rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-2895 
Cross-site scripting (XSS) vulnerability in MediaWiki 1.6.0 up to versions before 1.6.7 allows remote attackers to inject arbitrary HTML and web script via the edit form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-07T10:00:00.000Z
CVE-2006-2896 
profile.php in FunkBoard CF0.71 allows remote attackers to change arbitrary passwords via a modified uid hidden form field in an Edit Profile action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-07T10:00:00.000Z
CVE-2006-2897 
Cross-site scripting (XSS) vulnerability in FunkBoard 0.71 allows remote attackers to inject arbitrary HTML or web script via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-07T10:00:00.000Z
CVE-2006-2898 
The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via truncated IAX 2 (IAX2) video frames, which bypasses a length check and leads to a buffer overflow involving negative length check.  NOTE: the vendor advisory claims that only a DoS is possible, but the original researcher is reliable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-07T10:00:00.000Z
CVE-2006-2899 
Unspecified vulnerability in ESTsoft InternetDISK versions before 2006/04/20 allows remote authenticated users to execute arbitrary code, possibly by uploading a file with multiple extensions into the WebLink directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-07T10:00:00.000Z
CVE-2006-2900 
Internet Explorer 6 allows user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename in a text box and using the OnKeyDown, OnKeyPress, and OnKeyUp Javascript keystroke events to change the focus and cause those characters to be inserted into a file upload input control, which can then upload the file when the user submits the form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-07T16:00:00.000Z
CVE-2006-2901 
The web server for D-Link Wireless Access-Point (DWL-2100ap) firmware 2.10na and earlier allows remote attackers to obtain sensitive system information via a request to an arbitrary .cfg file, which returns configuration information including passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-07T21:00:00.000Z
CVE-2006-2902 
Directory traversal vulnerability in Particle Links 1.2.2 might allow remote attackers to access arbitrary files via ".." sequences in an HTTP request.  NOTE: it is not clear whether this issue is legitimate, as the original researcher seems unsure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-08T16:00:00.000Z
CVE-2006-2903 
Cross-site scripting (XSS) vulnerability in admin.php in Particle Links 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-08T16:00:00.000Z
CVE-2006-2904 
SQL injection vulnerability in index.php in Partial Links 1.2.2 allows remote attackers to execute arbitrary SQL commands via the topic parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-08T16:00:00.000Z
CVE-2006-2905 
Partial Links 1.2.2 allows remote attackers to obtain sensitive information via a direct request to (1) page_footer.php and (2) page_header.php, which displays the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-08T16:00:00.000Z
CVE-2006-2906 
The LZW decoding in the gdImageCreateFromGifPtr function in the Thomas Boutell graphics draw (GD) library (aka libgd) 2.0.33 allows remote attackers to cause a denial of service (CPU consumption) via malformed GIF data that causes an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-08T16:00:00.000Z
CVE-2006-2908 
The domecode function in inc/functions_post.php in MyBulletinBoard (MyBB) 1.1.2, and possibly other versions, allows remote attackers to execute arbitrary PHP code via the username field, which is used in a preg_replace function call with a /e (executable) modifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-13T01:00:00.000Z
CVE-2006-2909 
Stack-based buffer overflow in the info tip shell extension (zipinfo.dll) in PicoZip 4.01 allows remote attackers to execute arbitrary code via a long filename in an (1) ACE, (2) RAR, or (3) ZIP archive, which is triggered when the user moves the mouse over the archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-16T10:00:00.000Z
CVE-2006-2910 
Buffer overflow in jetAudio 6.2.6.8330 (Basic), and possibly other versions, allows user-assisted attackers to execute arbitrary code via an audio file (such as WMA) with long ID Tag values including (1) Title, (2) Author, and (3) Album, which triggers the overflow in the tooltip display string if the sound card driver is disabled or incorrectly installed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-05T18:00:00.000Z
CVE-2006-2911 
SQL injection vulnerability in controlpanel/index.php in CMS Mundo before 1.0 build 008 allows remote attackers to execute arbitrary SQL commands via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-21T19:00:00.000Z
CVE-2006-2912 
Multiple SQL injection vulnerabilities in SelectaPix 1.31 allow remote attackers to execute arbitrary SQL commands via the (1) albumID parameter to (a) view_album.php or (b) index.php, (2) imageID parameter to (c) popup.php, or (3) username and (4) password parameters to (d) admin/member.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-09T10:00:00.000Z
CVE-2006-2913 
Cross-site scripting (XSS) vulnerability in SelectaPix 1.31 allows remote attackers to inject arbitrary web script or HTML via the albumID parameter to (1) popup.php and (2) view_album.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-09T10:00:00.000Z
CVE-2006-2914 
PHP remote file inclusion vulnerability in DeluxeBB 1.06 allows remote attackers to execute arbitrary code via a URL in the templatefolder parameter to (1) postreply.php, (2) posting.php, (3) and pm/newpm.php in the deluxe/ directory, and (4) postreply.php, (5) posting.php, and (6) pm/newpm.php in the default/ directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-23T19:00:00.000Z
CVE-2006-2915 
Multiple SQL injection vulnerabilities in DeluxeBB 1.06 allow remote attackers to execute arbitrary SQL commands via the (1) hideemail, (2) languagex, (3) xthetimeoffset, and (4) xthetimeformat parameters during account registration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-23T20:00:00.000Z
CVE-2006-2916 
artswrapper in aRts, when running setuid root on Linux 2.6.0 or later versions, does not check the return value of the setuid function call, which allows local users to gain root privileges by causing setuid to fail, which prevents artsd from dropping privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-15T10:00:00.000Z
CVE-2006-2917 
Directory traversal vulnerability in the IMAP server in WinGate 6.1.2.1094 and 6.1.3.1096, and possibly other versions before 6.1.4 Build 1099, allows remote authenticated users to read email of other users, or perform unauthorized operations on directories, via the (1) CREATE, (2) SELECT, (3) DELETE, (4) RENAME, (5) COPY, (6) APPEND, and (7) LIST commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T19:00:00.000Z
CVE-2006-2918 
The Lanap BotDetect APS.NET CAPTCHA component before 1.5.4.0 stores the UUID and hash for a CAPTCHA in the ViewState of a page, which makes it easier for remote attackers to conduct automated attacks by "replaying the ViewState for a known number."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-23T21:00:00.000Z
CVE-2006-2919 
Unspecified vulnerability in Microsoft NetMeeting 3.01 allows remote attackers to cause a denial of service (crash or CPU consumption) and possibly execute arbitrary code via crafted inputs that trigger memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-09T01:00:00.000Z
CVE-2006-2920 
Sylpheed-Claws before 2.2.2 and Sylpheed before 2.2.6 allow remote attackers to bypass the URI check functionality and makes it easier to conduct phishing attacks via a URI that begins with a space character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-09T01:00:00.000Z
CVE-2006-2921 
PHP remote file inclusion vulnerability in cmpro_header.inc.php in Clan Manager Pro (CMPRO) 1.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the (1) cm_ext_server and (2) sitepath parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-09T10:00:00.000Z
CVE-2006-2922 
Multiple PHP remote file inclusion vulnerabilities in MiraksGalerie 2.62 allow remote attackers to execute arbitrary PHP code via a URL in the (1) g_pcltar_lib_dir parameter in (a) pcltar.lib.php when register_globals is enabled, and (2) listconfigfile[] parameter in (b) galsecurity.lib.php and (c) galimage.lib.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-09T10:00:00.000Z
CVE-2006-2923 
The iax_net_read function in the iaxclient open source library, as used in multiple products including (a) LoudHush 1.3.6, (b) IDE FISK 1.35 and earlier, (c) Kiax 0.8.5 and earlier, (d) DIAX, (e) Ziaxphone, (f) IAX Phone, (g) X-lite, (h) MediaX, (i) Extreme Networks ePhone, and (j) iaxComm before 1.2.0, allows remote attackers to execute arbitrary code via crafted IAX 2 (IAX2) packets with truncated (1) full frames or (2) mini-frames, which are detected in a length check but still processed, leading to buffer overflows related to negative length values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-09T10:00:00.000Z
CVE-2006-2924 
Ingate Firewall in the SIP module before 4.4.1 and SIParator before 4.4.1, when TLS is enabled or when SSL/TLS is enabled in the web server, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-09T10:00:00.000Z
CVE-2006-2925 
Cross-site scripting (XSS) vulnerability in the web interface in Ingate Firewall before 4.4.1 and SIParator before 4.4.1 allows remote attackers to inject arbitrary web script or HTML, and steal cookies, via unspecified vectors related to "XSS exploits" in administrator functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-09T10:00:00.000Z
CVE-2006-2926 
Stack-based buffer overflow in the WWW Proxy Server of Qbik WinGate 6.1.1.1077 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long URL HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-09T10:00:00.000Z
CVE-2006-2927 
Multiple cross-site scripting (XSS) vulnerabilities in post.asp in CodeAvalanche FreeForum (aka CAForum) 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_subject and (2) msg_body parameters.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-09T10:00:00.000Z
CVE-2006-2928 
Multiple PHP remote file inclusion vulnerabilities in CMS-Bandits 2.5 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter in (1) dialogs/img.php and (2) dialogs/td.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-09T10:00:00.000Z
CVE-2006-2929 
PHP remote file inclusion vulnerability in contrib/forms/evaluation/C_FormEvaluation.class.php in OpenEMR 2.8.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[fileroot] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-09T10:00:00.000Z
CVE-2006-2930 
Unspecified vulnerability in Sun Grid Engine 5.3 and Sun N1 Grid Engine 6.0, when configured in Certificate Security Protocol (CSP) Mode, allows local users to shut down the grid service or gain access, even if access is denied.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-09T10:00:00.000Z
CVE-2006-2931 
CMS Mundo before 1.0 build 008 does not properly verify uploaded image files, which allows remote attackers to execute arbitrary PHP code by uploading and later directly accessing certain files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-21T19:00:00.000Z
CVE-2006-2932 
A regression error in the restore_all code path of the 4/4GB split support for non-hugemem Linux kernels on Red Hat Linux Desktop and Enterprise Linux 4 allows local users to cause a denial of service (panic) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-23T19:00:00.000Z
CVE-2006-2933 
kdesktop_lock in kdebase before 3.1.3-5.11 for KDE in Red Hat Enterprise Linux (RHEL) 3 does not properly terminate, which can prevent the screensaver from activating or prevent users from manually locking the desktop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-27T22:00:00.000Z
CVE-2006-2934 
SCTP conntrack (ip_conntrack_proto_sctp.c) in netfilter for Linux kernel 2.6.17 before 2.6.17.3 and 2.6.16 before 2.6.16.23 allows remote attackers to cause a denial of service (crash) via a packet without any chunks, which causes a variable to contain an invalid value that is later used to dereference a pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-30T21:00:00.000Z
CVE-2006-2935 
The dvd_read_bca function in the DVD handling code in drivers/cdrom/cdrom.c in Linux kernel 2.2.16, and later versions, assigns the wrong value to a length variable, which allows local users to execute arbitrary code via a crafted USB Storage device that triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-05T18:00:00.000Z
CVE-2006-2936 
The ftdi_sio driver (usb/serial/ftdi_sio.c) in Linux kernel 2.6.x up to 2.6.17, and possibly later versions, allows local users to cause a denial of service (memory consumption) by writing more data to the serial port than the hardware can handle, which causes the data to be queued.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T19:00:00.000Z
CVE-2006-2937 
OpenSSL 0.9.7 before 0.9.7l and 0.9.8 before 0.9.8d allows remote attackers to cause a denial of service (infinite loop and memory consumption) via malformed ASN.1 structures that trigger an improperly handled error condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-28T18:00:00.000Z
CVE-2006-2940 
OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) "public exponent" or (2) "public modulus" values in X.509 certificates that require extra time to process when using RSA signature verification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-28T18:00:00.000Z
CVE-2006-2941 
Mailman before 2.1.9rc1 allows remote attackers to cause a denial of service via unspecified vectors involving "standards-breaking RFC 2231 formatted headers".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-06T00:00:00.000Z
CVE-2006-2942 
TWiki 4.0.0, 4.0.1, and 4.0.2 allows remote attackers to gain Twiki administrator privileges via a TWiki.TWikiRegistration form with a modified action attribute that references the Sandbox web instead of the user web, which can then be used to associate the user's login name with the WikiName of a member of the TWikiAdminGroup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-20T18:00:00.000Z
CVE-2006-2943 
Unspecified vulnerability in CGI-RESCUE WebFORM 4.1 and earlier allows remote attackers to inject email headers, which facilitates sending spam messages.  NOTE: the details for this issue are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2944 
Unspecified vulnerability in CGI-RESCUE FORM2MAIL 1.21 and earlier allows remote attackers to inject email headers, which facilitates sending spam messages.  NOTE: the details for this issue are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2945 
Unspecified vulnerability in the user profile change functionality in DokuWiki, when Access Control Lists are enabled, allows remote authenticated users to read unauthorized files via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2946 
Dmx Forum 2.1a stores _includes/bd.inc under the web root with insufficient access control, which allows remote attackers to obtain database username and password information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2947 
Dmx Forum 2.1a allows remote attackers to obtain username and password information via a direct request to pops/edit.php with a modified membre parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2948 
A-CART 2.0 stores the acart2_0.mdb file under the web document root with insufficient access control, which allows remote attackers to obtain username and password information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2949 
Cross-site scripting (XSS) vulnerability in private.php in MyBB 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the do parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2950 
Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) header.php, (2) contact.php, or (3) forum_extender.php, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2951 
Multiple cross-site scripting (XSS) vulnerabilities in Net Portal Dynamic System (NPDS) 5.10 and earlier allow remote attackers to inject arbitrary web script and HTML via the (1) Titlesitename or (2) sitename parameter to (a) header.php, (3) nuke_url parameter to (b) meta/meta.php, (4) forum parameter to (c) viewforum.php, (5) post_id, (6) forum, (7) topic, or (8) arbre parameter to (d) editpost.php, or (9) uname or (10) email parameter to (e) user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2952 
Directory traversal vulnerability in Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) sequence and trailing null (%00) byte in the (1) Default_Theme parameter to header.php or (2) ModPath parameter to modules/cluster-paradise/cluster-E.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2953 
Cross-site scripting (XSS) vulnerability in default.asp in OfficeFlow 2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the sqlType parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2954 
SQL injection vulnerability in files.asp in OfficeFlow 2.6 and earlier allows remote attackers to execute arbitrary SQL commands via the Project parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2955 
Multiple cross-site scripting (XSS) vulnerabilities in KAPhotoservice 7.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) New Category (newcategory) or (2) apage parameter to (a) edtalbum.asp, or the (3) cat or (4) albumid parameter to (b) album.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2956 
Multiple cross-site scripting (XSS) vulnerabilities in i.List 1.5 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) searchword parameter to search.php or (2) siteurl parameter to add.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2957 
Cross-site scripting (XSS) vulnerability in i.List 1.5 beta and earlier allows remote attackers to inject arbitrary web script or HTML via the banurl parameter to add.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2958 
Directory traversal vulnerability in FilZip 3.05 allows remote attackers to write arbitrary files via a .. (dot dot) in a (1) .rar, (2) .tar, (3) .jar, or (4) .gz file.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2959 
SQL injection vulnerability in inc_header.asp in Snitz Forum 3.4.05 and earlier allows remote attackers to execute arbitrary SQL commands via the %strCookieURL%.GROUP parameter in a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2960 
PHP remote file inclusion vulnerability in includes/joomla.php in Joomla! 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the includepath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z
CVE-2006-2961 
Stack-based buffer overflow in CesarFTP 0.99g and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long MKD command.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-12T20:00:00.000Z