Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,617 results · page 44 of 53
Nov 18, 2005Lynx 2.8.5, and other versions before 2.8.6dev.15, allows remote attackers to execute arbitrary commands via (1) lynxcgi:, (2) lynxexec, and (3) lynxprog links,CVE-2005-2929 · Other software · University Of Kansas · reported by MITREHigh 7.5
Lynx 2.8.5, and other versions before 2.8.6dev.15, allows remote attackers to execute arbitrary commands via (1) lynxcgi:, (2) lynxexec, and (3) lynxprog links, which are not properly restricted in the default configuration in some environments.
- Product
- Lynx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.sco.comftp.sco.com
Nov 16, 2005suid.cgi scripts in F-Secure (1) Internet Gatekeeper for Linux before 2.15.484 and (2) Anti-Virus Linux Gateway before 2.16 are installed SUID with world-executCVE-2005-3546 · Other software · F-secure · reported by MITREHigh 7.2
suid.cgi scripts in F-Secure (1) Internet Gatekeeper for Linux before 2.15.484 and (2) Anti-Virus Linux Gateway before 2.16 are installed SUID with world-executable permissions, which allows local users to gain privilege.
- Product
- F-secure Anti-virus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Nov 16, 2005ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to access arbitrary local files via the querystring.CVE-2005-3579 · Other software · Walla Telesite · reported by MITREMedium 5
ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to access arbitrary local files via the querystring.
- Product
- Walla Telesite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecuritytracker.com
Nov 16, 2005SQL injection vulnerability in ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to inject arbitrary SQL commands via the sug parameCVE-2005-3578 · Other software · Walla Telesite · reported by MITREHigh 7.5
SQL injection vulnerability in ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to inject arbitrary SQL commands via the sug parameter.
- Product
- Walla Telesite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comosvdb.org
Nov 16, 2005Cross-site scripting vulnerability (XSS) in ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to inject arbitrary web script or HTMLCVE-2005-3577 · Other software · Walla Telesite · reported by MITREMedium 4.3
Cross-site scripting vulnerability (XSS) in ts.exe (aka ts.cgi) in Walla TeleSite 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the sug parameter.
- Product
- Walla Telesite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Nov 16, 2005Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a ..CVE-2005-3559 · Other software · Digium · reported by MITREMedium 5
Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a .. (dot dot) in the folder parameter.
- Product
- Asterisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2005Stack-based buffer overflow in help.cgi in the HTTP administrative interface for (1) Sun Java System Directory Server 5.2 2003Q4, 2004Q2, and 2005Q1, (2) Red HaCVE-2005-3269 · Other software · SUN · reported by Red HatHigh 7.5
Stack-based buffer overflow in help.cgi in the HTTP administrative interface for (1) Sun Java System Directory Server 5.2 2003Q4, 2004Q2, and 2005Q1, (2) Red Hat Directory Server and (3) Certificate Server before 7.1 SP1, (4) Sun ONE Directory Server 5.1 SP4 and earlier, and (5) Sun ONE Administration Server 5.2 allows remote attackers to cause a denial of service (admin server crash), or local users to gain root privileges.
- Product
- Java System Directory Proxy Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2005The (1) cgiwrap and (2) php-cgiwrap packages before 3.9 in Debian GNU/Linux provide access to debugging CGIs under the web document root, which allows remote atCVE-2005-3255 · Other software · reported by MITREMedium 5
The (1) cgiwrap and (2) php-cgiwrap packages before 3.9 in Debian GNU/Linux provide access to debugging CGIs under the web document root, which allows remote attackers to obtain sensitive information via direct requests to those CGIs.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.alioth.debian.orglists.alioth.debian.org
Oct 18, 2005The CGIwrap program before 3.9 on Debian GNU/Linux uses an incorrect minimum value of 100 for a UID to determine whether it can perform a seteuid operation, whiCVE-2005-3254 · Other software · Nathan Neulinger · reported by MITREHigh 10
The CGIwrap program before 3.9 on Debian GNU/Linux uses an incorrect minimum value of 100 for a UID to determine whether it can perform a seteuid operation, which could allow attackers to execute code as other system UIDs that are greater than the minimum value, which should be 1000 on Debian systems.
- Product
- Cgiwrap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.alioth.debian.orglists.alioth.debian.org
Sep 28, 2005mt-comments.cgi in Movable Type before 3.2 allows attackers to redirect users to other web sites via URLs in comments.CVE-2005-3104 · Other software · SIX Apart · reported by MITRELow 2.6
mt-comments.cgi in Movable Type before 3.2 allows attackers to redirect users to other web sites via URLs in comments.
- Product
- Movable Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecunia.com
Sep 28, 2005Directory traversal vulnerability in Avi Alkalay contribute.cgi (aka contribute.pl), dated 16 Jun 2002, allows remote attackers to overwrite arbitrary files viaCVE-2005-3097 · Other software · AVI Alkalay · reported by MITREMedium 5
Directory traversal vulnerability in Avi Alkalay contribute.cgi (aka contribute.pl), dated 16 Jun 2002, allows remote attackers to overwrite arbitrary files via ".." sequences in the contribdir variable.
- Product
- Contribute.cgi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2005Avi Alkalay man-cgi script allows remote attackers to execute arbitrary code via shell metacharacters in the topic parameter.CVE-2005-3094 · Other software · AVI Alkalay · reported by MITREHigh 7.5
Avi Alkalay man-cgi script allows remote attackers to execute arbitrary code via shell metacharacters in the topic parameter.
- Product
- MAN CGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comalkalay.net
Sep 28, 2005Avi Alkalay nslookup.cgi program, dated 16 June 2002, allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter.CVE-2005-3096 · Other software · AVI Alkalay · reported by MITREHigh 7.5
Avi Alkalay nslookup.cgi program, dated 16 June 2002, allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter.
- Product
- Nslookup.cgi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comalkalay.net
Sep 27, 2005Cross-site scripting (XSS) vulnerability in perldiver.cgi in PerlDiver 2.x allows remote attackers to inject arbitrary web script or HTML via the module parametCVE-2005-3067 · Other software · Scriptsolutions · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in perldiver.cgi in PerlDiver 2.x allows remote attackers to inject arbitrary web script or HTML via the module parameter.
- Product
- Perldiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comexploitlabs.com
Sep 15, 2005Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03, 3.03.6, and possibly other versions before 4.20.7, allows remote attackers to execute arbitrary code viaCVE-2005-2799 · Network & remote access · Linksys · reported by MITREHigh 7.5
Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03, 3.03.6, and possibly other versions before 4.20.7, allows remote attackers to execute arbitrary code via a long HTTP POST request.
- Product
- Wrt54g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordidefense.comidefense.com
Sep 2, 2005Directory traversal vulnerability in bestmail_edit.cgi in cosmoshop 8.10.78 and earlier allows remote administrators to read arbitrary files via ".." sequences CVE-2005-2786 · Other software · Cosmoshop · reported by MITREMedium 5
Directory traversal vulnerability in bestmail_edit.cgi in cosmoshop 8.10.78 and earlier allows remote administrators to read arbitrary files via ".." sequences in the file parameter.
- Product
- Cosmoshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2005comment_delete_cgi.php in Simple PHP Blog allows remote attackers to delete arbitrary files via the comment parameter.CVE-2005-2787 · Other software · Alexander Palmo · reported by MITREMedium 5
comment_delete_cgi.php in Simple PHP Blog allows remote attackers to delete arbitrary files via the comment parameter.
- Product
- Simple PHP Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2005upload_img_cgi.php in Simple PHP Blog (SPHPBlog) does not properly restrict file extensions of uploaded files, which could allow remote attackers to execute arbCVE-2005-2733 · Other software · Alexander Palmo · reported by MITREHigh 7.5
upload_img_cgi.php in Simple PHP Blog (SPHPBlog) does not properly restrict file extensions of uploaded files, which could allow remote attackers to execute arbitrary code.
- Product
- Simple PHP Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2005Y.SAK allows remote attackers to execute arbitrary commands via shell metacharacters in the $no variable to (1) w_s3mbfm.cgi, (2) w_s3adix.cgi, or (3) w_s3sbfm.CVE-2005-2334 · Other software · Y.sak · reported by MITREHigh 10
Y.SAK allows remote attackers to execute arbitrary commands via shell metacharacters in the $no variable to (1) w_s3mbfm.cgi, (2) w_s3adix.cgi, or (3) w_s3sbfm.cgi.
- Product
- Y.sak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comsecurityfocus.com
Jul 18, 2005wps_shop.cgi in WPS Web Portal System 0.7.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) art and (2) cat variables.CVE-2005-2290 · Other software · reported by MITREHigh 10
wps_shop.cgi in WPS Web Portal System 0.7.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) art and (2) cat variables.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2005The ReadLog function in kaiseki.cgi in pngren allows remote attackers to execute arbitrary commands via shell metacharacters in the query string.CVE-2005-2205 · Other software · Pngren · reported by MITREHigh 7.5
The ReadLog function in kaiseki.cgi in pngren allows remote attackers to execute arbitrary commands via shell metacharacters in the query string.
- Product
- Pngren
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecunia.com
Jul 11, 2005probe.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the olddat parameter.CVE-2005-2178 · Other software · Probe.cgi · reported by MITREHigh 7.5
probe.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the olddat parameter. NOTE: it is unclear which product or vendor this program is associated with, if any.
- Product
- Probe.cgi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecuritytracker.com
Jul 6, 2005PHP remote file inclusion vulnerability in form.inc.php3 in MyGuestbook 0.6.1 allows remote attackers to execute arbitrary PHP code via the lang parameter.CVE-2005-2162 · Other software · Levcgi.com · reported by MITREMedium 5
PHP remote file inclusion vulnerability in form.inc.php3 in MyGuestbook 0.6.1 allows remote attackers to execute arbitrary PHP code via the lang parameter.
- Product
- Myguestbook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2005read.cgi in GlobalNoteScript allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameters.CVE-2005-2165 · Other software · Globalnotescript · reported by MITREHigh 7.5
read.cgi in GlobalNoteScript allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameters.
- Product
- Globalnotescript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comzone-h.org
Jul 5, 2005im_trbbs.cgi in imTRSET 1.02 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the df parameter.CVE-2005-2082 · Other software · Cgi-club · reported by MITREMedium 5
im_trbbs.cgi in imTRSET 1.02 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the df parameter.
- Product
- Imtrset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2005login.cgi in Community Link Pro Web Editor allows remote attackers to execute arbitrary commands via the file parameter.CVE-2005-2111 · Other software · Community Link Pro Web Editor · reported by MITREHigh 7.5
login.cgi in Community Link Pro Web Editor allows remote attackers to execute arbitrary commands via the file parameter.
- Product
- Community Link Pro Web Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2005Heap-based buffer overflow in the CGI extension for Pico Server (pServ) 3.3 allows remote attackers to execute arbitrary code via a long HTTP request.CVE-2005-1953 · Other software · Pico Server · reported by MITREHigh 7.5
Heap-based buffer overflow in the CGI extension for Pico Server (pServ) 3.3 allows remote attackers to execute arbitrary code via a long HTTP request.
- Product
- Pico Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2005SilverCity before 0.9.5-r1 installs (1) cgi-styler-form.py, (2) cgi-styler.py, and (3) source2html.py with read and write world permissions, which allows local CVE-2005-1941 · Other software · Silvercity Project · reported by MITREHigh 7.8
SilverCity before 0.9.5-r1 installs (1) cgi-styler-form.py, (2) cgi-styler.py, and (3) source2html.py with read and write world permissions, which allows local users to execute arbitrary code.
- Product
- Silvercity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.gentoo.orgsecunia.com
May 24, 2005Cookie Cart allows remote attackers to read the Order Notification list via the testmycgi and path parameters to testmy.cgi.CVE-2005-1732 · Other software · Metro Marketing · reported by MITREMedium 5
Cookie Cart allows remote attackers to read the Order Notification list via the testmycgi and path parameters to testmy.cgi.
- Product
- Cookie Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2005D-Link DSL-502T, DSL-504T, DSL-562T, and DSL-G604T, when /cgi-bin/firmwarecfg is executed, allows remote attackers to bypass authentication (1) if their IP addrCVE-2005-1680 · Network & remote access · D-link · reported by MITREHigh 7.5
D-Link DSL-502T, DSL-504T, DSL-562T, and DSL-G604T, when /cgi-bin/firmwarecfg is executed, allows remote attackers to bypass authentication (1) if their IP address already exists in /var/tmp/fw_ip or (2) if their request is the first, which causes /var/tmp/fw_ip to be created and contain their IP address.
- Product
- Dsl-502t
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2005apage.cgi in WebAPP 0.9.9.2.1, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the f parameter.CVE-2005-1628 · Other software · Web-app.org · reported by MITREHigh 7.5
apage.cgi in WebAPP 0.9.9.2.1, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the f parameter.
- Product
- Webapp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddefacers.com.mxsecurityfocus.com
May 16, 2005Pico Server (pServ) 3.2 and earlier allows remote attackers to obtain the source code for CGI scripts via "dirname/../cgi-bin" in a URL.CVE-2005-1366 · Other software · Pico Server · reported by MITREHigh 7.5
Pico Server (pServ) 3.2 and earlier allows remote attackers to obtain the source code for CGI scripts via "dirname/../cgi-bin" in a URL.
- Product
- Pico Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosourceforge.net
May 16, 2005Cross-site scripting (XSS) vulnerability in shop.cgi in Remote Cart allows remote attackers to inject arbitrary web script or HTML via the (1) merchant or (2) dCVE-2005-1607 · Other software · Remote Cart · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in shop.cgi in Remote Cart allows remote attackers to inject arbitrary web script or HTML via the (1) merchant or (2) demo parameters.
- Product
- Remote Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comgovernmentsecurity.org
May 12, 2005post_bug.cgi in Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 allows remote authenticated users to "enter bugs into products that are closed for bug entry" by CVE-2005-1564 · Computers, phones & browsers · Mozilla · reported by MITREHigh 7.5
post_bug.cgi in Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 allows remote authenticated users to "enter bugs into products that are closed for bug entry" by modifying the URL to specify the name of the product.
- Product
- Bugzilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2005Multiple cross-site scripting (XSS) vulnerabilities in admin.cgi in MegaBook 2.0 and 2.1 allow remote attackers to inject arbitrary web script or HTML via the (CVE-2005-1494 · Other software · Megabook · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in admin.cgi in MegaBook 2.0 and 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) entryid or (2) password parameter.
- Product
- Megabook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityfocus.com
May 11, 2005Cross-site scripting (XSS) vulnerability in user.cgi in Gossamer Threads Links SQL 2.x and 3.0 allows remote attackers to inject arbitrary web script or HTML viCVE-2005-1492 · Other software · Gossamer Threads · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in user.cgi in Gossamer Threads Links SQL 2.x and 3.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
- Product
- Gossamer Threads Links
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgossamer-threads.commarc.info
May 3, 2005Format string vulnerability in ArcGIS for ESRI ArcInfo Workstation 9.0 allows local users to gain privileges via format string specifiers in the ARCHOME environCVE-2005-1394 · Other software · Esri · reported by MITREHigh 7.2
Format string vulnerability in ArcGIS for ESRI ArcInfo Workstation 9.0 allows local users to gain privileges via format string specifiers in the ARCHOME environment variable to (1) wservice or (2) lockmgr.
- Product
- Arcinfo Workstation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2005Multiple buffer overflows in ArcGIS for ESRI ArcInfo Workstation 9.0 allow local users to execute arbitrary code via long command line arguments to (1) asmasterCVE-2005-1393 · Other software · Esri · reported by MITREMedium 4.6
Multiple buffer overflows in ArcGIS for ESRI ArcInfo Workstation 9.0 allow local users to execute arbitrary code via long command line arguments to (1) asmaster, (2) asuser, (3) asutility, (4) se, or (5) asrecovery.
- Product
- Arcinfo Workstation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005Cross-site scripting (XSS) vulnerability in the ad.cgi script allows remote attackers to inject arbitrary web script or HTML via the argument.CVE-2005-1352 · Other software · Leif M. Wright · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the ad.cgi script allows remote attackers to inject arbitrary web script or HTML via the argument.
- Product
- Ad.cgi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005The ad.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.CVE-2005-1351 · Other software · Leif M. Wright · reported by MITREHigh 7.5
The ad.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
- Product
- Ad.cgi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005The ad.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument.CVE-2005-1350 · Other software · Leif M. Wright · reported by MITREMedium 5
The ad.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument.
- Product
- Ad.cgi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005The hyper.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument.CVE-2005-1305 · Other software · Hyper.cgi · reported by MITREMedium 5
The hyper.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument.
- Product
- Hyper.cgi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005index.cgi in E-Cart 2004 1.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) art and possibly (2) cat paraCVE-2005-1289 · Other software · E-cart · reported by MITREHigh 7.5
index.cgi in E-Cart 2004 1.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) art and possibly (2) cat parameters.
- Product
- E-cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005CRLF injection vulnerability in bizmail.cgi in Biz Mail Form before 2.2 allows remote attackers to bypass the email check and send spam e-mail via CRLF sequenceCVE-2005-0493 · Other software · Seth M. Knorr · reported by MITREMedium 5
CRLF injection vulnerability in bizmail.cgi in Biz Mail Form before 2.2 allows remote attackers to bypass the email check and send spam e-mail via CRLF sequences and forged mail headers in the email parameter.
- Product
- BIZ Mail Form
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005Cross-site scripting (XSS) vulnerability in network.cgi in mailreader before 2.3.29 earlier allows remote attackers to inject arbitrary web script or HTML via MCVE-2005-0386 · Other software · Mailreader.com · reported by security@debian.orgMedium 4.3
Cross-site scripting (XSS) vulnerability in network.cgi in mailreader before 2.3.29 earlier allows remote attackers to inject arbitrary web script or HTML via MIME text/enriched or text/richtext messages.
- Product
- Mailreader.com
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005perlshop.cgi shopping cart program stores sensitive customer information in directories and files that are under the web root, which allows remote attackers to CVE-1999-1374 · Other software · Arpanet · reported by MITREMedium 5
perlshop.cgi shopping cart program stores sensitive customer information in directories and files that are under the web root, which allows remote attackers to obtain that information via an HTTP request.
- Product
- Perlshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005Cross-site scripting (XSS) vulnerability in text.cgi script allows remote attackers to inject arbitrary web script or HTML via the argument.CVE-2005-1359 · Other software · Text.cgi · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in text.cgi script allows remote attackers to inject arbitrary web script or HTML via the argument.
- Product
- Text.cgi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005text.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.CVE-2005-1358 · Other software · Text.cgi · reported by MITREHigh 7.5
text.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.
- Product
- Text.cgi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005text.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument.CVE-2005-1357 · Other software · Text.cgi · reported by MITREMedium 5
text.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument.
- Product
- Text.cgi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005Cross-site scripting (XSS) vulnerability in includer.cgi script in The Includer allows remote attackers to inject arbitrary web script or HTML via the argument.CVE-2005-1356 · Other software · Includer.cgi · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in includer.cgi script in The Includer allows remote attackers to inject arbitrary web script or HTML via the argument.
- Product
- Includer.cgi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.