rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-1983 
PHP remote file inclusion vulnerability in include/default_header.php in Cyboards PHP Lite 1.21 allows remote attackers to execute arbitrary PHP code via a URL in the script_path parameter, a different vector than CVE-2006-2871.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T01:00:00.000Z
CVE-2007-1984 
PHP remote file inclusion vulnerability in index.php in lite-cms 0.2.1 allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T01:00:00.000Z
CVE-2007-1985 
Multiple PHP remote file inclusion vulnerabilities in phpexplorator.php in phpexplorator 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) cmd or (2) lang_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T01:00:00.000Z
CVE-2007-1986 
Multiple PHP remote file inclusion vulnerabilities in barnraiser AROUNDMe 0.7.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) language_path_core parameter to inc/core_profile.header.php, the (2) template_path_core parameter to template/barnraiser_01/maint_contact_view.tpl.php, and the (3) template_path parameter to template/barnraiser_01/default.tpl.php. NOTE: this issue might overlap CVE-2006-5533.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T01:00:00.000Z
CVE-2007-1987 
Multiple PHP remote file inclusion vulnerabilities in PHPEcho CMS 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) _plugin_file parameter to smarty/internals/core.load_pulgins.php or the (2) root_path parameter to index.php.  NOTE: CVE disputes (1) because the inclusion occurs within a function that is not called during a direct request. CVE disputes (2) because root_path is defined in config.php before use
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T01:00:00.000Z
CVE-2007-1988 
Cross-site scripting (XSS) vulnerability in kernel/filters.inc.php in PHPEcho CMS 2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T01:00:00.000Z
CVE-2007-1989 
Multiple cross-site scripting (XSS) vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the (1) post_id parameter to ecrire/trackback.php or the (2) tool_url parameter to tools/thememng/index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T10:00:00.000Z
CVE-2007-1990 
PHP remote file inclusion vulnerability in games.php in Sam Crew MyBlog, possibly 1.0 through 1.6, allows remote attackers to execute arbitrary PHP code via a URL in the id parameter, a different vector than CVE-2007-1968.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T10:00:00.000Z
CVE-2007-1991 
Cross-site scripting (XSS) vulnerability in mail/signup.asp in CmailServer WebMail 5.4.3, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the Comment parameter, a different vector than CVE-2007-1927.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T10:00:00.000Z
CVE-2007-1992 
Multiple PHP remote file inclusion vulnerabilities in the com_zoom 2.5 beta 2 and earlier module for Mambo allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) EXIF_Makernote.php or (2) EXIF.php in classes/iptc/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T10:00:00.000Z
CVE-2007-1993 
Buffer overflow in the pfs_mountd.rpc RPC daemon in the Portable File System (PFS) in HP-UX B.11.00, B.11.11, and B.11.23 allows remote attackers to execute arbitrary code by sending "a call to procedure 5, followed by a crafted payload to procedure 2."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T10:00:00.000Z
CVE-2007-1994 
Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport functionality in HP-UX B.11.00 allows local users to cause a denial of service via unknown vectors.  NOTE: due to lack of vendor details, it is not clear whether this is the same as CVE-2007-0916.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T10:00:00.000Z
CVE-2007-1995 
bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T10:00:00.000Z
CVE-2007-1996 
PHP remote file inclusion vulnerability in codebreak.php in CodeBreak, probably 1.1.2 and earlier, allows remote attackers to execute arbitrary PHP code via a URL in the process_method parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T10:00:00.000Z
CVE-2007-1997 
Integer signedness error in the (1) cab_unstore and (2) cab_extract functions in libclamav/cab.c in Clam AntiVirus (ClamAV) before 0.90.2 allow remote attackers to execute arbitrary code via a crafted CHM file that contains a negative integer, which passes a signed comparison and leads to a stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T21:00:00.000Z
CVE-2007-1998 
Direct static code injection vulnerability in HIOX Guest Book (HGB) 4.0 allows remote attackers to inject arbitrary PHP code via the Email field, which results in code execution through a direct request to gb.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-1999 
PHP remote file inclusion vulnerability in index.php in Weatimages 1.7.1 and earlier, when weatimages.ini is missing, allows remote attackers to execute arbitrary PHP code via a URL in the ini[langpack] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-20001 
A flaw was found in StarWind iSCSI target. An attacker could script standard iSCSI Initiator operation(s) to exhaust the StarWind service socket, which could lead to denial of service. This affects iSCSI SAN (Windows Native) Version 3.2.2 build 2007-02-20.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-06T20:19:06.000Z
CVE-2007-2000 
Multiple SQL injection vulnerabilities in admin/admin.php in Crea-Book 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) pseudo or (2) passe parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2001 
Multiple direct static code injection vulnerabilities in admin/configurer2.php in Crea-Book 1.0 and earlier allow remote authenticated administrators to execute arbitrary PHP code via the "Fond de la page" (background color) field and other unspecified fields, which injects into config.inc.php3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2002 
InoutMailingListManager 3.1 and earlier allows remote attackers to access certain restricted functionality, and upload and execute arbitrary PHP code, by setting an arbitrary admin cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2003 
InoutMailingListManager 3.1 and earlier sends a Location redirect header but does not exit after an authorization check fails, which allows remote attackers to access certain restricted functionality, and upload and execute arbitrary PHP code, by ignoring the redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2004 
Multiple SQL injection vulnerabilities in InoutMailingListManager 3.1 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter to changename.php and other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2005 
Multiple PHP remote file inclusion vulnerabilities in the Taskhopper 1.1 component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) contact_type.php, (2) itemstatus_type.php, (3) projectstatus_type.php, (4) request_type.php, (5) responses_type.php, (6) timelog_type.php, or (7) urgency_type.php in inc/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2006 
Multiple SQL injection vulnerabilities in login.php in pL-PHP beta 0.9 allow remote attackers to execute arbitrary SQL commands via the (1) login or (2) pass parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2007 
admin.php in pL-PHP beta 0.9 allows remote attackers to bypass authentication by setting the is_admin parameter to 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2008 
Directory traversal vulnerability in admin.php in pL-PHP beta 0.9 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2009 
PHP remote file inclusion vulnerability in index.php in SimpCMS Light 04.10.2007 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the site parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2010 
Double free vulnerability in bftpd before 1.8 allows remote authenticated users to cause a denial of service (daemon crash) via a (1) get or (2) mget command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2011 
Cross-site scripting (XSS) vulnerability in login.php in DeskPro 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2012 
Multiple directory traversal vulnerabilities in MimarSinan CompreXX 4.1 allow remote attackers to create files in arbitrary directories via a .. (dot dot) in a (1) .rar, (2) .jar or (3) .zip archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2013 
Cross-site scripting (XSS) vulnerability in index.php in JEx-Treme Einfacher Passworschutz allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2014 
PHP remote file inclusion vulnerability in include/blocks/week_events.php in MyNews 4.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the myNewsConf[path][sys][index] parameter, a different vector than CVE-2007-0633.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2015 
PHP remote file inclusion vulnerability in index.php in Request It 1.0b allows remote attackers to execute arbitrary PHP code via a URL in the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2016 
Cross-site scripting (XSS) vulnerability in mysql/phpinfo.php in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the lang[] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2017 
siteadmin/useredit.php in AlstraSoft Video Share Enterprise does not check authentication, which allows remote attackers to obtain or modify user information via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2018 
SQL injection vulnerability in msg.php in AlstraSoft Video Share Enterprise allows remote authenticated users to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2019 
PHP remote file inclusion vulnerability in init.gallery.php in phpGalleryScript 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the include_class parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2020 
Unspecified vulnerability in administration.php in xodagallery allows remote attackers to execute arbitrary code via the cmd parameter. NOTE: CVE disputes this vulnerability because administration.php does not use the cmd parameter for inclusion
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2021 
Multiple PHP remote file inclusion vulnerabilities in Pineapple Technologies Lore 1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) lang_path parameter to third_party/phpmailer/class.phpmailer.php or the (2) get_plugin_file_path parameter to third_party/smarty/libs/plugins/function.html_checkboxes.php.  NOTE: the affected files might be from other software packages, so this might not be a vulnerability in Lore itself.  NOTE: (1) might be the same issue as CVE-2006-5734.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2007-2022 
Adobe Macromedia Flash Player 7 and 9, when used with Opera before 9.20 or Konqueror before 20070613, allows remote attackers to obtain sensitive information (browser keystrokes), which are leaked to the Flash Player applet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-13T18:00:00.000Z
CVE-2007-2023 
USB20.dll in Secustick USB flash drive decouples the authorization and file access routines, which allows local users to bypass authentication requirements by altering the return value of the VerifyPassWord function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-13T18:00:00.000Z
CVE-2007-2024 
Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.x allows remote attackers to upload arbitrary PHP files with a (1) php3, (2) php4, or (3) php5 extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-13T18:00:00.000Z
CVE-2007-2025 
Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.11p1 allows remote attackers to upload arbitrary PHP files with a double extension, as demonstrated by .php.3, which is interpreted by Apache as being a valid PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-13T18:00:00.000Z
CVE-2007-2026 
The gnu regular expression code in file 4.20 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted document with a large number of line feed characters, which is not well handled by OS/2 REXX regular expressions that use wildcards, as originally reported for AMaViS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-13T18:00:00.000Z
CVE-2007-2027 
Untrusted search path vulnerability in the add_filename_to_string function in intl/gettext/loadmsgcat.c for Elinks 0.11.1 allows local users to cause Elinks to use an untrusted gettext message catalog (.po file) in a "../po" directory, which can be leveraged to conduct format string attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-13T18:00:00.000Z
CVE-2007-2028 
Memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of EAP-TTLS tunnel connections using malformed Diameter format attributes, which causes the authentication request to be rejected but does not reclaim VALUE_PAIR data structures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-13T18:00:00.000Z
CVE-2007-2029 
File descriptor leak in the PDF handler in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service via a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2030 
lharc.c in lha does not securely create temporary files, which might allow local users to read or write files by creating a file before LHA is invoked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T20:00:00.000Z
CVE-2007-2031 
Buffer overflow in the HTTP proxy service for 3proxy 0.5 to 0.5.3g, and 0.6b-devel before 20070413, might allow remote attackers to execute arbitrary code via crafted transparent requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T21:00:00.000Z
CVE-2007-2032 
Cisco Wireless Control System (WCS) before 4.0.96.0 has a hard-coded FTP username and password for backup operations, which allows remote attackers to read and modify arbitrary files via unspecified vectors related to "properties of the FTP server," aka Bug ID CSCse93014.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T21:00:00.000Z
CVE-2007-2033 
Unspecified vulnerability in Cisco Wireless Control System (WCS) before 4.0.81.0 allows remote authenticated users to read any configuration page by changing the group membership of user accounts, aka Bug ID CSCse78596.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T21:00:00.000Z
CVE-2007-2034 
Unspecified vulnerability in Cisco Wireless Control System (WCS) before 4.0.87.0 allows remote authenticated users to gain the privileges of the SuperUsers group, and manage the application and its networks, related to the group membership of user accounts, aka Bug ID CSCsg05190.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T21:00:00.000Z
CVE-2007-2035 
Cisco Wireless Control System (WCS) before 4.0.66.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain network organization data via a direct request for files in certain directories, aka Bug ID CSCsg04301.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T21:00:00.000Z
CVE-2007-2036 
The SNMP implementation in the Cisco Wireless LAN Controller (WLC) before 20070419 uses the default read-only community public, and the default read-write community private, which allows remote attackers to read and modify SNMP variables, aka Bug ID CSCse02384.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T21:00:00.000Z
CVE-2007-2037 
Cisco Wireless LAN Controller (WLC) before 3.2.116.21, and 4.0.x before 4.0.155.0, allows remote attackers on a local network to cause a denial of service (device crash) via malformed Ethernet traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T21:00:00.000Z
CVE-2007-2038 
The Network Processing Unit (NPU) in the Cisco Wireless LAN Controller (WLC) before 3.2.193.5, 4.0.x before 4.0.206.0, and 4.1.x allows remote attackers on a local wireless network to cause a denial of service (loss of packet forwarding) via (1) crafted SNAP packets, (2) malformed 802.11 traffic, or (3) packets with certain header length values, aka Bug ID CSCsg36361.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T21:00:00.000Z
CVE-2007-2039 
The Network Processing Unit (NPU) in the Cisco Wireless LAN Controller (WLC) before 3.2.171.5, 4.0.x before 4.0.206.0, and 4.1.x allows remote attackers on a local wireless network to cause a denial of service (loss of packet forwarding) via (1) crafted SNAP packets, (2) malformed 802.11 traffic, or (3) packets with certain header length values, aka Bug IDs CSCsg15901 and CSCsh10841.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T21:00:00.000Z
CVE-2007-2040 
Cisco Aironet 1000 Series and 1500 Series Lightweight Access Points before 3.2.185.0, and 4.0.x before 4.0.206.0, have a hard-coded password, which allows attackers with physical access to perform arbitrary actions on the device, aka Bug ID CSCsg15192.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T21:00:00.000Z
CVE-2007-2041 
Cisco Wireless LAN Controller (WLC) before 4.0.206.0 saves the WLAN ACL configuration with an invalid checksum, which prevents WLAN ACLs from being loaded at boot time, and might allow remote attackers to bypass intended access restrictions, aka Bug ID CSCse58195.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T21:00:00.000Z
CVE-2007-2042 
Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite 1.0.6 and earlier module for Mambo allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) support.html.php or (2) info.html.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T22:00:00.000Z
CVE-2007-2043 
Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia (com_mosmedia) 1.08 and earlier module for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) media.tab.php or (2) media.divs.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T22:00:00.000Z
CVE-2007-2044 
PHP remote file inclusion vulnerability in mod_weather.php in the Antonis Ventouris Weather module for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T22:00:00.000Z
CVE-2007-2045 
Unspecified vulnerability in the IP implementation in Sun Solaris 8 and 9 allows remote attackers to cause a denial of service (CPU consumption) via crafted IP packets, probably related to fragmented packets with duplicate or missing fragments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T22:00:00.000Z