rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-5654 
LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed by a new extension, as demonstrated by reading PHP source code via requests for .php%00.txt files, aka "Mime Type Injection."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-23T21:00:00.000Z
CVE-2007-5655 
TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to execute arbitrary code via crafted requests containing values that are used as pointers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-16T02:00:00.000Z
CVE-2007-5656 
TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted requests that control loop operations related to memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-16T02:00:00.000Z
CVE-2007-5657 
TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to execute arbitrary code via crafted requests containing values that are used as pointer offsets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-16T02:00:00.000Z
CVE-2007-5658 
Heap-based buffer overflow in TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote attackers to execute arbitrary code via crafted requests containing size and copy-length values that trigger the overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-16T02:00:00.000Z
CVE-2007-5659 
Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with long arguments to unspecified JavaScript methods.  NOTE: this issue might be subsumed by CVE-2008-0655.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-12T18:00:00.000Z
CVE-2007-5660 
Unspecified vulnerability in the Update Service ActiveX control in isusweb.dll before 6.0.100.65101 in MacroVision FLEXnet Connect and InstallShield 2008 allows remote attackers to execute arbitrary code via an unspecified "unsafe method," possibly involving a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-02T16:00:00.000Z
CVE-2007-5661 
The Macrovision InstallShield InstallScript One-Click Install (OCI) ActiveX control 12.0 before SP2 does not validate the DLL files that are named as parameters to the control, which allows remote attackers to download arbitrary library code onto a client machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-04T00:00:00.000Z
CVE-2007-5663 
Adobe Reader and Acrobat 8.1.1 and earlier allows remote attackers to execute arbitrary code via a crafted PDF file that calls an insecure JavaScript method in the EScript.api plug-in.  NOTE: this issue might be subsumed by CVE-2008-0655.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-12T18:00:00.000Z
CVE-2007-5664 
db2dasrrm in the DB2 Administration Server (DAS) in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to overwrite arbitrary files via a symlink attack on files used for initialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-16T18:00:00.000Z
CVE-2007-5665 
STEngine.exe 3.5.0.20 in Novell ZENworks Endpoint Security Management (ESM) 3.5, and other ESM versions before 3.5.0.82, dynamically creates scripts in a world-writable directory when generating diagnostic reports, which allows local users to gain privileges, as demonstrated by creating a cmd.exe binary in the diagnostic report directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T00:00:00.000Z
CVE-2007-5666 
Untrusted search path vulnerability in Adobe Reader and Acrobat 8.1.1 and earlier allows local users to execute arbitrary code via a malicious Security Provider library in the reader's current working directory.  NOTE: this issue might be subsumed by CVE-2008-0655.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-12T18:00:00.000Z
CVE-2007-5667 
NWFILTER.SYS in Novell Client 4.91 SP 1 through SP 4 for Windows 2000, XP, and Server 2003 makes the \.\nwfilter device available for arbitrary user-mode input via METHOD_NEITHER IOCTLs, which allows local users to gain privileges by passing a kernel address as an argument and overwriting kernel memory locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-14T01:00:00.000Z
CVE-2007-5671 
HGFS.sys in the VMware Tools package in VMware Workstation 5.x before 5.5.6 build 80404, VMware Player before 1.0.6 build 80404, VMware ACE before 1.0.5 build 79846, VMware Server before 1.0.5 build 80187, and VMware ESX 2.5.4 through 3.0.2 does not properly validate arguments in user-mode METHOD_NEITHER IOCTLs to the \\.\hgfs device, which allows guest OS users to modify arbitrary memory locations in guest kernel memory and gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-05T20:21:00.000Z
CVE-2007-5673 
Cross-site scripting (XSS) vulnerability in cgi-bin/webif.exe in ifnet WebIf allows remote attackers to inject arbitrary web script or HTML via the cmd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-24T23:00:00.000Z
CVE-2007-5674 
Directory traversal vulnerability in index.php in InstaGuide Weather (aka Weather for PHP) 1.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PageName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-24T23:00:00.000Z
CVE-2007-5675 
Stack-based buffer overflow in the DebugPrint function in MultiXTpm Application Server before 4.0.2d allows remote attackers to execute arbitrary code via a long string argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-24T23:00:00.000Z
CVE-2007-5676 
PHP remote file inclusion vulnerability in modules/Forums/favorites.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbitrary PHP code via a URL in the nuke_bb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-24T23:00:00.000Z
CVE-2007-5677 
Cross-site scripting (XSS) vulnerability in shoutbox/blocco.php in Hackish BETA 1.1 allows remote attackers to inject arbitrary web script or HTML via the go_shout parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-24T23:00:00.000Z
CVE-2007-5678 
SQL injection vulnerability in the Music module in phpBasic allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-24T23:00:00.000Z
CVE-2007-5679 
SQL injection vulnerability in index.php in DeeEmm.com DM CMS 0.7.0.Beta allows remote attackers to execute arbitrary SQL commands via the id parameter in the media page (build_media_content.php). NOTE: it was later reported that 0.7.4 is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-25T00:00:00.000Z
CVE-2007-5682 
Incomplete blacklist vulnerability in tiki-graph_formula.php in TikiWiki before 1.9.8.2 allows remote attackers to execute arbitrary code by using variable functions and variable variables to write variables whose names match the whitelist, a different vulnerability than CVE-2007-5423.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-26T18:00:00.000Z
CVE-2007-5683 
Multiple cross-site scripting (XSS) vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to the password reminder page (tiki-remind_password.php), (2) IMG tags in wiki pages, and (3) the local_php parameter to db/tiki-db.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-26T18:00:00.000Z
CVE-2007-5684 
Multiple directory traversal vulnerabilities in TikiWiki 1.9.8.1 and earlier allow remote attackers to include and execute arbitrary files via an absolute pathname in (1) error_handler_file and (2) local_php parameters to (a) tiki-index.php, or (3) encoded "..%2F" sequences in the imp_language parameter to tiki-imexport_languages.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-26T18:00:00.000Z
CVE-2007-5685 
The safe_path function in shttp before 0.0.5 allows remote attackers to conduct directory traversal attacks and read files via a combination of ".." and sub-directory specifiers that resolve to a pathname that is at or below the same level as the web document root, but in a different part of the directory tree.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-28T16:00:00.000Z
CVE-2007-5686 
initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts.  NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-28T16:00:00.000Z
CVE-2007-5687 
Multiple buffer overflows in the rich text processing functionality in JustSystems Ichitaro 2004 through 2007, 11 through 13, and other versions allow remote attackers to execute arbitrary code via a long (1) pard field or (2) font name in the fcharset0 field, which is not properly handled in (a) JSTARO4.OCX; or (3) a long title, which is not properly handled by (b) TJSVDA.DLL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-28T16:00:00.000Z
CVE-2007-5688 
Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3, for phpBB and Invision Power Board (IPB or IP.Board), allow remote attackers to execute arbitrary SQL commands via the (1) go and (2) cat parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T19:00:00.000Z
CVE-2007-5689 
The Java Virtual Machine (JVM) in Sun Java Runtime Environment (JRE) in SDK and JRE 1.3.x through 1.3.1_20 and 1.4.x through 1.4.2_15, and JDK and JRE 5.x through 5.0 Update 12 and 6.x through 6 Update 2, allows remote attackers to execute arbitrary programs, or read or modify arbitrary files, via applets that grant privileges to themselves.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T19:00:00.000Z
CVE-2007-5690 
Buffer overflow in sethdlc.c in the Asterisk Zaptel 1.4.5.1 might allow local users to gain privileges via a long device name (interface name) in the ifr_name field.  NOTE: the vendor disputes this issue, stating that the application requires root access, so privilege boundaries are not crossed
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T19:00:00.000Z
CVE-2007-5691 
ParseFTPList.cpp in Mozilla Firefox 2.0.0.7 allows remote FTP servers to cause a denial of service (application crash) via a crafted reply to an unspecified listing command, related to "reading from invalid pointer."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T19:00:00.000Z
CVE-2007-5692 
Multiple cross-site scripting (XSS) vulnerabilities in SiteBar 3.3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter to integrator.php; (2) the token parameter in a New Password action, (3) the nid_acl parameter in a Folder Properties action, or (4) the uid parameter in a Modify User action to command.php; or (5) the target parameter to index.php, different vectors than CVE-2006-3320.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T20:00:00.000Z
CVE-2007-5693 
Eval injection vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenticated users to execute arbitrary PHP code via the edit parameter in an upd cmd action, a different vulnerability than CVE-2007-5492.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T20:00:00.000Z
CVE-2007-5694 
Absolute path traversal vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenticated users to read arbitrary files via an absolute path in the dir parameter, a different vulnerability than CVE-2007-5491.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T20:00:00.000Z
CVE-2007-5695 
Open redirect vulnerability in command.php in SiteBar 3.3.8 allows remote attackers to redirect users to arbitrary web sites via a URL in the forward parameter in a Log In action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T20:00:00.000Z
CVE-2007-5696 
PHP remote file inclusion vulnerability in includes.php in phpBasic allows remote attackers to execute arbitrary PHP code via a URL in the root parameter, possibly related to the Music module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T20:00:00.000Z
CVE-2007-5697 
Multiple PHP remote file inclusion vulnerabilities in PHP Image 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the xarg parameter to (1) xarg_corner.php, (2) xarg_corner_bottom.php, and (3) xarg_corner_top.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T21:00:00.000Z
CVE-2007-5698 
Cross-site scripting (XSS) vulnerability in default.asp in CREApark GOLD KOY PORTALI allows remote attackers to inject arbitrary web script or HTML via the aranan parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T21:00:00.000Z
CVE-2007-5699 
Stack-based buffer overflow in eIQNetworks Enterprise Security Analyzer (ESA) 2.5 allows remote attackers to execute arbitrary code via certain data on TCP port 10616 that results in a long argument to the SEARCHREPORT command, a different vector than CVE-2007-2059.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T21:00:00.000Z
CVE-2007-5700 
The Evaluate LotusScript method in IBM Lotus Domino before 7.0.3 uses an incorrect security context for @ formula commands in some circumstances, which might allow remote authenticated users to gain privileges and obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T21:00:00.000Z
CVE-2007-5701 
Incomplete blacklist vulnerability in the Certificate Authority (CA) in IBM Lotus Domino before 7.0.3 allows local users, or attackers with physical access, to obtain sensitive information (passwords) when an administrator enters a "ca activate" or "ca unlock" command with any uppercase character, which bypasses a blacklist designed to suppress password logging, resulting in cleartext password disclosure in the console log and Admin panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T21:00:00.000Z
CVE-2007-5702 
Cross-site scripting (XSS) vulnerability in swamp/action/LoginActions (aka the login box) in the Novell OpenSUSE SWAMP Workflow Administration and Management Platform 1.x allows remote attackers to inject arbitrary web script or HTML via the username parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T22:00:00.000Z
CVE-2007-5703 
Multiple cross-site scripting (XSS) vulnerabilities in (1) Request-spk.xuda and (2) Add-msie-request.xuda in RSA KEON Registration Authority Web Interface 1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T22:00:00.000Z
CVE-2007-5704 
Multiple SQL injection vulnerabilities in CodeWidgets.com Online Event Registration Template allow remote attackers to execute arbitrary SQL commands via the (1) Email Address and (2) Password fields in (a) login.asp and (b) admin_login.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T22:00:00.000Z
CVE-2007-5705 
Unspecified vulnerability in the Settings component in the administration system in Jeebles Directory 2.9.60 allows remote authenticated administrators to execute arbitrary PHP code via unspecified vectors related to settings.inc.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T22:00:00.000Z
CVE-2007-5706 
Absolute path traversal vulnerability in download.php in Jeebles Directory 2.9.60 allows remote attackers to read arbitrary files via a full pathname in the query string.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T22:00:00.000Z
CVE-2007-5707 
OpenLDAP before 2.3.39 allows remote attackers to cause a denial of service (slapd crash) via an LDAP request with a malformed objectClasses attribute.  NOTE: this has been reported as a double free, but the reports are inconsistent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T19:00:00.000Z
CVE-2007-5708 
slapo-pcache (overlays/pcache.c) in slapd in OpenLDAP before 2.3.39, when running as a proxy-caching server, allocates memory using a malloc variant instead of calloc, which prevents an array from being initialized properly and might allow attackers to cause a denial of service (segmentation fault) via unknown vectors that prevent the array from being null terminated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T19:00:00.000Z
CVE-2007-5709 
Stack-based buffer overflow in Sony SonicStage CONNECT Player (CP) 4.3 allows remote attackers to execute arbitrary code via a long file name in an M3U file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T19:00:00.000Z
CVE-2007-5710 
Cross-site scripting (XSS) vulnerability in wp-admin/edit-post-rows.php in WordPress 2.3 allows remote attackers to inject arbitrary web script or HTML via the posts_columns array parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T19:00:00.000Z
CVE-2007-5711 
Massive Entertainment World in Conflict 1.001 and earlier allows remote attackers to cause a denial of service (failed assertion and daemon crash) via a large packet to TCP or UDP port 48000.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T19:00:00.000Z
CVE-2007-5712 
The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows remote attackers to cause a denial of service (memory consumption) via many HTTP requests with large Accept-Language headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T19:00:00.000Z
CVE-2007-5713 
Off-by-one error in the GeoIP module in the AMX Mod X 1.76d plugin for Half-Life Server might allow attackers to execute arbitrary code or cause a denial of service via unspecified input related to geolocation, which triggers an error message from the (1) geoip_code2 or (2) geoip_code3 function, leading to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T19:00:00.000Z
CVE-2007-5714 
The Gentoo ebuild of MLDonkey before 2.9.0-r3 has a p2p user account with an empty default password and valid login shell, which might allow remote attackers to obtain login access and execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T19:00:00.000Z
CVE-2007-5715 
DenyHosts 2.6 processes OpenSSH sshd "not listed in AllowUsers" log messages with an incorrect regular expression that does not match an IP address, which might allow remote attackers to avoid detection and blocking when making invalid login attempts with a username not present in AllowUsers, as demonstrated by the root username, a different vulnerability than CVE-2007-4323.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T19:00:00.000Z
CVE-2007-5716 
Unspecified vulnerability in the Internet Protocol (IP) functionality in Sun Solaris 10 allows local users to cause a denial of service (panic) via unspecified vectors, probably related to a UDP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T21:00:00.000Z
CVE-2007-5717 
Unspecified vulnerability in Sun Fire X2100 M2 and X2200 M2 Embedded Lights Out Manager (ELOM) on x86 before firmware 2.70 allows remote attackers to execute arbitrary commands as root on the Service Processor (SP) via unspecified vectors, a different vulnerability than CVE-2007-5170.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T21:00:00.000Z
CVE-2007-5718 
vobcopy 0.5.14 allows local users to append data to an arbitrary file, or create an arbitrary new file, via a symlink attack on the (1) /tmp/vobcopy.bla or (2) /tmp/vobcopy_0.5.14.log temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T21:00:00.000Z
CVE-2007-5719 
SQL injection vulnerability in bb_func_search.php in miniBB 2.1 allows remote attackers to execute arbitrary SQL commands via the table parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T21:00:00.000Z
CVE-2007-5720 
Unrestricted file upload vulnerability in the profiles script in ProfileCMS 1.0 allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors involving creation of a profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T21:00:00.000Z
CVE-2007-5721 
PHP remote file inclusion vulnerability in _theme/breadcrumb.php in MySpacePros MySpace Resource Script (MSRS) 1.21 allows remote attackers to execute arbitrary PHP code via a URL in the rootBase parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T21:00:00.000Z