rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-5233 
xine-lib 1.1.12, and other versions before 1.1.15, does not check for failure of malloc in circumstances including (1) the mymng_process_header function in demux_mng.c, (2) the open_mod_file function in demux_mod.c, and (3) frame_buffer allocation in the real_parse_audio_specific_data function in demux_real.c, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted media file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T01:00:00.000Z
CVE-2008-5234 
Multiple heap-based buffer overflows in xine-lib 1.1.12, and other versions before 1.1.15, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted metadata atom size processed by the parse_moov_atom function in demux_qt.c and (2) frame reading in the id3v23_interp_frame function in id3.c.  NOTE: as of 20081122, it is possible that vector 1 has not been fixed in 1.1.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T01:00:00.000Z
CVE-2008-5235 
Heap-based buffer overflow in the demux_real_send_chunk function in src/demuxers/demux_real.c in xine-lib before 1.1.15 allows remote attackers to execute arbitrary code via a crafted Real Media file. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T01:00:00.000Z
CVE-2008-5236 
Multiple heap-based buffer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted EBML element length processed by the parse_block_group function in demux_matroska.c; (2) a certain combination of sps, w, and h values processed by the real_parse_audio_specific_data and demux_real_send_chunk functions in demux_real.c; and (3) an unspecified combination of three values processed by the open_ra_file function in demux_realaudio.c.  NOTE: vector 2 reportedly exists because of an incomplete fix in 1.1.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T01:00:00.000Z
CVE-2008-5237 
Multiple integer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via (1) crafted width and height values that are not validated by the mymng_process_header function in demux_mng.c before use in an allocation calculation or (2) crafted current_atom_size and string_size values processed by the parse_reference_atom function in demux_qt.c for an RDRF_ATOM string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T01:00:00.000Z
CVE-2008-5238 
Integer overflow in the real_parse_mdpr function in demux_real.c in xine-lib 1.1.12, and other versions before 1.1.15, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted stream_name_size field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T01:00:00.000Z
CVE-2008-5239 
xine-lib 1.1.12, and other 1.1.15 and earlier versions, does not properly handle (a) negative and (b) zero values during unspecified read function calls in input_file.c, input_net.c, input_smb.c, and input_http.c, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via vectors such as (1) a file or (2) an HTTP response, which triggers consequences such as out-of-bounds reads and heap-based buffer overflows.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T01:00:00.000Z
CVE-2008-5240 
xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input value to determine the memory allocation and does not check the result for (1) the MATROSKA_ID_TR_CODECPRIVATE track entry element processed by demux_matroska.c; and (2) PROP_TAG, (3) MDPR_TAG, and (4) CONT_TAG chunks processed by the real_parse_headers function in demux_real.c; which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) or possibly execute arbitrary code via a crafted value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T01:00:00.000Z
CVE-2008-5241 
Integer underflow in demux_qt.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allows remote attackers to cause a denial of service (crash) via a crafted media file that results in a small value of moov_atom_size in a compressed MOV (aka CMOV_ATOM).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T01:00:00.000Z
CVE-2008-5242 
demux_qt.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, does not validate the count field before calling calloc for STSD_ATOM atom allocation, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted media file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T01:00:00.000Z
CVE-2008-5243 
The real_parse_headers function in demux_real.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input length value to "reindex into an allocated buffer," which allows remote attackers to cause a denial of service (crash) via a crafted value, probably an array index error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T01:00:00.000Z
CVE-2008-5244 
Unspecified vulnerability in xine-lib before 1.1.15 has unknown impact and attack vectors related to libfaad.  NOTE: due to the lack of details, it is not clear whether this is an issue in xine-lib or in libfaad.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T01:00:00.000Z
CVE-2008-5245 
xine-lib before 1.1.15 performs V4L video frame preallocation before ascertaining the required length, which has unknown impact and attack vectors, possibly related to a buffer overflow in the open_video_capture_device function in src/input/input_v4l.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T01:00:00.000Z
CVE-2008-5246 
Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow remote attackers to execute arbitrary code via vectors that send ID3 data to the (1) id3v22_interp_frame and (2) id3v24_interp_frame functions in src/demuxers/id3.c.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T01:00:00.000Z
CVE-2008-5247 
The real_parse_audio_specific_data function in demux_real.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, uses an untrusted height (aka codec_data_length) value as a divisor, which allow remote attackers to cause a denial of service (divide-by-zero error and crash) via a zero value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T01:00:00.000Z
CVE-2008-5248 
xine-lib before 1.1.15 allows remote attackers to cause a denial of service (crash) via "MP3 files with metadata consisting only of separators."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T01:00:00.000Z
CVE-2008-5249 
Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.0 through 1.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T17:00:00.000Z
CVE-2008-5250 
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.6.11, 1.12.x before 1.12.2, and 1.13.x before 1.13.3, when Internet Explorer is used and uploads are enabled, or an SVG scripting browser is used and SVG uploads are enabled, allows remote authenticated users to inject arbitrary web script or HTML by editing a wiki page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T17:00:00.000Z
CVE-2008-5252 
Cross-site request forgery (CSRF) vulnerability in the Special:Import feature in MediaWiki 1.3.0 through 1.6.10, 1.12.x before 1.12.2, and 1.13.x before 1.13.3 allows remote attackers to perform unspecified actions as authenticated users via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T17:00:00.000Z
CVE-2008-5256 
The AcquireDaemonLock function in ipcdUnix.cpp in Sun Innotek VirtualBox before 2.0.6 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/.vbox-$USER-ipc/lock temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-27T00:00:00.000Z
CVE-2008-5257 
webseald in WebSEAL 6.0.0.17 in IBM Tivoli Access Manager for e-business allows remote attackers to cause a denial of service (crash or hang) via HTTP requests, as demonstrated by a McAfee vulnerability scan.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-27T00:00:00.000Z
CVE-2008-5259 
Integer signedness error in DivX Web Player 1.4.2.7, and possibly earlier versions, allows remote attackers to execute arbitrary code via a DivX file containing a crafted Stream Format (STRF) chunk, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-16T15:00:00.000Z
CVE-2008-5260 
Heap-based buffer overflow in the CamImage.CamImage.1 ActiveX control in AxisCamControl.ocx in AXIS Camera Control 2.40.0.0 allows remote attackers to execute arbitrary code via a long image_pan_tilt property value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-26T15:05:00.000Z
CVE-2008-5262 
Multiple stack-based buffer overflows in the iGetHdrHeader function in src-IL/src/il_hdr.c in DevIL 1.7.4 allow context-dependent attackers to execute arbitrary code via a crafted Radiance RGBE file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-13T16:00:00.000Z
CVE-2008-5263 
Multiple stack-based buffer overflows in the mt_codec::getHdrHead function in kernel/kls_hdr/fmt_codec_hdr.cpp in ksquirrel-libs 0.8.0 allow context-dependent attackers to execute arbitrary code via a crafted Radiance RGBE image (aka .hdr file).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-26T16:00:00.000Z
CVE-2008-5264 
Cross-site scripting (XSS) vulnerability in searcher.exe in Tornado Knowledge Retrieval System 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the p parameter in a root action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-28T18:26:00.000Z
CVE-2008-5265 
Directory traversal vulnerability in index.php in TNT Forum 0.9.4, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the modulo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-28T18:26:00.000Z
CVE-2008-5266 
Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java System Application Server 9.1_01 build b09d-fcs and 9.1_02 build b04-fcs allows remote attackers to inject arbitrary web script or HTML via the name parameter, a different vector than CVE-2008-2751.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-28T18:26:00.000Z
CVE-2008-5267 
SQL injection vulnerability in answer.php in Experts 1.0.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the question_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-28T18:26:00.000Z
CVE-2008-5268 
SQL injection vulnerability in content/forums/reply.asp in ASPPortal allows remote attackers to execute arbitrary SQL commands via the Topic_Id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-28T18:26:00.000Z
CVE-2008-5269 
SQL injection vulnerability in index.php in pSys 0.7.0 alpha allows remote attackers to execute arbitrary SQL commands via the shownews parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-28T18:26:00.000Z
CVE-2008-5270 
SQL injection vulnerability in view.topics.php in Yuhhu Superstar 2008 allows remote attackers to execute arbitrary SQL commands via the board parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-28T18:26:00.000Z
CVE-2008-5271 
Cross-site scripting (XSS) vulnerability in index.php in Fred Stuurman SyndeoCMS 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the section parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-28T18:26:00.000Z
CVE-2008-5272 
Multiple directory traversal vulnerabilities in Fred Stuurman SyndeoCMS 2.6.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the template parameter to (1) starnet/editors/fckeditor/studenteditor.php; (2) starnet/modules/sn_news/edit_content.php, reached through starnet/index.php; and (3) starnet/modules/sn_newsletter/edit_content.php, reached through starnet/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-28T18:26:00.000Z
CVE-2008-5273 
SQL injection vulnerability in viewnews.asp in Todd Woolums ASP News Management 2.2 allows remote attackers to execute arbitrary SQL commands via the newsID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-28T18:26:00.000Z
CVE-2008-5274 
Todd Woolums ASP News Management 2.2 allows remote attackers to obtain news items via a direct request to (1) rss.asp, (2) viewheadings.asp, or (3) viewnews.asp.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-28T18:26:00.000Z
CVE-2008-5275 
Multiple directory traversal vulnerabilities in the (a) "Unzip archive" and (b) "Upload files and archives" functionality in net2ftp 0.96 stable and 0.97 beta allow remote attackers to create, read, or delete arbitrary files via a .. (dot dot) in a filename within a (1) TAR or (2) ZIP archive.  NOTE: this can be leveraged for code execution by creating a .php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-28T18:26:00.000Z
CVE-2008-5276 
Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows remote attackers to execute arbitrary code via a malformed RealMedia (.rm) file that triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-03T17:00:00.000Z
CVE-2008-5277 
PowerDNS before 2.9.21.2 allows remote attackers to cause a denial of service (daemon crash) via a CH HINFO query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-09T00:00:00.000Z
CVE-2008-5278 
Cross-site scripting (XSS) vulnerability in the self_link function in in the RSS Feed Generator (wp-includes/feed.php) for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header (HTTP_HOST variable).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-28T19:00:00.000Z
CVE-2008-5279 
The Local ZIM Server (zcs.exe) in Zilab Chat and Instant Messaging (ZIM) Server 2.1 and earlier allow remote attackers to execute arbitrary code via (1) heap-based buffer overflows involving multiple vectors including a long room name and a long source account, and (2) a stack-based buffer overflow with a long username in an information request.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-29T02:00:00.000Z
CVE-2008-5280 
The Local ZIM Server in Zilab Chat and Instant Messaging (ZIM) Server 2.0 and 2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted requests without required parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-29T02:00:00.000Z
CVE-2008-5281 
Heap-based buffer overflow in Titan FTP Server 6.05 build 550 allows remote attackers to execute arbitrary code via a long DELE command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-29T02:00:00.000Z
CVE-2008-5282 
Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0.1 allow remote attackers to execute arbitrary code via (1) a link with a long HREF attribute, and (2) a DIV tag with a long id attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-29T02:00:00.000Z
CVE-2008-5283 
Google Hack Honeypot (GHH) File Upload Manager 1.3 allows remote attackers to delete uploaded files via unknown vectors related to the delall action to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. CVE analysis suggests that the most recent version as of 20081128 is 1.2, and the File Upload Manager does not have a "delall" action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-29T02:00:00.000Z
CVE-2008-5284 
The web server in IEA Software RadiusNT and RadiusX 5.1.38 and other versions before 5.1.44, Emerald 5.0.49 and other versions before 5.0.52, Air Marshal 2.0.4 and other versions before 2.0.8, and Radius test client (aka Radlogin) 4.0.20 and earlier, allows remote attackers to cause a denial of service (crash) via an HTTP Content-Length header with a negative value, which triggers a single byte overwrite of memory using a NULL terminator.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-29T02:00:00.000Z
CVE-2008-5285 
Wireshark 1.0.4 and earlier allows remote attackers to cause a denial of service via a long SMTP request, which triggers an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T15:00:00.000Z
CVE-2008-5286 
Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17 through 1.3.9 allows remote attackers to execute arbitrary code via a PNG image with a large height value, which bypasses a validation check and triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T15:00:00.000Z
CVE-2008-5287 
SQL injection vulnerability in catagorie.php in Werner Hilversum FAQ Manager 1.2 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T15:00:00.000Z
CVE-2008-5288 
PHP remote file inclusion vulnerability in include/header.php in Werner Hilversum FAQ Manager 1.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the config_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T15:00:00.000Z
CVE-2008-5289 
SQL injection vulnerability in full_txt.php in Werner Hilversum Clean CMS 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T15:00:00.000Z
CVE-2008-5290 
Cross-site scripting (XSS) vulnerability in full_txt.php in Werner Hilversum Clean CMS 1.5 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T15:00:00.000Z
CVE-2008-5291 
Directory traversal vulnerability in code/track.php in FuzzyLime 3.03 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter, a different vector than CVE-2007-4805 and CVE-2008-3165.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T15:00:00.000Z
CVE-2008-5292 
SQL injection vulnerability in view_snaps.php in VideoGirls BiZ allows remote attackers to execute arbitrary SQL commands via the type parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T15:00:00.000Z
CVE-2008-5293 
SQL injection vulnerability in index.php in WebStudio eHotel allows remote attackers to execute arbitrary SQL commands via the pageid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T15:00:00.000Z
CVE-2008-5294 
SQL injection vulnerability in index.php in WebStudio eCatalogue allows remote attackers to execute arbitrary SQL commands via the pageid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T15:00:00.000Z
CVE-2008-5295 
SQL injection vulnerability in index.php in Jamit Job Board 3.4.10 allows remote attackers to execute arbitrary SQL commands via the show_emp parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T15:00:00.000Z
CVE-2008-5296 
Gallery 1.5.x before 1.5.10 and 1.6 before 1.6-RC3, when register_globals is enabled, allows remote attackers to bypass authentication and gain administrative via unspecified cookies.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T15:00:00.000Z
CVE-2008-5297 
Buffer overflow in No-IP DUC 2.1.7 and earlier allows remote HTTP servers to execute arbitrary code via a crafted response to a DNS update request, related to a missing length check in the GetNextLine function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T15:00:00.000Z
CVE-2008-5298 
chm2pdf 0.9 uses temporary files in directories with fixed names, which allows local users to cause a denial of service (chm2pdf failure) of other users by creating those directories ahead of time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T15:00:00.000Z
CVE-2008-5299 
chm2pdf 0.9 allows user-assisted local users to delete arbitrary files via a symlink attack on .chm files in the (1) /tmp/chm2pdf/work or (2) /tmp/chm2pdf/orig temporary directories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T15:00:00.000Z
CVE-2008-5300 
Linux kernel 2.6.28 allows local users to cause a denial of service ("soft lockup" and process loss) via a large number of sendmsg function calls, which does not block during AF_UNIX garbage collection and triggers an OOM condition, a different vulnerability than CVE-2008-5029.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T17:00:00.000Z
CVE-2008-5301 
Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".." (dot dot) in a script name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T17:00:00.000Z