rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-4375 
The administrative interface (aka DkService.exe) in Diskeeper 9 Professional, 2007 Pro Premier, and probably other versions exposes a memory comparison function via RPC over TCP, which allows remote attackers to (1) obtain sensitive information (process memory contents), as demonstrated by an attack that obtains module base addresses to defeat Address Space Layout Randomization (ASLR); or (2) cause a denial of service (application crash) via an out-of-bounds address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-16T18:00:00.000Z
CVE-2007-4376 
Unrestricted file upload vulnerability in banner-upload.php in Szymon Kosok Best Top List allows remote attackers to upload and execute arbitrary PHP files in banners/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-16T18:00:00.000Z
CVE-2007-4377 
Stack-based buffer overflow in the IMAP service in SurgeMail 38k allows remote authenticated users to execute arbitrary code via a long argument to the SEARCH command.  NOTE: this might overlap CVE-2007-4372.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-16T18:00:00.000Z
CVE-2007-4378 
Multiple format string vulnerabilities in Babo Violent 2 2.08.00 and earlier allow remote attackers to execute arbitrary code via format string specifiers in (1) a message or (2) certain data associated with an admin login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-16T18:00:00.000Z
CVE-2007-4379 
Babo Violent 2 2.08.00 and earlier allows remote attackers to cause a denial of service (application crash) via (1) a value greater than 0x27 for the (a) 0xca, (b) 0xcb, (c) 0xcc, (d) 0xce, (e) 0xcf, or (f) 0xd0 data ID; (2) a nonexistent map name; or (3) a UDP packet that specifies a large data size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-16T18:00:00.000Z
CVE-2007-4380 
Aclient in Symantec Altiris Deployment Solution 6 before 6.8 SP2 (6.8.378) allows local users to gain local System privileges via the Log File Viewer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-16T18:00:00.000Z
CVE-2007-4381 
Unspecified vulnerability in the font parsing implementation in Sun JDK and JRE 5.0 Update 9 and earlier, and SDK and JRE 1.4.2_14 and earlier, allows remote attackers to perform unauthorized actions via an applet that grants certain privileges to itself.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-17T21:12:00.000Z
CVE-2007-4382 
CounterPath X-Lite 3.0 34025, and possibly eyeBeam, allows remote attackers to cause a denial of service (device crash) via a SIP INVITE message without a Content-Type header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-17T21:12:00.000Z
CVE-2007-4383 
PHP remote file inclusion vulnerability in tracking.php in Trackeur 1 allows remote attackers to execute arbitrary PHP code via a URL in the header parameter.  NOTE: CVE and a third party dispute this vulnerability because header is defined before use.  The researcher is known to be unreliable
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-17T21:12:00.000Z
CVE-2007-4384 
Multiple PHP remote file inclusion vulnerabilities in depouilg.php3 in Stephane Pineau VOTE 1c allow remote attackers to execute arbitrary PHP code via a URL in the (1) NomVote and (2) FilePalHex parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-17T21:12:00.000Z
CVE-2007-4385 
OWASP Stinger before 2.5 allows remote attackers to bypass input validation routines by using multipart encoded requests instead of form-urlencoded requests.  NOTE: this might be used to expose vulnerabilities in applications that would otherwise be protected by the validation routines.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-17T21:12:00.000Z
CVE-2007-4386 
SQL injection vulnerability in search.php in GetMyOwnArcade allows remote attackers to execute arbitrary SQL commands via the query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-17T22:00:00.000Z
CVE-2007-4387 
Cross-site request forgery (CSRF) vulnerability in /xslt in 2wire 1701HG and 2071 Gateway routers, with 3.17.5 and 5.29.51 software, allows remote attackers to perform certain configuration changes as administrators.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-17T22:00:00.000Z
CVE-2007-4388 
2wire 1701HG and 2071 Gateway routers, with 5.29.51 and possibly 3.17.5 software, have a blank password by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-17T22:00:00.000Z
CVE-2007-4389 
Cross-site request forgery (CSRF) vulnerability in /xslt in 2wire 1701HG, 1800HW, and 2071 Gateway routers, with 3.17.5, 3.7.1, and 5.29.51 software, allows remote attackers to create DNS mappings as administrators, and conduct DNS poisoning attacks, via the NAME and ADDR parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-17T22:00:00.000Z
CVE-2007-4390 
The Command Line Interface (CLI), aka Adonis Administration Console, on the BlueCat Networks Adonis DNS/DHCP appliance 5.0.2.8 allows local admin users to gain root privileges on the underlying operating system via shell metacharacters in a command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-17T22:00:00.000Z
CVE-2007-4391 
Heap-based buffer overflow in Kakadu kdu_v32m.dll in Yahoo! Messenger 8.1.0.413 allows remote attackers to cause a denial of service (application crash) via a certain length field in JPEG2000 data, as demonstrated by sending an "invite to view my webcam" request, and then injecting a DLL into the attacker's peer Yahoo! Messenger application when this request is accepted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-17T22:00:00.000Z
CVE-2007-4392 
Winamp 5.35 allows remote attackers to cause a denial of service (program stack overflow and application crash) via an M3U file that recursively includes itself.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-17T22:00:00.000Z
CVE-2007-4393 
The installation script for orarun on SUSE Linux before 20070810 places the oracle user into the disk group, which allows the local oracle user to read or write raw disk partitions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-17T22:00:00.000Z
CVE-2007-4394 
Unspecified vulnerability in a "core clean" cron job created by the findutils-locate package on SUSE Linux 10.0 and 10.1 and Enterprise Server 9 and 10 before 20070810 allows local users to delete of arbitrary files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-17T22:00:00.000Z
CVE-2007-4395 
Multiple unspecified vulnerabilities in the Role Based Access Control (RBAC) functionality in Sun Solaris 8 allow remote attackers who know the password for a role to gain privileges via that role.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-17T23:00:00.000Z
CVE-2007-4396 
Multiple CRLF injection vulnerabilities in (1) ixmmsa.pl 0.3, (2) l33tmusic.pl 2.00, (3) mpg123.pl 0.01, (4) ogg123.pl 0.01, (5) xmms.pl 2.0, (6) xmms2.pl 1.1.3, and (7) xmmsinfo.pl 1.1.1.1 scripts for irssi before 0.8.11 allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4397 
Multiple CRLF injection vulnerabilities in (1) xmms-thing 1.0, (2) XMMS Remote Control Script 1.07, (3) Disrok 1.0, (4) a2x 0.0.1, (5) Another xmms-info script 1.0, (6) XChat-XMMS 0.8.1, and other unspecified scripts for XChat allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4398 
Multiple CRLF injection vulnerabilities in the (1) now-playing.rb and (2) xmms.pl 1.1 scripts for WeeChat allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4399 
CRLF injection vulnerability in the xmms.bx 1.0 script for BitchX allows user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4400 
CRLF injection vulnerability in the included media script in Konversation allows user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4401 
Multiple CRLF injection vulnerabilities in the Advanced mIRC Integration Plugin and possibly other unspecified scripts in mIRC allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4402 
Multiple unspecified scripts in mIRC allow user-assisted remote attackers to execute arbitrary code via the '|' (pipe) shell metacharacter in the name of the song in a .mp3 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4403 
The mIRC Control Plug-in for Winamp allows user-assisted remote attackers to execute arbitrary code via the '|' (pipe) shell metacharacter in the name of the song in a .mp3 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4404 
ircu 2.10.12.01 allows remote attackers to (1) cause a denial of service (flood wallops) by joining two channels with certain long names that differ in the final character, which triggers a protocol violation and (2) cause a denial of service (daemon crash) via a "J 0:#channel" message on a channel without an apass; and (3) allows remote authenticated operators to cause a denial of service (daemon crash) via a remote "names -D" command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4405 
ircu 2.10.12.02 through 2.10.12.04 allows remote attackers to cause a denial of service (memory and bandwidth consumption) by creating a large number of unused channels (zannels).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4406 
ircu 2.10.12.01 through 2.10.12.04 does not remove ops privilege after a join from a server with an older timestamp (TS), which allows remote attackers to gain control of a channel during a split.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4407 
ircu 2.10.12.03 and 2.10.12.04 does not associate a timestamp with ops privilege on an unused channel (zannel), which allows remote attackers to (1) set or remove certain channel modes via a "netriding" attack or (2) take over a channel by joining an unlinked server with the A/Upass and then setting a new Apass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4408 
ircu 2.10.12.05 and earlier ignores timestamps in bounces, which allows remote attackers to take over a channel during a netjoin by causing a bounce while a server with an older version of the channel is linking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4409 
Race condition in ircu 2.10.12.01 through 2.10.12.05 allows remote attackers to set a new Apass during a netburst by arranging for ops privilege to be granted before the mode arrives.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4410 
ircu 2.10.12.05 and earlier does not properly synchronize a kick action in certain cross scenarios, which allows remote authenticated operators to prevent later kick or de-op actions from non-local ops.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4411 
ircu 2.10.12.05 and earlier allows remote attackers to discover the hidden IP address of arbitrary +x users via a series of /silence commands with (1) CIDR mask arguments or (2) certain other arguments that represent groups of IP addresses, then monitoring CTCP ping replies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4412 
Multiple cross-site scripting (XSS) vulnerabilities in Headstart Solutions DeskPRO 3.0.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters to (1) techs.php, (2) ticket_category.php, (3) ticket_priority.php, (4) ticket_workflow.php, (5) ticket_escalate.php, (6) fields_ticket.php, (7) ticket_rules_web.php, (8) ticket_displayfields.php, (9) ticket_rules_mail.php, (10) fields_user.php, (11) fields_faq.php, and (12) user_help.php, in (a) admincp/ and (b) possibly a directory on the "User side."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4413 
Direct static code injection vulnerability in admincp/user_help.php in Headstart Solutions DeskPRO 3.0.2 allows remote authenticated users to inject arbitrary PHP code into an unspecified file via a new_entry value in the do parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4414 
Cisco VPN Client on Windows before 4.8.02.0010 allows local users to gain privileges by enabling the "Start Before Logon" (SBL) and Microsoft Dial-Up Networking options, and then interacting with the dial-up networking dialog box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4415 
Cisco VPN Client on Windows before 5.0.01.0600, and the 5.0.01.0600 InstallShield (IS) release, uses weak permissions for cvpnd.exe (Modify granted to Interactive Users), which allows local users to gain privileges via a modified cvpnd.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4416 
captcha.php in BellaBook (aka BellaBuffs) allows remote attackers to obtain administrative privileges by sending the admin's username (admin_name) in a pheap_login cookie.  NOTE: the vendor disputes this vulnerability because authentication data is derived from the admin_pass and secret variables, in addition to the admin_name; and because the exploit code is designed for an unrelated application
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4417 
IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 does not properly revoke privileges on methods, which allows remote authenticated users to execute a method after revocation until the routine auth cache is flushed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4418 
IBM DB2 UDB 8 before Fixpak 15 does not properly check authorization, which allows remote authenticated users with a certain SELECT privilege to have an unknown impact via unspecified vectors.  NOTE: this issue is probably related to CVE-2007-1089, but this is uncertain due to lack of details.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4419 
Admin.php in Olate Download (od) 3.4.1 uses an MD5 hash of the admin username, user id, and group id, to compose the OD3_AutoLogin authentication cookie, which makes it easier for remote attackers to guess the cookie and access the Admin area.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4420 
Absolute path traversal vulnerability in a certain ActiveX control in officeviewer.ocx 5.1.199.1 in EDraw Office Viewer Component 5.1 allows remote attackers to create or overwrite arbitrary files via a full pathname in the second argument to the HttpDownloadFile method, a different vulnerability than CVE-2007-3168 and CVE-2007-3169.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4421 
SQL injection vulnerability in Admin.php in Olate Download (od) 3.4.1 allows remote attackers to execute arbitrary SQL commands via an OD3_AutoLogin cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4422 
The login interface in Symantec Enterprise Firewall 6.x, when a VPN with pre-shared key (PSK) authentication is enabled, generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4423 
Stack-based buffer overflow in the AUTH_LIST_GROUPS_FOR_AUTHID function in IBM DB2 UDB 9.1 before Fixpak 3 allows attackers to cause a denial of service and possibly execute arbitrary code via a long argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T21:00:00.000Z
CVE-2007-4424 
Apple Safari for Windows 3.0.3 and earlier does not prompt the user before downloading a file, which allows remote attackers to download arbitrary files to the desktop of a client system via certain HTML, as demonstrated by a filename in the DATA attribute of an OBJECT element. NOTE: it could be argued that this is not a vulnerability because a dangerous file is not actually launched, but as of 2007, it is generally accepted that web browsers should prompt users before saving dangerous content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-18T22:00:00.000Z
CVE-2007-4425 
Multiple buffer overflows in Live for Speed (LFS) demo, S1, and S2 allow remote authenticated users to (1) cause a denial of service (server crash) and probably execute arbitrary code via an ID 3 packet with a long nickname field, and (2) cause a denial of service (server crash) via an ID 10 packet containing a long string corresponding to an unavailable track.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-20T18:00:00.000Z
CVE-2007-4426 
Live for Speed (LFS) S1 and S2 allows remote attackers to cause a denial of service (server crash) via (1) a certain 0x00 byte in a pre-login ID 3 packet, which triggers a NULL dereference; or (2) a pre-login ID 5 packet that lacks certain strings, which triggers an invalid pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-20T18:00:00.000Z
CVE-2007-4427 
Unspecified vulnerability in the login page redirection logic in the Cache' Server Page (CSP) implementation in InterSystems Cache' 2007.1.0.369.0 and 2007.1.1.420.0 allows remote authenticated users to modify data on a server, related to encoding of certain parameter values by this redirection logic, aka MAK2116.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-20T19:00:00.000Z
CVE-2007-4428 
Lhaz 1.33 allows remote attackers to execute arbitrary code via unknown vectors, as actively exploited in August 2007 by the Exploit-LHAZ.a gzip file, a different issue than CVE-2006-4116.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-20T19:00:00.000Z
CVE-2007-4429 
Unspecified vulnerability in Skype allows remote attackers to cause a denial of service (server hang) via unknown vectors related to sending long URIs, as claimed to be actively exploited on 20070817 using a "call to a specific number."  NOTE: this identifier is for the en.securitylab.ru disclosure.  According to the vendor, this issue is separate from the "sign-on issues" that reduced Skype service on 20070817, which appears to be a site-specific problem.  As of 20070821, it is not clear whether this issue is simply a symptom of the larger sign-on problem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-20T19:00:00.000Z
CVE-2007-4430 
Unspecified vulnerability in Cisco IOS 12.0 through 12.4 allows context-dependent attackers to cause a denial of service (device restart and BGP routing table rebuild) via certain regular expressions in a "show ip bgp regexp" command.  NOTE: unauthenticated remote attacks are possible in environments with anonymous telnet and Looking Glass access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-20T19:00:00.000Z
CVE-2007-4431 
Cross-domain vulnerability in Apple Safari for Windows 3.0.3 and earlier allows remote attackers to bypass the Same Origin Policy, with access from local zones to external domains, via a certain body.innerHTML property value, aka "classic JavaScript frame hijacking."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-20T19:00:00.000Z
CVE-2007-4432 
Untrusted search path vulnerability in the wrapper scripts for the (1) rug, (2) zen-updater, (3) zen-installer, and (4) zen-remover programs on SUSE Linux 10.1 and Enterprise 10 allows local users to gain privileges via modified (a) LD_LIBRARY_PATH and (b) MONO_GAC_PREFIX environment variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-20T19:00:00.000Z
CVE-2007-4433 
Cross-site scripting (XSS) vulnerability in textfilesearch.aspx in the Text File Search ASP.NET edition allows remote attackers to inject arbitrary web script or HTML via the search field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-20T19:00:00.000Z
CVE-2007-4434 
Cross-site scripting (XSS) vulnerability in textfilesearch.asp in the Text File Search ASP (Classic) edition allows remote attackers to inject arbitrary web script or HTML via the query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-20T19:00:00.000Z
CVE-2007-4435 
Multiple SQL injection vulnerabilities in TorrentTrader before 1.07 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) account-inbox.php, (2) account-settings.php, and possibly (3) backend/functions.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-20T22:00:00.000Z
CVE-2007-4436 
The Drupal Project module before 5.x-1.0, 4.7.x-2.3, and 4.7.x-1.3 and Project issue tracking module before 5.x-1.0, 4.7.x-2.4, and 4.7.x-1.4 do not properly enforce permissions, which allows remote attackers to (1) obtain sensitive via the Tracker Module and the Recent posts page; (2) obtain project names via unspecified vectors; (3) obtain sensitive information via the statistics pages; and (4) read CVS project activity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-20T22:00:00.000Z