rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-1203 
Unspecified vulnerability in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2003 Viewer, 2004 for Mac, and 2007 allows user-assisted remote attackers to execute arbitrary code via a crafted set font value in an Excel file, which results in memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-08T22:00:00.000Z
CVE-2007-1204 
Stack-based buffer overflow in the Universal Plug and Play (UPnP) service in Microsoft Windows XP SP2 allows remote attackers on the same subnet to execute arbitrary code via crafted HTTP headers in request or notification messages, which trigger memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-10T21:00:00.000Z
CVE-2007-1205 
Unspecified vulnerability in Microsoft Agent (msagent\agentsvr.exe) in Windows 2000 SP4, XP SP2, and Server 2003, 2003 SP1, and 2003 SP2 allows remote attackers to execute arbitrary code via crafted URLs, which result in memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-10T21:00:00.000Z
CVE-2007-1206 
The Virtual DOS Machine (VDM) in the Windows Kernel in Microsoft Windows NT 4.0; 2000 SP4; XP SP2; Server 2003, 2003 SP1, and 2003 SP2; and Windows Vista before June 2006; uses insecure permissions (PAGE_READWRITE) for a physical memory view, which allows local users to gain privileges by modifying the "zero page" during a race condition before the view is unmapped.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-10T21:00:00.000Z
CVE-2007-1209 
Use-after-free vulnerability in the Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows Vista does not properly handle connection resources when starting and stopping processes, which allows local users to gain privileges by opening and closing multiple ApiPort connections, which leaves a "dangling pointer" to a process data structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-10T21:00:00.000Z
CVE-2007-1211 
Unspecified kernel GDI functions in Microsoft Windows 2000 SP4; XP SP2; and Server 2003 Gold, SP1, and SP2 allows user-assisted remote attackers to cause a denial of service (possibly persistent restart) via a crafted Windows Metafile (WMF) image that causes an invalid dereference of an offset in a kernel structure, a related issue to CVE-2005-4560.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-04T16:00:00.000Z
CVE-2007-1212 
Buffer overflow in the Graphics Device Interface (GDI) in Microsoft Windows 2000 SP4; XP SP2; Server 2003 Gold, SP1, and SP2; and Vista allows local users to gain privileges via a crafted Enhanced Metafile (EMF) image format file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-04T16:00:00.000Z
CVE-2007-1213 
The TrueType Fonts rasterizer in Microsoft Windows 2000 SP4 allows local users to gain privileges via crafted TrueType fonts, which result in an uninitialized function pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-04T16:00:00.000Z
CVE-2007-1214 
Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2003 Viewer, and 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a crafted AutoFilter filter record in an Excel BIFF8 format XLS file, which triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-08T22:00:00.000Z
CVE-2007-1215 
Buffer overflow in the Graphics Device Interface (GDI) in Microsoft Windows 2000 SP4; XP SP2; Server 2003 Gold, SP1, and SP2; and Vista allows local users to gain privileges via certain "color-related parameters" in crafted images.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-04T16:00:00.000Z
CVE-2007-1216 
Double free vulnerability in the GSS-API library (lib/gssapi/krb5/k5unseal.c), as used by the Kerberos administration daemon (kadmind) in MIT krb5 before 1.6.1, when used with the authentication method provided by the RPCSEC_GSS RPC library, allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an "an invalid direction encoding".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-06T01:00:00.000Z
CVE-2007-1217 
Buffer overflow in the bufprint function in capiutil.c in libcapi, as used in Linux kernel 2.6.9 to 2.6.20 and isdn4k-utils, allows local users to cause a denial of service (crash) and possibly gain privileges via a crafted CAPI packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-02T19:00:00.000Z
CVE-2007-1218 
Off-by-one buffer overflow in the parse_elements function in the 802.11 printer code (print-802_11.c) for tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted 802.11 frame.  NOTE: this was originally referred to as heap-based, but it might be stack-based.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-02T20:00:00.000Z
CVE-2007-1219 
PHP remote file inclusion vulnerability in actions/del.php in Admin Phorum 3.3.1a allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-02T22:00:00.000Z
CVE-2007-1220 
The Hypervisor in Microsoft Xbox 360 kernel 4532 and 4548 does not properly verify the parameters passed to the syscall dispatcher, which allows attackers with physical access to bypass code-signing requirements and execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-02T22:00:00.000Z
CVE-2007-1221 
The Hypervisor in Microsoft Xbox 360 kernel 4532 and 4548 allows attackers with physical access to force execution of the hypervisor syscall with a certain register set, which bypasses intended code protection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-02T22:00:00.000Z
CVE-2007-1222 
Parallels Desktop for Mac before 20070216 implements Drag and Drop by sharing the entire host filesystem as the .psf share, which allows local users of the guest operating system to write arbitrary files to the host filesystem, and execute arbitrary code via launchd by writing a plist file to a LaunchAgents directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-02T22:00:00.000Z
CVE-2007-1223 
Unspecified vulnerability in Hitachi OSAS/FT/W before 20070223 allows attackers to cause a denial of service (responder control processing halt) by sending "data unexpectedly through the port".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-02T22:00:00.000Z
CVE-2007-1224 
Grok Developments NetProxy 4.03 allows remote attackers to bypass URL filtering via a request that omits "http://" from the URL and specifies the destination port (:80).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-02T22:00:00.000Z
CVE-2007-1225 
The connection log file implementation in Grok Developments NetProxy 4.03 does not record requests that omit http:// in a URL, which might allow remote attackers to conduct unauthorized activities and avoid detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-02T22:00:00.000Z
CVE-2007-1226 
McAfee VirusScan for Mac (Virex) before 7.7 patch 1 has weak permissions (0666) for /Library/Application Support/Virex/VShieldExclude.txt, which allows local users to reconfigure Virex to skip scanning of arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-02T22:00:00.000Z
CVE-2007-1227 
VShieldCheck in McAfee VirusScan for Mac (Virex) before 7.7 patch 1 allow local users to change permissions of arbitrary files via a symlink attack on /Library/Application Support/Virex/VShieldExclude.txt, as demonstrated by symlinking to the root crontab file to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-02T22:00:00.000Z
CVE-2007-1228 
IBM DB2 UDB 8.2 before Fixpak 7 (aka fixpack 14), and DB2 9 before Fix Pack 2, on UNIX allows the "fenced" user to access certain unauthorized directories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-02T22:00:00.000Z
CVE-2007-1229 
Cross-site scripting (XSS) vulnerability in the Nullsoft ShoutcastServer 1.9.7 allows remote attackers to inject arbitrary web script or HTML via the top-level URI on the Incoming interface (port 8001/tcp), which is not properly handled in the administrator interface when viewing the log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-02T22:00:00.000Z
CVE-2007-1230 
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web script or HTML via (1) the Referer HTTP header or (2) the URI, a different vulnerability than CVE-2007-1049.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-02T22:00:00.000Z
CVE-2007-1231 
Multiple cross-site scripting (XSS) vulnerabilities in SQLiteManager 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) database name, (2) table name, (3) ViewName, (4) view, (5) trigger, and (6) function fields in main.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2007-1232 
Directory traversal vulnerability in SQLiteManager 1.2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in a SQLiteManager_currentTheme cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2007-1233 
PHP remote file inclusion vulnerability in downloadcounter.php in STWC-Counter 3.4.0.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the stwc_counter_verzeichniss parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2007-1234 
Multiple cross-site scripting (XSS) vulnerabilities in sitex allow remote attackers to inject arbitrary web script or HTML via (1) the sxYear parameter to calendar.php, (2) the search parameter to search.php, (3) the linkid parameter to redirect.php, or (4) the page parameter to calendar_events.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2007-1235 
Unrestricted file upload vulnerability in sitex allows remote attackers to upload arbitrary PHP code via an avatar filename with a double extension such as .php.jpg, which fails verification and is saved as a .php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2007-1236 
sitex allows remote attackers to obtain sensitive information via a request with a numerical value for the (1) sxMonth[] or (2) sxYear[] parameter to calendar.php, or the (3) page[] parameter to calendar_events.php, which reveals the path in various error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2007-1237 
sitex allows remote attackers to obtain potentially sensitive information via a ' (quote) value for certain parameters, as demonstrated by parameters used in forum and search, which forces a SQL error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2007-1238 
Microsoft Office 2003 allows user-assisted remote attackers to cause a denial of service (application crash) by attempting to insert a corrupted WMF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2007-1239 
Microsoft Excel 2003 does not properly parse .XLS files, which allows remote attackers to cause a denial of service (application crash) via a file with a (1) corrupted XML format or a (2) corrupted XLS format, which triggers a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2007-1240 
Multiple cross-site scripting (XSS) vulnerabilities in Docebo CMS 3.0.3 through 3.0.5 allow remote attackers to inject arbitrary web script or HTML via (1) the searchkey parameter to index.php, or the (2) sn or (3) ri parameter to modules/htmlframechat/index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2007-1241 
Cross-site scripting (XSS) vulnerability in setup.php in Audins Audiens 3.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2007-1242 
SQL injection vulnerability in system/index.php in Audins Audiens 3.3 allows remote attackers to execute arbitrary SQL commands via the PHPSESSID cookie.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2007-1243 
Audins Audiens 3.3 allows remote attackers to bypass authentication and perform certain privileged actions, possibly an uninstall of the product, by calling unistall.php with the values cnf=disinstalla and status=on.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2007-1244 
Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php.  NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks and steal cookies via the post parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2007-1245 
IrfanView 3.99 allows remote attackers to cause a denial of service (application crash) via a malformed WMF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2007-1246 
The DMO_VideoDecoder_Open function in loader/dmo/DMO_VideoDecoder.c in MPlayer 1.0rc1 and earlier, as used in xine-lib, does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code, a different vulnerability than CVE-2007-1387.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2007-1247 
Multiple PHP remote file inclusion vulnerabilities in aWeb Labs aWebNews 1.5 allow remote attackers to execute arbitrary PHP code via a URL in the path_to_news parameter to (1) listing.php or (2) visview.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T20:00:00.000Z
CVE-2007-1248 
Multiple cross-site scripting (XSS) vulnerabilities in built2go News Manager Blog 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cid, (2) uid, and (3) nid parameters to (a) news.php, and the nid parameter to (b) rating.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T20:00:00.000Z
CVE-2007-1249 
MoveSortedContentAction in C1 Financial Services Contelligent 9.1.4 does not check "the additional environment security configuration," which allows remote attackers with write permissions to reorder components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T20:00:00.000Z
CVE-2007-1250 
SQL injection vulnerability in section/default.asp in ANGEL Learning Management Suite (LMS) 7.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T20:00:00.000Z
CVE-2007-1251 
Format string vulnerability in the new_warning function in ntserv/warning.c for Netrek Vanilla Server 2.12.0, when EVENTLOG is enabled, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in the message handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T20:00:00.000Z
CVE-2007-1252 
Buffer overflow in Symantec Mail Security for SMTP 5.0 before Patch 175 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted headers in an e-mail message.  NOTE: some information was obtained from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T20:00:00.000Z
CVE-2007-1253 
Eval injection vulnerability in the (a) kmz_ImportWithMesh.py Script for Blender 0.1.9h, as used in (b) Blender before 2.43, allows user-assisted remote attackers to execute arbitrary Python code by importing a crafted (1) KML or (2) KMZ file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T20:00:00.000Z
CVE-2007-1254 
SQL injection vulnerability in part.userprofile.php in Connectix Boards 0.7 and earlier allows remote authenticated users to execute arbitrary SQL commands and obtain privileges via the p_skin parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T20:00:00.000Z
CVE-2007-1255 
Unrestricted file upload vulnerability in admin.bbcode.php in Connectix Boards 0.7 and earlier allows remote authenticated administrators to execute arbitrary PHP code by uploading a crafted GIF smiley image with a .php extension via the uploadimage parameter to admin.php, which can be later accessed via a direct request for the file in smileys/.  NOTE: this can be leveraged with a separate SQL injection issue for remote unauthenticated attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T20:00:00.000Z
CVE-2007-1256 
Mozilla Firefox 2.0.0.2 allows remote attackers to spoof the address bar, favicons, and document source, and perform updates in the context of arbitrary websites, by repeatedly setting document.location in the onunload attribute when linking to another website, a variant of CVE-2007-1092.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T20:00:00.000Z
CVE-2007-1257 
The Network Analysis Module (NAM) in Cisco Catalyst Series 6000, 6500, and 7600 allows remote attackers to execute arbitrary commands via certain SNMP packets that are spoofed from the NAM's own IP address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T20:00:00.000Z
CVE-2007-1258 
Unspecified vulnerability in Cisco IOS 12.2SXA, SXB, SXD, and SXF; and the MSFC2, MSFC2a and MSFC3 running in Hybrid Mode on Cisco Catalyst 6000, 6500 and Cisco 7600 series systems; allows remote attackers on a local network segment to cause a denial of service (software reload) via a certain MPLS packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T20:00:00.000Z
CVE-2007-1259 
Multiple unspecified vulnerabilities in WebAPP before 0.9.9.6 have unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T20:00:00.000Z
CVE-2007-1260 
Stack-based buffer overflow in the connectHandle function in server.cpp in WebMod 0.48 allows remote attackers to execute arbitrary code via a long string in the Content-Length HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T21:00:00.000Z
CVE-2007-1261 
Unspecified vulnerability in the reports system in OpenBiblio before 0.6.0 allows attackers to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T21:00:00.000Z
CVE-2007-1262 
Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the (1) data: URI in an HTML e-mail attachment or (2) various non-ASCII character sets that are not properly filtered when viewed with Microsoft Internet Explorer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-11T03:55:00.000Z
CVE-2007-1263 
GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-06T20:00:00.000Z
CVE-2007-1264 
Enigmail 0.94.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Enigmail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-06T20:00:00.000Z
CVE-2007-1265 
KMail 1.9.5 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents KMail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-06T20:00:00.000Z
CVE-2007-1266 
Evolution 2.8.1 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Evolution from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-06T20:00:00.000Z
CVE-2007-1267 
Sylpheed 2.2.7 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Sylpheed from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-06T20:00:00.000Z
CVE-2007-1268 
Mutt 1.5.13 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Mutt from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-06T20:00:00.000Z