVSS)
- [CVE-2005-4530](https://cve.now/CVE-2005-4530.md): Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft EPay Enterprise 3.0 (formerly DoPays) allow remote attackers to inject arb (no CVSS)
- [CVE-2005-4532](https://cve.now/CVE-2005-4532.md): scponlyc in scponly 4.1 and earlier, when the operating system supports LD\_PRELOAD mechanisms, allows local users to execute arbitrary code (no CVSS)
- [CVE-2005-4533](https://cve.now/CVE-2005-4533.md): Argument injection vulnerability in scponlyc in scponly 4.1 and earlier, when both scp and rsync compatibility are enabled, allows local use (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-12-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.