rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-5518 
Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet); the (5) createDB parameter to console/portal/Embedded DB/DB Manager (aka the Embedded DB/DB Manager portlet); or the (6) filename parameter to the createKeystore script in the Security/Keystores portlet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-17T14:00:00.000Z
CVE-2008-5519 
The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-09T15:00:00.000Z
CVE-2008-5520 
AhnLab V3 2008.12.4.1 and possibly 2008.9.13.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5521 
Avira AntiVir 7.9.0.36 and possibly 7.8.1.28, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5522 
AVG Anti-Virus 8.0.0.161, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5523 
avast! antivirus 4.8.1281.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5524 
CAT-QuickHeal 10.00 and possibly 9.50, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5525 
ClamAV 0.94.1 and possibly 0.93.1, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5526 
DrWeb Anti-virus 4.44.0.09170, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5527 
ESET Smart Security, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5528 
Aladdin eSafe 7.0.17.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5529 
CA eTrust Antivirus 31.6.6086, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5530 
Ewido Security Suite 4.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5531 
Fortinet Antivirus 3.113.0.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5532 
Ikarus Virus Utilities T3.1.1.45.0 and possibly T3.1.1.34.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5533 
K7AntiVirus 7.10.541 and possibly 7.10.454, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5534 
ESET NOD32 Antivirus 3662 and possibly 3440, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5535 
Norman Antivirus 5.80.02, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5536 
Panda Antivirus 9.0.0.4, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5537 
PC Tools AntiVirus 4.4.2.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5538 
Prevx Prevx1 2, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5539 
RISING Antivirus 21.06.31.00 and possibly 20.61.42.00, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5540 
Secure Computing Secure Web Gateway (aka Webwasher), when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5541 
Sophos Anti-Virus 4.33.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5542 
Sunbelt VIPRE 3.1.1832.2 and possibly 3.1.1633.1, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5543 
Symantec AntiVirus (SAV) 10, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5544 
Hacksoft The Hacker 6.3.1.2.174 and possibly 6.3.0.9.081, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5545 
Trend Micro VSAPI 8.700.0.1004 in Trend Micro AntiVirus, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5546 
VirusBlokAda VBA32 3.12.8.5, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5547 
HAURI ViRobot 2008.12.4.1499 and possibly 2008.9.12.1375, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5548 
VirusBuster 4.5.11.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5549 
Unspecified vulnerability in the Sun Java Web Console components in Sun Java System Portal Server 7.1 and 7.2 allows remote attackers to access local files and read the product's configuration information via unknown vectors related to "access to secure files by ThemeServlet."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5550 
Open redirect vulnerability in console/faces/jsp/login/BeginLogin.jsp in Sun Java Web Console 3.0.2 through 3.0.5 and Solaris 10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the redirect_url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5551 
The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks by injecting data at two different positions within an HTML document, related to STYLE elements and the CSS expression property, aka a "double injection."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5552 
The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks via a CRLF sequence in conjunction with a crafted Content-Type header, as demonstrated by a header with a utf-7 charset value.  NOTE: the vendor has reportedly stated that the XSS Filter intentionally does not attempt to "address every conceivable XSS attack scenario."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5553 
The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 disables itself upon encountering a certain X-XSS-Protection HTTP header, which allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks by injecting this header after a CRLF sequence. NOTE: the vendor has reportedly stated that the XSS Filter intentionally does not attempt to "address every conceivable XSS attack scenario."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5554 
The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not properly handle some HTTP headers that appear after a CRLF sequence in a URI, which allows remote attackers to bypass the XSS protection mechanism and conduct XSS or redirection attacks, as demonstrated by the (1) Location and (2) Set-Cookie HTTP headers.  NOTE: the vendor has reportedly stated that the XSS Filter intentionally does not attempt to "address every conceivable XSS attack scenario."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5555 
Microsoft Internet Explorer 8.0 Beta 2 relies on the XDomainRequestAllowed HTTP header to authorize data exchange between domains, which allows remote attackers to bypass the product's XSS Filter protection mechanism, and conduct XSS and cross-domain attacks, by injecting this header after a CRLF sequence, related to "XDomainRequest Allowed Injection (XAI)." NOTE: the vendor has reportedly stated that the XSS Filter intentionally does not attempt to "address every conceivable XSS attack scenario."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5556 
The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not recognize attack patterns designed to operate against web pages that are encoded with utf-7, which allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks by injecting crafted utf-7 content.  NOTE: the vendor reportedly disputes this issue, stating "Behaviour is by design.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-12T18:13:00.000Z
CVE-2008-5557 
Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6 allows context-dependent attackers to execute arbitrary code via a crafted string containing an HTML entity, which is not properly handled during Unicode conversion, related to the (1) mb_convert_encoding, (2) mb_check_encoding, (3) mb_convert_variables, and (4) mb_parse_str functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-23T18:13:00.000Z
CVE-2008-5558 
Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service (crash) via authentication attempts involving (1) an unknown user or (2) a user using hostname matching.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T17:00:00.000Z
CVE-2008-5559 
SQL injection vulnerability in sendcard.cfm in PostEcards allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-15T17:45:00.000Z
CVE-2008-5560 
PostEcards stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for postcards.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-15T17:45:00.000Z
CVE-2008-5561 
SQL injection vulnerability in Netref 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) fiche_product.php and (2) presentation.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-15T17:45:00.000Z
CVE-2008-5562 
ASPPortal stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for xportal.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-15T17:45:00.000Z
CVE-2008-5563 
Aruba Mobility Controller 2.4.8.x-FIPS, 2.5.x, 3.1.x, 3.2.x, 3.3.1.x, and 3.3.2.x allows remote attackers to cause a denial of service (device crash) via a malformed Extensible Authentication Protocol (EAP) frame.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-15T17:45:00.000Z
CVE-2008-5564 
Unspecified vulnerability in the media server in Orb Networks Orb before 2.01.0025 allows remote attackers to cause a denial of service (daemon crash) via a malformed HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-15T17:45:00.000Z
CVE-2008-5565 
Cross-site request forgery (CSRF) vulnerability in admin/settings.php in DL PayCart 1.34 and earlier allows remote attackers to change the admin password via a logout action in conjunction with the NewAdmin, NewPass1, and NewPass2 parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-15T17:45:00.000Z
CVE-2008-5566 
Cross-site scripting (XSS) vulnerability in index.php in Triangle Solutions PHP Multiple Newsletters 2.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-15T17:45:00.000Z
CVE-2008-5567 
Cross-site request forgery (CSRF) vulnerability in admin/ad_settings.php in Bonza Cart 1.10 and earlier allows remote attackers to change the admin password via a logout action in conjunction with the NewAdmin, NewPass1, and NewPass2 parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-15T17:45:00.000Z
CVE-2008-5568 
Cross-site request forgery (CSRF) vulnerability in admin/settings.php in IPN Pro 3 1.44 and earlier allows remote attackers to change the admin password via a logout action in conjunction with the admin_id, newpass_1, and newpass_2 parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-15T17:45:00.000Z