rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-1205 
Unspecified vulnerability in the ipsecah kernel module in Sun Solaris 10, when a key management daemon for IPsec security associations is running, allows local users to cause a denial of service (panic) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-08T00:00:00.000Z
CVE-2008-1206 
Format string vulnerability in the log_message function in lks.c in Linux Kiss Server 1.2, when background (daemon) mode is disabled, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in an invalid command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-08T00:00:00.000Z
CVE-2008-1207 
Multiple unspecified vulnerabilities in Fujitsu Interstage Smart Repository, as used in multiple Fujitsu Interstage products, allow remote attackers to cause a denial of service (daemon crash) via (1) an invalid request or (2) a large amount of data sent to the registered attribute value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-08T00:00:00.000Z
CVE-2008-1208 
Cross-site scripting (XSS) vulnerability in the login page in Check Point VPN-1 UTM Edge W Embedded NGX 7.0.48x allows remote attackers to inject arbitrary web script or HTML via the user parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-08T00:00:00.000Z
CVE-2008-1209 
Cross-site scripting (XSS) vulnerability in redirect.do in Xitex WebContent M1 allows remote attackers to inject arbitrary web script or HTML via the sid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-08T00:00:00.000Z
CVE-2008-1210 
Stack-based buffer overflow in the ctags parsing code in Programmer's Notepad before 2.0.8.718 allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted .c file, when the victim selects the Jump To dialog.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-08T00:00:00.000Z
CVE-2008-1211 
Cross-site scripting (XSS) vulnerability in BosDates 3.x and 4.x allows remote attackers to inject arbitrary web script or HTML via (1) the type parameter in calendar.php and (2) the category parameter in calendar_search.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-08T00:00:00.000Z
CVE-2008-1212 
Cross-site scripting (XSS) vulnerability in set_permissions.php in Podcast Generator 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the scriptlang parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-08T00:00:00.000Z
CVE-2008-1213 
Cross-site scripting (XSS) vulnerability in Numara FootPrints for Linux 8.1 allows remote attackers to inject arbitrary web script or HTML via the Title form field when setting an appointment.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-08T00:00:00.000Z
CVE-2008-1214 
MRcgi/MRProcessIncomingForms.pl in Numara FootPrints 8.1 on Linux allows remote attackers to execute arbitrary code via shell metacharacters in the PROJECTNUM parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-08T00:00:00.000Z
CVE-2008-1215 
Stack-based buffer overflow in the command_Expand_Interpret function in command.c in ppp (aka user-ppp), as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for NetBSD, allows local users to gain privileges via long commands containing "~" characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-09T02:00:00.000Z
CVE-2008-1216 
IBM Lotus Quickr 8.0 server, and possibly QuickPlace 7.x, does not properly identify URIs containing cross-site scripting (XSS) attack strings, which allows remote attackers to inject arbitrary web script or HTML via a Calendar OpenDocument action to main.nsf with a Count parameter containing a JavaScript event in a malformed element, as demonstrated by an onload event in an IFRAME element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-09T02:00:00.000Z
CVE-2008-1217 
Unspecified vulnerability in nlnotes.dll in the client in IBM Lotus Notes 6.5, 7.0.x before 7.0.2 CCH, and 8.0.x before 8.0.1 allows remote attackers to execute arbitrary code via a crafted attachment in an e-mail message sent over SMTP, a variant of CVE-2007-6706.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-09T02:00:00.000Z
CVE-2008-1218 
Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters, which are treated as argument delimiters that enable the skip_password_check field to be specified.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T23:00:00.000Z
CVE-2008-1219 
SQL injection vulnerability in the Kutub-i Sitte (KutubiSitte) 1.1 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the kid parameter in a hadisgoster action to modules.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1220 
SQL injection vulnerability in the 4nChat 0.91 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the roomid parameter in an index action to modules.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1221 
Absolute path traversal vulnerability in the FTP server in MicroWorld eScan Corporate Edition 9.0.742.98 and eScan Management Console (aka eScan Server) 9.0.742.1 allows remote attackers to read arbitrary files via an absolute pathname in the RETR (get) command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1222 
Cross-site scripting (XSS) vulnerability in Dokeos 1.8.4 before SP3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1223 
Unspecified vulnerability in Dokeos 1.8.4 before SP3 allows attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1224 
Cross-site scripting (XSS) vulnerability in account.php in BosClassifieds Classified Ads System 3.0 allows remote attackers to inject arbitrary web script or HTML via the returnTo parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1225 
Multiple cross-site scripting (XSS) vulnerabilities in WebCT Campus Edition 4.1.5.8, when "Don't wrap text" is enabled, allow remote authenticated users to inject arbitrary web script or HTML via a (1) mail message or (2) discussion board message.  NOTE: this might overlap CVE-2005-1076.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1226 
Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration Suite (ZCS) 4.0.3, 4.5.6, and possibly other versions before 4.5.10 allow remote attackers to inject arbitrary web script or HTML via an e-mail attachment, possibly involving a (1) .jpg or (2) .gif image attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1227 
Stack-based buffer overflow in the silc_fingerprint function in lib/silcutil/silcutil.c in Secure Internet Live Conferencing (SILC) Toolkit 1.1.5, and unspecified earlier versions, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via long input data.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1228 
Cross-site scripting (XSS) vulnerability in admin.php in MG2 (formerly Minigal) allows remote attackers to inject arbitrary web script or HTML via the list parameter in an import action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1229 
Cross-site scripting (XSS) vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to inject arbitrary web script or HTML via the editor parameter, a different vector than CVE-2007-5120.b.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1230 
Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbitrary .jsp files via an unspecified manipulation that attaches a .jsp file to an "entry page."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1231 
Directory traversal vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to include and execute arbitrary local .jsp files, and obtain sensitive information, via a .. (dot dot) in the editor parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1232 
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T01:00:00.000Z
CVE-2008-1233 
Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to execute arbitrary code via "XPCNativeWrapper pollution."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-27T10:00:00.000Z
CVE-2008-1234 
Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to inject arbitrary web script or HTML via event handlers, aka "Universal XSS using event handlers."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-27T10:00:00.000Z
CVE-2008-1235 
Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to execute arbitrary code via unknown vectors that cause JavaScript to execute with the wrong principal, aka "Privilege escalation via incorrect principals."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-27T10:00:00.000Z
CVE-2008-1236 
Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to the layout engine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-27T10:00:00.000Z
CVE-2008-1237 
Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to the JavaScript engine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-27T10:00:00.000Z
CVE-2008-1238 
Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9, when generating the HTTP Referer header, does not list the entire URL when it contains Basic Authentication credentials without a username, which makes it easier for remote attackers to bypass application protection mechanisms that rely on Referer headers, such as with some Cross-Site Request Forgery (CSRF) mechanisms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-27T10:00:00.000Z
CVE-2008-1240 
LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine.  NOTE: this is closely related to CVE-2008-1195.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-28T01:00:00.000Z
CVE-2008-1241 
GUI overlay vulnerability in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 allows remote attackers to spoof form elements and redirect user inputs via a borderless XUL pop-up window from a background tab.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-27T10:00:00.000Z
CVE-2008-1242 
The control panel on the Belkin F5D7230-4 router with firmware 9.01.10 maintains authentication state by IP address, which allows remote attackers to bypass authentication by establishing a session from a source IP address of a previously authenticated user, a different vulnerability than CVE-2005-3802.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1243 
Cross-site scripting (XSS) vulnerability on the Linksys WRT300N router with firmware 2.00.20, when Mozilla Firefox or Apple Safari is used, allows remote attackers to inject arbitrary web script or HTML via the dyndns_domain parameter to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1244 
cgi-bin/setup_dns.exe on the Belkin F5D7230-4 router with firmware 9.01.10 does not require authentication, which allows remote attackers to perform administrative actions, as demonstrated by changing a DNS server via the dns1_1, dns1_2, dns1_3, and dns1_4 parameters.  NOTE: it was later reported that F5D7632-4V6 with firmware 6.01.08 is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1245 
cgi-bin/setup_virtualserver.exe on the Belkin F5D7230-4 router with firmware 9.01.10 allows remote attackers to cause a denial of service (control center outage) via an HTTP request with invalid POST data and a "Connection: Keep-Alive" header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1246 
The Cisco PIX/ASA Finesse Operation System 7.1 and 7.2 allows local users to gain privileges by entering characters at the enable prompt, erasing these characters via the Backspace key, and then holding down the Backspace key for one second after erasing the final character. NOTE: third parties, including one who works for the vendor, have been unable to reproduce the flaw unless the enable password is blank
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1247 
The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows remote attackers to perform arbitrary administrative actions via a direct request to (1) Advanced.tri, (2) AdvRoute.tri, (3) Basic.tri, (4) ctlog.tri, (5) ddns.tri, (6) dmz.tri, (7) factdefa.tri, (8) filter.tri, (9) fw.tri, (10) manage.tri, (11) ping.tri, (12) PortRange.tri, (13) ptrigger.tri, (14) qos.tri, (15) rstatus.tri, (16) tracert.tri, (17) vpn.tri, (18) WanMac.tri, (19) WBasic.tri, or (20) WFilter.tri.  NOTE: the Security.tri vector is already covered by CVE-2006-5202.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1248 
The web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to make arbitrary phone calls via the "Call a number" field.  NOTE: this might overlap CVE-2007-3440.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1249 
snomControl.swf in the central phone server for the Snom 320 SIP Phone allows remote attackers to cause a denial of service (application crash and corruption of call logs) via a "'); (double quote, quote, close parenthesis, semicolon) sequence in the "Call a number" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1250 
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface on the central phone server for the Snom 320 SIP Phone allow remote attackers to perform actions as the phone user, as demonstrated by inserting an address-book entry containing an XSS sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1251 
Cross-site scripting (XSS) vulnerability in the web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1252 
b_banner.stm (aka the login page) on the Deutsche Telekom Speedport W500 DSL router allows remote attackers to obtain the logon password by reading the pwd field in the HTML source.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1253 
Cross-site scripting (XSS) vulnerability in cgi-bin/webcm on the D-Link DSL-G604T router allows remote attackers to inject arbitrary web script or HTML via the var:category parameter, as demonstrated by a request for advanced/portforw.htm on the fwan page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1254 
Multiple cross-site request forgery (CSRF) vulnerabilities on the ZyXEL P-660HW series router allow remote attackers to (1) change DNS servers and (2) add keywords to the "bannedlist" via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1255 
The ZyXEL P-660HW series router maintains authentication state by IP address, which allows remote attackers to bypass authentication by establishing a session from a source IP address of a previously authenticated user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1256 
The ZyXEL P-660HW series router has "admin" as its default password, which allows remote attackers to gain administrative access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1257 
Cross-site scripting (XSS) vulnerability in Forms/DiagGeneral_2 on the ZyXEL P-660HW series router allows remote attackers to inject arbitrary web script or HTML via the PingIPAddr parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1258 
Cross-site scripting (XSS) vulnerability in prim.htm on the D-Link DI-604 router allows remote attackers to inject arbitrary web script or HTML via the rf parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1259 
The Zyxel P-2602HW-D1A router with 3.40(AJZ.1) firmware maintains authentication state by IP address, which allows remote attackers to bypass authentication by establishing a session from a source IP address of a user who previously authenticated within the previous 5 minutes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1260 
Multiple cross-site request forgery (CSRF) vulnerabilities on the Zyxel P-2602HW-D1A router with 3.40(AJZ.1) firmware allow remote attackers to (1) make the admin web server available on the Internet (WAN) interface via the WWWAccessInterface parameter to Forms/RemMagWWW_1 or (2) change the IP whitelisting timeout via the StdioTimout parameter to Forms/rpSysAdmin_1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1261 
The Zyxel P-2602HW-D1A router with 3.40(AJZ.1) firmware provides different responses to admin page requests depending on whether a user is logged in, which allows remote attackers to obtain current login status by requesting an arbitrary admin URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1262 
The administration panel on the Airspan WiMax ProST 4.1 antenna with 6.5.38.0 software does not verify authentication credentials, which allows remote attackers to (1) upload malformed firmware or (2) bind the antenna to a different WiMAX base station via unspecified requests to forms under process_adv/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1263 
The Linksys WRT54G router stores passwords and keys in cleartext in the Config.bin file, which might allow remote authenticated users to obtain sensitive information via an HTTP request for the top-level Config.bin URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1264 
The Linksys WRT54G router has "admin" as its default FTP password, which allows remote attackers to access sensitive files including nvram.cfg, a file that lists all HTML documents, and an ELF executable file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1265 
The Linksys WRT54G router allows remote attackers to cause a denial of service (device restart) via a long username and password to the FTP interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1266 
Multiple buffer overflows in the web interface on the D-Link DI-524 router allow remote attackers to cause a denial of service (device crash) or possibly have unspecified other impact via (1) a long username or (2) an HTTP header with a large name and an empty value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z
CVE-2008-1267 
The Siemens SpeedStream 6520 router allows remote attackers to cause a denial of service (web interface crash) via an HTTP request to basehelp_English.htm with a large integer in the Content-Length field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-10T17:00:00.000Z