rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-0880 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Noah's Classifieds 1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) inf parameter; or, when register_globals is enabled, the (2) upperTemplate and (3) lowerTemplate parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-24T11:00:00.000Z
CVE-2006-0881 
Multiple PHP remote file include vulnerabilities in gorum/gorumlib.php in Noah's Classifieds 1.3, when register_globals is enabled, allow remote attackers to include arbitrary PHP files via the (1) upperTemplate and (2) lowerTemplate parameters, as demonstrated using the lowerTemplate parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-24T11:00:00.000Z
CVE-2006-0882 
Directory traversal vulnerability in include.php in Noah's Classifieds 1.3 allows remote attackers to include arbitrary local files via the otherTemplate parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-24T11:00:00.000Z
CVE-2006-0883 
OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle when a forked child process terminates during PAM authentication, which allows remote attackers to cause a denial of service (client connection refusal) by connecting multiple times to the SSH server, waiting for the password prompt, then disconnecting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-07T02:00:00.000Z
CVE-2006-0884 
The WYSIWYG rendering engine ("rich mail" editor) in Mozilla Thunderbird 1.0.7 and earlier allows user-assisted attackers to bypass javascript security settings and obtain sensitive information or cause a crash via an e-mail containing a javascript URI in the SRC attribute of an IFRAME tag, which is executed when the user edits the e-mail.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-24T22:00:00.000Z
CVE-2006-0885 
Cross-site scripting (XSS) vulnerability in show_news.php in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the show parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-25T11:00:00.000Z
CVE-2006-0886 
Cross-site scripting (XSS) vulnerability in register.php in DEV web management system 1.5 allows remote attackers to inject arbitrary web script or HTML via the "City/Region" field (mesto variable).  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-25T11:00:00.000Z
CVE-2006-0887 
Eval injection vulnerability in sessions.inc in PHP Base Library (PHPLib) before 7.4a, when index.php3 from the PHPLib distribution is available on the server, allows remote attackers to execute arbitrary PHP code by including a base64-encoded representation of the code in a cookie.  NOTE: this description was significantly updated on 20060605 to reflect new details after an initial vague advisory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-25T11:00:00.000Z
CVE-2006-0888 
index.php in Invision Power Board (IPB) 2.0.1, with Code Confirmation disabled, allows remote attackers to cause an unspecified denial of service by registering a large number of users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-25T11:00:00.000Z
CVE-2006-0889 
Cross-site scripting (XSS) vulnerability in Calcium 3.10.1 allows remote attackers to inject arbitrary web script or HTML via the EventText parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-25T11:00:00.000Z
CVE-2006-0890 
Directory traversal vulnerability in SpeedProject Squeez 5.1, as used in (1) ZipStar 5.1 and (2) SpeedCommander 11.01.4450, allows remote attackers to overwrite arbitrary files via unspecified manipulations in a (1) JAR or (2) ZIP archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-25T11:00:00.000Z
CVE-2006-0891 
Multiple directory traversal vulnerabilities in NOCC Webmail 1.0 allow remote attackers to include arbitrary files via .. (dot dot) sequences and a trailing NULL (%00) byte in (1) the _SESSION['nocc_theme'] parameter in (a) html/footer.php; and (2) the lang and (3) theme parameters and the (4) Accept-Language HTTP header field, when force_default_lang is disabled, in (b) index.php, as demonstrated by injecting PHP code into a profile and accessing it using the lang parameter in index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-25T11:00:00.000Z
CVE-2006-0892 
NOCC Webmail 1.0 stores e-mail attachments in temporary files with predictable filenames, which makes it easier for remote attackers to execute arbitrary code by accessing the e-mail attachment via directory traversal vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-25T11:00:00.000Z
CVE-2006-0893 
NOCC Webmail 1.0 allows remote attackers to obtain sensitive information via a direct request to (1) the profiles directory, which leaks e-mail addresses contained in filenames of profiles, and (2) the tmp directory, which lists names of uploaded attachments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-25T11:00:00.000Z
CVE-2006-0894 
Multiple cross-site scripting (XSS) vulnerabilities in NOCC Webmail 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the html_error_occurred parameter in error.php, (2) html_filter_select parameter in filter_prefs.php, (3) html_no_mail parameter in no_mail.php, the (4) page_line, (5) prev, and (6) next parameters in html_bottom_table.php, and the (7) _SESSION['nocc_theme'] parameter in footer.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-25T11:00:00.000Z
CVE-2006-0895 
NOCC Webmail 1.0 allows remote attackers to obtain the installation path via a direct request to html/header.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-25T11:00:00.000Z
CVE-2006-0896 
Cross-site scripting (XSS) vulnerability in Sources/Register.php in Simple Machine Forum (SMF) 1.0.6 allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For HTTP header field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-25T11:00:00.000Z
CVE-2006-0897 
SQL injection vulnerability in VCS Virtual Program Management Intranet (VPMi) Enterprise 3.3 allows remote attackers to execute arbitrary SQL commands via the UpdateID0 parameter to Service_Requests.asp.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: the vendor has disputed this issue, saying that "[we] have a behind the scenes complex state management system that uses a combination of keys placed in JavaScript and Session State (server side) that protects against the type of SQL injection you describe.  We have tested for many of the cases and have not found it to be an issue."  Further investigation suggests that the original researcher might have triggered errors using invalid field values, which is not proof of SQL injection; however, the vendor did not receive a response from the original researcher
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-25T11:00:00.000Z
CVE-2006-0898 
Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-25T11:00:00.000Z
CVE-2006-0899 
Directory traversal vulnerability in index.php in 4Images 1.7.1 and earlier allows remote attackers to read and include arbitrary files via ".." (dot dot) sequences in the template parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-27T19:00:00.000Z
CVE-2006-0900 
nfsd in FreeBSD 6.0 kernel allows remote attackers to cause a denial of service via a crafted NFS mount request, as demonstrated by the ProtoVer NFS test suite.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-27T19:00:00.000Z
CVE-2006-0901 
Unspecified vulnerability in the hsfs filesystem in Solaris 8, 9, and 10 allows unspecified attackers to cause a denial of service (panic) or execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-27T19:00:00.000Z
CVE-2006-0903 
MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysql_real_query function.  NOTE: this issue was originally reported for the mysql_query function, but the vendor states that since mysql_query expects a null character, this is not an issue for mysql_query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-27T23:00:00.000Z
CVE-2006-0905 
A "programming error" in fast_ipsec in FreeBSD 4.8-RELEASE through 6.1-STABLE and NetBSD 2 through 3 does not properly update the sequence number associated with a Security Association, which allows packets to pass sequence number checks and allows remote attackers to capture IPSec packets and conduct replay attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-23T11:00:00.000Z
CVE-2006-0906 
SQL injection vulnerability in D3Jeeb Pro 3 allows remote attackers to execute arbitrary SQL commands via the catid parameter in (1) fastlinks.php and (2) catogary.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T02:00:00.000Z
CVE-2006-0907 
SQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/*) sequences in the query string, which bypasses regular expressions that are intended to protect against SQL injection, as demonstrated via the kala parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T02:00:00.000Z
CVE-2006-0908 
PHP-Nuke 7.8 Patched 3.2 allows remote attackers to bypass SQL injection protection mechanisms via /%2a (/*) sequences with the "ad_click" word in the query string, as demonstrated via the kala parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T02:00:00.000Z
CVE-2006-0909 
Invision Power Board (IPB) 2.1.4 and earlier allows remote attackers to view sensitive information via a direct request to multiple PHP scripts that include the full path in error messages, including (1) PEAR/Text/Diff/Renderer/inline.php, (2) PEAR/Text/Diff/Renderer/unified.php, (3) PEAR/Text/Diff3.php, (4) class_db.php, (5) class_db_mysql.php, and (6) class_xml.php in the ips_kernel/ directory; (7) mysql_admin_queries.php, (8) mysql_extra_queries.php, (9) mysql_queries.php, and (10) mysql_subsm_queries.php in the sources/sql directory; (11) sources/acp_loaders/acp_pages_components.php; (12) sources/action_admin/member.php and (13) sources/action_admin/paysubscriptions.php; (14) login.php, (15) messenger.php, (16) moderate.php, (17) paysubscriptions.php, (18) register.php, (19) search.php, (20) topics.php, (21) and usercp.php in the sources/action_public directory; (22) bbcode/class_bbcode.php, (23) bbcode/class_bbcode_legacy.php, (24) editor/class_editor_rte.php, (25) editor/class_editor_std.php, (26) post/class_post.php, (27) post/class_post_edit.php, (28) post/class_post_new.php, (29) and post/class_post_reply.php in the sources/classes directory; (30) sources/components_acp/registration_DEPR.php; (31) sources/handlers/han_paysubscriptions.php; (32) func_usercp.php; (33) search_mysql_ftext.php, and (34) search_mysql_man.php in the sources/lib/ directory; and (35) convert/auth.php.bak, (36) external/auth.php, and (37) ldap/auth.php in the sources/loginauth directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0910 
Invision Power Board (IPB) 2.1.4 and earlier allows remote attackers to list directory contents via a direct request to multiple directories, including (1) sources/loginauth/convert/, (2) sources/portal_plugins/, (3) cache/skin_cache/cacheid_2/, (4) ips_kernel/PEAR/, (5) ips_kernel/PEAR/Text/, (6) ips_kernel/PEAR/Text/Diff/, (7) ips_kernel/PEAR/Text/Diff/Renderer/, (8) style_images/1/folder_rte_files/, (9) style_images/1/folder_js_skin/, (10) style_images/1/folder_rte_images/, and (11) upgrade/ and its subdirectories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0911 
NmService.exe in Ipswitch WhatsUp Professional 2006 allows remote attackers to cause a denial of service (CPU consumption) via crafted requests to Login.asp, possibly involving the (1) "In]" and (2) "b;tnLogIn" parameters, or (3) malformed btnLogIn parameters, possibly involving missing "[" (open bracket) or "[" (closing bracket) characters, as demonstrated by "&btnLogIn=[Log&In]=&" or "&b;tnLogIn=[Log&In]=&" in the URL.  NOTE: due to the lack of diagnosis by the original researcher, the precise nature of the vulnerability is unclear.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0912 
Oreka before 0.5 allows remote attackers to cause a denial of service (application crash) via a "certain RTP sequence."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0913 
SQL injection vulnerability in whineatnews.pl in Bugzilla 2.17 through 2.18.4 and 2.20 allows remote authenticated users with administrative privileges to execute arbitrary SQL commands via the whinedays parameter, as accessible from editparams.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0914 
Bugzilla 2.16.10, 2.17 through 2.18.4, and 2.20 does not properly handle certain characters in the mostfreqthreshold parameter in duplicates.cgi, which allows remote attackers to trigger a SQL error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0915 
Bugzilla 2.16.10 does not properly handle certain characters in the (1) maxpatchsize and (2) maxattachmentsize parameters in attachment.cgi, which allows remote attackers to trigger a SQL error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0916 
Bugzilla 2.19.3 through 2.20 does not properly handle "//" sequences in URLs when redirecting a user from the login form, which could cause it to generate a partial URL in a form action that causes the user's browser to send the form data to another domain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0917 
Melange Chat Server (aka M-Chat), when accessed via a web browser, automatically sends cookies and other sensitive information for a server to any port specified in the associated link, which allows local users on that server to read the cookies from HTTP headers and possibly gain sensitive information, such as credentials, by setting up a listening port and reading the credentials when the victim clicks on the link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0918 
Buffer overflow in RITLabs The Bat! 3.60.07 allows remote attackers to execute arbitrary code via a long Subject field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0919 
SQL injection vulnerability in index.php (aka the login page) in Oi! Email Marketing System 3.0 (aka Oi! 3) allows remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0920 
Oi! Email Marketing System 3.0 (aka Oi! 3) stores the server's FTP password in cleartext on a Configuration web page, which allows local users with superadministrator privileges, or attackers who have obtained access to the web page, to view the password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0921 
Multiple directory traversal vulnerabilities in connector.php in FCKeditor 2.0 FC, as used in products such as RunCMS, allow remote attackers to list and create arbitrary directories via a .. (dot dot) in the CurrentFolder parameter to (1) GetFoldersAndFiles and (2) CreateFolder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0922 
CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php (aka upload.php) that allows remote attackers to upload arbitrary files via a modified CurrentFolder parameter in a direct request to admin/filemanager/upload.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0923 
Multiple cross-site scripting (XSS) vulnerabilities in MyPHPNuke (MPN) 1.88 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the letter parameter in reviews.php and (2) the dcategory parameter in download.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0924 
Cross-site scripting (XSS) vulnerability in Brown Bear iCal 3.10 allows remote attackers to inject arbitrary web script or HTML via the Calendar Text field when a new event is added.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0925 
Format string vulnerability in the IMAP4rev1 server in Alt-N MDaemon 8.1.1 and possibly 8.1.4 allows remote attackers to cause a denial of service (CPU consumption) by creating and then listing folders whose names contain format string specifiers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0926 
Multiple directory traversal vulnerabilities in Allume StuffIt Standard and Deluxe 9.0, ZipMagic Deluxe 9.0, and StuffIt Expander 9.0.0.21 Engine 9.0.0.21 allow remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a (1) zip or (2) tar archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0927 
Multiple cross-site scripting (XSS) vulnerabilities in the JGS-XA JGS-Gallery Addon 4.0.0 and earlier for Woltlab Burning Board (wBB) 2.x allow remote attackers to inject arbitrary web script or HTML via the (1) userid parameter in (a) jgs_galerie_slideshow.php and (b) jgs_galerie_scroll.php, and the (2) katid parameter in (c) jgs_galerie_slideshow.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0928 
The POP3 Server in ArGoSoft Mail Server Pro 1.8 allows remote attackers to obtain sensitive information via the _DUMP command, which reveals the operating system, registered user, and registration code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0929 
Directory traversal vulnerability in the IMAP server in ArGoSoft Mail Server Pro 1.8.8.1 allows remote authenticated users to create arbitrary folders via a .. (dot dot) in the RENAME command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0930 
Directory traversal vulnerability in Webmail in ArGoSoft Mail Server Pro 1.8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the UIDL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0931 
Directory traversal vulnerability in PEAR::Archive_Tar 1.2, and other versions before 1.3.2, allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a TAR archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0932 
Directory traversal vulnerability in zip.lib.php 0.1.1 in PEAR::Archive_Zip allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a ZIP archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0933 
Cross-site scripting (XSS) vulnerability in PHPX 3.5.9 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a url XCode tag in a posted message.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0934 
Cross-site scripting (XSS) vulnerability in webinsta Limbo 1.0.4.2 allows remote attackers to inject arbitrary web script or HTML via the message field in the Contact Form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0935 
Microsoft Word 2003 allows remote attackers to cause a denial of service (application crash) via a crafted file, as demonstrated by 101_filefuzz.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0936 
Free Host Shop Website Generator 3.3 allows remote authenticated users with administrative privileges to upload and execute arbitrary files via a formname parameter with a filename containing a dangerous file extension and a trailing %00.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0937 
U.N.U. Mailgust 1.9 allows remote attackers to obtain sensitive information via a direct request to index.php with method=showfullcsv, which reveals the POP3 server configuration, including account name and password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-28T11:00:00.000Z
CVE-2006-0938 
Cross-site scripting (XSS) vulnerability in eZ publish 3.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the RefererURL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-01T02:00:00.000Z
CVE-2006-0939 
SQL injection vulnerability in DCI-Taskeen 1.03 allows remote attackers to execute arbitrary SQL commands via the (1) id or (2) action parameter to (a) basket.php, or (3) id or (4) page parameter to (b) cat.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-01T02:00:00.000Z