rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-0500 
MyCO Guestbook 1.0 stores the admin directory under the web document root with insufficient access control, which allows remote attackers to perform unspecified privileged actions by directly accessing files via a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T22:00:00.000Z
CVE-2006-0501 
Cross-site scripting (XSS) vulnerability in MyCO Guestbook 1.0 allows remote attackers to inject arbitrary web script or HTML via the Name field, when registering a user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T22:00:00.000Z
CVE-2006-0502 
PHP remote file inclusion vulnerability in loginout.php in FarsiNews 2.1 Beta 2 and earlier, with register_globals enabled, allows remote attackers to include arbitrary files via a URL in the cutepath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T22:00:00.000Z
CVE-2006-0503 
IMAP service in MailEnable Professional Edition before 1.72 allows remote attackers to cause a denial of service (service crash) via unspecified vectors involving the EXAMINE command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T22:00:00.000Z
CVE-2006-0504 
Unspecified vulnerability in MailEnable Enterprise Edition before 1.2 allows remote attackers to cause a denial of service (CPU utilization) by viewing "formatted quoted-printable emails" via webmail.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T22:00:00.000Z
CVE-2006-0505 
zbattle.net Zbattle client 1.09 SR-1 beta allows remote attackers to cause an unspecified denial of service by rapidly creating and closing a game.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T23:00:00.000Z
CVE-2006-0506 
Cross-site scripting (XSS) vulnerability in index.php in Nuked-klaN 1.7 allows remote attackers to inject arbitrary web script or HTML via the letter parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T23:00:00.000Z
CVE-2006-0507 
Multiple cross-site scripting (XSS) vulnerabilities in Easy CMS allow remote attackers to inject arbitrary web script or HTML via (1) unknown attack vectors in the administrative interface and (2) input fields of the contact form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T23:00:00.000Z
CVE-2006-0508 
Easy CMS stores the images directory under the web document root with insufficient access control and browsing enabled, which allows remote attackers to list and possibly read images that are stored in that directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T23:00:00.000Z
CVE-2006-0509 
Multiple cross-site scripting (XSS) vulnerabilities in clients.php in Cerberus Helpdesk, possibly 2.7, allow remote attackers to inject arbitrary web script or HTML via (1) the contact_search parameter and (2) unspecified url fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T23:00:00.000Z
CVE-2006-0510 
SQL injection vulnerability in userlogin.jsp in Daffodil CRM 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified parameters in a login action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T23:00:00.000Z
CVE-2006-0511 
Blackboard Academic Suite 6.0 and earlier does not properly clear session information when de-authenticating a user who is idle, which allows subsequent users to log in as the previous user and gain privileges.  NOTE: the vendor has disputed this issue, saying that "This is a customer specific issue related to their Kerberos authentication single sign-on application and not a vulnerability in the Blackboard product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T23:00:00.000Z
CVE-2006-0512 
PADL MigrationTools 46 creates temporary files insecurely, which allows local users to overwrite arbitrary files via a symlink attack on the temporary files, which are not properly created by (1) migrate_all_online.sh, (2) migrate_all_offline.sh, (3) migrate_all_netinfo_online.sh, (4) migrate_all_netinfo_offline.sh, (5) migrate_all_nis_online.sh, (6) migrate_all_nis_offline.sh, (7) migrate_all_nisplus_online.sh, and (8) migrate_all_nisplus_offline.sh.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T11:00:00.000Z
CVE-2006-0513 
Directory traversal vulnerability in pkmslogout in Tivoli Web Server Plug-in 5.1.0.10 in Tivoli Access Manager (TAM) 5.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-06T23:00:00.000Z
CVE-2006-0515 
Cisco PIX/ASA 7.1.x before 7.1(2) and 7.0.x before 7.0(5), PIX 6.3.x before 6.3.5(112), and FWSM 2.3.x before 2.3(4) and 3.x before 3.1(7), when used with Websense/N2H2, allows remote attackers to bypass HTTP access restrictions by splitting the GET method of an HTTP request into multiple packets, which prevents the request from being sent to Websense for inspection, aka bugs CSCsc67612, CSCsc68472, and CSCsd81734.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-09T10:00:00.000Z
CVE-2006-0516 
Unspecified vulnerability in the kernel processing in Solaris 10 64 bit platform, when running in 64-bit mode, allows local users to cause a denial of service (system panic) via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T11:00:00.000Z
CVE-2006-0517 
Multiple SQL injection vulnerabilities in formulaires/inc-formulaire_forum.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id_forum, (2) id_article, or (3) id_breve parameters to forum.php3; (4) unspecified vectors related to "session handling"; and (5) when posting "petitions".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T11:00:00.000Z
CVE-2006-0518 
Cross-site scripting (XSS) vulnerability in index.php3 in SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T11:00:00.000Z
CVE-2006-0519 
SPIP 1.8.2-e and earlier and 1.9 Alpha 2 (5539) and earlier allows remote attackers to obtain sensitive information via a direct request to inc-messforum.php3, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T11:00:00.000Z
CVE-2006-0520 
SQL injection vulnerability index.php in Dragoran Portal module 1.3 for Invision Power Board (IPB) allows remote attackers to execute arbitrary SQL commands via the site parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T11:00:00.000Z
CVE-2006-0521 
Cross-site scripting (XSS) vulnerability in results.php in BrowserCRM allows remote attackers to inject arbitrary web script or HTML via certain manipulations of the query parameter, as demonstrated using an IMG SRC tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T11:00:00.000Z
CVE-2006-0522 
SQL injection vulnerability in the Authentication Servlet in Symantec Sygate Management Server (SMS) version 4.1 build 1417 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via unknown attack vectors related to a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T11:00:00.000Z
CVE-2006-0523 
SQL injection vulnerability in global.php in MyBB before 1.03 allows remote attackers to execute arbitrary SQL commands via the templatelist variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T11:00:00.000Z
CVE-2006-0524 
Cross-site scripting (XSS) vulnerability in ashnews.php in Derek Ashauer ashNews 0.83 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T11:00:00.000Z
CVE-2006-0525 
Multiple Adobe products, including (1) Photoshop CS2, (2) Illustrator CS2, and (3) Adobe Help Center, install a large number of .EXE and .DLL files with write-access permission for the Everyone group, which allows local users to gain privileges via Trojan horse programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T11:00:00.000Z
CVE-2006-0526 
The default configuration of the America Online (AOL) client software allows all users to modify a certain registry value that specifies a DLL file name, which might allow local users to gain privileges via a Trojan horse program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T11:00:00.000Z
CVE-2006-0527 
BIND 4 (BIND4) and BIND 8 (BIND8), if used as a target forwarder, allows remote attackers to gain privileged access via a "Kashpureff-style DNS cache corruption" attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T11:00:00.000Z
CVE-2006-0528 
The cairo library (libcairo), as used in GNOME Evolution and possibly other products, allows remote attackers to cause a denial of service (persistent client crash) via an attached text file that contains "Content-Disposition: inline" in the header, and a very long line in the body, which causes the client to repeatedly crash until the e-mail message is manually removed, possibly due to a buffer overflow, as demonstrated using an XML attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T11:00:00.000Z
CVE-2006-0529 
Computer Associates (CA) Message Queuing (CAM / CAFT) before 1.07 Build 220_16 and 1.11 Build 29_20, as used in multiple CA products, allows remote attackers to cause a denial of service via a crafted message to TCP port 4105.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T20:00:00.000Z
CVE-2006-0530 
Computer Associates (CA) Message Queuing (CAM / CAFT) before 1.07 Build 220_16 and 1.11 Build 29_20, as used in multiple CA products, allows remote attackers to cause a denial of service via spoofed CAM control messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T20:00:00.000Z
CVE-2006-0531 
Unspecified vulnerability in Sun Java System Access Manager 7.0 allows local users logged in as "root" to bypass authentication and gain top-level administrator privileges via the amadmin CLI tool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T00:00:00.000Z
CVE-2006-0532 
Cross-site scripting (XSS) vulnerability in resultat.asp in SoftMaker Shop allows remote attackers to inject arbitrary web script or HTML via a strSok parameter containing a javascript: URI in an IMG SRC attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T00:00:00.000Z
CVE-2006-0533 
Cross-site scripting (XSS) vulnerability in webmailaging.cgi in cPanel allows remote attackers to inject arbitrary web script or HTML via the numdays parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T00:00:00.000Z
CVE-2006-0534 
Multiple cross-site scripting (XSS) vulnerabilities in default.asp in CyberShop Ultimate E-commerce allow remote attackers to inject arbitrary web script or HTML via the (1) ortak or (2) kat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T00:00:00.000Z
CVE-2006-0535 
Multiple cross-site scripting (XSS) vulnerabilities in Community Server allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.  NOTE: this candidate does not contain any actionable or distinguishing information.  Perhaps it should not be included in CVE.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T00:00:00.000Z
CVE-2006-0536 
Cross-site scripting (XSS) vulnerability in neomail.pl in NeoMail 1.27 allows remote attackers to inject arbitrary web script or HTML via the sort parameter.  NOTE: some sources say that the affected parameter is "date," but the demonstration URL shows that it is "sort".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T00:00:00.000Z
CVE-2006-0537 
Buffer overflow in the POP3 server in Kinesphere Corporation eXchange before 5.0.060125 allows remote attackers to execute arbitrary code via a long RCPT TO argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T00:00:00.000Z
CVE-2006-0538 
CipherTrust IronMail 5.0.1, when "Denial of Service Protection" is enabled, allows remote attackers to cause a denial of service (possibly CPU consumption) via a SYN flood with malformed TCP packets from multiple connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T00:00:00.000Z
CVE-2006-0539 
The convert-fcrontab program in fcron 3.0.0 might allow local users to gain privileges via a long command-line argument, which causes Linux glibc to report heap memory corruption, possibly because a strcpy in the strdup2 function can "overwrite some data."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T02:00:00.000Z
CVE-2006-0540 
Multiple SQL injection vulnerabilities in Tachyon Vanilla Guestbook 1.0 beta allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T02:00:00.000Z
CVE-2006-0541 
Multiple cross-site scripting (XSS) vulnerabilities in Tachyon Vanilla Guestbook 1.0 beta allow remote attackers to inject arbitrary web script or HTML via unknown vectors related to "posting new messages."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T02:00:00.000Z
CVE-2006-0542 
Multiple SQL injection vulnerabilities in config.php in NukedWeb GuestBookHost 2005.04.25 allow remote attackers to execute arbitrary SQL commands via the (1) email and (2) password parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T02:00:00.000Z
CVE-2006-0543 
Cerulean Trillian 3.1.0.120 allows remote attackers to cause a denial of service (client crash) via an AIM message containing the Mac encoded Rich Text Format (RTF) escape sequences (1) \'d1, (2) \'d2, (3) \'d3, (4) \'d4, and (5) \'d5.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T02:00:00.000Z
CVE-2006-0544 
urlmon.dll in Microsoft Internet Explorer 7.0 beta 2 (aka 7.0.5296.0) allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a BGSOUND element with its SRC attribute set to "file://" followed by a large number of "-" (dash of hyphen) characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T02:00:00.000Z
CVE-2006-0545 
SQL injection vulnerability in showflat.php in Groupee (formerly known as Infopop) UBB.threads 6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Number parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T02:00:00.000Z
CVE-2006-0546 
Unspecified vulnerability in index.php in a certain application available from /v1/tr/portfoy.php on www.egeinternet.com allows remote attackers to execute arbitrary code via "evilcode" in the key parameter, possibly a PHP remote file include vulnerability in which the attack vector is a URL in the key parameter.  NOTE: it is not clear whether this vulnerability is associated with an online service or application service provider.  If so, then it should not be included in CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T02:00:00.000Z
CVE-2006-0547 
Oracle Database 8i, 9i, and 10g allow remote authenticated users to execute arbitrary SQL statements in the context of the SYS user and bypass audit logging, including statements to create new privileged database accounts, via a modified AUTH_ALTER_SESSION attribute in the authentication phase of the Transparent Network Substrate (TNS) protocol.  NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle.  It is possible that this is the same issue as Oracle Vuln# DB18 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0265.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T02:00:00.000Z
CVE-2006-0548 
SQL injection vulnerability in the Oracle Text component of Oracle Database 10g, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle.  It is possible that this is the same issue as Oracle Vuln# DB15 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0260.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T02:00:00.000Z
CVE-2006-0549 
SQL injection vulnerability in the SYS.DBMS_METADATA_UTIL package in Oracle Database 10g, and possibly earlier versions, might allow remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle.  It is possible that this is the same issue as Oracle Vuln# DB05 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0260.  However, there are some inconsistencies that make this unclear, and there is also a possibility that this is related to DB06, which is subsumed by CVE-2006-0259.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T02:00:00.000Z
CVE-2006-0550 
Buffer overflow in an unspecified Oracle Client utility might allow remote attackers to execute arbitrary code or cause a denial of service.  NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle.  It is possible that this is the same issue as Oracle Vuln# DBC02 from the January 2006 CPU, in which case this would be a duplicate of CVE-2006-0283.  However, there are enough inconsistencies that the mapping can not be made authoritatively.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T02:00:00.000Z
CVE-2006-0551 
SQL injection vulnerability in the Data Pump Metadata API in Oracle Database 10g and possibly earlier might allow remote attackers to execute arbitrary SQL commands via unknown vectors.  NOTE: due to the lack of relevant details from the Oracle advisory, a separate CVE is being created since it cannot be conclusively proven that this issue has been addressed by Oracle.  It is possible that this is the same issue as Oracle Vuln# DB06 from the January 2006 CPU, in which case this would be subsumed by CVE-2006-0259 or, if it is DB05, subsumed by CVE-2006-0260.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T02:00:00.000Z
CVE-2006-0552 
Unspecified vulnerability in the Net Listener component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, and 9.2.0.7 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB11.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-04T11:00:00.000Z
CVE-2006-0553 
PostgreSQL 8.1.0 through 8.1.2 allows authenticated database users to gain additional privileges via "knowledge of the backend protocol" using a crafted SET ROLE to other database users, a different vulnerability than CVE-2006-0678.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-14T19:00:00.000Z
CVE-2006-0554 
Linux kernel 2.6 before 2.6.15.5 allows local users to obtain sensitive information via a crafted XFS ftruncate call, which may return stale data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-07T02:00:00.000Z
CVE-2006-0555 
The Linux Kernel before 2.6.15.5 allows local users to cause a denial of service (NFS client panic) via unknown attack vectors related to the use of O_DIRECT (direct I/O).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-07T02:00:00.000Z
CVE-2006-0557 
sys_mbind in mempolicy.c in Linux kernel 2.6.16 and earlier does not sanity check the maxnod variable before making certain computations for the get_nodes function, which has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-12T21:00:00.000Z
CVE-2006-0558 
perfmon (perfmon.c) in Linux kernel on IA64 architectures allows local users to cause a denial of service (crash) by interrupting a task while another process is accessing the mm_struct, which triggers a BUG_ON action in the put_page_testzero function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T21:00:00.000Z
CVE-2006-0559 
Format string vulnerability in the SMTP server for McAfee WebShield 4.5 MR2 and earlier allows remote attackers to execute arbitrary code via format strings in the domain name portion of a destination address, which are not properly handled when a bounce message is constructed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-04T14:00:00.000Z
CVE-2006-0561 
Cisco Secure Access Control Server (ACS) 3.x for Windows stores ACS administrator passwords and the master key in the registry with insecure permissions, which allows local users and remote administrators to decrypt the passwords by using Microsoft's cryptographic API functions to obtain the plaintext version of the master key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-09T23:00:00.000Z
CVE-2006-0562 
Cross-site scripting (XSS) vulnerability in problem.php in PluggedOut Blog 1.9.9c allows remote attackers to inject arbitrary web script or HTML via the data parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-06T23:00:00.000Z
CVE-2006-0563 
SQL injection vulnerability in exec.php in PluggedOut Blog 1.9.9c allows remote attackers to execute arbitrary SQL commands via the entryid parameter in a comment_add action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-06T23:00:00.000Z