rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-4692 
The tabbed browsing feature in Apple Safari 3 before Beta Update 3.0.4 on Windows, and Mac OS X 10.4 through 10.4.10, allows remote attackers to spoof HTTP authentication for other sites and possibly conduct phishing attacks by causing an authentication sheet to be displayed for a tab that is not active, which makes it appear as if it is associated with the active tab.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-15T00:00:00.000Z
CVE-2007-4693 
The SecurityAgent component in Mac OS X 10.4 through 10.4.10 allows attackers with physical access to bypass the authentication dialog of the screen saver and send keystrokes to a process, related to "handling of keyboard focus between secure text fields."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-15T01:00:00.000Z
CVE-2007-4694 
Safari in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to access local content via file:// URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-15T01:00:00.000Z
CVE-2007-4695 
Unspecified "input validation" vulnerability in WebCore in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to modify form field values via unknown vectors related to file uploads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-15T01:00:00.000Z
CVE-2007-4696 
Race condition in WebCore in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to obtain information for forms from other sites via unknown vectors related to "page transitions" in Safari.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-15T01:00:00.000Z
CVE-2007-4697 
Unspecified vulnerability in WebCore in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via unknown vectors related to browser history, which triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-15T01:00:00.000Z
CVE-2007-4698 
Apple Safari 3 before Beta Update 3.0.4 on Windows, and Mac OS X 10.4 through 10.4.10, allows remote attackers to conduct cross-site scripting (XSS) attacks by causing JavaScript events to be associated with the wrong frame.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-15T00:00:00.000Z
CVE-2007-4699 
The default configuration of Safari in Apple Mac OS X 10.4 through 10.4.10 adds a private key to the keychain with permissions that allow other applications to access the key without warning the user, which might allow other applications to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-15T02:00:00.000Z
CVE-2007-4700 
Unspecified vulnerability in WebKit on Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to use Safari as an indirect proxy and send attacker-controlled data to arbitrary TCP ports via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-15T02:00:00.000Z
CVE-2007-4701 
WebKit on Apple Mac OS X 10.4 through 10.4.10 does not create temporary files securely when Safari is previewing a PDF file, which allows local users to read the contents of that file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-15T02:00:00.000Z
CVE-2007-4702 
The Application Firewall in Apple Mac OS X 10.5, when "Block all incoming connections" is enabled, does not prevent root processes or mDNSResponder from accepting connections, which might allow remote attackers or local root processes to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-15T20:00:00.000Z
CVE-2007-4703 
The Application Firewall in Apple Mac OS X 10.5 does not prevent a root process from accepting incoming connections, even when "Block incoming connections" has been set for its associated executable, which might allow remote attackers or local root processes to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-15T20:00:00.000Z
CVE-2007-4704 
The Application Firewall in Apple Mac OS X 10.5 does not apply changed settings to processes that are started by launchd until the processes are restarted, which might allow attackers to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-15T20:00:00.000Z
CVE-2007-4706 
Heap-based buffer overflow in Apple QuickTime before 7.3.1 allows remote attackers to execute arbitrary code via a crafted QTL file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-15T01:00:00.000Z
CVE-2007-4707 
Multiple unspecified vulnerabilities in the Flash media handler in Apple QuickTime before 7.3.1 allow remote attackers to execute arbitrary code or have other unspecified impacts via a crafted QuickTime movie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-15T01:00:00.000Z
CVE-2007-4708 
Format string vulnerability in Address Book in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via the URL handler.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-19T21:00:00.000Z
CVE-2007-4709 
Directory traversal vulnerability in CFNetwork in Apple Mac OS X 10.5.1 allows remote attackers to overwrite arbitrary files via a crafted HTTP response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-19T21:00:00.000Z
CVE-2007-4710 
Unspecified vulnerability in ColorSync in Apple Mac OS X 10.4.11 allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via an image with a crafted ColorSync profile, which triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-19T21:00:00.000Z
CVE-2007-4711 
Multiple cross-site scripting (XSS) vulnerabilities in Toms Gaestebuch 1.00 allow remote attackers to inject arbitrary web script or HTML via the (1) homepage, (2) mail, and (3) name parameters in a show action to (a) form.php; the (4) language and (5) anzeigebreite parameters to (b) admin/header.php; and the (6) msg parameter to (c) install.php, different vectors than CVE-2006-0706.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T19:00:00.000Z
CVE-2007-4712 
PHP remote file inclusion vulnerability in index.php in eNetman 1 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T19:00:00.000Z
CVE-2007-4713 
Multiple cross-site scripting (XSS) vulnerabilities in urchin.cgi in Urchin 5.6.00r2 allow remote attackers to inject arbitrary web script or HTML via the (1) dtc, (2) vid, (3) n, (4) dt, (5) ed, and (6) bd parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T19:00:00.000Z
CVE-2007-4714 
SQL injection vulnerability in error_view.php in Yvora 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T19:00:00.000Z
CVE-2007-4715 
Multiple PHP remote file inclusion vulnerabilities in Weblogicnet allow remote attackers to execute arbitrary PHP code via a URL in the files_dir parameter in (1) es_desp.php, (2) es_custom_menu.php, and (3) es_offer.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T19:00:00.000Z
CVE-2007-4716 
Multiple SQL injection vulnerabilities in PHD Help Desk before 1.31 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T19:00:00.000Z
CVE-2007-4717 
Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.8.6 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) dir parameter in admin/adminusers.php, the (2) action parameter in admin/advancedUserSearch.php, and the (3) view parameter in admin/campusProblem.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T19:00:00.000Z
CVE-2007-4718 
Directory traversal vulnerability in inc/lib/language.lib.php in Claroline before 1.8.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T19:00:00.000Z
CVE-2007-4719 
SQL injection vulnerability in read.php in 212cafeBoard 6.30 Beta allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T19:00:00.000Z
CVE-2007-4720 
Unspecified vulnerability in the Shared Trace Service in Hitachi JP1/Cm2/Network Node Manager (NNM) 07-10 through 07-10-05, and NNM Starter Edition Enterprise and 250 08-00 through 08-10, allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T19:00:00.000Z
CVE-2007-4722 
Multiple stack-based buffer overflows in the Quantum Streaming Internet Explorer Player ActiveX control in qsp2ie07051001.dll 1.0.0.1 in Move Media Player allow remote attackers to execute arbitrary code via a long string to the (1) Play and (2) Buzzer methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T19:00:00.000Z
CVE-2007-4723 
Directory traversal vulnerability in Ragnarok Online Control Panel 4.3.4a, when the Apache HTTP Server is used, allows remote attackers to bypass authentication via directory traversal sequences in a URI that ends with the name of a publicly available page, as demonstrated by a "/...../" sequence and an account_manage.php/login.php final component for reaching the protected account_manage.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T19:00:00.000Z
CVE-2007-4724 
Cross-site request forgery (CSRF) vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T19:00:00.000Z
CVE-2007-4725 
Stack consumption vulnerability in AkkyWareHOUSE 7-zip32.dll before 4.42.00.04, as derived from Igor Pavlov 7-Zip before 4.53 beta, allows user-assisted remote attackers to execute arbitrary code via a long filename in an archive, leading to a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T19:00:00.000Z
CVE-2007-4726 
Directory traversal vulnerability in Web Oddity 0.09b allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T19:00:00.000Z
CVE-2007-4727 
Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the SCRIPT_FILENAME variable, aka a "header overflow."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-12T19:00:00.000Z
CVE-2007-4730 
Buffer overflow in the compNewPixmap function in compalloc.c in the Composite extension for the X.org X11 server before 1.4 allows local users to execute arbitrary code by copying data from a large pixel depth pixmap into a smaller pixel depth pixmap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-11T19:00:00.000Z
CVE-2007-4731 
Stack-based buffer overflow in the TMregChange function in TMReg.dll in Trend Micro ServerProtect before 5.58 Security Patch 4 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 5005.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-12T01:00:00.000Z
CVE-2007-4732 
Unspecified vulnerability in the strfreectty function in the Special File System (SPECFS) in Sun Solaris 8 through 10 allows local users to cause a denial of service (system panic), related to passing a NULL pointer to the pgsignal function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T19:00:00.000Z
CVE-2007-4733 
The Aztech DSL600EU router, when WAN access to the web interface is disabled, does not properly block inbound traffic on TCP port 80, which allows remote attackers to connect to the web interface by guessing a TCP sequence number, possibly involving spoofing of an ARP packet, a related issue to CVE-1999-0077.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T19:00:00.000Z
CVE-2007-4734 
Buffer overflow in Ots Labs OTSTurntables 1.00 allows user-assisted remote attackers to execute arbitrary code via a long file path in an m3u file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T19:00:00.000Z
CVE-2007-4735 
Buffer overflow in Next Generation Software Virtual DJ (VDJ) 5.0 allows user-assisted remote attackers to execute arbitrary code via a long file path in an m3u file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T19:00:00.000Z
CVE-2007-4736 
SQL injection vulnerability in category.php in CartKeeper CKGold Shopping Cart 2.0 allows remote attackers to execute arbitrary SQL commands via the category_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T19:00:00.000Z
CVE-2007-4737 
Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the STPHPLIB_DIR parameter to (1) stphpapplication.php, (2) stphpbtnimage.php, or (3) stphpform.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T19:00:00.000Z
CVE-2007-4738 
Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) db_conf or (2) ADODB_DIR parameter to utils/stphpimage_show.php; or a URL in the STPHPLIB_DIR parameter to (3) stphpbutton.php, (4) stphpcheckbox.php, (5) stphpcheckboxwithcaption.php, (6) stphpcheckgroup.php, (7) stphpcomponent.php, (8) stphpcontrolwithcaption.php, (9) stphpedit.php, (10) stphpeditwithcaption.php, (11) stphphr.php, (12) stphpimage.php, (13) stphpimagewithcaption.php, (14) stphplabel.php, (15) stphplistbox.php, (16) stphplistboxwithcaption.php, (17) stphplocale.php, (18) stphppanel.php, (19) stphpradiobutton.php, (20) stphpradiobuttonwithcaption.php, (21) stphpradiogroup.php, (22) stphprichbutton.php, (23) stphpspacer.php, (24) stphptable.php, (25) stphptablecell.php, (26) stphptablerow.php, (27) stphptabpanel.php, (28) stphptabtitle.php, (29) stphptextarea.php, (30) stphptextareawithcaption.php, (31) stphptoolbar.php, (32) stphpwindow.php, (33) stphpxmldoc.php, or (34) stphpxmlelement.php, a different set of vectors than CVE-2007-4737.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T19:00:00.000Z
CVE-2007-4739 
reprepro 1.3.0 through 2.2.3 does not properly verify signatures when updating repositories, which allows remote attackers to construct and distribute an ostensibly valid Release.gpg file by signing it with an unknown key, related to the update command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T19:00:00.000Z
CVE-2007-4740 
The HPRevolutionRegistryManager ActiveX control in Hp.Revolution.RegistryManager.dll 1 in Telecom Italy Alice Messenger allows remote attackers to create registry keys and values via the arguments to the WriteRegistry method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T19:00:00.000Z
CVE-2007-4741 
Cross-site scripting (XSS) vulnerability in admin/adminusers.php in Claroline before 1.8.6 allows remote authenticated administrators to inject arbitrary web script or HTML via the sort parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T19:00:00.000Z
CVE-2007-4742 
Claroline before 1.8.6 allows remote authenticated administrators to obtain sensitive information via an invalid value in the sort parameter to admin/adminusers.php, which reveals the path in an error message in some circumstances, as demonstrated by a parameter value containing an XSS sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T19:00:00.000Z
CVE-2007-4743 
The original patch for CVE-2007-3999 in svc_auth_gss.c in the RPCSEC_GSS RPC library in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and other applications that use krb5, does not correctly check the buffer length in some environments and architectures, which might allow remote attackers to conduct a buffer overflow attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T22:00:00.000Z
CVE-2007-4744 
PHP remote file inclusion vulnerability in environment.php in AnyInventory 1.9.1 and 2.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the DIR_PREFIX parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T22:00:00.000Z
CVE-2007-4745 
Multiple cross-site scripting (XSS) vulnerabilities in the AkoBook 3.42 and earlier component (com_akobook) for Mambo allow remote attackers to inject arbitrary web script or HTML via Javascript events in the (1) gbmail and (2) gbpage parameters in the sign function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T22:00:00.000Z
CVE-2007-4746 
The Cisco Video Surveillance IP Gateway Encoder/Decoder (Standalone and Module) firmware 1.8.1 and earlier, Video Surveillance SP/ISP Decoder Software firmware 1.11.0 and earlier, and the Video Surveillance SP/ISP firmware 1.23.7 and earlier have default passwords for the sypixx and root user accounts, which allows remote attackers to perform administrative actions, aka CSCsj34681.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T22:00:00.000Z
CVE-2007-4747 
The telnet service in Cisco Video Surveillance IP Gateway Encoder/Decoder (Standalone and Module) firmware 1.8.1 and earlier, Video Surveillance SP/ISP Decoder Software firmware 1.11.0 and earlier, and the Video Surveillance SP/ISP firmware 1.23.7 and earlier does not require authentication, which allows remote attackers to perform administrative actions, aka CSCsj31729.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T22:00:00.000Z
CVE-2007-4748 
Buffer overflow in the PowerPlayer.dll ActiveX control in PPStream 2.0.1.3829 allows remote attackers to execute arbitrary code via a long Logo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T22:00:00.000Z
CVE-2007-4749 
The cmdjob utility in Autodesk Backburner 3.0.2 allows remote attackers to execute arbitrary commands on render servers by queueing jobs that contain these commands.  NOTE: this is only a vulnerability in environments in which the administrator has not followed documentation that outlines the security risks of operating Backburner on untrusted networks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-14T00:00:00.000Z
CVE-2007-4750 
Unspecified vulnerability in RemoteDocs R-Viewer before 1.6.3768 allows user-assisted remote attackers to execute arbitrary code via a crafted RDZ archive in which the first file has an executable extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T21:00:00.000Z
CVE-2007-4751 
RemoteDocs R-Viewer before 1.6.3768 stores encrypted RDZ file data in unencrypted temporary files, which allows local users to obtain sensitive information by reading the temporary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T21:00:00.000Z
CVE-2007-4752 
ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-12T01:00:00.000Z
CVE-2007-4753 
The Thomson ST 2030 SIP phone with software 1.52.1 allows remote attackers to cause a denial of service (device hang) via (1) an empty SIP message or (2) a SIP INVITE message with a malformed To header, different vectors than CVE-2007-4553.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-08T00:00:00.000Z
CVE-2007-4754 
Format string vulnerability in the safe_bprintf function in acesrc/acebot_cmds.c in Alien Arena 2007 6.10 and earlier allows remote attackers to cause a denial of service (daemon crash) via format string specifiers in a nickname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-08T01:00:00.000Z
CVE-2007-4755 
Alien Arena 2007 6.10 and earlier allows remote attackers to cause a denial of service (client disconnect) by sending a client_connect command in a forged packet from the server to a client.  NOTE: client IP addresses are available via product-specific queries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-08T01:00:00.000Z
CVE-2007-4756 
Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote FTP servers to create or overwrite arbitrary files via "..\" (dot dot backslash) sequences in a filename.  NOTE: the "..\" are not displayed when the user lists files.  NOTE: this can be leveraged for code execution by writing to a Startup folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-08T01:00:00.000Z
CVE-2007-4757 
PHP remote file inclusion vulnerability in menu.php in phpMytourney allows remote attackers to execute arbitrary PHP code via a URL in the functions_file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-08T10:00:00.000Z
CVE-2007-4758 
Multiple buffer overflows in the image-processing APIs in Cosminexus Developer's Kit for Java in Cosminexus 4 through 7 allow remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-08T10:00:00.000Z