rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-1005 
Heap-based buffer overflow in SW3eng.exe in the eID Engine service in CA (formerly Computer Associates) eTrust Intrusion Detection 3.0.5.57 and earlier allows remote attackers to cause a denial of service (application crash) via a long key length value to the remote administration port (9191/tcp).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-02T21:00:00.000Z
CVE-2007-1006 
Multiple format string vulnerabilities in the gm_main_window_flash_message function in Ekiga before 2.0.5 allow attackers to cause a denial of service and possibly execute arbitrary code via a crafted Q.931 SETUP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-20T00:00:00.000Z
CVE-2007-1007 
Format string vulnerability in GnomeMeeting 1.0.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in the name, which is not properly handled in a call to the gnomemeeting_log_insert function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-20T17:00:00.000Z
CVE-2007-1008 
Apple iTunes 7.0.2 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted XML list of radio stations, which results in memory corruption.  NOTE: iTunes retrieves the XML document from a static URL, which requires an attacker to perform DNS spoofing or man-in-the-middle attacks for exploitation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-20T00:00:00.000Z
CVE-2007-1009 
Macrovision InstallAnywhere Enterprise before 8.0.1 uses the InstallScript.iap_xml configuration file without integrity protection to verify authorization for installing an application, which allows local users to perform unauthorized installations by removing the (1) password or (2) serial number verification sections from this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-19T10:00:00.000Z
CVE-2007-1010 
Multiple PHP remote file inclusion vulnerabilities in ZebraFeeds 1.0, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the zf_path parameter to (1) aggregator.php and (2) controller.php in newsfeeds/includes/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1011 
PHP remote file inclusion vulnerability in functions_inc.php in VS-Gastebuch 1.5.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the gb_pfad parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1012 
Cross-site scripting (XSS) vulnerability in faq.php in DeskPRO 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the article parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1013 
PHP remote file inclusion vulnerability in generate.php in VirtualSystem Htaccess Passwort Generator 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the ht_pfad parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1014 
Stack-based buffer overflow in VicFTPS before 5.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long CWD command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1015 
SQL injection vulnerability in HaberDetay.asp in Aktueldownload Haber script allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1016 
SQL injection vulnerability in Aktueldownload Haber script allows remote attackers to execute arbitrary SQL commands via certain vectors related to the HaberDetay.asp and rss.asp components, and the id and kid parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: the combination of the HaberDetay.asp component and the id parameter is already covered by another February 2007 CVE candidate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1017 
PHP remote file inclusion vulnerability in show_news_inc.php in VirtualSystem VS-News-System 1.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the newsordner parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1018 
PHP remote file inclusion vulnerability in tpl/header.php in VirtualSystem VS-News-System 1.2.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the newsordner parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1019 
SQL injection vulnerability in news.php in webSPELL 4.01.02, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the showonly parameter to index.php, a different vector than CVE-2006-5388.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1020 
Cross-site scripting (XSS) vulnerability in index.php in CedStat 1.31 allows remote attackers to inject arbitrary web script or HTML via the hier parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1021 
SQL injection vulnerability in inc_listnews.asp in CodeAvalanche News 1.x allows remote attackers to execute arbitrary SQL commands via the CAT_ID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1022 
SQL injection vulnerability in h_goster.asp in Turuncu Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1023 
SQL injection vulnerability in pop_profile.asp in Snitz Forums 2000 3.1 SR4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1024 
PHP remote file inclusion vulnerability in include.php in Meganoide's news 1.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the _SERVER[DOCUMENT_ROOT] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1025 
PHP remote file inclusion vulnerability in inc/functions_inc.php in VS-Link-Partner 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the gb_pfad, or possibly script_pfad, parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1026 
SQL injection vulnerability in view.php in XLAtunes 0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the album parameter in view mode.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1027 
Certain setuid DB2 binaries in IBM DB2 before 9 Fix Pack 2 for Linux and Unix allow local users to overwrite arbitrary files via a symlink attack on the DB2DIAG.LOG temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1028 
Cross-site scripting (XSS) vulnerability in the Barry Jaspan Image Pager 4.7.x-1.x-dev and 5.x-1.x-dev before 2007-02-08 module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to HTML entities and the IMG element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1029 
Stack-based buffer overflow in the Connect method in the IMAP4 component in Quiksoft EasyMail Objects before 6.5 allows remote attackers to execute arbitrary code via a long host name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1030 
Niels Provos libevent 1.2 and 1.2a allows remote attackers to cause a denial of service (infinite loop) via a DNS response containing a label pointer that references its own offset.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1031 
Directory traversal vulnerability in include/db_conn.php in SpoonLabs Vivvo Article Management CMS 3.4 allows remote attackers to include and execute arbitrary local files via the root parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1032 
Unspecified vulnerability in phpMyFAQ 1.6.9 and earlier, when register_globals is enabled, allows remote attackers to "gain the privilege for uploading files on the server."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1033 
Unspecified vulnerability in the Secure site 4.7.x-1.x-dev and 5.x-1.x-dev module for Drupal allows remote attackers to bypass access restrictions via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1034 
SQL injection vulnerability in the category file in modules.php in the Emporium 2.3.0 and earlier module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the category_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1035 
Unspecified vulnerability in certain demonstration scripts in getID3 1.7.1, as used in the Mediafield and Audio modules for Drupal, allows remote attackers to read and delete arbitrary files, list arbitrary directories, and write to empty files or .mp3 files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1036 
The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attackers to bypass authentication and gain administrative access via direct requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T11:00:00.000Z
CVE-2007-1037 
Stack-based buffer overflow in News File Grabber 4.1.0.1 and earlier allows remote attackers to execute arbitrary code via a .nzb file with a long subject field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T17:00:00.000Z
CVE-2007-1038 
Shemes.com Grabit 1.5.3, and possibly earlier, allows remote attackers to cause a denial of service (application crash) via a .nzb file with a subject field containing ';' (semicolon) characters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T17:00:00.000Z
CVE-2007-1039 
Unspecified vulnerability in Peanut Knowledge Base (PeanutKB) 0.0.3 and earlier has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T17:00:00.000Z
CVE-2007-1040 
Directory traversal vulnerability in archives.php in Xpression News (X-News) 1.0.1 allows remote attackers to include arbitrary files or obtain sensitive information via a .. (dot dot) in the xnews-template parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T17:00:00.000Z
CVE-2007-1041 
Multiple stack-based buffer overflows in S&H Computer Systems News Rover 12.1 Rev 1 allow remote attackers to execute arbitrary code via a .nzb file with a long (1) group or (2) subject string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T17:00:00.000Z
CVE-2007-1042 
Directory traversal vulnerability in news.php in Xpression News (X-News) 1.0.1, when magic_quotes_gpc is disabled, allows remote attackers to include arbitrary files or obtain sensitive information via a .. (dot dot) in the xnews-template parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T17:00:00.000Z
CVE-2007-1043 
Ezboo webstats, possibly 3.0.3, allows remote attackers to bypass authentication and gain access via a direct request to (1) update.php and (2) config.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T17:00:00.000Z
CVE-2007-1044 
Pearson Education PowerSchool 4.3.6 allows remote attackers to list the contents of the admin folder via a URI composed of the admin/ directory name and an arbitrary filename ending in ".js."  NOTE: it was later reported that this issue had been addressed by 5.1.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T17:00:00.000Z
CVE-2007-1045 
mAlbum 0.3 has default accounts (1) "login"/"pass" for its administrative account and (2) "dqsfg"/"sdfg", which allows remote attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T17:00:00.000Z
CVE-2007-1046 
Dem_trac allows remote attackers to read log file contents via a direct request for /anc_sit.txt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T17:00:00.000Z
CVE-2007-1047 
Unspecified vulnerability in Distributed Checksum Clearinghouse (DCC) before 1.3.51 allows remote attackers to delete or add hosts in /var/dcc/maps.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T17:00:00.000Z
CVE-2007-1048 
PHP remote file inclusion vulnerability in admin_rebuild_search.php in phpbb_wordsearch allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T17:00:00.000Z
CVE-2007-1049 
Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T17:00:00.000Z
CVE-2007-1050 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in AbleDesign MyCalendar allow remote attackers to inject arbitrary web script or HTML via (1) the go parameter, (2) the keyword parameter in the search menu (go=search), or (3) the username or (4) the password in a go=Login action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T23:00:00.000Z
CVE-2007-1051 
Comodo Firewall Pro (formerly Comodo Personal Firewall) 2.4.17.183 and earlier uses a weak cryptographic hashing function (CRC32) to identify trusted modules, which allows local users to bypass security protections by substituting modified modules that have the same CRC32 value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T23:00:00.000Z
CVE-2007-1052 
PHP remote file inclusion vulnerability in index.php in PBLang (PBL) 4.60 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the dbpath parameter, a different vector than CVE-2006-5062.  NOTE: this issue has been disputed by a reliable third party for 4.65, stating that the dbpath variable is initialized in an included file that is created upon installation
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T23:00:00.000Z
CVE-2007-1053 
Multiple PHP remote file inclusion vulnerabilities in phpXmms 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the tcmdp parameter to (1) phpxmmsb.php or (2) phpxmmst.php.  NOTE: this issue has been disputed by a reliable third party, stating that the tcmdp variable is initialized by config.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T23:00:00.000Z
CVE-2007-1054 
Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.6.x through 1.9.2, when $wgUseAjax is enabled, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded value of the rs parameter, which is processed by Internet Explorer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T23:00:00.000Z
CVE-2007-1055 
Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.9.x before 1.9.0rc2, and 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the rs parameter.  NOTE: this issue might be a duplicate of CVE-2007-0177.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T23:00:00.000Z
CVE-2007-1056 
VMware Workstation 5.5.3 build 34685 does not provide per-user restrictions on certain privileged actions, which allows local users to perform restricted operations such as changing system time, accessing hardware components, and stopping the "VMware tools service" service. NOTE: exploitation is simplified via (1) weak file permissions (Users = Read & Execute) for %PROGRAMFILES%\VMware; and weak registry key permissions (access by Users) for (2) vmmouse, (3) vmscsi, (4) VMTools, (5) vmx_svga, and (6) vmxnet in HKLM\SYSTEM\CurrentControlSet\Services\; which allows local users to perform various privileged actions outside of the guest OS by executing certain files under %PROGRAMFILES%\VMware\VMware Tools, as demonstrated by (a) VMControlPanel.cpl and (b) vmwareservice.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T23:00:00.000Z
CVE-2007-1057 
The Net Direct client for Linux before 6.0.5 in Nortel Application Switch 2424, VPN 3050 and 3070, and SSL VPN Module 1000 extracts and executes files with insecure permissions, which allows local users to exploit a race condition to replace a world-writable file in /tmp/NetClient and cause another user to execute arbitrary code when attempting to execute this client, as demonstrated by replacing /tmp/NetClient/client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T23:00:00.000Z
CVE-2007-1058 
SQL injection vulnerability in user_pages/page.asp in Online Web Building 2.0 allows remote attackers to execute arbitrary SQL commands via the art_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-21T23:00:00.000Z
CVE-2007-1059 
PHP remote file inclusion vulnerability in function.php in Ultimate Fun Book 1.02 allows remote attackers to execute arbitrary PHP code via a URL in the gbpfad parameter.  NOTE: some sources mention "Ultimate Fun Board," but this appears to be an error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T00:00:00.000Z
CVE-2007-1060 
Multiple PHP remote file inclusion vulnerabilities in Interspire SendStudio 2004.14 and earlier, when register_globals and allow_fopenurl are enabled, allow remote attackers to execute arbitrary PHP code via a URL in the ROOTDIR parameter to (1) createemails.inc.php and (2) send_emails.inc.php in /admin/includes/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T00:00:00.000Z
CVE-2007-1061 
SQL injection vulnerability in index.php in Francisco Burzi PHP-Nuke 8.0 Final and earlier, when the "HTTP Referers" block is enabled, allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header (HTTP_REFERER variable).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T00:00:00.000Z
CVE-2007-1062 
The Cisco Unified IP Conference Station 7935 3.2(15) and earlier, and Station 7936 3.3(12) and earlier does not properly handle administrator HTTP sessions, which allows remote attackers to bypass authentication controls via a direct URL request to the administrative HTTP interface for a limited time
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T01:00:00.000Z
CVE-2007-1063 
The SSH server in Cisco Unified IP Phone 7906G, 7911G, 7941G, 7961G, 7970G, and 7971G, with firmware 8.0(4)SR1 and earlier, uses a hard-coded username and password, which allows remote attackers to access the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T01:00:00.000Z
CVE-2007-1064 
Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client do not drop privileges when the help facility in the supplicant GUI is invoked, which allows local users to gain privileges, aka CSCsf14120.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T01:00:00.000Z
CVE-2007-1065 
Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client allows local users to gain SYSTEM privileges via unspecified vectors in the supplicant, aka CSCsf15836.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T01:00:00.000Z
CVE-2007-1066 
Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client use an insecure default Discretionary Access Control Lists (DACL) for the connection client GUI, which allows local users to gain privileges by injecting "a thread under ConnectionClient.exe," aka CSCsg20558.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T01:00:00.000Z
CVE-2007-1067 
Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client do not properly parse commands, which allows local users to gain privileges via unspecified vectors, aka CSCsh30624.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-22T01:00:00.000Z