rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-1130 
Cross-site scripting (XSS) vulnerability in EKINboard 1.0.3 allows remote attackers to inject arbitrary web script or HTML via a Javascript URI in a BBCode img tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T02:00:00.000Z
CVE-2006-1131 
Cross-site scripting (XSS) vulnerability in read.php in bitweaver CMS 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the comment_title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T02:00:00.000Z
CVE-2006-1132 
SQL injection vulnerability in show.php in vbzoom 1.11 allow remote attackers to execute arbitrary SQL commands via the MainID parameter. NOTE: the SubjectID vector is already covered by CVE-2005-4729.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T02:00:00.000Z
CVE-2006-1133 
Multiple cross-site scripting (XSS) vulnerabilities in vbzoom 1.11 allow remote attackers to inject arbitrary web script or HTML via the UserID parameter to (1) comment.php or (2) contact.php.  NOTE: the profile.php/UserName vector is already covered by CVE-2005-2441.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T02:00:00.000Z
CVE-2006-1134 
SQL injection vulnerability in CyBoards PHP Lite 1.25, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the parent parameter to (1) post.php and possibly (2) process_post.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T02:00:00.000Z
CVE-2006-1135 
Multiple cross-site scripting (XSS) vulnerabilities in sBlog 0.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword parameter to search.php or (2) username parameter to comments_do.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T02:00:00.000Z
CVE-2006-1136 
Buffer overflow in the PostScript file interpreter code for Xerox CopyCentre and Xerox WorkCentre Pro, running software 1.001.02.073 or earlier, or 1.001.02.074 before 1.001.02.715, allows attackers to cause a denial of service via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T02:00:00.000Z
CVE-2006-1137 
Multiple unspecified vulnerabilities in Xerox CopyCentre and Xerox WorkCentre Pro, running software 1.001.02.073 or earlier, or 1.001.02.074 before 1.001.02.715, allow remote attackers to cause an unspecified denial of service via a crafted PostScript file that will (1) "navigate through the directory" or (2) a "file sent to expose TCP/IP ports".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T02:00:00.000Z
CVE-2006-1138 
Unspecified vulnerability in the web server code in Xerox CopyCentre and Xerox WorkCentre Pro, running software 1.001.02.073 or earlier, or 1.001.02.074 before 1.001.02.715, allows remote attackers to cause a denial of service (memory corruption) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T02:00:00.000Z
CVE-2006-1139 
Unspecified vulnerability in the ESS/ Network Controller in Xerox CopyCentre and Xerox WorkCentre Pro, running software 1.001.02.073 or earlier, or 1.001.02.074 before 1.001.02.715, causes the Immediate Image Overwrite feature to fail after a power loss, which could leave data exposed to attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T02:00:00.000Z
CVE-2006-1140 
SQL injection vulnerability in rss.php in RedBLoG 0.5 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T11:00:00.000Z
CVE-2006-1141 
Buffer overflow in qmailadmin.c in QmailAdmin before 1.2.10 allows remote attackers to execute arbitrary code via a long PATH_INFO environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T11:00:00.000Z
CVE-2006-1142 
Unspecified vulnerability in Ravenous Web Server before 0.7.1 allows remote attackers to access arbitrary rvplg files, with unknown impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T11:00:00.000Z
CVE-2006-1143 
Cross-site scripting (XSS) vulnerability in FTPoed Blog Engine 1.1 allows remote attackers to inject arbitrary web script or HTML via the comment_body parameter, as used by the comment field, when posting a comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T11:00:00.000Z
CVE-2006-1144 
Cross-site scripting (XSS) vulnerability in HitHost 1.0.0 allows remote attackers to inject arbitrary web script or HTML via (1) the user parameter in deleteuser.php and (2) the hits parameter in viewuser.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T11:00:00.000Z
CVE-2006-1145 
Format string vulnerability in the safe_cprintf function in acebot_cmds.c in Alien Arena 2006 Gold Edition 5.00 allows remote attackers (possibly authenticated) to execute arbitrary code via unspecified vectors when the server sends crafted messages to the clients.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T11:00:00.000Z
CVE-2006-1146 
Stack-based buffer overflow in the Cmd_Say_f function in g_cmds.c in Alien Arena 2006 Gold Edition 5.00 allows remote attackers (possibly authenticated) to execute arbitrary code by sending a long message to the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T11:00:00.000Z
CVE-2006-1147 
The Com_sprintf function in q_shared.c in Alien Arena 2006 Gold Edition 5.00 does not properly NULL terminate certain long strings, which allows remote attackers (possibly authenticated) to cause a denial of service (application crash) via a long skin, weapon, or model name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T11:00:00.000Z
CVE-2006-1148 
Multiple stack-based buffer overflows in the procConnectArgs function in servmgr.cpp in PeerCast before 0.1217 allow remote attackers to execute arbitrary code via an HTTP GET request with a long (1) parameter name or (2) value in a URL, which triggers the overflow in the nextCGIarg function in servhs.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T11:00:00.000Z
CVE-2006-1149 
PHP remote file inclusion vulnerability in lib/OWL_API.php in OWL Intranet Engine 0.82, when register_globals is enabled, allows remote attackers to include arbitrary files via a URL in the xrms_file_root parameter, which is not initialized before use.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T11:00:00.000Z
CVE-2006-1150 
Buffer overflow in Tenes Empanadas Graciela (TEG) 0.11.1, automatically appends an _ (underscore) to the end of duplicate nicknames, which allows remote attackers to cause a denial of service (application crash) by creating multiple users with long, identical nicknames, which triggers an off-by-one error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T11:00:00.000Z
CVE-2006-1151 
Cross-site scripting vulnerability in index.php in M-Phorum 0.2 allows remote attackers to inject arbitrary web script or HTML via the go parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T11:00:00.000Z
CVE-2006-1152 
PHP remote file inclusion vulnerability in index.php in M-Phorum 0.2 allows remote attackers to include arbitrary files via the go parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T11:00:00.000Z
CVE-2006-1153 
SQL injection vulnerability in D2-Shoutbox 4.2 allows remote attackers to execute arbitrary SQL commands via the load parameter, when performing a Shoutbox action through Invision Power Board (IPB).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T11:00:00.000Z
CVE-2006-1154 
PHP remote file inclusion vulnerability in archive.php in Fantastic News 2.1.2 allows remote attackers to include arbitrary files via the CONFIG[script_path] variable.  NOTE: 2.1.4 was also reported to be vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T11:00:00.000Z
CVE-2006-1155 
Cross-site scripting (XSS) vulnerability in manas tungare Site Membership Script before 8 March, 2006 allows remote attackers to inject arbitrary web script or HTML via the Error parameter in (1) login.asp and (2) default.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-12T20:00:00.000Z
CVE-2006-1156 
SQL injection vulnerability in manas tungare Site Membership Script before 8 March, 2006 allows remote attackers to execute arbitrary SQL commands via the Username parameter in login.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-12T20:00:00.000Z
CVE-2006-1157 
Cross-site scripting (XSS) vulnerability in Vz Scripts ADP Forum 2.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the Subject field (possibly messaggio parameter) when posting a new message in post.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-12T20:00:00.000Z
CVE-2006-1158 
Kerio MailServer before 6.1.3 Patch 1 allows remote attackers to cause a denial of service (application crash) via a crafted IMAP LOGIN command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-12T20:00:00.000Z
CVE-2006-1159 
Format string vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in the query string argument in an HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-12T21:00:00.000Z
CVE-2006-1160 
Cross-site scripting (XSS) vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote attackers to inject arbitrary web script or HTML via the Description field in creating a folder or uploading a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-12T21:00:00.000Z
CVE-2006-1161 
Absolute path traversal vulnerability in Easy File Sharing (EFS) Web Server 3.2 allows remote registered users to execute arbitrary code by uploading a malicious file to the Windows startup folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-12T21:00:00.000Z
CVE-2006-1162 
Directory traversal vulnerability in Nodez 4.6.1.1 and earlier allows remote attackers to read or include arbitrary PHP files via a ..  (dot dot) in the op parameter, as demonstrated by inserting malicious Email parameters into list.gtdat, then accessing list.gtdat using the op parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-12T21:00:00.000Z
CVE-2006-1163 
Cross-site scripting (XSS) vulnerability in Nodez 4.6.1.1 allows remote attackers to inject arbitrary web script or HTML via the op parameter.  NOTE: it is possible that this issue is resultant from the directory traversal vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-12T21:00:00.000Z
CVE-2006-1164 
Nodez 4.6.1.1 and earlier stores sensitive data in the list.gtdat file under the web document root with insufficient access control, which allows remote attackers to obtain usernames and password hashes by directly accessing list.gtdat.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-12T21:00:00.000Z
CVE-2006-1165 
Cross-site scripting (XSS) vulnerability in the mediamanager module in DokuWiki before 2006-03-05 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors relating to "handling EXIF data."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-12T21:00:00.000Z
CVE-2006-1166 
Monotone 0.25 and earlier, when a user creates a file in a directory called "mt", and when checking out that file on a case-insensitive file system such as Windows or Mac OS X, places the file into the "MT" bookkeeping directory, which could allow context-dependent attackers to execute arbitrary Lua programs as the user running monotone.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-12T21:00:00.000Z
CVE-2006-1167 
SGI ProPack 3 SP6 kernel displays the frame buffer contents of the last session after a reboot, which might allow local users to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-06T22:00:00.000Z
CVE-2006-1168 
The decompress function in compress42.c in (1) ncompress 4.2.4 and (2) liblzw allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code, via crafted data that leads to a buffer underflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-14T20:00:00.000Z
CVE-2006-1172 
Stack-based buffer overflow in the createPKCS10 function in Cryptomathic Cenroll ActiveX Control 1.1.0.0 allows remote attackers to execute arbitrary code via vectors related to the TDC Digital signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-09T10:00:00.000Z
CVE-2006-1173 
Sendmail before 8.13.7 allows remote attackers to cause a denial of service via deeply nested, malformed multipart MIME messages that exhaust the stack during the recursive mime8to7 function for performing 8-bit to 7-bit conversion, which prevents Sendmail from delivering queued messages and might lead to disk consumption by core dump files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-07T23:00:00.000Z
CVE-2006-1174 
useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-28T23:00:00.000Z
CVE-2006-1175 
The WeOnlyDo! SFTP (wodSFTP) ActiveX control is marked as safe for scripting, which allows remote attackers to read and write files in arbitrary locations by accessing the control from a web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-31T10:00:00.000Z
CVE-2006-1176 
Buffer overflow in eBay Enhanced Picture Services (aka EPUImageControl Class) in EUPWALcontrol.dll before 1.0.3.48, as used in Sell Your Item (SYI), Setup & Test eBay Enhanced Picture Services, Picture Manager Enhanced Uploader, and CARad.com Add Vehicle, allows remote attackers to execute arbitrary code via a crafted HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-08T00:00:00.000Z
CVE-2006-1178 
Tamarack MMSd before 7.992 allows remote attackers to cause a denial of service (crash) via malformed RFC1006 (OSI over TCP/IP) packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-29T01:00:00.000Z
CVE-2006-1182 
Adobe Graphics Server 2.0 and 2.1 (formerly AlterCast) and Adobe Document Server (ADS) 5.0 and 6.0 allows local users to read files with certain extensions or overwrite arbitrary files and execute code via a crafted SOAP request to the AlterCast web service in which the request uses the (1) saveContent or (2) saveOptimized ADS commands, or the (3) loadContent command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-16T01:00:00.000Z
CVE-2006-1183 
The Ubuntu 5.10 installer does not properly clear passwords from the installer log file (questions.dat), and leaves the log file with world-readable permissions, which allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-13T11:00:00.000Z
CVE-2006-1184 
Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service (crash) via a BuildContextW request with a large (1) UuidString or (2) GuidIn of a certain length, which causes an out-of-range memory access, aka the MSDTC Denial of Service Vulnerability.  NOTE: this is a variant of CVE-2005-2119.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-09T23:00:00.000Z
CVE-2006-1185 
Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML that causes memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-11T23:00:00.000Z
CVE-2006-1186 
Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via by instantiating the (1) Mdt2gddr.dll, (2) Mdt2dd.dll, and (3) Mdt2gddo.dll COM objects as ActiveX controls, which leads to memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-11T23:00:00.000Z
CVE-2006-1188 
Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag, which leads to memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-11T23:00:00.000Z
CVE-2006-1189 
Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted URL with an International Domain Name (IDN) using double-byte character sets (DBCS), aka the "Double Byte Character Parsing Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-11T23:00:00.000Z
CVE-2006-1190 
Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object, which could cause Internet Explorer to run the object in the wrong security context or zone, and allow remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-11T23:00:00.000Z
CVE-2006-1191 
Microsoft Internet Explorer 5.01 through 6 does not always correctly identify the domain that is associated with a browser window, which allows remote attackers to obtain sensitive cross-domain information and spoof sites by running script after the user has navigated to another site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-11T23:00:00.000Z
CVE-2006-1192 
Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts of the trust UI via unknown methods that allow "window content to persist" after the user has navigated to another site, aka the "Address Bar Spoofing Vulnerability."  NOTE: this is a different vulnerability than CVE-2006-1626.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-11T23:00:00.000Z
CVE-2006-1193 
Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access (OWA), allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-13T19:00:00.000Z
CVE-2006-1194 
Integer signedness error in the enet_protocol_handle_incoming_commands function in protocol.c for ENet library CVS version Jul 2005 and earlier, as used in products including (1) Cube, (2) Sauerbraten, and (3) Duke3d_w32, allows remote attackers to cause a denial of service (application crash) via a packet with a large command length value, which leads to an invalid memory access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-13T22:00:00.000Z
CVE-2006-1195 
The enet_protocol_handle_send_fragment function in protocol.c for ENet library CVS version Jul 2005 and earlier, as used in products including (1) Cube, (2) Sauerbraten, and (3) Duke3d_w32, allows remote attackers to cause a denial of service (application crash) via a packet fragment with a large total data size, which triggers an application abort when memory allocation fails.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-13T22:00:00.000Z
CVE-2006-1196 
Multiple cross-site scripting (XSS) vulnerabilities in QwikiWiki 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) from and (2) help parameters to (a) index.php; (3) action, (4) page, (5) debug, (6) help, (7) username, or (8) password parameters to (b) login.php; the (7) help parameter to (c) pageindex.php; or (8) help parameter to (d) recentchanges.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-13T22:00:00.000Z
CVE-2006-1197 
SafeDisc installs the driver service for the secdrv.sys driver with insecure permissions, which allows local users to gain privileges by changing the configuration to reference a malicious program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-13T22:00:00.000Z
CVE-2006-1198 
Comvigo IM Lock 2006 uses a simple substitution cipher to encrypt a password stored in the msnvs\prc registry value, for which all users have Read permission, which allows local users to bypass the product's blocking functionality by decrypting the password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-14T01:00:00.000Z
CVE-2006-1199 
Cross-site scripting (XSS) vulnerability in iframe.php in daverave Link Bank allows remote attackers to inject arbitrary web script or HTML via the site parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-14T01:00:00.000Z
CVE-2006-1200 
Direct static code injection vulnerability in add_link.txt in daverave Link Bank allows remote attackers to execute arbitrary PHP code via the url_name parameter, which is not sanitized before being stored in links.txt, which is later used in an include statement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-14T01:00:00.000Z
CVE-2006-1201 
Directory traversal vulnerability in resetpw.php in eschew.net phpBannerExchange 2.0 and earlier, and other versions before 2.0 Update 5, allows remote attackers to read arbitrary files via a .. (dot dot) in the email parameter during a "Recover password" operation (recoverpw.php).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-14T01:00:00.000Z
CVE-2006-1202 
Multiple cross-site scripting (XSS) vulnerabilities in textfileBB 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) mess and (2) user parameters in messanger.php, possibly requiring a URL encoded value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-14T01:00:00.000Z