CVE-2005-2020

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in the web server for 3Com Network Supervisor 5.0.2 allows remote attackers to read arbitrary files via ".." sequences in the URL to TCP port 21700.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/16639Patch, Vendor Advisory
http://securitytracker.com/id?1014836Patch, Vendor Advisory
http://www.idefense.com/application/poi/display?id=300&type=vulnerabilities&flashstatus=truePatch, Vendor Advisory
http://www.vupen.com/english/advisories/2005/1611
http://secunia.com/advisories/16639Patch, Vendor Advisory
http://securitytracker.com/id?1014836Patch, Vendor Advisory
http://www.idefense.com/application/poi/display?id=300&type=vulnerabilities&flashstatus=truePatch, Vendor Advisory
http://www.vupen.com/english/advisories/2005/1611

Timeline

Published: Sep 8, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-20214.3Cross-site scripting (XSS) vulnerability in cPanel 9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the us CVE-2005-20224.3Unknown vulnerability in Webmail in iPlanet Messaging Server 5.2 Patch 1 and Sun ONE Messaging Server 6.2 allows remote attackers to execute CVE-2005-202310.0The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 does not properly handle certain options, which can prevent pi CVE-2005-20245.0Vipul Razor Agents (razor-agents) before 2.70 allows remote attackers to cause a denial of service via (1) certain "unusual HTML messages" o CVE-2005-20255.0Cisco VPN 3000 Concentrator before 4.1.7.F allows remote attackers to determine valid groupnames by sending an IKE Aggressive Mode packet wi CVE-2005-20267.5Enterasys Vertical Horizon VH-2402S before firmware 2.05.05.09 has a hard-coded account and password for debugging, which allows remote atta CVE-2005-20275.0Enterasys Vertical Horizon VH-2402S before firmware 2.05.05.09 does not properly restrict certain debugging commands to the ADMIN account, w CVE-2005-20287.5SQL injection vulnerability in index.php for MercuryBoard 1.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via th CVE-2005-20297.5amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allow CVE-2005-20305.0Ultimate PHP Board (UPB) 1.9.6 GOLD uses weak encryption for passwords in the users.dat file, which allows attackers to easily decrypt the p CVE-2005-20317.5Multiple SQL injection vulnerabilities in socialMPN allow remote attackers to execute arbitrary SQL commands via (1) the sid parameter to ar CVE-2005-20322.1Unknown vulnerability in lpadmin on Sun Solaris 7, 8, and 9 allows local users to overwrite arbitrary files.