rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-3670 
Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe.  NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE's opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox, and this issue could arise with other protocol handlers in IE as well. However, Mozilla has stated that it will address the issue with a "defense in depth" fix that will "prevent IE from sending Firefox malicious data."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-10T19:00:00.000Z
CVE-2007-3671 
Unspecified vulnerability in the kernel in Microsoft Windows Vista has unspecified remote attack vectors and impact, as shown in the "0day IPO" presentation at SyScan'07.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-10T19:00:00.000Z
CVE-2007-3672 
Cross-site scripting (XSS) vulnerability in ecrire/tools.php in DotClear 1.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified form fields on the blogroll page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-10T19:00:00.000Z
CVE-2007-3673 
Symantec symtdi.sys before 7.0.0, as distributed in Symantec AntiVirus Corporate Edition 9 through 10.1 and Client Security 2.0 through 3.1, Norton AntiSpam 2005, and Norton AntiVirus, Internet Security, Personal Firewall, and System Works 2005 and 2006; allows local users to gain privileges via a crafted Interrupt Request Packet (Irp) in an IOCTL 0x83022323 request to \\symTDI\, which results in memory overwrite.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T21:00:00.000Z
CVE-2007-3675 
Multiple format string vulnerabilities in the kavwebscan.CKAVWebScan ActiveX control (kavwebscan.dll) in Kaspersky Online Scanner before 5.0.98 allow remote attackers to execute arbitrary code via format string specifiers in "various string formatting functions," which trigger heap-based buffer overflows.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T20:00:00.000Z
CVE-2007-3676 
IBM DB2 Universal Database (UDB) Administration Server (DAS) 8 before Fix Pack 16 and 9 before Fix Pack 4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via modified pointer values in unspecified remote administration requests, which triggers memory corruption or other invalid memory access. NOTE: this might be the same issue as CVE-2008-0698.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-12T23:00:00.000Z
CVE-2007-3677 
Multiple SQL injection vulnerabilities in Maxsi eVisit Analyst allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) idsp1.pl, (2) ip.pl, and (3) einsite_director.pl. NOTE: this issue can be leveraged for path disclosure from resulting error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T16:00:00.000Z
CVE-2007-3678 
Stack-based buffer overflow in the MSWord text-import extension (Word 6-2000 Filter.xnt) in QuarkXPress 7.2 for Windows, when using the Rectangle Text Box tool for importing text, allows user-assisted remote attackers to execute arbitrary code via a long font name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T16:00:00.000Z
CVE-2007-3679 
The Citrix EPA ActiveX control (aka the "endpoint checking control" or CCAOControl Object) before 4.5.0.0 in npCtxCAO.dll in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 allows remote attackers to download and execute arbitrary programs onto a client system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-25T17:00:00.000Z
CVE-2007-3680 
Stack-based buffer overflow in the odm_searchpath function in libodm in IBM AIX 5.2.0 and 5.3.0 allows local users to execute arbitrary code via a long ODMPATH environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T17:00:00.000Z
CVE-2007-3681 
The IOCTL 9031 (BIOCGSTATS) handler in the NPF.SYS device driver in WinPcap before 4.0.1 allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T17:00:00.000Z
CVE-2007-3682 
SQL injection vulnerability in index.php in OpenLD 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T17:00:00.000Z
CVE-2007-3683 
SQL injection vulnerability in pagetopic.php in Aigaion 1.3.3 and earlier allows remote attackers to execute arbitrary SQL commands via the topic_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T17:00:00.000Z
CVE-2007-3684 
Multiple SQL injection vulnerabilities in Unobtrusive Ajax Star Rating Bar before 1.2.0 allow remote attackers to execute arbitrary SQL commands via the (1) q and (2) t parameters in (a) db.php and (b) rpc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T17:00:00.000Z
CVE-2007-3685 
Cross-site scripting (XSS) vulnerability in rpc.php in Unobtrusive Ajax Star Rating Bar before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T17:00:00.000Z
CVE-2007-3686 
CRLF injection vulnerability in db.php in Unobtrusive Ajax Star Rating Bar before 1.2.0 allows remote attackers to inject arbitrary HTTP headers and data via CRLF sequences in the HTTP_REFERER parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T17:00:00.000Z
CVE-2007-3687 
SQL injection vulnerability in inferno.php in the Inferno Technologies RPG Inferno 2.4 and earlier, a vBulletin module, allows remote authenticated attackers to execute arbitrary SQL commands via the id parameter in a ScanMember do action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T17:00:00.000Z
CVE-2007-3688 
Multiple cross-site request forgery (CSRF) vulnerabilities in DotClear 1.2.6 allow remote attackers to perform actions as arbitrary users via the (1) tool_url parameter to ecrire/tools.php and multiple fields on the (2) blogconf, (3) blogroll, (4) ecrire/redacteur.php, and (5) ecrire/user_prefs.php pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T17:00:00.000Z
CVE-2007-3689 
The Print module before 4.7-1.0 and 5.x before 5.x-1.2 for Drupal allows remote attackers to read restricted posts in (1) Organic Groups, (2) Taxonomy Access Control, (3) Taxonomy Access Lite, and other unspecified node access modules, via modified URL arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T17:00:00.000Z
CVE-2007-3690 
The Forward module before 4.7-1.1 and 5.x before 5.x-1.0 for Drupal allows remote attackers to read restricted posts in (1) Organic Groups, (2) Taxonomy Access Control, (3) Taxonomy Access Lite, and other unspecified node access modules, via modified URL arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T17:00:00.000Z
CVE-2007-3691 
Multiple SQL injection vulnerabilities in changePW.php in AV Tutorial Script (avtutorial) 1.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) userid parameters, a different issue than CVE-2007-3630.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T17:00:00.000Z
CVE-2007-3692 
Directory traversal vulnerability in download.cgi in EZFactory KDDI Download CGI 1.x allows remote attackers to read and download arbitrary files via a .. (dot dot) in the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T17:00:00.000Z
CVE-2007-3693 
Cross-site scripting (XSS) vulnerability in Gobi as of 20070711, built on Helma, allows remote attackers to inject arbitrary web script or HTML via the q parameter to the search function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3694 
Cross-site scripting (XSS) vulnerability in login.php in Miro Project Broadcast Machine 0.9.9.9 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-14T23:00:00.000Z
CVE-2007-3695 
Buffer overflow in LICRCMD.EXE in CA ERwin Process Modeler (formerly AllFusion Process Modeler) 7.1 allows attackers to execute arbitrary code via a long filename.  NOTE: the researcher does not suggest any circumstances in which the filename would come from an untrusted source, and therefore perhaps the issue does not cross privilege boundaries and should not be included in CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T22:00:00.000Z
CVE-2007-3696 
CA ERwin Data Model Validator (formerly AllFusion Data Model Validator) allows remote attackers to (1) cause a denial of service (application hang) via a malformed .EXP database file and (2) cause a denial of service (aaplication crash) via a crafted .EXP database file, which triggers a NULL dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T22:00:00.000Z
CVE-2007-3697 
PHP remote file inclusion vulnerability in phpbb/sendmsg.php in FlashBB 1.1.8 and earlier allows remote attackers to execute arbitrary code via a URL in the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T22:00:00.000Z
CVE-2007-3698 
The Java Secure Socket Extension (JSSE) in Sun JDK and JRE 6 Update 1 and earlier, JDK and JRE 5.0 Updates 7 through 11, and SDK and JRE 1.4.2_11 through 1.4.2_14, when using JSSE for SSL/TLS support, allows remote attackers to cause a denial of service (CPU consumption) via certain SSL/TLS handshake requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T22:00:00.000Z
CVE-2007-3699 
The Decomposer component in multiple Symantec products allows remote attackers to cause a denial of service (infinite loop) via a certain value in the PACK_SIZE field of a RAR archive file header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-05T21:00:00.000Z
CVE-2007-3700 
Sun Java System Access Manager (formerly Java System Identity Server) before 20070710, when the message debug level is configured in the com.iplanet.services.debug.level property in AMConfig.properties, logs cleartext login passwords, which allows local users to gain privileges by reading /var/opt/SUNWam/debug/amAuth.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3701 
TippingPoint IPS before 20070710 does not properly handle a hex-encoded alternate Unicode '/' (slash) character, which might allow remote attackers to send certain network traffic and avoid detection, as demonstrated by a cmd.exe attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3702 
Directory traversal vulnerability in the load function in cgi-bin/mail/mailmachine.cgi in Mail Machine 3.989 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the archives parameter in a Load action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3703 
Stack-based buffer overflow in a certain ActiveX control in sasatl.dll 1.5.0.531 in Zenturi Program Checker (ProgramChecker) Pro allows remote attackers to execute arbitrary code via a long argument to the Fill method.  NOTE: this is probably a different issue than CVE-2007-2987.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3704 
Entertainment CMS allows remote attackers to bypass authentication and perform certain administrative actions by setting the adminLogged cookie to "Administrator."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3705 
SQL injection vulnerability in FuseTalk 2.0 allows remote attackers to execute arbitrary SQL commands via the FTVAR_SUBCAT (txForumID) parameter to forum/index.cfm and possibly other unspecified components, related to forum/include/error/forumerror.cfm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3706 
The _sanitize_globals function in CodeIgniter 1.5.3 before 20070628 allows remote attackers to unset arbitrary global variables with unspecified impact, as demonstrated by a _SERVER cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3707 
Directory traversal vulnerability in index.php in CodeIgniter 1.5.3 before 20070628, when enable_query_strings is true, allows remote attackers to read arbitrary files via a .. (dot dot) in the c parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3708 
Cross-site scripting (XSS) vulnerability in CodeIgniter 1.5.3 before 20070626 allows remote attackers to inject arbitrary web script or HTML via (1) String.fromCharCode and (2) malformed nested tag manipulations in an unspecified component, related to insufficient sanitization by the xss_clean function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3709 
CRLF injection vulnerability in the redirect function in url_helper.php in CodeIgniter 1.5.3 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in an unspecified parameter, as demonstrated by a Set-Cookie header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3710 
PHP remote file inclusion vulnerability in example/gamedemo/inc.functions.php in PHP Comet-Server allows remote attackers to execute arbitrary PHP code via a URL in the projectPath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3711 
Unspecified vulnerability in TOS 2.1.x, 2.2.x before 2.2.5, and 2.5.x before 2.5.2 on TippingPoint IPS allows remote attackers to avoid detection by sending certain fragmented packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3712 
Multiple cross-site scripting (XSS) vulnerabilities in HiddenChest "is ve Bayi Basvuru Formu" (Yb ve Bayi Babvuru Formu) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3713 
Multiple buffer overflows in Konst CenterICQ 4.9.11 through 4.21 allow remote attackers to execute arbitrary code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: this might overlap CVE-2007-0160.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3714 
Directory traversal vulnerability in Ada Image Server (ImgSvr) 0.6.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter to the default URI.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: this is probably a different issue than CVE-2004-2464.  NOTE: it was later reported that 0.6.21 and earlier is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3715 
Sun Java System Application Server and Web Server 7.0 through 9.0 before 20070710 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute an arbitrary Java method via a crafted stylesheet, a related issue to CVE-2007-3716.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3716 
The Java XML Digital Signature implementation in Sun JDK and JRE 6 before Update 2 does not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute arbitrary code via a crafted stylesheet, a related issue to CVE-2007-3715.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-11T23:00:00.000Z
CVE-2007-3717 
rcp on Sun Solaris 8, 9, and 10 before 20070710 does not properly call certain helper applications, which allows local users to gain privileges by creating files with certain names, possibly containing shell metacharacters or spaces, a similar issue to CVE-2006-0225.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-12T16:00:00.000Z
CVE-2007-3718 
Multiple unspecified vulnerabilities in the SVG parsing engine in Apple Safari 3 Beta for Windows have unspecified remote attack vectors and impact.  NOTE: this issue contains no actionable information, but it was released by a reliable researcher.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-12T16:00:00.000Z
CVE-2007-3719 
The process scheduler in the Linux kernel 2.6.16 gives preference to "interactive" processes that perform voluntary sleeps, which allows local users to cause a denial of service (CPU consumption), as described in "Secretly Monopolizing the CPU Without Superuser Privileges."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-12T16:00:00.000Z
CVE-2007-3720 
The process scheduler in the Linux kernel 2.4 performs scheduling based on CPU billing gathered from periodic process sampling ticks, which allows local users to cause a denial of service (CPU consumption) by performing voluntary nanosecond sleeps that result in the process not being active during a clock interrupt, as described in "Secretly Monopolizing the CPU Without Superuser Privileges."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-12T16:00:00.000Z
CVE-2007-3721 
The ULE process scheduler in the FreeBSD kernel gives preference to "interactive" processes that perform voluntary sleeps, which allows local users to cause a denial of service (CPU consumption), as described in "Secretly Monopolizing the CPU Without Superuser Privileges."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-12T16:00:00.000Z
CVE-2007-3722 
The 4BSD process scheduler in the FreeBSD kernel performs scheduling based on CPU billing gathered from periodic process sampling ticks, which allows local users to cause a denial of service (CPU consumption) by performing voluntary nanosecond sleeps that result in the process not being active during a clock interrupt, as described in "Secretly Monopolizing the CPU Without Superuser Privileges."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-12T16:00:00.000Z
CVE-2007-3723 
The process scheduler in the Sun Solaris kernel does not make use of the process statistics kept by the kernel and performs scheduling based upon CPU billing gathered from periodic process sampling ticks, which allows local users to cause a denial of service (CPU consumption), as described in "Secretly Monopolizing the CPU Without Superuser Privileges."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-12T16:00:00.000Z
CVE-2007-3724 
The process scheduler in the Microsoft Windows XP kernel does not make use of the process statistics kept by the kernel, performs scheduling based on CPU billing gathered from periodic process sampling ticks, and gives preference to "interactive" processes that perform voluntary sleeps, which allows local users to cause a denial of service (CPU consumption), as described in "Secretly Monopolizing the CPU Without Superuser Privileges."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-12T16:00:00.000Z
CVE-2007-3725 
The RAR VM (unrarvm.c) in Clam Antivirus (ClamAV) before 0.91 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted RAR archive, resulting in a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-12T16:00:00.000Z
CVE-2007-3726 
Integer signedness error in the SET_VALUE function in rarvm.cpp in unrar 3.70 beta 3, as used in products including WinRAR and RAR for OS X, allows user-assisted remote attackers to cause a denial of service (crash) via a crafted RAR archive that causes a negative signed number to be cast to a large unsigned number.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-12T16:00:00.000Z
CVE-2007-3727 
Multiple unspecified vulnerabilities in Webmatic before 2.7 have unknown impact and attack vectors, related to the "administration area."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-12T17:00:00.000Z
CVE-2007-3728 
Buffer overflow in lib/silcclient/client_notify.c of SILC Client and SILC Toolkit before 1.1.2 allows remote attackers to cause a denial of service via "NICK_CHANGE" notifications.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-12T17:00:00.000Z
CVE-2007-3729 
The default configuration of the POP server in TCP/IP Services 5.6 for HP OpenVMS 8.3 generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid POP usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-12T17:00:00.000Z
CVE-2007-3730 
The default configuration of the POP server in TCP/IP Services 5.6 for HP OpenVMS 8.3 does not log the source IP address or attempted username for login attempts, which might help remote attackers to avoid identification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-12T17:00:00.000Z
CVE-2007-3731 
The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT segment selector in %cs (the xcs field) during ptrace single-step operations, which allows local users to cause a denial of service (NULL dereference and OOPS) via certain code that makes ptrace PTRACE_SETREGS and PTRACE_SINGLESTEP requests, related to the TRACE_IRQS_ON function, and possibly related to the arch_ptrace function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-17T17:00:00.000Z