CVE-2005-4774

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in Xerver 4.17 allows remote attackers to inject arbitrary web script or HTML after a /%00/ sequence at the end of the URI.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/17243Exploit, Patch, Vendor Advisory
http://securitytracker.com/id?1015079Exploit, Patch
http://www.osvdb.org/20077Exploit, Patch
http://www.securityfocus.com/bid/15135Exploit, Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/22787
http://secunia.com/advisories/17243Exploit, Patch, Vendor Advisory
http://securitytracker.com/id?1015079Exploit, Patch
http://www.osvdb.org/20077Exploit, Patch
http://www.securityfocus.com/bid/15135Exploit, Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/22787

Timeline

Published: Dec 31, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-47755.0Michael Scholz and Sebastian Stein Contineo 2.0, when the admin account lacks an e-mail address attribute, displays the password hash in a w CVE-2005-47767.2Integer overflow in the FreeBSD compatibility code (freebsd_misc.c) in NetBSD-current, NetBSD-3, NetBSD-2.0, and NetBSD-2 before 20050913; a CVE-2005-47774.9Tashcom ASPEdit 2.9 stores the administration password (aka the FTP password) in cleartext in the registry, which might allow local users to CVE-2005-47782.1The powersave daemon in SUSE Linux 10.0 before 20051007 has an unspecified "configuration problem," which allows local users to suspend the CVE-2005-47793.6verifiedexecioctl in verified_exec.c in NetBSD 2.0.2 calls NDINIT with UIO_USERSPACE rather than UID_SYSSPACE, which removes the functionali CVE-2005-47803.7Cross-site scripting (XSS) vulnerability in Fidra Lighthouse CMS 1.1.0 and earlier allows remote attackers to inject arbitrary web script or CVE-2005-47815.0Multiple SQL injection vulnerabilities in SergiDs Top Music module 3.0 PR3 and earlier for PHP-Nuke allow remote attackers to execute arbitr CVE-2005-47824.9NetBSD 2.0 before 2.0.4, 2.1 before 2.1.1, and 3, when the kernel is compiled with "options DIAGNOSTIC," allows local users to cause a denia CVE-2005-47832.1kernfs_xread in kernfs_vnops.c in NetBSD before 20050831 does not check for a negative offset when reading the message buffer, which allows CVE-2005-47845.6Multiple buffer overflows in the POSIX readdir_r function, as used in multiple packages, allow local users to cause a denial of service and CVE-2005-47854.3Cross-site scripting (XSS) vulnerability in QuickBlogger 1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via CVE-2005-47864.0Buffer overflow in the archive decompression library (vrAZMain.dll 5.8.22.137), as used in HAURI anti-virus products including (1) ViRobot E