rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-1723 
Multiple cross-site scripting (XSS) vulnerabilities in the administration console in Secure Computing CipherTrust IronMail 6.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) network, (2) defRouterIp, (3) hostName, (4) domainName, (5) ipAddress, (6) defaultRouter, (7) dns1, or (8) dns2 parameter to (a) admin/system_IronMail.do; the (9) ipAddress parameter to (b) admin/systemOutOfBand.do; the (10) password or (11) confirmPassword parameter to (c) admin/systemBackup.do; the (12) Klicense parameter to (d) admin/systemLicenseManager.do; the (13) rows[1].attrValueStr or (14) rows[2].attrValueStr parameter to (e) admin/systemWebAdminConfig.do; the (15) rows[0].attrValueStr, rows[1].attrValueStr, (16) rows[2].attrValue, or (17) rows[2].attrValueStrClone parameter to (f) admin/ldap_ConfigureServiceProperties.do; the (18) input1 parameter to (g) admin/mailFirewall_MailRoutingInternal.do; or the (19) rows[2].attrValueStr, (20) rows[3].attrValueStr, (21) rows[5].attrValueStr, or (22) rows[6].attrValueStr parameter to (h) admin/mailIdsConfig.do.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-28T00:00:00.000Z
CVE-2007-1724 
Unspecified vulnerability in ReactOS 0.3.1 has unknown impact and attack vectors, related to a fix for "dozens of win32k bugs and failures," in which the fix itself introduces a vulnerability, possibly related to user-mode and kernel-mode copy failures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-28T00:00:00.000Z
CVE-2007-1725 
SQL injection vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to execute arbitrary SQL commands via the filename of an uploaded file to the avatar function, as demonstrated by setting admin privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-28T10:00:00.000Z
CVE-2007-1726 
Unrestricted file upload vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to upload arbitrary files via the avatar function, which can later be accessed in uploads/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-28T10:00:00.000Z
CVE-2007-1727 
Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 6.20, 6.4x, 7.01, 7.50, and 7.51 allows remote authenticated users to access certain privileged "facilities" via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-28T10:00:00.000Z
CVE-2007-1728 
The Remote Play feature in Sony Playstation 3 (PS3) 1.60 and Playstation Portable (PSP) 3.10 OE-A allows remote attackers to cause a denial of service via a flood of UDP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-28T10:00:00.000Z
CVE-2007-1729 
SQL injection vulnerability in includes/start.php in Flexbb 1.0.0 10005 Beta Release 1 allows remote attackers to execute arbitrary SQL commands via the flexbb_lang_id COOKIE parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-28T10:00:00.000Z
CVE-2007-1730 
Integer signedness error in the DCCP support in the do_dccp_getsockopt function in net/dccp/proto.c in Linux kernel 2.6.20 and later allows local users to read kernel memory or cause a denial of service (oops) via a negative optlen value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-28T10:00:00.000Z
CVE-2007-1731 
Multiple stack-based buffer overflows in High Performance Anonymous FTP Server (hpaftpd) 1.01 allow remote attackers to execute arbitrary code via long arguments to the (1) USER, (2) PASS, (3) CWD, (4) MKD, (5) RMD, (6) DELE, (7) RNFR, or (8) RNTO FTP command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-28T10:00:00.000Z
CVE-2007-1732 
Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: another researcher disputes this issue, stating that this is legitimate functionality for administrators.  However, it has been patched by at least one vendor
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-28T20:00:00.000Z
CVE-2007-1733 
Buffer overflow in InterVations NaviCOPA HTTP Server 2.01 allows remote attackers to execute arbitrary code via a long (1) /cgi-bin/ or (2) /cgi/ pathname in an HTTP GET request, probably a different issue than CVE-2006-5112.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-28T22:00:00.000Z
CVE-2007-1734 
The DCCP support in the do_dccp_getsockopt function in net/dccp/proto.c in Linux kernel 2.6.20 and later does not verify the upper bounds of the optlen value, which allows local users running on certain architectures to read kernel memory or cause a denial of service (oops), a related issue to CVE-2007-1730.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-28T22:00:00.000Z
CVE-2007-1735 
Stack-based buffer overflow in Corel WordPerfect Office X3 (13.0.0.565) allows user-assisted remote attackers to execute arbitrary code via a long printer selection (PRS) name in a Wordperfect document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-28T22:00:00.000Z
CVE-2007-1736 
Mozilla Firefox 2.0.0.3 does not check URLs embedded in (1) object or (2) iframe HTML tags against the phishing site blacklist, which allows remote attackers to bypass phishing protection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-28T22:00:00.000Z
CVE-2007-1737 
Opera 9.10 does not check URLs embedded in (1) object or (2) iframe HTML tags against the phishing site blacklist, which allows remote attackers to bypass phishing protection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-28T22:00:00.000Z
CVE-2007-1738 
TrueCrypt 4.3, when installed setuid root, allows local users to cause a denial of service (filesystem unavailability) or gain privileges by mounting a crafted TrueCrypt volume, as demonstrated using (1) /usr/bin or (2) another user's home directory, a different issue than CVE-2007-1589.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-28T22:00:00.000Z
CVE-2007-1739 
Heap-based buffer overflow in the LDAP server in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to cause a denial of service (crash) via a long, malformed DN request, which causes only the lower 16 bits of the string length to be used in memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-28T22:00:00.000Z
CVE-2007-1741 
Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute arbitrary code by renaming directories or performing symlink attacks. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-13T16:00:00.000Z
CVE-2007-1742 
suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using "html_backup" and "htmleditor" under an "html" directory.  NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-13T17:00:00.000Z
CVE-2007-1743 
suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local users to leverage other vulnerabilities to create arbitrary UID/GID owned files if /proc is mounted.  NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."  In addition, because this is dependent on other vulnerabilities, perhaps this is resultant and should not be included in CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-13T17:00:00.000Z
CVE-2007-1744 
Directory traversal vulnerability in the Shared Folders feature for VMware Workstation before 5.5.4, when a folder is shared, allows users on the guest system to write to arbitrary files on the host system via the "Backdoor I/O Port" interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-02T19:00:00.000Z
CVE-2007-1745 
The chm_decompress_stream function in libclamav/chmunpack.c in Clam AntiVirus (ClamAV) before 0.90.2 leaks file descriptors, which has unknown impact and attack vectors involving a crafted CHM file, a different vulnerability than CVE-2007-0897.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-16T21:00:00.000Z
CVE-2007-1747 
Unspecified vulnerability in MSO.dll in Microsoft Office 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and 2007 allows user-assisted remote attackers to execute arbitrary code via a malformed drawing object, which triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-08T23:00:00.000Z
CVE-2007-1748 
Stack-based buffer overflow in the RPC interface in the Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server SP 4, Server 2003 SP 1, and Server 2003 SP 2 allows remote attackers to execute arbitrary code via a long zone name containing character constants represented by escape sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-13T18:00:00.000Z
CVE-2007-1749 
Integer underflow in the CDownloadSink class code in the Vector Markup Language (VML) component (VGX.DLL), as used in Internet Explorer 5.01, 6, and 7 allows remote attackers to execute arbitrary code via compressed content with an invalid buffer size, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T22:00:00.000Z
CVE-2007-1750 
Unspecified vulnerability in Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code via a crafted Cascading Style Sheets (CSS) tag that triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-12T19:00:00.000Z
CVE-2007-1751 
Microsoft Internet Explorer 5.01, 6, and 7 allows remote attackers to execute arbitrary code by causing Internet Explorer to access an uninitialized or deleted object, related to prototype variables and table cells, aka "Uninitialized Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-12T19:00:00.000Z
CVE-2007-1754 
PUBCONV.DLL in Microsoft Office Publisher 2007 does not properly clear memory when transferring data from disk to memory, which allows user-assisted remote attackers to execute arbitrary code via a malformed .pub page via a certain negative value, which bypasses a sanitization procedure that initializes critical pointers to NULL, aka the "Publisher Invalid Memory Reference Vulnerability".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-10T22:00:00.000Z
CVE-2007-1756 
Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2003 Viewer, and Office Excel 2007 does not properly validate version information, which allows user-assisted remote attackers to execute arbitrary code via a crafted Excel file, aka "Calculation Error Vulnerability".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-10T22:00:00.000Z
CVE-2007-1762 
Mozilla Firefox 2.0.0.1 through 2.0.0.3 does not canonicalize URLs before checking them against the phishing site blacklist, which allows remote attackers to bypass phishing protection via multiple / (slash) characters in the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T00:00:00.000Z
CVE-2007-1763 
The ATI kernel driver (atikmdag.sys) in Microsoft Windows Vista allows user-assisted remote attackers to cause a denial of service (crash) via a crafted JPG image, as demonstrated by a slideshow, possibly due to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T00:00:00.000Z
CVE-2007-1764 
Stack-based buffer overflow in FastStone Image Viewer 2.8 allows user-assisted remote attackers to execute arbitrary code via a crafted JPG image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T00:00:00.000Z
CVE-2007-1765 
Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a malformed ANI file, which results in memory corruption when processing cursors, animated cursors, and icons, a similar issue to CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7.  NOTE: this issue might be a duplicate of CVE-2007-0038; if so, then use CVE-2007-0038 instead of this identifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T00:00:00.000Z
CVE-2007-1766 
PHP remote file inclusion vulnerability in login/engine/db/profiledit.php in Advanced Login 0.76 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T00:00:00.000Z
CVE-2007-1767 
Unspecified vulnerability in (1) Deskbar.dll and (2) Toolbar.dll in AOL 9.0 before February 2007 allows remote attackers to cause a denial of service (browser crash) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T00:00:00.000Z
CVE-2007-1768 
Cross-site scripting (XSS) vulnerability in app/helpers/application_helper.rb in Mephisto 0.7.3 and Mephisto Edge 20070325 allows remote attackers to inject arbitrary web script or HTML via the author name field in a comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T01:00:00.000Z
CVE-2007-1770 
Buffer overflow in the ArcSDE service (giomgr) in Environmental Systems Research Institute (ESRI) ArcGIS before 9.2 Service Pack 2, when using three tiered ArcSDE configurations, allows remote attackers to cause a denial of service (giomgr crash) and execute arbitrary code via long parameters in crafted requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T01:00:00.000Z
CVE-2007-1771 
PHP remote file inclusion vulnerability in manage/javascript/formjavascript.php in Ay System Solutions Web Content System (WCS) 2.7.1 allows remote attackers to execute arbitrary PHP code via a URL in the path[JavascriptEdit] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T01:00:00.000Z
CVE-2007-1772 
The FTP service in HP JetDirect print servers allows remote attackers to cause a denial of service (engine crash) via a RETR command with a long pathname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T01:00:00.000Z
CVE-2007-1773 
Multiple directory traversal vulnerabilities in aBitWhizzy allow remote attackers to list arbitrary directories via a .. (dot dot) in the d parameter to (1) whizzery/whizzypic.php or (2) whizzery/whizzylink.php, different vectors than CVE-2006-6384.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T01:00:00.000Z
CVE-2007-1774 
Multiple cross-site scripting (XSS) vulnerabilities in aBitWhizzy allow remote attackers to inject arbitrary web script or HTML via the d parameter to (1) whizzery/whizzypic.php or (2) whizzery/whizzylink.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T01:00:00.000Z
CVE-2007-1775 
Unrestricted file upload vulnerability in upload.php3 in JBrowser 2.4 and earlier allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T01:00:00.000Z
CVE-2007-1776 
SQL injection vulnerability in index.php in the DesignForJoomla.com D4J eZine (com_ezine) 2.8 and earlier component for Joomla! allows remote attackers to execute arbitrary SQL commands via the article parameter in a read action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T01:00:00.000Z
CVE-2007-1777 
Integer overflow in the zip_read_entry function in PHP 4 before 4.4.5 allows remote attackers to execute arbitrary code via a ZIP archive that contains an entry with a length value of 0xffffffff, which is incremented before use in an emalloc call, triggering a heap overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T01:00:00.000Z
CVE-2007-1778 
PHP remote file inclusion vulnerability in db/mysql.php in the Eve-Nuke 0.1 (EN-Forums) module for PHP-Nuke allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T01:00:00.000Z
CVE-2007-1779 
Multiple SQL injection vulnerabilities in the MySQL back-end in Advanced Website Creator (AWC) before 1.9.0 might allow remote attackers to execute arbitrary SQL commands via unspecified parameters, related to use of mysql_escape_string instead of mysql_real_escape_string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T01:00:00.000Z
CVE-2007-1780 
Cross-site scripting (XSS) vulnerability in the DHT shell (owdhtshell) in Overlay Weaver 0.5.9 to 0.5.11, when invoked with the -x option, allows remote attackers to inject arbitrary web script or HTML via fields in certain input forms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T10:00:00.000Z
CVE-2007-1781 
Minna De Office 1.x and 2.x does not properly restrict user access to certain privileged actions, which allows local users to change the configuration or have other unspecified impact.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T10:00:00.000Z
CVE-2007-1782 
CruiseWorks 1.09e and earlier does not properly restrict user access to certain privileged actions, which allows local users to change the configuration or have other unspecified impact.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T10:00:00.000Z
CVE-2007-1784 
The JNILoader ActiveX control (STJNILoader.ocx) 3.1.0.26 in IBM Lotus Notes Sametime before 7.5 allows remote attackers to load arbitrary DLL libraries and execute arbitrary code via arbitrary arguments to the loadLibrary function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-31T01:00:00.000Z
CVE-2007-1785 
The RPC service in mediasvr.exe in CA BrightStor ARCserve Backup 11.5 SP2 build 4237 allows remote attackers to execute arbitrary code via crafted xdr_handle_t data in RPC packets, which is used in calculating an address for a function call, as demonstrated using the 191 (0xbf) RPC request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-31T01:00:00.000Z
CVE-2007-1786 
SQL injection vulnerability in Hitachi Collaboration - Online Community Management 01-00 through 01-30, as used in Groupmax Collaboration Portal, Groupmax Collaboration Web Client, uCosminexus Collaboration Portal, Cosminexus Collaboration Portal, and uCosminexus Content Manager, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-31T10:00:00.000Z
CVE-2007-1787 
Multiple PHP remote file inclusion vulnerabilities in lib/timesheet.class.php in Softerra Time-Assistant 6.2 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) inc_dir or (2) lib_dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-31T10:00:00.000Z
CVE-2007-1788 
Flyspray 0.9.9, when output_buffering is disabled or "set to a low value," allows remote attackers to bypass authentication via a crafted post request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-31T10:00:00.000Z
CVE-2007-1789 
Flyspray 0.9.9 allows remote attackers to obtain sensitive information (private project summaries) via direct requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-31T10:00:00.000Z
CVE-2007-1790 
Multiple PHP remote file inclusion vulnerabilities in Kaqoo Auction Software Free Edition allow remote attackers to execute arbitrary PHP code via a URL in the install_root parameter to (1) support.inc.php, (2) function.inc.php, (3) rdal_object.inc.php, (4) rdal_editor.inc.php. (5) login.inc.php, (6) request.inc.php, and (7) categories.inc.php in include/core/; (8) save.inc.php, (9) preview.inc.php, (10) edit_item.inc.php, (11) new_item.inc.php, and (12) item_info.inc.php in include/display/item/; (13) search.inc.php, (14) item_edit.inc.php, (15) register_succsess.inc.php, (16) context_menu.inc.php, (17) item_repost.inc.php, (18) balance.inc.php, (19) featured.inc.php, (20) user.inc.php, (21) buynow.inc.php, (22) install_complete.inc.php, (23) fees_info.inc.php, (24) user_feedback.inc.php, (25) admin_balance.inc.php, (26) activate.inc.php, (27) user_info.inc.php, (28) member.inc.php, (29) add_bid.inc.php, (30) items_filter.inc.php, (31) my_info.inc.php, (32) register.inc.php, (33) leave_feedback.inc.php, and (34) user_auctions.inc.php in include/display/; and (35) design/form.inc.php, (36) processor.inc.php, (37) interfaces.inc.php (38) left_menu.inc.php, (39) login.inc.php, and (40) categories.inc.php in include/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-31T10:00:00.000Z
CVE-2007-1791 
SQL injection vulnerability in wall.php in Picture-Engine 1.2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-31T10:00:00.000Z