rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-1068 
Netgear 614 and 624 routers, possibly running VXWorks, allow remote attackers to cause a denial of service by sending a malformed DCC SEND string to an IRC channel, which causes an IRC connection reset, possibly related to the masquerading code for NAT environments, and as demonstrated via (1) a DCC SEND with a single long argument, or (2) a DCC SEND with IP, port, and filesize arguments with a 0 value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-07T22:00:00.000Z
CVE-2006-1069 
Unspecified vulnerability in the session handling for Geeklog 1.4.x before 1.4.0sr2, 1.3.11 before 1.3.11sr5, 1.3.9 before 1.3.9sr5, and possibly earlier versions allows attackers to gain privileges as arbitrary users via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-07T23:00:00.000Z
CVE-2006-1070 
Cross-site scripting (XSS) vulnerability in dv_gbook.php in DVguestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via the f parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-08T00:00:00.000Z
CVE-2006-1071 
Cross-site scripting (XSS) vulnerability in index.php in DVguestbook 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-08T00:00:00.000Z
CVE-2006-1072 
Cross-site scripting (XSS) vulnerability in Daverave Simplog 1.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a blog post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-08T00:00:00.000Z
CVE-2006-1073 
Directory traversal vulnerability in index.php in Daverave Simplog 1.0.2 and earlier allows remote attackers to include or read arbitrary .txt files via the (1) act and (2) blogid parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-08T00:00:00.000Z
CVE-2006-1074 
Jason Boettcher Liero Xtreme 0.62b and earlier allow remote attackers to cause a denial of service (application crash or hang) via a long argument to the connect command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T00:00:00.000Z
CVE-2006-1075 
Format string vulnerability in the visualization function in Jason Boettcher Liero Xtreme 0.62b and earlier allows remote attackers to execute arbitrary code via format string specifiers in (1) a nickname, (2) a dedicated server name, or (3) a mapname in a level (aka .lxl) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T00:00:00.000Z
CVE-2006-1076 
SQL injection vulnerability in index.php, possibly during a showtopic operation, in Invision Power Board (IPB) 2.1.5 allows remote attackers to execute arbitrary SQL commands via the st parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T00:00:00.000Z
CVE-2006-1077 
Multiple cross-site scripting (XSS) vulnerabilities in the commentary in Evo-Dev evoBlog allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter and (2) other unspecified parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T00:00:00.000Z
CVE-2006-1078 
Multiple buffer overflows in htpasswd, as used in Acme thttpd 2.25b, and possibly other products such as Apache, might allow local users to gain privileges via (1) a long command line argument and (2) a long line in a file.  NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE.  However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T00:00:00.000Z
CVE-2006-1079 
htpasswd, as used in Acme thttpd 2.25b and possibly other products such as Apache, might allow local users to gain privileges via shell metacharacters in a command line argument, which is used in a call to the system function.  NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE.  However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T00:00:00.000Z
CVE-2006-1080 
Cross-site scripting (XSS) vulnerability in login.php in Game-Panel 2.6.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the message parameter, possibly requiring a URL encoded value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T00:00:00.000Z
CVE-2006-1081 
SQL injection vulnerability in forgotten_password.php in Jonathan Beckett PluggedOut Nexus 0.1 allows remote attackers to execute arbitrary SQL commands via the email parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T00:00:00.000Z
CVE-2006-1082 
Multiple cross-site scripting (XSS) vulnerabilities in phpArcadeScript 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the gamename parameter in tellafriend.php, (2) the login_status parameter in loginbox.php, (3) the submissionstatus parameter in index.php, the (4) cell_title_background_color and (5) browse_cat_name parameters in browse.php, the (6) gamefile parameter in displaygame.php, and (7) possibly other parameters in unspecified PHP scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T00:00:00.000Z
CVE-2006-1083 
Multiple directory traversal vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to read and possibly execute arbitrary files via a .. (dot dot) in the (1) option[language] and (2) option[template] parameters, and (3) possibly other parameters, to (a) admin.php and (b) other unspecified scripts.  NOTE: the admin.php/option[language] vector can be used by remote unauthenticated attackers to include arbitrary files in conjunction with CVE-2006-1085.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T00:00:00.000Z
CVE-2006-1084 
Multiple SQL injection vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the option[prefix] parameter in admin.php and other unspecified PHP scripts, and (2) the PC_REMOTE_ADDR HTTP header to click.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T00:00:00.000Z
CVE-2006-1085 
admin.php in PHP-Stats 0.1.9.1 and earlier allows remote attackers to bypass authentication, gain administrator privileges, and execute arbitrary PHP code by modifying the option[admin_pass] parameter and setting the pass_cookie to the MD5 hash of the specified password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T00:00:00.000Z
CVE-2006-1087 
Direct static code injection vulnerability in the modify_config action in admin.php for PHP-Stats 0.1.9.1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the option_new[compatibility_mode] parameter, which is not filtered before being stored in config.php.  NOTE: this vulnerability can be exploited by remote unauthenticated attackers in conjunction with the option[admin_pass] authentication bypass vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T00:00:00.000Z
CVE-2006-1088 
PHP-Stats 0.1.9.1 and earlier allows remote attackers to obtain potentially sensitive information via a direct request to checktables.php, which lists the database table_prefix.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T00:00:00.000Z
CVE-2006-1089 
Cross-site scripting (XSS) vulnerability in header.php in PunBB 1.2.10 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly handled when the PHP_SELF variable is used to handle a pun_page tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1090 
register.php in PunBB 1.2.10 allows remote attackers to cause an unspecified denial of service via a flood of new user registrations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1091 
Kaspersky Antivirus 5.0.5 and 5.5.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1092 
Unspecified vulnerability in the pagedata subsystem of the process file system (/proc) in Solaris 8 through 10 allows local users to cause a denial of service (system hang or panic) via unknown attack vectors that cause cause the kmem_oversize arena to allocate a large amount of system memory that does not get freed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1093 
Unspecified vulnerability in IBM WebSphere 5.0.2.10 through 5.0.2.15 and 5.1.1.4 through 5.1.1.9 allows remote attackers to obtain sensitive information via unknown attack vectors, which causes JSP source code to be revealed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1094 
SQL injection vulnerability in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allows remote attackers to execute arbitrary SQL commands via the fileid parameter to (1) info_db.php or (2) database.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1095 
Directory traversal vulnerability in the FileSession object in Mod_python module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1096 
Cross-site scripting (XSS) vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter.  NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1097 
Multiple cross-site scripting (XSS) vulnerabilities in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allow remote attackers to inject arbitrary web script or HTML via the fileid parameter to (1) info_db.php or (2) database.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1098 
Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers to execute arbitrary SQL commands via the (1) informationID or (2) ParentCategory parameter to index.php. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1099 
PHP remote file include vulnerability in logIT 1.3 and 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1100 
Buffer overflow in the sgetstr function in shared/cube.h in Sauerbraten 2006_02_28 and earlier, as derived from the Cube engine, allows remote attackers to execute arbitrary code via long streams of input data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1101 
The (1) sgetstr and (2) getint functions in Sauerbraten 2006_02_28, as derived from the Cube engine, allow remote attackers to cause a denial of service (segmentation fault) via long streams of input data that trigger an out-of-bounds read, as demonstrated using SV_EXT tag data in the Cube engine, which is not properly handled by getint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1102 
Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (client exit) by forcing the server to change to a map (ogz) file whose name contains ".." sequences and has a certain length that prevents the addition of the ".ogz" extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1103 
engine/server.cpp in Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (segmentation fault) via a client that does not completely join the game and times out, which results in a null pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1104 
Multiple SQL injection vulnerabilities in Pixelpost 1.5 beta 1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the showimage parameter in index.php; and the (2) USER_AGENT, (3) HTTP_REFERER, and (4) HTTP_HOST HTTP header fields as used in the book_vistor function in includes/functions.php.  NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1105 
Pixelpost 1.5 beta 1 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, which calls the phpinfo function.  NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1106 
Cross-site scripting (XSS) vulnerability in Pixelpost 1.5 beta 1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) message, (2) name, (3) url, and (4) email parameters when commenting on a post.  NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1107 
Cross-site scripting (XSS) vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the nick parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1108 
SQL injection vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1109 
SQL injection vulnerability in index.asp in Total Ecommerce 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: it is not clear whether this report is associated with a specific product.  If not, then it should not be included in CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1110 
Cross-site scripting (XSS) vulnerability in Aztek Forum 4.0 allows remote attackers to inject arbitrary web script or HTML via the message body in a new message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1111 
Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a "*/*" in the msg parameter to index.php, which reveals usernames and passwords in a MySQL error message, possibly due to a forced SQL error or SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1112 
Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a long login value in a register form, which displays the installation path in a MySQL error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1113 
SQL injection vulnerability in podcast.php in Loudblog before 0.42 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1114 
Multiple directory traversal vulnerabilities in Loudblog before 0.42 allow remote attackers to read or include arbitrary files via a .. (dot dot) and trailing %00 (NULL) byte in the (1) template and (2) page parameters in (a) index.php, and the (3) language parameter in (b) inc/backend_settings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1115 
nCipher HSM before 2.22.6, when generating a Diffie-Hellman public/private key pair without any specified DiscreteLogGroup parameters, chooses random parameters that could allow an attacker to crack the private key in significantly less time than a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1116 
The CBC-MAC integrity functions in the nCipher nCore API before 2.18 transmit the initialization vector IV as part of a message when the implementation uses a non-zero IV, which allows remote attackers to bypass integrity checks and modify messages without being detected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1117 
nCipher firmware before V10, as used by (1) nShield, (2) nForce, (3) netHSM, (4) payShield, (5) SecureDB, (6) DSE200 Document Sealing Engine, (7) Time Source Master Clock (TSMC), and possibly other products, contains certain options that were only intended for testing and not production, which might allow remote attackers to obtain information about encryption keys and crack those keys with less effort than brute force.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1118 
SQL injection vulnerability in bmail before Aardvark PR9.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving GBK character sets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2006-1119 
fantastico in Cpanel does not properly handle when it has insufficient permissions to perform certain file operations, which allows remote authenticated users to obtain the full pathname, which is leaked in a PHP error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T20:00:00.000Z
CVE-2006-1120 
Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 6.1.1 and earlier, with register_globals enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) its_url parameter in the documents page and (2) url parameter in the send_write page of (a) index.php; (3) subject, and (4) images parameters to (b) calendar.php; (5) bid, (6) replying_msg, (7) subject, (8) body, and (9) mid parameters to (c) forums.php; (10) subject and (11) message parameters to (d) inbox.php; (12) subject_color and (13) email parameters to (e) lostpassword.php; and the (14) c_name, (15) content_inicial, and (16) cid parameters to (f) mycontents.php.  NOTE: the calendar.php/day vector is already subsumed by CVE-2006-0220, and the calendar.php/month, calendar.php/year, and search.php/q parameters for calendar.php are already subsumed by CVE-2004-2511.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T21:00:00.000Z
CVE-2006-1121 
Cross-site scripting (XSS) vulnerability in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the query string to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T21:00:00.000Z
CVE-2006-1122 
Cross-site scripting (XSS) vulnerability in Default.asp in D2KBlog 1.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T21:00:00.000Z
CVE-2006-1123 
SQL injection vulnerability in D2KBlog 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the memName parameter in a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T21:00:00.000Z
CVE-2006-1124 
Buffer overflow in RevilloC MailServer and Proxy 1.21 allows remote attackers to execute arbitrary code via a long USER command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T21:00:00.000Z
CVE-2006-1125 
Grisoft AVG Free 7.1, and other versions including 7.0.308, sets Everyone/Full Control permissions for certain update files including (1) upd_vers.cfg, (2) incavi.avm, and (3) unspecified drivers, which might allow local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T21:00:00.000Z
CVE-2006-1126 
Gallery 2 up to 2.0.2 allows remote attackers to spoof their IP address via a modified X-Forwarded-For (X_FORWARDED_FOR) HTTP header, which is checked by Gallery before other more reliable sources of IP address information, such as REMOTE_ADDR.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T22:00:00.000Z
CVE-2006-1127 
Cross-site scripting (XSS) vulnerability in Gallery 2 up to 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For (X_FORWARDED_FOR) HTTP header, which is not properly handled when adding a comment to an album.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T22:00:00.000Z
CVE-2006-1128 
Directory traversal vulnerability in the session handling class (GallerySession.class) in Gallery 2 up to 2.0.2 allows remote attackers to access and delete files by specifying the session in a cookie, which is used in constructing file paths before the session value is sanitized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T22:00:00.000Z
CVE-2006-1129 
SQL injection vulnerability in config.php in EKINboard 1.0.3 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T02:00:00.000Z