rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-3722 
SQL injection vulnerability in forum/neu.asp in fipsCMS 2.1 allows remote attackers to execute arbitrary SQL commands via the kat parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-20T16:00:00.000Z
CVE-2008-3723 
Directory traversal vulnerability in index.php in PHPizabi 0.848b C1 HFP3 allows remote authenticated administrators to read arbitrary files via (1) a .. (dot dot), (2) a URL, or possibly (3) a full pathname in the id parameter in an admin.templates.edittemplate action.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-20T16:00:00.000Z
CVE-2008-3724 
SQL injection vulnerability in index.php in Papoo before 3.7.2 allows remote attackers to execute arbitrary SQL commands via the suchanzahl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-20T16:00:00.000Z
CVE-2008-3725 
SQL injection vulnerability in trr.php in YourFreeWorld Ad Board Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-20T16:00:00.000Z
CVE-2008-3726 
Cross-site scripting (XSS) vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to inject arbitrary web script or HTML via the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-20T16:00:00.000Z
CVE-2008-3727 
Directory traversal vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-20T16:00:00.000Z
CVE-2008-3728 
Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to determine the installation path, IP addresses, and error messages via direct requests to files under LOG/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-20T16:00:00.000Z
CVE-2008-3729 
Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to bypass authentication and obtain administrative access via a direct request with (1) an IsAdmin=true cookie value or (2) no cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-20T16:00:00.000Z
CVE-2008-3730 
Cross-site scripting (XSS) vulnerability in Nordicwind Document Management System (NOAH) before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-20T16:00:00.000Z
CVE-2008-3731 
Unspecified vulnerability in Serv-U File Server 7.0.0.1, and other versions before 7.2.0.1, allows remote authenticated users to cause a denial of service (daemon crash) via an SSH session with SFTP commands for directory creation and logging.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-20T16:00:00.000Z
CVE-2008-3732 
Integer overflow in the Open function in modules/demux/tta.c in VLC Media Player 0.8.6i allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TTA file, which triggers a heap-based buffer overflow.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-20T16:00:00.000Z
CVE-2008-3733 
Stack-based buffer overflow in EO Video (eo-video) 1.36 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a .eop (aka playlist) file with a ProjectElement element that contains a long Name element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-20T16:00:00.000Z
CVE-2008-3734 
Format string vulnerability in Ipswitch WS_FTP Home 2007.0.0.2 and WS_FTP Professional 2007.1.0.0 allows remote FTP servers to cause a denial of service (application crash) or possibly execute arbitrary code via format string specifiers in a connection greeting (response).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-20T16:00:00.000Z
CVE-2008-3735 
Cross-site scripting (XSS) vulnerability in index.php in PHPizabi before 848 Core HotFix Pack 3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a blogs.search action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-20T16:00:00.000Z
CVE-2008-3736 
Multiple cross-site request forgery (CSRF) vulnerabilities in (1) System Consultants La!Cooda WIZ 1.4.0 and earlier and (2) SpaceTag LacoodaST 2.1.3 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (a) change passwords or (b) change configurations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-27T20:00:00.000Z
CVE-2008-3737 
Unspecified vulnerability in (1) System Consultants La!Cooda WIZ 1.4.0 and earlier and (2) SpaceTag LacoodaST 2.1.3 and earlier allows remote attackers to execute arbitrary PHP scripts, and delete files, read files, and possibly have unknown other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-27T20:00:00.000Z
CVE-2008-3738 
Session fixation vulnerability in SpaceTag LacoodaST 2.1.3 and earlier allows remote attackers to hijack web sessions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-27T20:00:00.000Z
CVE-2008-3739 
Cross-site scripting (XSS) vulnerability in (1) System Consultants La!Cooda WIZ 1.4.0 and earlier and (2) SpaceTag LacoodaST 2.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving upload of files containing XSS sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-27T20:00:00.000Z
CVE-2008-3740 
Cross-site scripting (XSS) vulnerability in the output filter in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-27T15:00:00.000Z
CVE-2008-3741 
The private filesystem in Drupal 5.x before 5.10 and 6.x before 6.4 trusts the MIME type sent by a web browser, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks by uploading files containing arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-27T15:00:00.000Z
CVE-2008-3742 
Unrestricted file upload vulnerability in the BlogAPI module in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, which is not validated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-27T15:00:00.000Z
CVE-2008-3743 
Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote attackers to perform unspecified actions via unknown vectors, related to improper token validation for (1) cached forms and (2) forms with AHAH elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-27T15:00:00.000Z
CVE-2008-3744 
Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4 allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2) delete user access rules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-27T15:00:00.000Z
CVE-2008-3745 
The Upload module in Drupal 6.x before 6.4 allows remote authenticated users to edit nodes, delete files, and download unauthorized attachments via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-27T15:00:00.000Z
CVE-2008-3746 
neon 0.28.0 through 0.28.2 allows remote servers to cause a denial of service (NULL pointer dereference and crash) via vectors related to Digest authentication, Digest domain parameter support, and the parse_domain function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-27T15:00:00.000Z
CVE-2008-3747 
The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force SSL communication in the intended situations, which might allow remote attackers to gain administrative access by sniffing the network for a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-27T15:00:00.000Z
CVE-2008-3748 
SQL injection vulnerability in view_group.php in Active PHP Bookmarks (APB) 1.1.02 and 1.2.06 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3749 
SQL injection vulnerability in tr.php in YourFreeWorld Banner Management Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3750 
SQL injection vulnerability in tr.php in YourFreeWorld URL Rotator Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3751 
SQL injection vulnerability in tr.php in YourFreeWorld Short Url & Url Tracker Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3752 
SQL injection vulnerability in tr.php in YourFreeWorld Ad-Exchange Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3753 
SQL injection vulnerability in details.php in YourFreeWorld Programs Rating Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3754 
SQL injection vulnerability in trl.php in YourFreeWorld Stylish Text Ads Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3755 
SQL injection vulnerability in view.php in YourFreeWorld Classifieds Script allows remote attackers to execute arbitrary SQL commands via the category parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3756 
SQL injection vulnerability in tr.php in YourFreeWorld Viral Marketing Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3757 
SQL injection vulnerability in tr1.php in YourFreeWorld Forced Matrix Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3758 
Multiple cross-site scripting (XSS) vulnerabilities in Lussumo Vanilla 1.1.4 and earlier (1) allow remote attackers to inject arbitrary web script or HTML via the NewPassword parameter to people.php, and allow remote authenticated users to inject arbitrary web script or HTML via the (2) Account picture and (3) Icon fields in account.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3759 
Cross-site request forgery (CSRF) vulnerability in ajax/UpdateCheck.php in Vanilla 1.1.4 and earlier has unknown impact and remote attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3760 
Cross-site request forgery (CSRF) vulnerability in the sign-out page in Vanilla 1.1.4 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout via a SignOutNow action to people.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3761 
hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745 uses the METHOD_NEITHER communication method for IOCTLs, which allows local users to cause a denial of service via a crafted IOCTL request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3762 
SQL injection vulnerability in onlinestatus_html.php in Turnkey PHP Live Helper 2.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the dep parameter, related to lack of input sanitization in the get function in global.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3763 
Variable overwrite vulnerability in libsecure.php in Turnkey PHP Live Helper 2.0.1 and earlier, when register_globals is enabled, allows remote attackers to overwrite arbitrary variables related to the db config file.  NOTE: this can be leveraged for code injection by overwriting the language file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3764 
Eval injection vulnerability in globalsoff.php in Turnkey PHP Live Helper 2.0.1 and earlier allows remote attackers to execute arbitrary PHP code via the test parameter, and probably arbitrary parameters, to chat.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3765 
SQL injection vulnerability in code.php in Quick Poll Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-21T17:00:00.000Z
CVE-2008-3766 
Realtime Internet Band Rehearsal Low-Latency (Internet) Connection tool (llcon) before 2.1.2 allows remote attackers to cause a denial of service (application crash) via malformed protocol messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-22T16:00:00.000Z
CVE-2008-3767 
SQL injection vulnerability in classified.php in phpBazar 2.0.2 allows remote attackers to execute arbitrary SQL commands via the adid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-22T16:00:00.000Z
CVE-2008-3768 
Multiple SQL injection vulnerabilities in class.ajax.php in Turnkey Web Tools SunShop Shopping Cart before 4.1.5 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in an edit_registry action to index.php, (2) a vector involving the check_email function, and other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-22T16:00:00.000Z
CVE-2008-3769 
PHP remote file inclusion vulnerability in admin/create_order_new.php in Freeway 1.4.1.171, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the include_page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-22T16:00:00.000Z
CVE-2008-3770 
Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter to (1) includes/events_application_top.php; (2) english/account.php, (3) french/account.php, and (4) french/account_newsletters.php in includes/languages/; (5) includes/modules/faqdesk/faqdesk_article_require.php; (6) includes/modules/newsdesk/newsdesk_article_require.php; (7) card1.php, (8) loginbox.php, and (9) whos_online.php in templates/Freeway/boxes/; and (10) templates/Freeway/mainpage_modules/mainpage.php.  NOTE: vector 1 may be the same as CVE-2008-3677.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-22T16:00:00.000Z
CVE-2008-3771 
Cross-site scripting (XSS) vulnerability in members.php in Pars4u Videosharing 1 allows remote attackers to inject arbitrary web script or HTML via the PageNo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-22T16:00:00.000Z
CVE-2008-3772 
SQL injection vulnerability in categories_portal.php in Pars4u Videosharing 1 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-22T16:00:00.000Z
CVE-2008-3773 
Cross-site scripting (XSS) vulnerability in vBulletin 3.7.2 PL1 and 3.6.10 PL3, when "Show New Private Message Notification Pop-Up" is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a private message subject (aka newpm[title]).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-22T16:00:00.000Z
CVE-2008-3774 
SQL injection vulnerability in index.php in Simasy CMS allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-22T16:00:00.000Z
CVE-2008-3775 
Folder Lock 5.9.5 and earlier uses weak encryption (ROT-25) for the password, which allows local administrators to obtain sensitive information by reading and decrypting the QualityControl\_pack registry value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-22T16:00:00.000Z
CVE-2008-3776 
Directory traversal vulnerability in Fujitsu Web-Based Admin View 2.1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-25T21:00:00.000Z
CVE-2008-3777 
The SIP Enablement Services (SES) Server in Avaya SIP Enablement Services 5.0, and Communication Manager (CM) 5.0 on the S8300C with SES enabled, writes account names and passwords to the (1) alarm and (2) system logs during failed login attempts, which allows local users to obtain login credentials by reading these logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-25T21:00:00.000Z
CVE-2008-3778 
The remote management interface in SIP Enablement Services (SES) Server in Avaya SIP Enablement Services 5.0, and Communication Manager (CM) 5.0 on the S8300C with SES enabled, proceeds with Core router updates even when a login is invalid, which allows remote attackers to cause a denial of service (messaging outage) or gain privileges via an update request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-25T21:00:00.000Z
CVE-2008-3779 
Cross-site scripting (XSS) vulnerability in search/index.php in Five Star Review Script allows remote attackers to inject arbitrary web script or HTML via the words parameter in a search action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-26T14:06:00.000Z
CVE-2008-3780 
SQL injection vulnerability in recommend.php in Five Star Review Script allows remote attackers to execute arbitrary SQL commands via the item_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-26T14:06:00.000Z
CVE-2008-3781 
Cross-site scripting (XSS) vulnerability in GMOD GBrowse before 1.69 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-26T14:06:00.000Z
CVE-2008-3782 
Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in ACG-PTP 1.0.6 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) Category name field under Advertisement Packages, the (2) Reason field under Credit/Debit Users, and the (3) FAQ question and (4) FAQ answer fields under Add New FAQ Entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-26T14:06:00.000Z
CVE-2008-3783 
Multiple SQL injection vulnerabilities in index.php in Matterdaddy Market 1.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) type parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-26T14:06:00.000Z
CVE-2008-3784 
SQL injection vulnerability in scrape.php in BtiTracker 1.4.7 and earlier and xBtiTracker 2.0.542 and earlier allows remote attackers to execute arbitrary SQL commands via the info_hash parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-26T14:06:00.000Z
CVE-2008-3785 
Multiple SQL injection vulnerabilities in the com_content component in MiaCMS 4.6.5 allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) view, (2) category, or (3) blogsection action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-26T14:06:00.000Z
CVE-2008-3786 
Cross-site scripting (XSS) vulnerability in index.php in PICTURESPRO Photo Cart 3.9 allows remote attackers to inject arbitrary web script or HTML via the qtitle parameter (aka "Gallery or event name" field) in a search action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-26T14:06:00.000Z
CVE-2008-3787 
SQL injection vulnerability in listing_view.php in Web Directory Script 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-26T14:06:00.000Z
CVE-2008-3788 
Multiple SQL injection vulnerabilities in PICTURESPRO Photo Cart 3.9, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) qtitle, (2) qid, and (3) qyear parameters to (a) search.php, and the (4) email and (5) password parameters to (b) _login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-26T14:06:00.000Z
CVE-2008-3789 
Samba 3.2.0 uses weak permissions (0666) for the (1) group_mapping.tdb and (2) group_mapping.ldb files, which allows local users to modify the membership of Unix groups.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-27T20:00:00.000Z