Browse CVE records published in April 2005, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 444 matching CVEs · Page 3 of 9.
Cross-site scripting (XSS) vulnerability in the include.cgi script allows remote attackers to inject arbitrary web script or HTML via the argument.
Published Apr 26, 2005 · Updated Aug 7, 2024
Cross-site scripting (XSS) vulnerability in Horde Accounts module before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
Published Apr 27, 2005 · Updated Aug 7, 2024
owOfflineCC.asp in OneWorldStore allows remote attackers to obtain sensitive information by modifying the idOrder parameter.
Published Apr 27, 2005 · Updated Aug 7, 2024
The ad.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
Published Apr 28, 2005 · Updated Aug 7, 2024
Cross-site scripting (XSS) vulnerability in Horde Vacation module before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
Published Apr 27, 2005 · Updated Aug 7, 2024
Multiple cross-site scripting (XSS) vulnerabilities in index.php for phpMyVisites allow remote attackers to inject arbitrary web script or HTML via the (1) part, (2) per, or (3) site parameters.
Published Apr 27, 2005 · Updated Aug 7, 2024
SQL injection vulnerability in news.php in FlexPHPNews 0.0.3 allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
Published Apr 24, 2005 · Updated Aug 7, 2024
Cross-site scripting (XSS) vulnerability in Horde Forwards E-Mail Forwarding Manager before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
Published Apr 27, 2005 · Updated Aug 7, 2024
Cross-site scripting (XSS) vulnerability in Horde IMP Webmail client before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
Published Apr 27, 2005 · Updated Aug 7, 2024
Cross-site scripting (XSS) vulnerability in Horde Mnemo Note Manager before 1.1.4 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
Published Apr 27, 2005 · Updated Aug 7, 2024
Buffer overflow in VooDoo cIRCle BOTNET before 1.0.33 allows remote authenticated attackers to cause a denial of service (client crash) via a crafted packet.
Published Apr 27, 2005 · Updated Aug 7, 2024
Format string vulnerability in the snmppd_log function in snmppd_util.c for snmppd 0.4.5 and earlier may allow remote attackers to cause a denial of service or execute arbitrary code via format string specifiers that are not properly handled in a syslog call.
Published Apr 25, 2005 · Updated Aug 7, 2024
The hyper.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument.
Published Apr 26, 2005 · Updated Aug 7, 2024
Cross-site scripting (XSS) vulnerability in Horde Chora module before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
Published Apr 27, 2005 · Updated Aug 7, 2024
set_lang.php in phpMyVisites 1.3 allows remote attackers to read and include arbitrary files via the mylang parameter.
Published Apr 27, 2005 · Updated Aug 7, 2024
SQL injection vulnerability in login.asp for Ecommerce-Carts EcommPro 3.0 allows remote attackers to execute arbitrary SQL commands via the password field.
Published Apr 22, 2005 · Updated Aug 7, 2024
webadmin.exe in Novell Nsure Audit 1.0.1 allows remote attackers to cause a denial of service via malformed ASN.1 packets in corrupt client certificates to an SSL server, as demonstrated using an exploit for the OpenSSL ASN.1 parsing vulnerability.
Published Apr 25, 2005 · Updated Aug 7, 2024
Cross-site scripting (XSS) vulnerability in index.php in PHP Labs proFile allows remote attackers to inject arbitrary web script or HTML via the (1) dir or (2) file parameters.
Published Apr 24, 2005 · Updated Aug 7, 2024
The inserter.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
Published Apr 26, 2005 · Updated Aug 7, 2024
Multiple cross-site scripting (XSS) vulnerabilities in Argosoft Mail Server Pro 1.8.7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the src parameter in an IMG tag, (2) User settings, or (3) Address book input boxes in the webmail interface.
Published Apr 26, 2005 · Updated Aug 7, 2024
Cross-site scripting (XSS) vulnerability in Horde Nag Task List Manager before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
Published Apr 27, 2005 · Updated Aug 7, 2024
Cross-site scripting (XSS) vulnerability in Yappa-NG before 2.3.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Published Apr 27, 2005 · Updated Aug 7, 2024
SQL injection vulnerability in mod.php in the datenbank module for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter.
Published Apr 18, 2005 · Updated Aug 7, 2024
Multiple cross-site scripting (XSS) vulnerabilities in CartWIZ ASP Cart allow remote attackers to inject arbitrary web script or HTML via the idProduct parameter to (1) tellAFriend.asp or (2) addToWishlist.asp, redirect parameter to (3) access.asp or (4) login.asp, message parameter to (5) login.asp or (6) error.asp, or (7) sku or (8) name parameter to searchResults.asp.
Published Apr 26, 2005 · Updated Aug 7, 2024
auction_my_auctions.php in phpbb-Auction 1.2m and earlier allows remote attackers to obtain sensitive information via an invalid mode parameter, which leaks the full path in a PHP error message.
Published Apr 24, 2005 · Updated Aug 7, 2024
Buffer overflow in NetFtpd for NetTerm 5.1.1 and earlier allows remote attackers to execute arbitrary code via a long USER command.
Published Apr 27, 2005 · Updated Aug 7, 2024
Cross-site scripting (XSS) vulnerability in Horde Passwd module before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
Published Apr 27, 2005 · Updated Aug 7, 2024
The rsvp_print function in tcpdump 3.9.1 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted RSVP packet of length 4.
Published Apr 26, 2005 · Updated Aug 7, 2024
Cross-site scripting (XSS) vulnerability in Horde Kronolith module before 1.1.4 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
Published Apr 27, 2005 · Updated Aug 7, 2024
nProtect:Netizen 2005.3.17.1 does not properly verify that the update module is downloaded from an authorized site, which allows remote malicious web sites to write arbitrary files.
Published Apr 26, 2005 · Updated Aug 7, 2024
SQL injection vulnerability in Confixx 3.08 and earlier allows remote attackers to execute arbitrary SQL commands via the "change user" field.
Published Apr 26, 2005 · Updated Aug 7, 2024
inc_login_check.asp ACS Blog 0.8 through 1.1.3 allows remote attackers to gain administrator privileges via the "in" value in a cookie.
Published Apr 26, 2005 · Updated Aug 7, 2024
index.cgi in E-Cart 2004 1.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) art and possibly (2) cat parameters.
Published Apr 26, 2005 · Updated Aug 7, 2024
DiagCollectionControl.dll in Musicmatch 10.00.2047 and earlier allows remote attackers to overwrite arbitrary files via the bstrSavePath argument.
Published Apr 18, 2005 · Updated Aug 7, 2024
Multiple SQL injection vulnerabilities in default.asp in StorePortal 2.63 allow remote attackers to execute arbitrary SQL commands via the (1) language, (2) bpic, (3) idcategory, (4) content, (5) keyword, or (6) idproduct parameter.
Published Apr 26, 2005 · Updated Aug 7, 2024
PHP remote file inclusion vulnerability in Yappa-NG before 2.3.2 allows remote attackers to execute arbitrary PHP code via unknown vectors.
Published Apr 27, 2005 · Updated Aug 7, 2024
Cross-site scripting (XSS) vulnerability in Horde Turba module before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
Published Apr 27, 2005 · Updated Aug 7, 2024
Unquoted Windows search path vulnerability in BitDefender 8 allows local users to prevent BitDefender from starting by creating a malicious C:\program.exe, possibly due to the lack of quoting of the full pathname when executing a process.
Published Apr 26, 2005 · Updated Aug 7, 2024
Multiple cross-site scripting (XSS) vulnerabilities in phpBB 2.0.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) u parameter to profile.php, (2) highlight parameter to viewtopic.php, or (3) forumname or forumdesc parameters to admin_forums.php.
Published Apr 26, 2005 · Updated Aug 7, 2024
Cross-site scripting (XSS) vulnerability in bBlog 0.7.4 allows remote attackers to inject arbitrary web script or HTML via the (1) entry title field or (2) comment body text.
Published Apr 27, 2005 · Updated Aug 7, 2024
Multiple SQL injection vulnerabilities in BK Forum 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to member.asp, (2) forum parameter to forum.asp, or (3) various parameters in register.asp.
Published Apr 26, 2005 · Updated Aug 7, 2024
SQL injection vulnerability in bBlog 0.7.4 allows remote attackers to execute arbitrary SQL commands via the postid parameter.
Published Apr 27, 2005 · Updated Aug 7, 2024
The citat.pl script allows remote attackers to execute arbitrary files via shell metacharacters in the argument.
Published Apr 26, 2005 · Updated Aug 7, 2024
Cross-site scripting (XSS) vulnerability in the inserter.cgi script allows remote attackers to inject arbitrary web script or HTML via the argument.
Published Apr 26, 2005 · Updated Aug 7, 2024
The affix_sock_register in the Affix Bluetooth Protocol Stack for Linux might allow local users to gain privileges via a socket call with a negative protocol value, which is used as an array index.
Published Apr 26, 2005 · Updated Aug 7, 2024
tcpdump 3.8.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted (1) BGP packet, which is not properly handled by RT_ROUTING_INFO, or (2) LDP packet, which is not properly handled by the ldp_print function.
Published Apr 26, 2005 · Updated Aug 7, 2024
Multiple SQL injection vulnerabilities in CartWIZ ASP Cart allow remote attackers to execute arbitrary SQL commands via the idProduct parameter to (1) addToCart.asp or (2) productDetails.asp, the (3) priceFrom, (4) idCategory, or (5) priceTo parameter to searchResults.asp, or (6) the idParentCategory parameter to productCatalogSubCats.asp.
Published Apr 26, 2005 · Updated Aug 7, 2024
The addnew script in Argosoft Mail Server Pro 1.8.7.6 allows remote attackers to create arbitrary accounts, even if "Allow Creation of Accounts From the Web Interface" is disabled, via a direct HTTP POST request.
Published Apr 26, 2005 · Updated Aug 7, 2024
The citat.pl script allows remote attackers to read arbitrary files via a full pathname in the argument.
Published Apr 26, 2005 · Updated Aug 7, 2024
include.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
Published Apr 26, 2005 · Updated Aug 7, 2024
