rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-2497 
Multiple cross-site scripting (XSS) vulnerabilities in AspBB 0.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter to default.asp or (2) get parameter to profile.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-20T02:59:00.000Z
CVE-2006-2498 
Invision Power Board (IPB) before 2.1.6 allows remote attackers to execute arbitrary PHP script via attack vectors involving (1) the post_icon variable in classes/post/class_post.php and (2) the df value in action_public/moderate.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-20T02:59:00.000Z
CVE-2006-2499 
SQL injection vulnerability in default.asp in CodeAvalanche News (CANews) 1.2 allows remote attackers to execute arbitrary SQL commands via the password field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-20T02:59:00.000Z
CVE-2006-2500 
Cross-site scripting (XSS) vulnerability in add_news.asp in CodeAvalanche News (CANews) 1.2 allows remote attackers to inject arbitrary web script or HTML via the Headline field.  NOTE: if this issue is limited to administrators, and if it is expected behavior for administrators to be able to generate HTML, then this is not a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-20T02:59:00.000Z
CVE-2006-2501 
Cross-site scripting (XSS) vulnerability in Sun ONE Web Server 6.0 SP9 and earlier, Java System Web Server 6.1 SP4 and earlier, Sun ONE Application Server 7 Platform and Standard Edition Update 6 and earlier, and Java System Application Server 7 2004Q2 Standard and Enterprise Edition Update 2 and earlier, allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, possibly involving error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-20T02:59:00.000Z
CVE-2006-2502 
Stack-based buffer overflow in pop3d in Cyrus IMAPD (cyrus-imapd) 2.3.2, when the popsubfolders option is enabled, allows remote attackers to execute arbitrary code via a long USER command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T16:00:00.000Z
CVE-2006-2503 
SQL injection vulnerability in misc.php in DeluxeBB 1.06 allows remote attackers to execute arbitrary SQL commands via the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T19:00:00.000Z
CVE-2006-2504 
Multiple SQL injection vulnerabilities in mono AZBOARD 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) search and (2) cate parameters to (a) list.asp, and the (3) id and cate parameters to (b) admin_ok.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T19:00:00.000Z
CVE-2006-2505 
Oracle Database Server 10g Release 2 allows local users to execute arbitrary SQL queries via a reference to a malicious package in the TYPE_NAME argument in the (1) GET_DOMAIN_INDEX_TABLES or (2) GET_V2_DOMAIN_INDEX_TABLES function in the DBMS_EXPORT_EXTENSION package.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T19:00:00.000Z
CVE-2006-2506 
Multiple cross-site scripting (XSS) vulnerabilities in search.php in Sphider allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO and (2) the category parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T19:00:00.000Z
CVE-2006-2507 
Multiple PHP remote file inclusion vulnerabilities in Teake Nutma Foing 0.2.0 through 0.7.0, as used with phpBB, allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) index.php, (2) song.php, (3) faq.php, (4) list.php, (5) gen_m3u.php, and (6) playlist.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T19:00:00.000Z
CVE-2006-2508 
SQL injection vulnerability in tr1.php in YourFreeWorld.com Stylish Text Ads Script allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly involving an attack vector using advertise.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T19:00:00.000Z
CVE-2006-2509 
SQL injection vulnerability in login.php in YourFreeWorld.com Short Url & Url Tracker Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T19:00:00.000Z
CVE-2006-2510 
Cross-site scripting (XSS) vulnerability in the URL submission form in YourFreeWorld.com Short Url & Url Tracker Script allows remote attackers to inject arbitrary web script or HTML via an unspecified form for submitting URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T19:00:00.000Z
CVE-2006-2511 
The ActiveX version of FrontRange iHEAT allows remote authenticated users to run arbitrary programs or access arbitrary files on the host machine by uploading a file with an extension that is not associated with an application, and selecting a file from the "Open With..." dialog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T19:00:00.000Z
CVE-2006-2512 
SQL injection vulnerability in Hitachi EUR Professional Edition, EUR Viewer, EUR Print Service, and EUR Print Service for ILF allows remote authenticated users to execute arbitrary SQL commands via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T21:00:00.000Z
CVE-2006-2513 
Unspecified vulnerability in the installation process in Sun Java System Directory Server 5.2 causes wrong user data to be written to a file created by the installation, which allows remote attackers or local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T21:00:00.000Z
CVE-2006-2514 
Coppermine galleries before 1.4.6, when running on Apache with mod_mime installed, allows remote attackers to upload arbitrary files via a filename with multiple file extensions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T22:00:00.000Z
CVE-2006-2515 
Cross-site scripting (XSS) vulnerability in index.php in Hiox Guestbook 3.1 allows remote attackers to inject arbitrary web script or HTML via the input forms for signing the guestbook.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T22:00:00.000Z
CVE-2006-2516 
mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon'] and conduct directory traversal attacks or include PHP files via (1) xoopsConfig[language] to misc.php or (2) xoopsConfig[theme_set] to index.php, as demonstrated by injecting PHP sequences into a log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T22:00:00.000Z
CVE-2006-2517 
SQL injection vulnerability in MyWeb Portal Office, Standard Edition, Public Edition, Medical Edition, Citizen Edition, School Edition, and Light Edition allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T22:00:00.000Z
CVE-2006-2518 
Cross-site scripting (XSS) vulnerability in phpwcms 1.2.5-DEV allows remote attackers to inject arbitrary web script or HTML via the BL[be_cnt_plainhtml] parameter to include/inc_tmpl/content/cnt6.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T22:00:00.000Z
CVE-2006-2519 
Directory traversal vulnerability in include/inc_ext/spaw/spaw_control.class.php in phpwcms 1.2.5-DEV allows remote attackers to include arbitrary local files via .. (dot dot) sequences in the spaw_root parameter.  NOTE: CVE analysis suggests that this issue is actually in SPAW Editor PHP Edition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T22:00:00.000Z
CVE-2006-2520 
Directory traversal vulnerability in BitZipper 4.1.2 SR-1 and earlier allows remote attackers to create files in arbitrary directories via a ..  (dot dot) in the filename of a file that is stored in a (1) RAR (.rar), (2) TAR (.tar), (3) ZIP (.zip), (4) GZ (.gz), or (5) JAR (.jar) archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T22:00:00.000Z
CVE-2006-2521 
PHP remote file inclusion vulnerability in cron.php in phpMyDirectory 10.4.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ROOT_PATH parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T22:00:00.000Z
CVE-2006-2522 
Dayfox Blog 2.0 and earlier stores user credentials in edit/slog_users.txt under the web document root with insufficient access control, which allows remote attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T22:00:00.000Z
CVE-2006-2523 
PHP remote file inclusion vulnerability in config.php in phpListPro 2.0.1 and earlier, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary PHP code via a URL in the Language cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T22:00:00.000Z
CVE-2006-2524 
Cross-site scripting (XSS) vulnerability in UseBB 1.0 RC1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when processing the user date format.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T22:00:00.000Z
CVE-2006-2525 
SQL injection vulnerability in UseBB 1.0 RC1 and earlier allows remote attackers to execute arbitrary SQL commands via the member list search module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T22:00:00.000Z
CVE-2006-2526 
PHP remote file inclusion vulnerability in index.php in PHP Easy Galerie 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the includepath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T22:00:00.000Z
CVE-2006-2527 
Admin/admin.php in phpBazar 2.1.0 and earlier allows remote attackers to bypass the authentication process and gain unauthorized access to the administrative section by setting the action parameter to edit_member and the value parameter to 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T22:00:00.000Z
CVE-2006-2528 
PHP remote file inclusion vulnerability in classified_right.php in phpBazar 2.1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the language_dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T22:00:00.000Z
CVE-2006-2529 
editor/filemanager/upload/php/upload.php in FCKeditor before 2.3 Beta, when the upload feature is enabled, does not verify the Type parameter, which allows remote attackers to upload arbitrary file types.  NOTE: It is not clear whether this is related to CVE-2006-0658.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T23:00:00.000Z
CVE-2006-2530 
avatar_upload.asp in Avatar MOD 1.3 for Snitz Forums 3.4, and possibly other versions, allows remote attackers to bypass file type checks and upload arbitrary files via a null byte in the file name, as discovered by the Codescan product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T23:00:00.000Z
CVE-2006-2531 
Ipswitch WhatsUp Professional 2006 only verifies the user's identity via HTTP headers, which allows remote attackers to spoof being a trusted console and bypass authentication by setting HTTP User-Agent header to "Ipswitch/1.0" and the User-Application header to "NmConsole".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T23:00:00.000Z
CVE-2006-2532 
stats.php in Destiney Rated Images Script 0.5.0 allows remote attackers to obtain the installation path via an invalid s parameter, which displays the path in an error message.  NOTE: this issue was originally claimed to be SQL injection, but CVE analysis shows that the problem is related to an invalid value that prevents some variables from being set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T23:00:00.000Z
CVE-2006-2533 
Cross-site scripting (XSS) vulnerability in (1) addWeblog.php and (2) leaveComments.php in Destiney Rated Images Script 0.5.0 does not properly filter all vulnerable HTML tags, which allows remote attackers to inject arbitrary web script or HTML via Javascript in a DIV tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T23:00:00.000Z
CVE-2006-2534 
Destiney Links Script 2.1.2 does not protect library and other support files, which allows remote attackers to obtain the installation path via a direct URL to files in the (1) include and (2) themes/original directories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T23:00:00.000Z
CVE-2006-2535 
index.php in Destiney Links Script 2.1.2 allows remote attackers to obtain the installation path via an invalid show parameter referencing a non-existent file, which reveals the path in the resulting error message.  NOTE: this issue might be resultant from a more serious issue such as directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T23:00:00.000Z
CVE-2006-2536 
Cross-site scripting (XSS) vulnerability in Destiney Links Script 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the (1) "Search" (term parameter in index.php) and (2) "Add a Site" (add.php) fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T23:00:00.000Z
CVE-2006-2537 
Multiple format string vulnerabilities in (a) OpenBOR 2.0046 and earlier, (b) Beats of Rage (BOR) 1.0029 and earlier, and (c) Horizontal Shooter BOR (HOR) 2.0000 and earlier allow remote attackers to execute code via format string specifiers in configurations used in various mod files, as demonstrated by the (1) music identifier in data/scenes/intro.txt, which is not properly handled in the update function, and (2) background identifier in data/easy/1aeasy.txt, which is not properly handled in the shutdown function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T23:00:00.000Z
CVE-2006-2538 
IE Tab 1.0.9 plugin for Mozilla Firefox 1.5.0.3 allows remote user-assisted attackers to cause a denial of service (application crash), possibly due to a null dereference, via certain Javascript, as demonstrated using a url parameter to the content/reloaded.html page in a chrome:// URI.  Some third-party researchers claim that they are unable to reproduce this vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T23:00:00.000Z
CVE-2006-2539 
Sybase EAServer 5.0 for HP-UX Itanium, 5.2 for IBM AIX, HP-UX PA-RISC, Linux x86, and Sun Solaris SPARC, and 5.3 for Sun Solaris SPARC does not properly protect passwords when they are being entered via the GUI, which allows local users to obtain the cleartext passwords via the getSelectedText function in javax.swing.JPasswordField component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-22T23:00:00.000Z
CVE-2006-2540 
Privacy leak in install.php for Diesel PHP Job Site sends sensitive information such as user credentials to an e-mail address controlled by the product developers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-23T10:00:00.000Z
CVE-2006-2541 
SQL injection vulnerability in settings.asp in Zixforum 1.12 allows remote attackers to execute arbitrary SQL commands via the layid parameter to (1) login.asp and (2) main.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-23T10:00:00.000Z
CVE-2006-2542 
xmcdconfig in xmcd for Debian GNU/Linux 2.6-17.1 creates /var/lib/cddb and /var/lib/xmcd/discog with world writable permissions, which allows local users to cause a denial of service (disk consumption).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-23T10:00:00.000Z
CVE-2006-2543 
Xtreme Topsites 1.1 allows remote attackers to trigger MySQL errors and possibly conduct SQL injection attacks via unspecified vectors in join.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-23T10:00:00.000Z
CVE-2006-2544 
Multiple SQL injection vulnerabilities in Xtreme Topsites 1.1, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the (1) searchthis parameter in lostid.php and (2) id parameter in stats.php.  NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-23T10:00:00.000Z
CVE-2006-2545 
Multiple cross-site scripting (XSS) vulnerabilities in Xtreme Topsites 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter in stats.php and (2) unspecified inputs in lostid.php, probably the searchthis parameter.  NOTE: one or more of these vectors might be resultant from SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-23T10:00:00.000Z
CVE-2006-2546 
A recommended admin password reset mechanism for BEA WebLogic Server 8.1, when followed before October 10, 2005, causes the administrator password to be stored in cleartext in the domain directory, which could allow attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-23T10:00:00.000Z
CVE-2006-2547 
Unspecified vulnerability in the sapdba command in SAP with Informix before 700, and 700 up to patch 100, allows local users to execute arbitrary commands via unknown vectors related to "insecure environment variable" handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-23T10:00:00.000Z
CVE-2006-2548 
Prodder before 0.5, and perlpodder before 0.5, allows remote attackers to execute arbitrary code via shell metacharacters in the URL of a podcast (url attribute of an enclosure tag, or $enc_url variable), which is executed when running wget.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-23T10:00:00.000Z
CVE-2006-2549 
Stack-based buffer overflow in PDF Form Filling and Flattening Tool before 3.1.0.12 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via long field names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T23:00:00.000Z
CVE-2006-2550 
perlpodder before 0.5 allows remote attackers to execute arbitrary code via shell metacharacters in the URL of a podcast, which are executed when saving the URL to a log file.  NOTE: the wget vector is already covered by CVE-2006-2548.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-23T10:00:00.000Z
CVE-2006-2551 
Unspecified vulnerability in the kernel in HP-UX B.11.00 allows local users to cause an unspecified denial of service via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-23T16:00:00.000Z
CVE-2006-2552 
Jemscripts DownloadControl 1.0 allows remote attackers to obtain sensitive information via an invalid dcid parameter to dc.php, which leaks the pathname in an error message.  NOTE: this was originally claimed to be SQL injection, but it is probably resultant from another issue in functions.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T01:00:00.000Z
CVE-2006-2553 
Cross-site scripting (XSS) vulnerability in Jemscripts DownloadControl 1.0 allows remote attackers to inject arbitrary HTML or web script via the dcid parameter to dc.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. This issue appears to be independent from a different issue that involves the same vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T01:00:00.000Z
CVE-2006-2554 
Buffer overflow in the tell_player_surr_changes function in Genecys 0.2 and earlier might allow remote attackers to execute arbitrary code via long arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T01:00:00.000Z
CVE-2006-2555 
The parse_command function in Genecys 0.2 and earlier allows remote attackers to cause a denial of service (crash) via a command with a missing ":" (colon) separator, which triggers a null dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T01:00:00.000Z
CVE-2006-2556 
Cross-site scripting (XSS) vulnerability in Florian Amrhein NewsPortal before 0.37, and possibly TR Newsportal (TRanx rebuilded), allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T01:00:00.000Z
CVE-2006-2557 
PHP remote file inclusion vulnerability in extras/poll/poll.php in Florian Amrhein NewsPortal before 0.37, and TR Newsportal (TRanx rebuilded), allows remote attackers to execute arbitrary PHP code via a URL in the file_newsportal parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T01:00:00.000Z
CVE-2006-2558 
Cross-site scripting (XSS) vulnerability in IpLogger 1.7 and earlier allows remote attackers to inject arbitrary HTML or web script via the User-Agent (useragent) header in an HTTP request, which is not filtered when the log files are viewed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T01:00:00.000Z
CVE-2006-2559 
Linksys WRT54G Wireless-G Broadband Router allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T01:00:00.000Z
CVE-2006-2560 
Sitecom WL-153 router firmware before 1.38 allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T01:00:00.000Z
CVE-2006-2561 
Edimax BR-6104K router allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter (possibly within NewInternalClient), which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T01:00:00.000Z