rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-7009 
Buffer overflow in multiscan.exe in Check Point ZoneAlarm Security Suite 7.0.483.000 and 8.0.020.000 allows local users to execute arbitrary code via a file or directory with a long path.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-19T10:00:00.000Z
CVE-2008-7010 
Skalfa Software SkaLinks Exchange Script 1.5 allows remote attackers to add new administrators and gain privileges via a direct request to admin/register.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-19T10:00:00.000Z
CVE-2008-7011 
The Unreal engine, as used in Unreal Tournament 3 1.3, Unreal Tournament 2003 and 2004, Dead Man's Hand, Pariah, WarPath, Postal2, and Shadow Ops, allows remote authenticated users to cause a denial of service (server exit) via multiple file downloads from the server, which triggers an assertion failure when the Closing flag in UnChan.cpp is set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-19T10:00:00.000Z
CVE-2008-7012 
courier/1000@/api_error_email.html (aka "error reporting page") in Accellion File Transfer Appliance FTA_7_0_178, and possibly other versions before FTA_7_0_189, allows remote attackers to send spam e-mail via modified description and client_email parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-19T10:00:00.000Z
CVE-2008-7013 
NetService.dll in Baidu Hi IM allows remote servers to cause a denial of service (client crash) via a crafted login response that triggers a divide-by-zero error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-19T10:00:00.000Z
CVE-2008-7014 
fhttpd 0.4.2 allows remote attackers to cause a denial of service (crash) via an Authorization HTTP header with an invalid character after the Basic value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-19T10:00:00.000Z
CVE-2008-7015 
Unreal engine 3, as used in Unreal Tournament 3 1.3, Frontlines: Fuel of War 1.1.1, and other products, allows remote attackers to cause a denial of service (server exit) via a packet with a large length value that triggers a memory allocation failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-19T10:00:00.000Z
CVE-2008-7016 
tnftpd before 20080929 splits large command strings into multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unknown vectors, probably involving a crafted ftp:// link to a tnftpd server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T14:00:00.000Z
CVE-2008-7017 
Cross-site scripting (XSS) vulnerability in analyse.php in CAcert 20080921, and possibly other versions before 20080928, allows remote attackers to inject arbitrary web script or HTML via the CN (CommonName) field in the subject of an X.509 certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T14:00:00.000Z
CVE-2008-7018 
Cross-site scripting (XSS) vulnerability in NashTech Easy PHP Calendar 6.3.25 allows remote attackers to inject arbitrary web script or HTML via the Details field (descr parameter) in an Add New Event action in an unspecified request as generated by an add action in index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T14:00:00.000Z
CVE-2008-7019 
Esqlanelapse 2.6.1 and 2.6.2 allows remote attackers to bypass authentication and gain privileges via modified (1) enombre and (2) euri cookies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T14:00:00.000Z
CVE-2008-7020 
McAfee SafeBoot Device Encryption 4 build 4750 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T14:00:00.000Z
CVE-2008-7021 
Unrestricted file upload vulnerability in editlogo.php in AvailScript Jobs Portal Script allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as an image or logo, then accessing it via a direct request to the file in an unspecified directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T14:00:00.000Z
CVE-2008-7022 
Insecure method vulnerability in ChilkatMail_v7_9.dll in the Chilkat Software IMAP ActiveX control (ChilkatMail2.ChilkatMailMan2.1) allows remote attackers to execute arbitrary programs via the LoadXmlEmail method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T14:00:00.000Z
CVE-2008-7023 
Aruba Mobility Controller running ArubaOS 3.3.1.16, and possibly other versions, installs the same default X.509 certificate for all installations, which allows remote attackers to bypass authentication. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's security documentation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T14:00:00.000Z
CVE-2008-7024 
admin.php in Arz Development The Gemini Portal 4.7 and earlier allows remote attackers to bypass authentication and gain administrator privileges by setting the user cookie to "admin" and setting the name parameter to "users."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T14:00:00.000Z
CVE-2008-7025 
TrueVector in Check Point ZoneAlarm 8.0.020.000, with vsmon.exe running, allows remote HTTP proxies to cause a denial of service (crash) and disable the HIDS module via a crafted response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T14:00:00.000Z
CVE-2008-7026 
Unrestricted file upload vulnerability in filesystem3.class.php in eFront 3.5.1 build 2710 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension as an avatar, then accessing it via a direct request to the file in (1) student/avatars/ or (2) professor/avatars/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T14:00:00.000Z
CVE-2008-7027 
Libra File Manager 1.18 and earlier allows remote attackers to bypass authentication and gain privileges by setting the user and pass cookies to 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T14:00:00.000Z
CVE-2008-7028 
RPG.Board 0.8 Beta2 and earlier allows remote attackers to bypass authentication and gain privileges by setting the keep4u cookie to a certain value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T14:00:00.000Z
CVE-2008-7029 
Unrestricted file upload vulnerability in usercp.php in AlilG Application AliBoard Beta allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as an avatar, then accessing it via a direct request to the file in uploads/avatars/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7030 
Multiple SQL injection vulnerabilities in Site2Nite Real Estate Web allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field to an unspecified component, possibly agentlist.asp.  NOTE: this issue was disclosed by an unreliable researcher, so it might be incorrect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7031 
Heap-based buffer overflow in Foxit Remote Access Server (aka WAC Server) 2.0 Build 3503 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long SSH packets, a different vulnerability than CVE-2008-0151.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7032 
Web Management Console Cross-site request forgery (CSRF) vulnerability in the web management console in F5 BIG-IP 9.4.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrators and execute shell commands, as demonstrated using tmui/Control/form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7033 
SQL injection vulnerability in the Simple Shop Galore (com_simpleshop) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the section parameter in a section action to index.php, a different vulnerability than CVE-2008-2568.  NOTE: this issue was disclosed by an unreliable researcher, so the details might be incorrect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7034 
PHP remote file inclusion vulnerability in kernel/smarty/Smarty.class.php in PHPEcho CMS 2.0 rc3 allows remote attackers to execute arbitrary PHP code via a URL in unspecified vectors that modify the _smarty_compile_path variable in the fetch function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7035 
Cross-site scripting (XSS) vulnerability in an unspecified component in Simple Machines phpRaider 1.0.7 allows remote attackers to inject arbitrary web script or HTML via the resistance field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7036 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in DevTracker module 3.0 for bcoos 1.1.11 and earlier, and DevTracker module 0.20 for E-XooPS 1.0.8 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) direction and (2) order_by parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7037 
The Sidebar gadget in ITN News Gadget (aka ITN Hub Gadget) 1.06 for Windows Vista, and possibly other versions before 1.23, allows remote web servers or man-in-the-middle attackers to execute arbitrary commands via script in a short_title response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7038 
SQL injection vulnerability in the My_eGallery module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the gid parameter in a showgall action to modules.php.  NOTE: this issue was disclosed by an unreliable researcher, so the details might be incorrect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7039 
Cross-site scripting (XSS) vulnerability in admin/comments.php in Gelato CMS 0.95 allows remote attackers to inject arbitrary web script or HTML via the content parameter in a comment.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7040 
SQL injection vulnerability in ahah/sf-profile.php in the Yellow Swordfish Simple Forum module for Wordpress allows remote attackers to execute arbitrary SQL commands via the u parameter.  NOTE: this issue was disclosed by an unreliable researcher, so the details might be incorrect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7041 
AJ Classifieds allows remote attackers to bypass authentication and gain administrator privileges via a direct request to admin/home.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7042 
PHP remote file inclusion vulnerability in url.php in FreshScripts Fresh Email Script 1.0 through 1.11 allows remote attackers to execute arbitrary PHP code via a URL in the tmp_sid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7043 
Cross-site scripting (XSS) vulnerability in register.php in FreshScripts Fresh Email Script 1.0 through 1.11 allows remote attackers to inject arbitrary web script or HTML via the Email parameter.  NOTE: this can be leveraged to modify cookies and conduct session fixation attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7044 
SQL injection vulnerability in admin/include/newpoll.php in AJ Square Free Polling Script (AJPoll) Database version allows remote attackers to execute arbitrary SQL commands via the ques parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7045 
AJ Square Free Polling Script (AJPoll) Database version allows remote attackers to bypass authentication and reset poll votes via a direct request to admin/resetvote.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7046 
AJ Square Free Polling Script (AJPoll) allows remote attackers to bypass authentication and create new polls via a direct request to admin/include/newpoll.php, a different vector than CVE-2008-7045. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7047 
NatterChat 1.1 allows remote attackers to bypass authentication and gain administrator privileges to read or delete rooms and messages via a direct request to admin/home.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7048 
Multiple cross-site scripting (XSS) vulnerabilities in NatterChat 1.12 allow remote attackers to inject arbitrary web script or HTML via the (1) txtUsername parameter to registerDo.asp, as invoked from register.asp, or (2) txtRoomName parameter to room_new.asp.  NOTE: these issues might be resultant from XSS in SQL error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7049 
Multiple SQL injection vulnerabilities in login.asp in NatterChat 1.1 and 1.12 allow remote attackers to execute arbitrary SQL commands via the (1) txtUsername parameter (aka Username) and (2) txtPassword parameter (aka Password) in a form generated by home.asp.  NOTE: due to lack of details, it is not clear whether this is related to CVE-2004-2206.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7050 
The password_check function in auth/auth_phpbb3.php in WoW Raid Manager 3.5.1 before Patch 1, when using PHPBB3 authentication, (1) does not invoke the CheckPassword function with the required arguments, which always triggers an authentication failure, and (2) returns true instead of false when an authentication failure occurs, which allows remote attackers to bypass authentication and gain privileges with an arbitrary password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7051 
AJ Square AJ Article allows remote attackers to bypass authentication and access administrator functionality via a direct request to (1) user.php, (2) articles.php, (3) articlesuspend.php, (4) site.php, (5) statistics.php, (6) mail.php, (7) category.php, (8) subcategory.php, (9) changepassword.php, (10) polling.php, and (11) logo.php in admin/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7052 
Unrestricted file upload vulnerability in profile.php in Pre Projects Pre Real Estate Listings allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile logo, then accessing it via a direct request to the file in re_images/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T10:00:00.000Z
CVE-2008-7053 
LogMeIn Remote Access Utility ActiveX control (RACtrl.dll) allows remote attackers to cause a denial of service (crash) by setting the fgcolor and bgcolor properties to certain long values that trigger memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T19:00:00.000Z
CVE-2008-7054 
Multiple directory traversal vulnerabilities in ezContents 2.0.3 allow remote attackers to include and execute arbitrary local files via the (1) gsLanguage and (2) language_home parameters to modules/diary/showdiary.php; (3) admin_home, (4) gsLanguage, and (5) language_home parameters to modules/diary/showdiarydetail.php; (6) gsLanguage and (7) language_home parameters to modules/diary/submit_diary.php; (8) admin_home parameter to modules/news/news_summary.php; (9) nLink, (10) gsLanguage, and (11) language_home parameters to modules/news/inlinenews.php; and possibly other unspecified vectors in (12) diary/showeventlist.php, (13) gallery/showgallery.php, (14) reviews/showreviews.php, (15) gallery/showgallerydetails.php, (16) reviews/showreviewsdetails.php, (17) news/shownewsdetails.php, (18) gallery/submit_gallery.php, (19) guestbook/submit_guestbook.php, (20) reviews/submit_reviews.php, (21) news/submit_news.php, (22) diary/inlineeventlist.php, and (23) news/archivednews_summary.php in modules/, related to the lack of directory traversal protection in modules/moduleSec.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T19:00:00.000Z
CVE-2008-7055 
module.php in ezContents 2.0.3 allows remote attackers to bypass the directory traversal protection mechanism to include and execute arbitrary local files via "....//" (doubled dot dot slash) sequences in the link parameter, which is not properly filtered using the str_replace function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T19:00:00.000Z
CVE-2008-7056 
BandSite CMS 1.1.4 does not perform access control for adminpanel/phpmydump.php, which allows remote attackers to obtain copies of the database via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T19:00:00.000Z
CVE-2008-7057 
Cross-site scripting (XSS) vulnerability in merchandise.php in BandSite CMS 1.1.4 allows remote attackers to inject arbitrary HTML or web script via the type parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T19:00:00.000Z
CVE-2008-7058 
Cross-site request forgery (CSRF) vulnerability in BandSite CMS 1.1.4 allows remote attackers to hijack the authentication of administrators and force a logout via adminpanel/logout.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T19:00:00.000Z
CVE-2008-7059 
SQL injection vulnerability in index.php in One-News Beta 2 allows remote attackers to execute arbitrary SQL commands via the q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T19:00:00.000Z
CVE-2008-7060 
Multiple cross-site scripting (XSS) vulnerabilities in One-News Beta 2 allow remote attackers to inject arbitrary HTML and web script via the (1) title or (2) content parameters in a news item to add.php, and the (3) itemnum, (4) author, or (5) comment parameters in a comment to index.php.  NOTE: vectors 1 and 2 require user authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T19:00:00.000Z
CVE-2008-7061 
The tooltip manager (chrome/views/tooltip_manager.cc) in Google Chrome 0.2.149.29 Build 1798 and possibly other versions before 0.2.149.30 allows remote attackers to cause a denial of service (CPU consumption or crash) via a tag with a long title attribute, which is not properly handled when displaying a tooltip, a different vulnerability than CVE-2008-6994.  NOTE: there is inconsistent information about the environments under which this issue exists.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-24T19:00:00.000Z
CVE-2008-7062 
Unrestricted file upload vulnerability in admin/index.php in Download Manager module 1.0 for LoveCMS 1.6.2 Final allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7063 
Ocean12 FAQ Manager Pro stores sensitive data under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for admin/o12faq.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7064 
Directory traversal vulnerability in the get_lang function in global.php in Quicksilver Forums 1.4.2 and earlier, as used in QSF Portal before 1.4.5, when running on Windows, allows remote attackers to include and execute arbitrary local files via a "\" (backslash) in the lang parameter to index.php, which bypasses a protection mechanism that only checks for "/" (forward slash), as demonstrated by uploading and including PHP code in an avatar file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7065 
Siemens C450 IP and C475 IP VoIP devices allow remote attackers to cause a denial of service (disconnected calls and device reboot) via a crafted SIP packet to UDP port 5060.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7066 
OpenForum 0.66 Beta allows remote attackers to bypass authentication and reset passwords of other users via a direct request with the update parameter set to 1 and modified user and password parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7067 
PHP remote file inclusion vulnerability in admin/plugins/Online_Users/main.php in PageTree CMS 0.0.2 BETA 0001 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[PT_Config][dir][data] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7068 
The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte.  NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have permissions to truncate the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7069 
All Club CMS (ACCMS) 0.0.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database configuration information, including credentials, via a direct request to accms.dat.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z