rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-1531 
The connection_state_machine function (connections.c) in lighttpd 1.4.19 and earlier, and 1.5.x before 1.5.0, allows remote attackers to cause a denial of service (active SSL connection loss) by triggering an SSL error, such as disconnecting before a download has finished, which causes all active SSL connections to be lost.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-27T23:00:00.000Z
CVE-2008-1532 
Perlbal before 1.70, when buffered upload is enabled, allows remote attackers to cause a denial of service (crash) via a zero-byte chunked upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-28T00:00:00.000Z
CVE-2008-1533 
Unspecified vulnerability in the XML-RPC Blogger API plugin in Joomla! 1.5 allows remote attackers to perform unauthorized article operations on articles via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-28T00:00:00.000Z
CVE-2008-1534 
Multiple directory traversal vulnerabilities in PowerPHPBoard 1.00b allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) settings[footer] parameter to footer.inc.php and the (2) settings[header] parameter to header.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-28T18:00:00.000Z
CVE-2008-1535 
SQL injection vulnerability in the Matti Kiviharju rekry (aka com_rekry or rekry!Joom) 1.0.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the op_id parameter in a view action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-28T18:00:00.000Z
CVE-2008-1536 
Cross-site scripting (XSS) vulnerability in index.php in Pictures Pro (aka Tim Grissett) Photo Cart 4.1 allows remote attackers to inject arbitrary web script or HTML via the amessage parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-28T18:00:00.000Z
CVE-2008-1537 
Directory traversal vulnerability in pb_inc/admincenter/index.php in PowerScripts PowerBook 1.21 allows remote attackers to include and execute arbitrary local files via a ..  (dot dot) in the page parameter.  NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-28T18:00:00.000Z
CVE-2008-1538 
Cross-site scripting (XSS) vulnerability in searchAction.do in ManageEngine EventLog Analyzer 5 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Fixed in EventLog Analyzer 10.0 Build 10000.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-28T18:00:00.000Z
CVE-2008-1539 
SQL injection vulnerability in includes/dynamic_titles.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbitrary SQL commands via the p parameter to modules.php for the Forums module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-28T18:00:00.000Z
CVE-2008-1540 
SQL injection vulnerability in the Datsogallery (com_datsogallery) 1.3.1 module for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-28T18:00:00.000Z
CVE-2008-1541 
Directory traversal vulnerability in cgi-bin/his-webshop.pl in HIS Webshop 2.50 allows remote attackers to read arbitrary files via a .. (dot dot) in the t parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-28T18:00:00.000Z
CVE-2008-1542 
Airspan Base Station Distribution Unit (BSDU) has "topsecret" as its password for the root account, which allows remote attackers to obtain administrative access via a telnet login, a different vulnerability than CVE-2008-1262.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-28T23:00:00.000Z
CVE-2008-1543 
The Advanced User Interface Pages in the ProST Web Management component on the Airspan WiMAX ProST have a certain default User ID and password, which makes it easier for remote attackers to obtain partial administrative access, a different vulnerability than CVE-2008-1262.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-28T23:00:00.000Z
CVE-2008-1544 
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length header, (2) access arbitrary virtual hosts via a modified Host header, (3) bypass referrer restrictions via an incorrect Referer header, and (4) bypass the same-origin policy and obtain sensitive information via a crafted request header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-28T23:00:00.000Z
CVE-2008-1545 
The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-28T23:00:00.000Z
CVE-2008-1546 
servlet/MIMEReceiveServlet in the web controller for Mitsubishi Electric GB-50 and GB-50A air-conditioning control systems allows remote attackers to cause a denial of service (air-conditioning outage) via an XML document containing a setRequest command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-28T23:00:00.000Z
CVE-2008-1547 
Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 (aka build 6.5.7638) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-21T00:00:00.000Z
CVE-2008-1548 
Multiple cross-site scripting (XSS) vulnerabilities in Aeries Browser Interface (ABI) 3.8.3.14 in Eagle Software Aries Student Information System allow remote attackers to inject arbitrary web script or HTML via the (1) UserName parameter to loginproc.asp and the (2) usr parameter to Login.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T17:00:00.000Z
CVE-2008-1549 
Multiple SQL injection vulnerabilities in Aeries Browser Interface (ABI) 3.8.3.14 in Eagle Software Aries Student Information System allow remote attackers to execute arbitrary SQL commands via the (1) GrdBk parameter to GradebookOptions.asp and the (2) SchlCode variable to loginproc.asp, a different vector than CVE-2008-0942.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T17:00:00.000Z
CVE-2008-1550 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in CubeCart 4.2.1 allow remote attackers to inject arbitrary web script or HTML via (1) the _a parameter in a searchStr action and the (2) Submit parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T17:00:00.000Z
CVE-2008-1551 
SQL injection vulnerability in viewcat.php in the Photo 3.02 module for RunCMS allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T17:00:00.000Z
CVE-2008-1552 
The silc_pkcs1_decode function in the silccrypt library (silcpkcs1.c) in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.7, SILC Client before 1.1.4, and SILC Server before 1.1.2 allows remote attackers to execute arbitrary code via a crafted PKCS#1 message, which triggers an integer underflow, signedness error, and a buffer overflow.  NOTE: the researcher describes this as an integer overflow, but CVE uses the "underflow" term in cases of wraparound from unsigned subtraction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T17:00:00.000Z
CVE-2008-1553 
Directory traversal vulnerability in mod.php in TopperMod 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the to parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T17:00:00.000Z
CVE-2008-1554 
SQL injection vulnerability in account/index.php in TopperMod 2.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via a non-alphanumeric first character the localita parameter, which bypasses a protection mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T17:00:00.000Z
CVE-2008-1555 
Directory traversal vulnerability in system/_b/contentFiles/gbincluder.php in BolinOS 4.6.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _bFileToInclude parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T17:00:00.000Z
CVE-2008-1556 
Multiple cross-site scripting (XSS) vulnerabilities in BolinOS 4.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to (a) system/actionspages/_b/contentFiles/gBImageViewer.php, (2) ForEditor parameter to (b) system/actionspages/_b/contentFiles/gBselectorContents.php, (3) the PATH_INFO to (c) gBLoginPage.php and (d) gBPassword.php in system/actionspages/_b/contentFiles/, (4) formlogin parameter to system/actionspages/_b/contentFiles/gBLoginPage.php, and the (5) bolini_searchengine46Search parameter to (e) help/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T17:00:00.000Z
CVE-2008-1557 
BolinOS 4.6.1 allows remote attackers to obtain sensitive information via a direct request to system/actionspages/_b/contentFiles/gBphpInfo.php, which calls the phpinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T17:00:00.000Z
CVE-2008-1558 
Uncontrolled array index in the sdpplin_parse function in stream/realrtsp/sdpplin.c in MPlayer 1.0 rc2 allows remote attackers to overwrite memory and execute arbitrary code via a large streamid SDP parameter.  NOTE: this issue has been referred to as an integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T17:00:00.000Z
CVE-2008-1559 
SQL injection vulnerability in the Bernard Gilly AlphaContent (com_alphacontent) 2.5.8 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T17:00:00.000Z
CVE-2008-1560 
Multiple cross-site scripting (XSS) vulnerabilities in Digiappz DigiDomain 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) domain parameter to lookup_result.asp, and the (2) word1 and (3) word2 parameters to suggest_result.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T22:00:00.000Z
CVE-2008-1561 
Multiple unspecified vulnerabilities in Wireshark (formerly Ethereal) 0.99.5 through 0.99.8 allow remote attackers to cause a denial of service (application crash) via a malformed packet to the (1) X.509sat or (2) Roofnet dissectors.  NOTE: Vector 2 might also lead to a hang.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T22:00:00.000Z
CVE-2008-1562 
The LDAP dissector in Wireshark (formerly Ethereal) 0.99.2 through 0.99.8 allows remote attackers to cause a denial of service (application crash) via a malformed packet, a different vulnerability than CVE-2006-5740.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T22:00:00.000Z
CVE-2008-1563 
The "decode as" feature in packet-bssap.c in the SCCP dissector in Wireshark (formerly Ethereal) 0.99.6 through 0.99.8 allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T22:00:00.000Z
CVE-2008-1564 
Directory traversal vulnerability in Dan Costin File Transfer before 1.2f allows remote attackers to read arbitrary files via a "..\" (dot dot backslash) in the filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T22:00:00.000Z
CVE-2008-1565 
Directory traversal vulnerability in forum/irc/irc.php in the PJIRC 0.5 module for phpBB allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phpEx parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T22:00:00.000Z
CVE-2008-1566 
Cross-site scripting (XSS) vulnerability in Search.do in ManageEngine Applications Manager 8.x allows remote attackers to inject arbitrary web script or HTML via the query parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T22:00:00.000Z
CVE-2008-1567 
phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and the (3) Blowfish secret key, in cleartext in a Session file under /tmp, which allows local users to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T22:00:00.000Z
CVE-2008-1568 
comix 3.6.4 allows attackers to execute arbitrary commands via a filename containing shell metacharacters that are not properly sanitized when executing the rar, unrar, or jpegtran programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T22:00:00.000Z
CVE-2008-1569 
policyd-weight 0.1.14 beta-16 and earlier allows local users to modify or delete arbitrary files via a symlink attack on temporary files that are used when creating a socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T22:00:00.000Z
CVE-2008-1570 
Race condition in the create_lockpath function in policyd-weight 0.1.14 beta-16 allows local users to modify or delete arbitrary files by creating the LOCKPATH directory, then modifying it after the symbolic link check occurs.  NOTE: this is due to an incomplete fix for CVE-2008-1569.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T22:00:00.000Z
CVE-2008-1571 
Directory traversal vulnerability in the embedded web server in Image Capture in Apple Mac OS X before 10.5 allows remote attackers to read arbitrary files via directory traversal sequences in the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-02T14:00:00.000Z
CVE-2008-1572 
Image Capture in Apple Mac OS X before 10.5 does not properly use temporary files, which allows local users to overwrite arbitrary files, and display images that are being resized by this application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-02T14:00:00.000Z
CVE-2008-1573 
The BMP and GIF image decoding engine in ImageIO in Apple Mac OS X before 10.5.3 allows remote attackers to obtain sensitive information (memory contents) via a crafted (1) BMP or (2) GIF image, which causes an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-02T14:00:00.000Z
CVE-2008-1574 
Integer overflow in ImageIO in Apple Mac OS X before 10.5.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG2000 image that triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-02T14:00:00.000Z
CVE-2008-1575 
Unspecified vulnerability in the Apple Type Services (ATS) server in Apple Mac OS X 10.5 before 10.5.3 allows user-assisted remote attackers to execute arbitrary code via a crafted embedded font in a PDF document, related to memory corruption that occurs during printing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-02T14:00:00.000Z
CVE-2008-1576 
Mail in Apple Mac OS X before 10.5, when an IPv6 SMTP server is used, does not properly initialize memory, which might allow remote attackers to execute arbitrary code or cause a denial of service (application crash), or obtain sensitive information (memory contents) in opportunistic circumstances, by sending an e-mail message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-02T14:00:00.000Z
CVE-2008-1577 
Unspecified vulnerability in the Pixlet codec in Apple Pixlet Video in Apple Mac OS X before 10.5.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file, related to "multiple memory corruption issues."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-02T14:00:00.000Z
CVE-2008-1578 
The sso_util program in Single Sign-On in Apple Mac OS X before 10.5.3 places passwords on the command line, which allows local users to obtain sensitive information by listing the process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-02T14:00:00.000Z
CVE-2008-1579 
Wiki Server in Apple Mac OS X 10.5 before 10.5.3 allows remote attackers to obtain sensitive information (user names) by reading the error message produced upon access to a nonexistent blog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-02T14:00:00.000Z
CVE-2008-1580 
CFNetwork in Safari in Apple Mac OS X before 10.5.3 automatically sends an SSL client certificate in response to a web server's certificate request, which allows remote web sites to obtain sensitive information (Subject data) from personally identifiable certificates, and use arbitrary certificates to track user activities across domains, a related issue to CVE-2007-4879.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-02T14:00:00.000Z
CVE-2008-1581 
Heap-based buffer overflow in Apple QuickTime before 7.5 on Windows allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted packed scanlines in PixData structures in a PICT image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-10T18:00:00.000Z
CVE-2008-1582 
Unspecified vulnerability in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted AAC-encoded file that triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-10T18:00:00.000Z
CVE-2008-1583 
Heap-based buffer overflow in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PICT image, a different vulnerability than CVE-2008-1581.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-10T18:00:00.000Z
CVE-2008-1584 
Stack-based buffer overflow in Indeo.qtx in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via crafted Indeo video codec content in a movie file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-10T18:00:00.000Z
CVE-2008-1585 
Apple QuickTime before 7.5 uses the url.dll!FileProtocolHandler handler for unrecognized URIs in qt:next attributes within SMIL text in video files, which sends these URIs to explorer.exe and thereby allows remote attackers to execute arbitrary programs, as originally demonstrated by crafted file: URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-10T18:00:00.000Z
CVE-2008-1586 
ImageIO in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 allow remote attackers to cause a denial of service (memory consumption and device reset) via a crafted TIFF image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-25T23:00:00.000Z
CVE-2008-1588 
Safari on Apple iPhone before 2.0 and iPod touch before 2.0 allows remote attackers to spoof the address bar via Unicode ideographic spaces in the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-14T18:00:00.000Z
CVE-2008-1589 
Safari on Apple iPhone before 2.0 and iPod touch before 2.0 misinterprets a menu button press as user confirmation for visiting a web site with a (1) self-signed or (2) invalid certificate, which makes it easier for remote attackers to spoof web sites.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-14T18:00:00.000Z
CVE-2008-1590 
JavaScriptCore in WebKit on Apple iPhone before 2.0 and iPod touch before 2.0 does not properly perform runtime garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors that trigger memory corruption, a different vulnerability than CVE-2008-2317.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-14T18:00:00.000Z
CVE-2008-1591 
The pnVarPrepForStore function in PostNuke 0.764 and earlier skips input sanitization when magic_quotes_runtime is enabled, which allows remote attackers to conduct SQL injection attacks and execute arbitrary SQL commands via input associated with server variables, as demonstrated by the CLIENT_IP HTTP header (HTTP_CLIENT_IP variable).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T23:00:00.000Z
CVE-2008-1592 
MQSeries 5.1 in IBM WebSphere MQ 5.1 through 5.3.1 on the HP NonStop and Tandem NSK platforms does not require mqm group membership for execution of administrative tasks, which allows local users to bypass intended access restrictions via the runmqsc program, related to "Pathway panels."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T23:00:00.000Z
CVE-2008-1593 
The checkpoint and restart feature in the kernel in IBM AIX 5.2, 5.3, and 6.1 does not properly protect kernel memory, which allows local users to read and modify portions of memory and gain privileges via unspecified vectors involving a restart of a 64-bit process, probably related to the as_getadsp64 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-31T23:00:00.000Z