rainbutterfly/cve_corpus huggingface dataset:
CVE-2005-0148 
Thunderbird before 0.9, when running on Windows systems, uses the default handler when processing javascript: links, which invokes Internet Explorer and may expose the Thunderbird user to vulnerabilities in the version of Internet Explorer that is installed on the user's system.  NOTE: since the invocation between multiple products is a common practice, and the vulnerabilities inherent in multi-product interactions are not easily enumerable, this issue might be REJECTED in the future.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0149 
Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackers to bypass the user's intended privacy and security policy by using cookies in e-mail messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0150 
Firefox before 1.0 allows the user to store a (1) javascript: or (2) data: URLs as a Livefeed bookmark, then executes it in the security context of the currently loaded page when the user later accesses the bookmark, which could allow remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0151 
Unknown vulnerability in the installation of Adobe License Management Service, as used in Adobe Photoshop CS, Adobe Creative Suite 1.0, and Adobe Premiere Pro 1.5, allows attackers to gain administrator privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-09T04:00:00.000Z
CVE-2005-0152 
PHP remote file inclusion vulnerability in Squirrelmail 1.2.6 allows remote attackers to execute arbitrary code via "URL manipulation."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0155 
The PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to create arbitrary files via the PERLIO_DEBUG variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-07T05:00:00.000Z
CVE-2005-0156 
Buffer overflow in the PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to execute arbitrary code by setting the PERLIO_DEBUG variable and executing a Perl script whose full pathname contains a long directory tree.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-07T05:00:00.000Z
CVE-2005-0157 
The confirm add-on in SmartList 3.15 and earlier allows attackers to subscribe arbitrary e-mail addresses by using a valid cookie that specifies an address other than the address for which the cookie was assigned.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-03T04:00:00.000Z
CVE-2005-0158 
Format string vulnerability in bidwatcher before 1.3.17 allows remote malicious web servers from eBay, or a spoofed eBay server, to cause a denial of service and possibly execute arbitrary code via certain responses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-18T05:00:00.000Z
CVE-2005-0159 
The tpkg-* scripts in the toolchain-source 3.0.4 package on Debian GNU/Linux 3.0 allow local users to overwrite arbitrary files via a symlink attack on temporary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-15T05:00:00.000Z
CVE-2005-0160 
Multiple buffer overflows in unace 1.2b allow attackers to execute arbitrary code via (1) 2 overflows in ACE archives, (2) a long command line argument, or (3) certain "Ready for next volume" messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-24T05:00:00.000Z
CVE-2005-0161 
Multiple directory traversal vulnerabilities in unace 1.2b allow attackers to overwrite arbitrary files via an ACE archive containing (1) ../ sequences or (2) absolute pathnames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-24T05:00:00.000Z
CVE-2005-0162 
Stack-based buffer overflow in the get_internal_addresses function in the pluto application for Openswan 1.x before 1.0.9, and Openswan 2.x before 2.3.0, when compiled with XAUTH and PAM enabled, allows remote authenticated attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0173 
squid_ldap_auth in Squid 2.5 and earlier allows remote authenticated users to bypass username-based Access Control Lists (ACLs) via a username with a space at the beginning or end, which is ignored by the LDAP server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0174 
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0175 
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache via an HTTP response splitting attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0176 
The shmctl function in Linux 2.6.9 and earlier allows local users to unlock the memory of other processes, which could cause sensitive memory to be swapped to disk, which could allow it to be read by other users once it has been released.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-16T05:00:00.000Z
CVE-2005-0177 
nls_ascii.c in Linux before 2.6.8.1 uses an incorrect table size, which allows attackers to cause a denial of service (kernel crash) via a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-16T05:00:00.000Z
CVE-2005-0178 
Race condition in the setsid function in Linux before 2.6.8.1 allows local users to cause a denial of service (crash) and possibly access portions of kernel memory, related to TTY changes, locking, and semaphores.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-16T05:00:00.000Z
CVE-2005-0179 
Linux kernel 2.4.x and 2.6.x allows local users to cause a denial of service (CPU and memory consumption) and bypass RLIM_MEMLOCK limits via the mlockall call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0180 
Multiple integer signedness errors in the sg_scsi_ioctl function in scsi_ioctl.c for Linux 2.6.x allow local users to read or modify kernel memory via negative integers in arguments to the scsi ioctl, which bypass a maximum length check before calling the copy_from_user and copy_to_user functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0182 
The mod_dosevasive module 1.9 and earlier for Apache creates temporary files with predictable filenames, which could allow remote attackers to overwrite arbitrary files via a symlink attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0183 
ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to execute arbitrary commands via shell metacharacters in a command line argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0184 
Directory traversal vulnerability in ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to read arbitrary files via a .. (dot dot) in a get request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0185 
Stack-based buffer overflow in NodeManager Professional 2.00 allows remote attackers to execute arbitrary commands via a LinkDown-Trap packet that contains a long OCTET-STRING in the Trap variable-bindings field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0186 
Cisco IOS 12.1YD, 12.2T, 12.3 and 12.3T, when configured for the IOS Telephony Service (ITS), CallManager Express (CME) or Survivable Remote Site Telephony (SRST), allows remote attackers to cause a denial of service (device reboot) via a malformed packet to the SCCP port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0187 
Stack-based buffer overflow in the SetSkin function in AtHoc toolbar allows remote attackers to execute arbitrary code via a long skin name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0188 
Format string vulnerability in the SetBaseURL function in AtHoc toolbar allows remote attackers to execute arbitrary code via format string specifiers in an invalid URL that is recorded in the debug log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0189 
Stack-based buffer overflow in the HandleAction function in RealPlayer 10.5 (6.0.12.1040) and earlier allows remote attackers to execute arbitrary code via a long ShowPreferences argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0190 
Directory traversal vulnerability in RealPlayer 10.5 (6.0.12.1040) and earlier allows remote attackers to delete arbitrary files via a Real Metadata Packages (RMP) file with a FILENAME tag containing .. (dot dot) sequences in a filename that ends with a ? (question mark) and an allowed file extension (e.g. .mp3), which bypasses the check for the file extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0191 
Off-by-one buffer overflow in the processing of tags in Real Metadata Package (RMP) files in RealPlayer 10.5 (6.0.12.1040) and earlier could allow remote attackers to execute arbitrary code via a long tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0192 
Directory traversal vulnerability in the parsing of Skin file names in RealPlayer 10.5 (6.0.12.1040) and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in an RJS filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0193 
Buffer overflow in the (1) -v and (2) -a switches in mRouter in iSync 1.5 in Mac OS X 10.3.7 and earlier allows local users to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0194 
Squid 2.5, when processing the configuration file, parses empty Access Control Lists (ACLs), including proxy_auth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warnings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0195 
Cisco IOS 12.0S through 12.3YH allows remote attackers to cause a denial of service (device restart) via a crafted IPv6 packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0196 
Cisco IOS 12.0 through 12.3YL, with BGP enabled and running the bgp log-neighbor-changes command, allows remote attackers to cause a denial of service (device reload) via a malformed BGP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0197 
Cisco IOS 12.1T, 12.2, 12.2T, 12.3 and 12.3T, with Multi Protocol Label Switching (MPLS) installed but disabled, allows remote attackers to cause a denial of service (device reload) via a crafted packet sent to the disabled interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0198 
A logic error in the CRAM-MD5 code for the University of Washington IMAP (UW-IMAP) server, when Challenge-Response Authentication Mechanism with MD5 (CRAM-MD5) is enabled, does not properly enforce all the required conditions for successful authentication, which allows remote attackers to authenticate as arbitrary users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0199 
Integer underflow in the Lists_MakeMask() function in lists.c in ngIRCd before 0.8.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long MODE line that causes an incorrect length calculation, which leads to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0200 
TikiWiki before 1.8.5 does not properly validate files that have been uploaded to the temp directory, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2004-1386.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0201 
D-BUS (dbus) before 0.22 does not properly restrict access to a socket, if the socket address is known, which allows local users to listen or send arbitrary messages on another user's per-user session bus via that socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-28T04:00:00.000Z
CVE-2005-0202 
Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-09T05:00:00.000Z
CVE-2005-0204 
Linux kernel before 2.6.9, when running on the AMD64 and Intel EM64T architectures, allows local users to write to privileged IO ports via the OUTS instruction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-21T05:00:00.000Z
CVE-2005-0205 
KPPP 2.1.2 in KDE 3.1.5 and earlier, when setuid root without certain wrappers, does not properly close a privileged file descriptor for a domain socket, which allows local users to read and write to /etc/hosts and /etc/resolv.conf and gain control over DNS name resolution by opening a number of file descriptors before executing kppp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-28T05:00:00.000Z
CVE-2005-0206 
The patch for integer overflow vulnerabilities in Xpdf 2.0 and 3.0 (CVE-2004-0888) is incomplete for 64-bit architectures on certain Linux distributions such as Red Hat, which could leave Xpdf users exposed to the original vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-15T05:00:00.000Z
CVE-2005-0207 
Unknown vulnerability in Linux kernel 2.4.x, 2.5.x, and 2.6.x allows NFS clients to cause a denial of service via O_DIRECT.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-09T05:00:00.000Z
CVE-2005-0208 
The HTML parsing functions in Gaim before 1.1.4 allow remote attackers to cause a denial of service (application crash) via malformed HTML that causes "an invalid memory access," a different vulnerability than CVE-2005-0473.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-28T05:00:00.000Z
CVE-2005-0209 
Netfilter in Linux kernel 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) via crafted IP packet fragments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-18T05:00:00.000Z
CVE-2005-0210 
Netfilter in the Linux kernel 2.6.8.1 allows local users to cause a denial of service (memory consumption) via certain packet fragments that are reassembled twice, which causes a data structure to be allocated twice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-18T05:00:00.000Z
CVE-2005-0211 
Buffer overflow in wccp.c in Squid 2.5 before 2.5.STABLE7 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long WCCP packet, which is processed by a recvfrom function call that uses an incorrect length parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0212 
The Amp II engine as used by Gore: Ultimate Soldier 1.50 and earlier allows remote attackers to cause a denial of service (infinite loop) via a zero byte UDP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0213 
Directory traversal vulnerability in WinHKI 1.4d allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a zip file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0214 
Directory traversal vulnerability in Simple PHP Blog (SPHPBlog) 0.3.7c allows remote attackers to read or create arbitrary files via a .. (dot dot) in the entry parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0215 
Mozilla 1.6 and possibly other versions allows remote attackers to cause a denial of service (application crash) via a XBM (X BitMap) file with a large (1) height or (2) width value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0216 
Cross-site scripting (XSS) vulnerability in formmail.php in Woltlab Burning Board Lite 1.0.0, 1.0.1e, and possibly other versions, allows remote attackers to inject arbitrary web script and HTML via the userid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0217 
SQL injection vulnerability in index.php in Invision Community Blog allows remote attackers to execute arbitrary SQL commands via the eid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0218 
ClamAV 0.80 and earlier allows remote attackers to bypass virus scanning via a base64 encoded image in a data: (RFC 2397) URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0219 
Multiple cross-site scripting (XSS) vulnerabilities in Gallery 1.3.4-pl1 allow remote attackers to inject arbitrary web script or HTML via (1) the index field in add_comment.php, (2) set_albumName, (3) slide_index, (4) slide_full, (5) slide_loop, (6) slide_pause, (7) slide_dir fields in slideshow_low.php, or (8) username field in search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0220 
Cross-site scripting vulnerability in login.php in Gallery 1.4.4-pl2 allows remote attackers to inject arbitrary web script or HTML via the username field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0221 
Cross-site scripting (XSS) vulnerability in login.php in Gallery 2.0 Alpha allows remote attackers to inject arbitrary web script or HTML via the g2_form[subject] field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0222 
main.php in Gallery 2.0 Alpha allows remote attackers to gain sensitive information by changing the value of g2_subView parameter, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0223 
The Software Development Kit (SDK) and Run Time Environment (RTE) 1.4.1 and 1.4.2 for Tru64 UNIX allows remote attackers to cause a denial of service (Java Virtual Machine hang) via object deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0224 
Unknown vulnerability in HP-UX B.11.04 running Virtualvault 4.5 through 4.7, when running the TGA daemon, allows remote attackers to cause a denial of service via certain network traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0225 
firehol.sh in FireHOL before 1.224 creates temporary files with predictable file names, which could allow local users to overwrite arbitrary files via a symlink attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0226 
Format string vulnerability in the Log_Resolver function in log.c for ngIRCd 0.8.2 and earlier, when compiled with IDENT, logging to SYSLOG, and with DEBUG enabled, allows remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0227 
PostgreSQL (pgsql) 7.4.x, 7.2.x, and other versions allows local users to load arbitrary shared libraries and execute code via the LOAD extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0229 
CitrusDB 0.3.5 and earlier stores the newfile.txt temporary data file under the web root, which allows remote attackers to steal credit card information via a direct request to newfile.txt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-14T05:00:00.000Z
CVE-2005-0230 
Firefox 1.0 does not prevent the user from dragging an executable file to the desktop when it has an image/gif content type but has a dangerous extension such as .bat or .exe, which allows remote attackers to bypass the intended restriction and execute arbitrary commands via malformed GIF files that can still be parsed by the Windows batch file parser, aka "firedragging."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-10T05:00:00.000Z
CVE-2005-0231 
Firefox 1.0 does not invoke the Javascript Security Manager when a user drags a javascript: or data: URL to a tab, which allows remote attackers to bypass the security model, aka "firetabbing."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-08T05:00:00.000Z
CVE-2005-0232 
Firefox 1.0 allows remote attackers to modify Boolean configuration parameters for the about:config site by using a plugin such as Flash, and the -moz-opacity filter, to display the about:config site then cause the user to double-click at a certain screen position, aka "Fireflashing."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-08T05:00:00.000Z