Unscored severity · published Nov 22, 2005
CVE-2005-3756
Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to port scan arbitrary hosts via URLs with modified targets and ports, then comparing…
–
CVSS
1.8%
EPSS
No
On KEV
Description
Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to port scan arbitrary hosts via URLs with modified targets and ports, then comparing the resulting error messages to determine open and closed ports.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Mini Search Appliance · Google
All versions, or not specified · source: NVD
SA
Search Appliance · Google
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-3756
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-3756
Patch
http://metasploit.com/research/vulns/google_proxystylesheet/
Vendor Advisory
http://secunia.com/advisories/17644
Patch
http://securitytracker.com/id?1015246
Exploit
http://www.osvdb.org/20979
www.securityfocus.com
http://www.securityfocus.com/archive/1/417310/30/0/threaded
Patch
http://www.securityfocus.com/bid/15509
More from Mini Search Appliance
–
CVE-2007-5255
Cross-site scripting (XSS) vulnerability in Google Mini Search Appliance 3.4.14 allows remote attackers to inject arbitrary web script or HTML via the ie parameter to the /search…
–
CVE-2006-6223
Cross-site scripting (XSS) vulnerability in Google Search Appliance and Google Mini allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded q parameter
–
CVE-2006-5019
Google Mini 4.4.102.M.36 and earlier allows remote attackers to obtain sensitive information via a direct request for /search with an invalid client parameter, which reveals the…
–
CVE-2005-3757
The Saxon XSLT parser in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to obtain sensitive information and execute arbitrary code via…
–
CVE-2005-3754
Cross-site scripting (XSS) vulnerability in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to inject arbitrary Javascript, and…