rainbutterfly/cve_corpus huggingface dataset:
CVE-2005-2503 
AppKit for Mac OS X 10.3.9 and 10.4.2 allows attackers with physical access to create local accounts by forcing a particular error to occur at the login window.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2504 
The System Profiler in Mac OS X 10.4.2 labels a Bluetooth device with "Requires Authentication: No" even when the user has selected the "Require pairing for security" option, which could confuse users about which setting is valid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2505 
Buffer overflow in CoreFoundation in Mac OS X 10.3.9 allows attackers to execute arbitrary code via command line arguments to an application that uses CoreFoundation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2506 
Algorithmic complexity vulnerability in CoreFoundation in Mac OS X 10.3.9 and 10.4.2 allows attackers to cause a denial of service (CPU consumption) via crafted Gregorian dates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2507 
Buffer overflow in Directory Services in Mac OS X 10.3.9 and 10.4.2 allows remote attackers to execute arbitrary code during authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2508 
dsidentity in Directory Services in Mac OS X 10.4.2 allows local users to add or remove user accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2509 
Unknown vulnerability in loginwindow in Mac OS X 10.4.2 and earlier, when Fast User Switching is enabled, allows attackers to log into other accounts if they know the passwords to at least two accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2510 
The Server Admin tool in servermgr_ipfilter for Mac OS X 10.4 to 10.4.2, when using multiple subnets and Address Groups, does not always properly write firewall rules to the Active Rules when certain conditions occur, which could result in firewall policies that are less restrictive than intended by the administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2511 
Unknown vulnerability in Mac OS X 10.4.2 and earlier, when using Kerberos authentication with LDAP, allows attackers to gain access to a root Terminal window.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2512 
Mail.app in Mac OS 10.4.2 and earlier, when printing or forwarding an HTML message, loads remote images even when the user's preferences state otherwise, which could result in a privacy leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2513 
Unknown vulnerability in HItoolbox for Mac OS X 10.4.2 allows VoiceOver services to read secure input fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2514 
Buffer overflow in ping in Mac OS X 10.3.9 allows local users to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2515 
Quartz Composer Screen Saver in Mac OS X 10.4.2 allows local users to access links from the RSS Visualizer even when a password is required.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2516 
Safari in Mac OS X 10.3.9 and 10.4.2, when rendering Rich Text Format (RTF) files, can directly access URLs without performing the normal security checks, which allows remote attackers to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2517 
Safari in Mac OS X 10.3.9 and 10.4.2 submits forms from an XSL formatted page to the next page that is browsed by the user, which causes form data to be sent to the wrong site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2518 
Buffer overflow in servermgrd in Mac OS X 10.3.9 and 10.4.2 allows remote attackers to execute arbitrary code during authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2519 
slpd in Directory Services in Mac OS X 10.3.9 creates insecure temporary files as root, which allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2520 
The password assistant in Mac OS X 10.4 to 10.4.2, when used to create multiple accounts from the same process, does not reset the suggested password list when the assistant is displayed, which allows attackers to view recently used passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2521 
Buffer overflow in traceroute in Mac OS X 10.3.9 allows local users to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2522 
Safari in WebKit in Mac OS X 10.4 to 10.4.2 directly accesses URLs within PDF files without the normal security checks, which allows remote attackers to execute arbitrary code via links in a PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2523 
Multiple cross-site scripting (XSS) vulnerabilities in Weblog Server in Mac OS X 10.4 to 10.4.2 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2524 
Safari after 2.0 in Apple Mac OS X 10.3.9 allows remote attackers to bypass domain restrictions via crafted web archives that cause Safari to render them as if they came from a different site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-25T04:00:00.000Z
CVE-2005-2525 
CUPS in Mac OS X 10.3.9 and 10.4.2 does not properly close file descriptors when handling multiple simultaneous print jobs, which allows remote attackers to cause a denial of service (printing halt).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2526 
CUPS in Mac OS X 10.3.9 and 10.4.2 allows remote attackers to cause a denial of service (CPU consumption) by sending a partial IPP request and closing the connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-19T04:00:00.000Z
CVE-2005-2527 
Race condition in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to corrupt files or create arbitrary files via unspecified attack vectors related to a temporary directory, possibly due to a symlink attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-05T01:00:00.000Z
CVE-2005-2529 
Unspecified vulnerability in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to gain privileges via unspecified attack vectors relating to "the utility used to update Java shared archives."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-05T01:00:00.000Z
CVE-2005-2530 
Unspecified vulnerability in Java 1.3.1 before 1.3.1_16 on Apple Mac OS X allows an untrusted applet to gain privileges, related to "Mac OS X specific extensions."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-05T01:00:00.000Z
CVE-2005-2531 
OpenVPN before 2.0.1, when running with "verb 0" and without TLS authentication, does not properly flush the OpenSSL error queue when a client fails certificate authentication to the server and causes the error to be processed by the wrong client, which allows remote attackers to cause a denial of service (client disconnection) via a large number of failed authentication attempts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-24T04:00:00.000Z
CVE-2005-2532 
OpenVPN before 2.0.1 does not properly flush the OpenSSL error queue when a packet can not be decrypted by the server, which allows remote authenticated attackers to cause a denial of service (client disconnection) via a large number of packets that can not be decrypted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-24T04:00:00.000Z
CVE-2005-2533 
OpenVPN before 2.0.1, when running in "dev tap" Ethernet bridging mode, allows remote authenticated clients to cause a denial of service (memory exhaustion) via a flood of packets with a large number of spoofed MAC addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-24T04:00:00.000Z
CVE-2005-2534 
Race condition in OpenVPN before 2.0.1, when --duplicate-cn is not enabled, allows remote attackers to cause a denial of service (server crash) via simultaneous TCP connections from multiple clients that use the same client certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-24T04:00:00.000Z
CVE-2005-2535 
Buffer overflow in the Discovery Service in BrightStor ARCserve Backup 9.0 through 11.1 allows remote attackers to execute arbitrary commands via a large packet to TCP port 41523, a different vulnerability than CVE-2005-0260.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2536 
pstotext before 1.8g does not properly use the "-dSAFER" option when calling Ghostscript to extract plain text from PostScript and PDF files, which allows remote attackers to execute arbitrary commands via a malicious PostScript file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2537 
FlatNuke 2.5.5 and possibly earlier versions allows remote attackers to obtain sensitive information via a direct request to structure.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2538 
FlatNuke 2.5.5 and possibly earlier versions allows remote attackers to obtain sensitive information via (1) a null byte or (2) an MS-DOS device name such as AUX, CON, PRN, COM1, or LPT1 in the mod parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2539 
Multiple cross-site scripting (XSS) vulnerabilities in FlatNuke 2.5.5 and possibly earlier versions allow remote attackers to inject arbitrary web script or HTML via the (1) bodycolor, (2) backimage, (3) theme, or (4) logo parameter to structure.php, (5) admin, (6) admin_mail, or (7) back parameter to footer.php, or (8) the message body in a news post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2540 
CRLF injection vulnerability in FlatNuke 2.5.5 and possibly earlier versions allows remote attackers to execute arbitrary PHP commands via an ASCII char 13 (carriage return) in the signature field, which is injected into a PHP script without a preceding comment character, which can then be executed by a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2541 
Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2542 
Invision Power Board (IPB) 1.0.3 allows remote attackers to inject arbitrary web script or HTML via an attachment, which is automatically downloaded and processed as HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2543 
Directory traversal vulnerability in wce.download.php in Comdev eCommerce 3.0 allows remote attackers to download arbitrary files via a .. (dot dot) in the download parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2544 
PHP remote file inclusion vulnerability in config.php in Comdev eCommerce 3.0 allows remote attackers to execute arbitrary PHP code via the path[docroot] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2545 
Multiple cross-site scripting (XSS) vulnerabilities in PHPOpenChat 3.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) content parameter to profile.php and profile_misc.php, (3) the profile fields in userpage.php, (4) subject or (5) body in mail.php, or (8) disinvited_chatter or (7) invited_chatter parameter to invite.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2546 
Arab Portal 2.0 allows remote attackers to obtain sensitive information via a long (1) username or (2) password, which reveals the path in an error message when the undefined "errmsg" function is called.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2547 
security.c in hcid for BlueZ 2.16, 2.17, and 2.18 allows remote attackers to execute arbitrary commands via shell metacharacters in the Bluetooth device name when invoking the PIN helper.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-12T04:00:00.000Z
CVE-2005-2548 
vlan_dev.c in the VLAN code for Linux kernel 2.6.8 allows remote attackers to cause a denial of service (kernel oops from null dereference) via certain UDP packets that lead to a function call with the wrong argument, as demonstrated using snmpwalk on snmpd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-12T04:00:00.000Z
CVE-2005-2549 
Multiple format string vulnerabilities in Evolution 1.5 through 2.3.6.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) full vCard data, (2) contact data from remote LDAP servers, or (3) task list data from remote servers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-12T04:00:00.000Z
CVE-2005-2550 
Format string vulnerability in Evolution 1.4 through 2.3.6.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the calendar entries such as task lists, which are not properly handled when the user selects the Calendars tab.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-12T04:00:00.000Z
CVE-2005-2551 
Buffer overflow in dhost.exe in iMonitor for Novell eDirectory 8.7.3 on Windows allows attackers to cause a denial of service (crash) and obtain access to files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-12T04:00:00.000Z
CVE-2005-2552 
Unknown vulnerability in HP ProLiant DL585 servers running Integrated Lights Out (ILO) firmware before 1.81 allows attackers to access server controls when the server is "powered down."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-12T04:00:00.000Z
CVE-2005-2553 
The find_target function in ptrace32.c in the Linux kernel 2.4.x before 2.4.29 does not properly handle a NULL return value from another function, which allows local users to cause a denial of service (kernel crash/oops) by running a 32-bit ltrace program with the -i option on a 64-bit executable program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-12T04:00:00.000Z
CVE-2005-2554 
The web server for Network Associates ePolicy Orchestrator Agent 3.5.0 (patch 3) uses insecure permissions for the "Common Framework\Db" folder, which allows local users to read arbitrary files by creating a subfolder in the EPO agent web root directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-12T04:00:00.000Z
CVE-2005-2555 
Linux kernel 2.6.x does not properly restrict socket policy access to users with the CAP_NET_ADMIN capability, which could allow local users to conduct unauthorized activities via (1) ipv4/ip_sockglue.c and (2) ipv6/ipv6_sockglue.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2005-2556 
core/database_api.php in Mantis 0.19.0a1 through 1.0.0a3, with register_globals enabled, allows remote attackers to connect to internal databases by modifying the g_db_type variable and monitoring the speed of responses, as identified by bug#0005956.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-24T04:00:00.000Z
CVE-2005-2557 
Cross-site scripting (XSS) vulnerability in view_all_set.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the dir parameter, as identified by bug#0005959, and a different vulnerability than CVE-2005-3090.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-28T04:00:00.000Z
CVE-2005-2558 
Stack-based buffer overflow in the init_syms function in MySQL 4.0 before 4.0.25, 4.1 before 4.1.13, and 5.0 before 5.0.7-beta allows remote authenticated users who can create user-defined functions to execute arbitrary code via a long function_name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2005-2559 
doping.php in ePing plugin 1.02 and earlier for e107 portal allows remote attackers to execute arbitrary code or overwrite files via (1) shell metacharacters in the eping_count parameter or (2) restricted shell metacharacters such as ">" and "&" in the eping_host parameter, which is not handled by the validation function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2005-2560 
Cross-site scripting (XSS) vulnerability in index.cfm in CFBB 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2005-2561 
Multiple SQL injection vulnerabilities in MYFAQ 1.0 allow remote attackers to execute arbitrary SQL commands via the Theme parameter to (1) affichagefaq.php3, (2) choixsoustheme.php3, (3) consultation.php3, (4) insfaq.php3, (5) inssoustheme.php3, (6) instheme.php3, (7) saisiefaqtotale.php3, (8) saisiesoustheme.php3, or (9) voirfaq.php3, the SousTheme parameter to (10) affichagefaq.php3, (11) consultation.php3, (12) insfaq.php3, (13) inssoustheme.php3, (14) saisiefaq.php3, (15) saisiefaqtotale.php3, or (16) voirfaq.php3, the Faq parameter to (17) saisiefaq.php3, (18) voirfaq.php3, or (19) inssolution.php3, or (20) question parameter to affichagefaq.php3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2005-2562 
SQL injection vulnerability in Gravity Board X (GBX) 1.1 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the login field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2005-2563 
Multiple cross-site scripting (XSS) vulnerabilities in Gravity Board X (GBX) 1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the board_id parameter to deletethread.php or (2) the template.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2005-2564 
Direct static code injection vulnerability in editcss.php in Gravity Board X (GBX) 1.1 allows remote attackers to execute arbitrary PHP code, HTML, and script via the csscontent parameter, which is directly inserted into the gbxfinal.css file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2005-2565 
Gravity Board X (GBX) 1.1 allows remote attackers to obtain sensitive information via (1) a 1 in the perm parameter to deletethread.php or a direct request to (2) ban.php, (3) addnews.php, (4) banned.php, (5) boardstats.php, (6) adminform.php, (7) /forms/admininfo.php, (8) /forms/announcements.php, (9) forms/banform.php, or (10) other pages in the /forms directory, which reveal the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2005-2566 
Multiple SQL injection vulnerabilities in Open Bulletin Board (OpenBB) allow remote attackers to execute arbitrary SQL commands via the (1) FID parameter to board.php or (2) UID parameter to member.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2005-2567 
PHP remote file inclusion vulnerability in SysCP 1.2.10 and earlier allows remote attackers to execute arbitrary PHP code via the language parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2005-2568 
Eval injection vulnerability in the template engine for SysCP 1.2.10 and earlier allows remote attackers to execute arbitrary PHP code via a string containing the code within "{" and "}" (curly bracket) characters, which are processed by the PHP eval function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2005-2569 
Multiple cross-site scripting (XSS) vulnerabilities in FunkBoard 0.66CF, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the fbusername or fbpassword parameter to (1) editpost.php, (2) prefs.php, (3) newtopic.php, (4) reply.php, or (5) profile.php, the (6) fbusername, (7) fmail, (8) www, (9) icq, (10) yim, (11) location, (12) sex, (13) interebbies, (14) sig or (15) aim parameter to register.php, or (16) subject parameter to newtopic.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2005-2570 
FunkBoard 0.66CF, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to forums.php, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2005-2571 
FunkBoard 0.66CF, and possibly earlier versions, does not properly restrict access to the (1) admin/mysql_install.php and (2) admin/pg_install.php scripts, which allows attackers to obtain the database username and password or inject arbitrary PHP code into info.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z