CVE-2005-1403

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in JustWilliam's Amazon Webstore 04050100 allow remote attackers to inject arbitrary web script or HTML via the (1) image parameter to closeup.php, the (2) currentIsExpanded or (3) searchFor parameters to index.php, (4) the currentNumber parameter to software_CAD_Technical_60002_uk.htm, or (5) a cookie.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lostmon.blogspot.com/2005/04/amazon-webstore-script-injection-and.htmlExploit
http://secunia.com/advisories/15155Exploit, Vendor Advisory
http://securitytracker.com/id?1013836Exploit
http://www.osvdb.org/15892
http://www.osvdb.org/15893
http://www.osvdb.org/15894Exploit, Vendor Advisory
http://www.securityfocus.com/bid/13419
http://www.securityfocus.com/bid/13425
http://www.securityfocus.com/bid/13426
http://www.securityfocus.com/bid/13427Exploit
http://lostmon.blogspot.com/2005/04/amazon-webstore-script-injection-and.htmlExploit
http://secunia.com/advisories/15155Exploit, Vendor Advisory
http://securitytracker.com/id?1013836Exploit
http://www.osvdb.org/15892
http://www.osvdb.org/15893
http://www.osvdb.org/15894Exploit, Vendor Advisory
http://www.securityfocus.com/bid/13419
http://www.securityfocus.com/bid/13425
http://www.securityfocus.com/bid/13426
http://www.securityfocus.com/bid/13427Exploit

Timeline

Published: May 3, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-14045.0MyPHP Forum 1.0 allows remote attackers to spoof the username by modifying the (1) nbuser parameter to post.php or (2) sender parameter to p CVE-2005-14052.1HTTP response splitting vulnerability in the @SetHTTPHeader function in Lotus Domino 6.5.x before 6.5.4 and 6.0.x before 6.0.5 allows attack CVE-2005-14064.6The kernel in FreeBSD 4.x to 4.11 and 5.x to 5.4 does not properly clear certain fixed-length buffers when copying variable-length data for CVE-2005-14074.6Skype for Windows 1.2.0.0 to 1.2.0.46 allows local users to bypass the identity check for an authorized application, then call arbitrary Sky CVE-2005-14085.0Apple Keynote 2.0 and 2.0.1 allows remote attackers to read arbitrary files via the keynote: URI handler in a crafted Keynote presentation.CVE-2005-14097.5PostgreSQL 7.3.x through 8.0.x gives public EXECUTE access to certain character conversion functions, which allows unprivileged users to cal CVE-2005-14102.1The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex_init, (2) snb_en_init, (3) snb_ru_init, (4) spell_init, and (5) syn CVE-2005-14114.6Cybration ICUII 7.0 stores passwords in plaintext in the world-readable icuii.ini file, which allows local users to gain privileges.CVE-2005-14127.5SQL injection vulnerability in verify.asp for Ecomm Professional Guestbook 3.x allows remote attackers to execute arbitrary SQL commands via CVE-2005-14137.5Multiple SQL injection vulnerabilities in enVivo!CMS allow remote attackers to execute arbitrary SQL commands and gain privileges via the (1 CVE-2005-14144.6ExoticSoft FilePocket 1.2 stores sensitive proxy information, including proxy passwords, in plaintext in the registry, which allows local us CVE-2005-141510.0Buffer overflow in GlobalSCAPE Secure FTP Server 3.0.2 allows remote authenticated users to execute arbitrary code via a long FTP command.