rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-3799 
The session_start function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attackers to insert arbitrary attributes into the session cookie via special characters in a cookie that is obtained from (1) PATH_INFO, (2) the session_id function, and (3) the session_start function, which are not encoded or filtered when the new session cookie is generated, a related issue to CVE-2006-0207.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-16T22:00:00.000Z
CVE-2007-3800 
Unspecified vulnerability in the Real-time scanner (RTVScan) component in Symantec AntiVirus Corporate Edition 9.0 through 10.1 and Client Security 2.0 through 3.1, when the Notification Message window is enabled, allows local users to gain privileges via crafted code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-16T23:00:00.000Z
CVE-2007-3803 
The SMTP ALG in Clavister CorePlus before 8.80.04, and 8.81.00, does not properly parse SMTP commands in certain circumstances, which allows remote attackers to bypass address blacklists.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-16T23:00:00.000Z
CVE-2007-3804 
The AntiVirus engine in the HTTP-ALG in Clavister CorePlus before 8.81.00 and 8.80.03 might allow remote attackers to bypass scanning via small files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-16T23:00:00.000Z
CVE-2007-3805 
The IKE implementation in Clavister CorePlus before 8.80.03, and 8.80.00, does not properly validate certificates during IKE negotiation, which allows remote attackers to cause a denial of service (gateway stop) via certain certificates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-16T23:00:00.000Z
CVE-2007-3806 
The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an invalid value of the flags parameter, probably related to memory corruption or an invalid read on win32 platforms, and possibly related to lack of initialization for a glob structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T00:00:00.000Z
CVE-2007-3807 
Multiple cross-site scripting (XSS) vulnerabilities in SiteScape Forum before 7.3 allow remote attackers to inject arbitrary web script or HTML via the user name field in the login procedure, and other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T00:00:00.000Z
CVE-2007-3808 
SQL injection vulnerability in includes/search.php in paFileDB 3.6 allows remote attackers to execute arbitrary SQL commands via the categories[] parameter in a search action to index.php, a different vector than CVE-2005-2000.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T00:00:00.000Z
CVE-2007-3809 
Multiple SQL injection vulnerabilities in Prozilla Directory Script allow remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action to directory.php, and other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T00:00:00.000Z
CVE-2007-3810 
SQL injection vulnerability in index.php in Realtor 747 allows remote attackers to execute arbitrary SQL commands via the categoryid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T00:00:00.000Z
CVE-2007-3811 
Multiple SQL injection vulnerabilities in eSyndiCat allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to news.php or (2) the name parameter to page.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T00:00:00.000Z
CVE-2007-3812 
SQL injection vulnerability in forums.php in CMScout 1.23 and earlier allows remote attackers to execute arbitrary SQL commands via the f parameter in a forums action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T00:00:00.000Z
CVE-2007-3813 
PHP remote file inclusion vulnerability in include/user.php in the NoBoard BETA module for MKPortal allows remote attackers to execute arbitrary PHP code via a URL in the MK_PATH parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T00:00:00.000Z
CVE-2007-3814 
Multiple SQL injection vulnerabilities in MKPortal 1.1.1 allow remote attackers to execute arbitrary SQL commands via (1) the idurlo field in the delete_urlo function in (a) index.php in the urlobox module; the iden field in the (2) update_file and (3) del_file functions in (b) index.php in the reviews module; the (4) idnews field in the delete_news function and the (5) idcomm field in the del_comment function in (c) index.php in the news module; the (6) idcomm field in the delete_comments function in (d) index.php in the gallery module; the iden field in the (7) edit_file, (8) update_file, and (9) del_file functions in index.php in the gallery module; the (10) ide and (11) cat fields in the slide_update function in index.php in the gallery module; the iden field in the (12) update_file and (13) del_file functions in (d) index.php in the downloads module; and other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T00:00:00.000Z
CVE-2007-3815 
Buffer overflow in pirs32.exe in Poslovni informator Republike Slovenije (PIRS) 2007 allows local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long search string in certain fields in the GUI.  NOTE: this may cross privilege boundaries if PIRS is used by data-entry workers who do not have full access to the underlying Windows environment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T00:00:00.000Z
CVE-2007-3816 
JWIG might allow context-dependent attackers to cause a denial of service (service degradation) via loops of references to external templates.  NOTE: this issue has been disputed by multiple third parties who state that only the application developer can trigger the issue, so no privilege boundaries are crossed.  However, it seems possible that this is a vulnerability class to which an JWIG application may be vulnerable if template contents can be influenced, but this would be an issue in the application itself, not JWIG
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T00:00:00.000Z
CVE-2007-3817 
Cross-site scripting (XSS) vulnerability in the LoginToboggan module 4.7.x-1.0, 4.7.x-1.x-dev, and 5.x-1.x-dev before 20070712 for Drupal, when configured to display a "Log out" link, allows remote attackers to inject arbitrary web script or HTML via a crafted username.  NOTE: Drupal sanitizes the username by removing certain characters, so this might not be a vulnerability on default installations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T01:00:00.000Z
CVE-2007-3818 
Cross-site scripting (XSS) vulnerability in the LoginToboggan module 5.x-1.x-dev before 20070712 for Drupal allows remote authenticated users with "administer blocks" permission to inject arbitrary JavaScript and gain privileges via "the message displayed above the default user login block."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T01:00:00.000Z
CVE-2007-3819 
Opera 9.21 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T01:00:00.000Z
CVE-2007-3820 
konqueror/konq_combo.cc in Konqueror 3.5.7 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents the beginning of the URI from being displayed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T01:00:00.000Z
CVE-2007-3821 
Cross-site request forgery (CSRF) vulnerability in Webcit before 7.11 allows remote attackers to modify configurations and perform other actions as arbitrary users via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T01:00:00.000Z
CVE-2007-3822 
Multiple cross-site scripting (XSS) vulnerabilities in Webcit before 7.11 allow remote attackers to inject arbitrary web script or HTML via (1) the who parameter to showuser; and other vectors involving (2) calendar mode, (3) bulletin board mode, (4) room names, and (5) uploaded file names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T01:00:00.000Z
CVE-2007-3823 
The Logging Server (Logsrv.exe) in IPSwitch WS_FTP 7.5.29.0 allows remote attackers to cause a denial of service (daemon crash) by sending a crafted packet containing a long string to port 5151/udp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T01:00:00.000Z
CVE-2007-3824 
SQL injection vulnerability in katgoster.asp in MzK Blog (tr) allows remote attackers to execute arbitrary SQL commands via the katID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T01:00:00.000Z
CVE-2007-3825 
Multiple stack-based buffer overflows in the RPC implementation in alert.exe before 8.0.255.0 in CA (formerly Computer Associates) Alert Notification Server, as used in Threat Manager for the Enterprise, Protection Suites, certain BrightStor ARCserve products, and BrightStor Enterprise Backup, allow remote attackers to execute arbitrary code by sending certain data to unspecified RPC procedures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-18T23:00:00.000Z
CVE-2007-3826 
Microsoft Internet Explorer 7 on Windows XP SP2 allows remote attackers to prevent users from leaving a site, spoof the address bar, and conduct phishing and other attacks via repeated document.open function calls after a user requests a new page, but before the onBeforeUnload function is called.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T21:00:00.000Z
CVE-2007-3827 
Mozilla Firefox allows for cookies to be set with a null domain (aka "domainless cookies"), which allows remote attackers to pass information between arbitrary domains and track user activity, as demonstrated by the domain attribute in the document.cookie variable in a javascript: window.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T21:00:00.000Z
CVE-2007-3828 
Unspecified vulnerability in mDNSResponder in Apple Mac OS X allows remote attackers to execute arbitrary code via unspecified vectors, a related issue to CVE-2007-2386.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T21:00:00.000Z
CVE-2007-3829 
Multiple stack-based buffer overflows in (a) InterActual Player 2.60.12.0717 and (b) Roxio CinePlayer 3.2 allow remote attackers to execute arbitrary code via a (1) long FailURL attribute in the IAMCE ActiveX Control (IAMCE.dll) or a (2) long URLCode attribute in the IAKey ActiveX Control (IAKey.dll).  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T21:00:00.000Z
CVE-2007-3830 
Cross-site scripting (XSS) vulnerability in alert.php in ISS Proventia Network IPS GX5108 1.3 and GX5008 1.5 allows remote attackers to inject arbitrary web script or HTML via the reminder parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T21:00:00.000Z
CVE-2007-3831 
PHP remote file inclusion in main.php in ISS Proventia Network IPS GX5108 1.3 and GX5008 1.5 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T21:00:00.000Z
CVE-2007-3832 
Buffer overflow in the AOL Instant Messenger (AIM) protocol handler in AIM.DLL in Cerulean Studios Trillian allows remote attackers to execute arbitrary code via a malformed aim: URI, as demonstrated by a long URI beginning with the aim:///#1111111/ substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T22:00:00.000Z
CVE-2007-3833 
The AOL Instant Messenger (AIM) protocol handler in Cerulean Studios Trillian allows remote attackers to create files with arbitrary contents via certain aim: URIs, as demonstrated by a URI that begins with the "aim: &c:\" substring and contains a full pathname in the ini field.  NOTE: this can be leveraged for code execution by writing to a Startup folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T22:00:00.000Z
CVE-2007-3834 
Multiple cross-site scripting (XSS) vulnerabilities in Ex Libris ALEPH allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a URL that can be discovered through a keyword search.  NOTE: this may be related to the MetaLib XSS issue, CVE-2007-3835.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T22:00:00.000Z
CVE-2007-3835 
Cross-site scripting (XSS) vulnerability in Ex Libris MetaLib 3.13 and 4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a resource id that can be discovered through a search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T22:00:00.000Z
CVE-2007-3836 
Format string vulnerability in HydraIRC 0.3.151 allows remote attackers to cause a denial of service via format string specifiers in certain data related to failed DCC file transfer negotiation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T22:00:00.000Z
CVE-2007-3837 
Heap-based buffer overflow in HydraIRC 0.3.151 allows remote IRC servers to cause a denial of service (application crash) via a long CTCP request message containing '%' (percent) characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T22:00:00.000Z
CVE-2007-3838 
Cross-site scripting (XSS) vulnerability in takeprofedit.php in TBDev.NET DR 11-10-05-BETA-SF1:111005 and earlier allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of a SCRIPT element in the avatar parameter.  NOTE: this may be related to the tracker program in the Janitor package.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T22:00:00.000Z
CVE-2007-3839 
Cross-site scripting (XSS) vulnerability in takeprofedit.php in TBDev.NET DR 010306 and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the avatar parameter.  NOTE: this may be related to the tracker program in the Janitor package.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T22:00:00.000Z
CVE-2007-3840 
SQL injection vulnerability in referralUrl.php in Traffic Stats allows remote attackers to execute arbitrary SQL commands via the offset parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T22:00:00.000Z
CVE-2007-3841 
Unspecified vulnerability in Pidgin (formerly Gaim) 2.0.2 for Linux allows remote authenticated users, who are listed in a users list, to execute certain commands via unspecified vectors, aka ZD-00000035. NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T22:00:00.000Z
CVE-2007-3842 
Cross-site scripting (XSS) vulnerability in the 8e6 R3000 Enterprise Filter before 2.0.05 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this may be the same as CVE-2007-2970.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T22:00:00.000Z
CVE-2007-3843 
The Linux kernel before 2.6.23-rc1 checks the wrong global variable for the CIFS sec mount option, which might allow remote attackers to spoof CIFS network traffic that the client configured for security signatures, as demonstrated by lack of signing despite sec=ntlmv2i in a SetupAndX request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-09T21:00:00.000Z
CVE-2007-3844 
Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 and before 1.5.0.13, and SeaMonkey 1.1.3 allows remote attackers to conduct cross-site scripting (XSS) attacks with chrome privileges via an addon that inserts a (1) javascript: or (2) data: link into an about:blank document loaded by chrome via (a) the window.open function or (b) a content.location assignment, aka "Cross Context Scripting." NOTE: this issue is caused by a CVE-2007-3089 regression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-08T01:11:00.000Z
CVE-2007-3845 
Mozilla Firefox before 2.0.0.6, Thunderbird before 1.5.0.13 and 2.x before 2.0.0.6, and SeaMonkey before 1.1.4 allow remote attackers to execute arbitrary commands via certain vectors associated with launching "a file handling program based on the file extension at the end of the URI," a variant of CVE-2007-4041.  NOTE: the vendor states that "it is still possible to launch a filetype handler based on extension rather than the registered protocol handler."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-08T01:11:00.000Z
CVE-2007-3846 
Directory traversal vulnerability in Subversion before 1.4.5, as used by TortoiseSVN before 1.4.5 and possibly other products, when run on Windows-based systems, allows remote authenticated users to overwrite and create arbitrary files via a ..\ (dot dot backslash) sequence in the filename, as stored in the file repository.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-28T18:00:00.000Z
CVE-2007-3847 
The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-23T22:00:00.000Z
CVE-2007-3848 
Linux kernel 2.4.35 and other versions allows local users to send arbitrary signals to a child process that is running at higher privileges by causing a setuid-root parent process to die, which delivers an attacker-controlled parent process death signal (PR_SET_PDEATHSIG).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T17:00:00.000Z
CVE-2007-3849 
Red Hat Enterprise Linux (RHEL) 5 ships the rpm for the Advanced Intrusion Detection Environment (AIDE) before 0.13.1 with a database that lacks checksum information, which allows context-dependent attackers to bypass file integrity checks and modify certain files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T01:00:00.000Z
CVE-2007-3850 
The eHCA driver in Linux kernel 2.6 before 2.6.22, when running on PowerPC, does not properly map userspace resources, which allows local users to read portions of physical address space.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-23T10:00:00.000Z
CVE-2007-3851 
The drm/i915 component in the Linux kernel before 2.6.22.2, when used with i965G and later chipsets, allows local users with access to an X11 session and Direct Rendering Manager (DRM) to write to arbitrary memory locations and gain privileges via a crafted batchbuffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-13T19:00:00.000Z
CVE-2007-3852 
The init script (sysstat.in) in sysstat 5.1.2 up to 7.1.6 creates /tmp/sysstat.run insecurely, which allows local users to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T18:00:00.000Z
CVE-2007-3853 
Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 and 10.2.0.3 allow remote authenticated users to have unknown impact via (1) DBMS_JAVA_TEST in the JavaVM component (DB01), (2) Oracle Text component (DB09), and (3) MDSYS.SDO_GEOR_INT in the Spatial component (DB15).  NOTE: a reliable researcher claims that DB01 is SQL injection in DBMS_PRVTAQIS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-18T19:00:00.000Z
CVE-2007-3854 
Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMS_PRVTAQIS in the Advanced Queuing component (DB02) and (2) MDSYS.MD in the Spatial component (DB12).  NOTE: Oracle has not disputed reliable researcher claims that DB02 is for SQL injection and DB12 is for a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-18T19:00:00.000Z
CVE-2007-3855 
Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to have an unknown impact via (1) SYS.DBMS_DRS in the DataGuard component (DB03), (2) SYS.DBMS_STANDARD in the PL/SQL component (DB10), (3) MDSYS.RTREE_IDX in the Spatial component (DB16), and (4) SQL Compiler (DB17).  NOTE: a reliable researcher claims that DB17 is for using Views to perform unauthorized insert, update, or delete actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-18T19:00:00.000Z
CVE-2007-3856 
Unspecified vulnerability in the Oracle Data Mining component for Oracle Database 10g Release 2 10.2.0.2 and 10.2.0.3, 10g 10.1.0.5, and Oracle9i Database Release 2 9.2.0.7, 9.2.0.8, and 9.2.0.8DV has unknown impact and remote authenticated attack vectors related to DMSYS.DMP_SYS, aka DB04.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-18T19:00:00.000Z
CVE-2007-3857 
Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 allow remote authenticated users to have an unknown impact via (a) the Oracle Text component, including (1) unspecified vectors (DB05), (2) CTXSYS.DRVXMD (DB06), (3) CTXSYS.DRI_MOVE_CTXSYS (DB07), (4) CTXSYS.DRVXMD (DB08), and (b) JavaVM (DB14).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-18T19:00:00.000Z
CVE-2007-3858 
Multiple unspecified vulnerabilities in Oracle Database 10.2.0.3 allow remote authenticated users to have an unknown impact via (1) EXFSYS.DBMS_RLMGR_UTL in Rules Manager (DB11) and (2) Program Interface (DB13).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-18T19:00:00.000Z