rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-4575 
Multiple SQL injection vulnerabilities in The Address Book 1.04e allow remote attackers to execute arbitrary SQL commands via the (1) lastname, (2) firstname, (3) passwordOld, (4) passwordNew, (5) id, (6) language, (7) defaultLetter, (8) newuserPass, (9) newuserType, (10) newuserEmail parameters in (a) user.php; the (11) goTo and (12) search parameters in (b) search.php; and the (13) groupAddName parameter in (c) save.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-03T20:00:00.000Z
CVE-2006-4576 
Cross-site scripting (XSS) vulnerability in The Address Book 1.04e allows remote attackers to inject arbitrary web script or HTML by uploading the HTML file with a GIF or JPG extension, which is rendered by Internet Explorer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-03T20:00:00.000Z
CVE-2006-4577 
Multiple cross-site scripting (XSS) vulnerabilities in The Address Book 1.04e allow remote attackers to inject arbitrary web script or HTML via Javascript events in the (1) email, (2) websites, and (3) groupAddName parameters in (a) save.php; the (4) errorMsg parameter in (b) index.php; and the (5) goTo and (6) search parameters in (c) search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-03T20:00:00.000Z
CVE-2006-4578 
export.php in The Address Book 1.04e writes username and password hash information into a publicly accessible file when dumping the MySQL database contents, which allows remote attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-03T20:00:00.000Z
CVE-2006-4579 
Directory traversal vulnerability in users.php in The Address Book 1.04e allows remote attackers to include arbitrary files via a .. (dot dot) in the language parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-03T20:00:00.000Z
CVE-2006-4580 
register.php in The Address Book 1.04e allows remote attackers to bypass the "Allow User Self-Registration" setting and create arbitrary users by setting the mode parameter to "confirm".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-03T20:00:00.000Z
CVE-2006-4581 
Unrestricted file upload vulnerability in The Address Book 1.04e validates the Content-Type header but not the file extension, which allows remote attackers to upload arbitrary PHP scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-03T20:00:00.000Z
CVE-2006-4582 
Cross-site request forgery (CSRF) vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other users via unspecified vectors, as demonstrated by deleting arbitrary users via the id parameter in a deleteuser action in users.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-03T20:00:00.000Z
CVE-2006-4583 
Multiple PHP remote file inclusion vulnerabilities in FlashChat before 4.6.2 allow remote attackers to execute arbitrary PHP code via a URL in the dir[inc] parameter in (1) inc/cmses/aedatingCMS.php, (2) inc/cmses/aedatingCMS2.php, or (3) inc/cmses/aedating4CMS.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-06T22:00:00.000Z
CVE-2006-4584 
Tr Forum 2.0 allows remote attackers to bypass authentication and add an administrative account via the login and password parameters to admin/insert_admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-06T22:00:00.000Z
CVE-2006-4585 
SQL injection vulnerability in admin/editer.php in Tr Forum 2.0 allows remote authenticated users to execute arbitrary SQL commands via the id2 parameter.  NOTE: this can be leveraged with other Tr Forum vulnerabilities to allow unauthenticated attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-06T22:00:00.000Z
CVE-2006-4586 
The admin panel in Tr Forum 2.0 accepts a username and password hash for authentication, which allows remote authenticated users to perform unauthorized actions, as demonstrated by modifying user settings via the id parameter to /membres/modif_profil.php, and changing a password via /membres/change_mdp.php.  NOTE: this can be leveraged with other Tr Forum vulnerabilities to allow unauthenticated attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-06T22:00:00.000Z
CVE-2006-4587 
Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 4.2.4, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) description parameter in unspecified modules or the (2) solution parameter in the HelpDesk module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-06T22:00:00.000Z
CVE-2006-4588 
vtiger CRM 4.2.4, and possibly earlier, allows remote attackers to bypass authentication and access administrative modules via a direct request to index.php with a modified module parameter, as demonstrated using the Settings module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-06T22:00:00.000Z
CVE-2006-4589 
PHP remote file inclusion vulnerability in 0_admin/modules/Wochenkarte/frontend/index.php in DynCMS 6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the x_admindir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-06T22:00:00.000Z
CVE-2006-4590 
SQL injection vulnerability in admin/default.asp in Jetstat.com JS ASP Faq Manager 1.10 and earlier allows remote attackers to execute arbitrary SQL commands via the uid parameter, a different vector than CVE-2006-4463.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-06T22:00:00.000Z
CVE-2006-4591 
Multiple PHP remote file inclusion vulnerabilities in AlstraSoft Template Seller, and possibly AltraSoft Template Seller Pro 3.25, allow remote attackers to execute arbitrary PHP code via a URL in the config[template_path] parameter to (1) payment/payment_result.php or (2) /payment/spuser_result.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-06T22:00:00.000Z
CVE-2006-4592 
Incomplete blacklist vulnerability in default.asp in 8pixel.net Simple Blog 2.3 and earlier allows remote attackers to conduct SQL injection attacks via ">" characters in the id parameter, which are not filtered by the protection mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-06T22:00:00.000Z
CVE-2006-4593 
Cross-site scripting (XSS) vulnerability in index.php in SoftBB 0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-06T22:00:00.000Z
CVE-2006-4594 
Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpAtm) 1.21 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the include_location parameter in (1) confirm.php or (2) login.php.  NOTE: the include_location parameter to index.php is already covered by CVE-2005-1681.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-06T22:00:00.000Z
CVE-2006-4595 
muforum (µforum) 0.4c stores membres/members.dat under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as usernames and password hashes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4596 
PHP remote file inclusion in MyBace Light Skrip, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the (1) hauptverzeichniss parameter in includes/login_check.php and the (2) template_back parameter in admin/login/content/user_daten.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4597 
SQL injection vulnerability in devam.asp in ICBlogger 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the YID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4598 
Multiple SQL injection vulnerabilities in links.php in ssLinks 1.22 allow remote attackers to execute arbitrary SQL commands via the (1) go parameter and (2) id parameter in a rate action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4599 
SQL injection vulnerability in aut_verifica.inc.php in Autentificator 2.01 allows remote attackers to execute arbitrary SQL commands via the user parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4600 
slapd in OpenLDAP before 2.3.25 allows remote authenticated users with selfwrite Access Control List (ACL) privileges to modify arbitrary Distinguished Names (DN).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4601 
SQL injection vulnerability in index.php in Annuaire 1Two 2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4602 
Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier allows remote attackers to execute arbitrary PHP code via a filepath parameter that contains a filename with a .php extension, which is uploaded to the img/wiki/ directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4603 
NCH Swift Sound Web Dictate 1.02 allows remote attackers to bypass authentication via a null password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4604 
PHP remote file inclusion vulnerability in LFXlib/access_manager.php in Lanifex Database of Managed Objects (DMO) 2.3 Beta and earlier allows remote attackers to execute arbitrary PHP code via the _incMgr parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4605 
PHP remote file inclusion vulnerability in index.php in Longino Jacome php-Revista 1.1.2 allows remote attackers to execute arbitrary PHP code via the adodb parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4606 
Multiple SQL injection vulnerabilities in Longino Jacome php-Revista 1.1.2 allow remote attackers to execute arbitrary SQL commands via the (1) id_temas parameter in busqueda_tema.php, the (2) cadena parameter in busqueda.php, the (3) id_autor parameter in autor.php, the (4) email parameter in lista.php, and the (5) id_articulo parameter in articulo.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4607 
admin/index.php in Longino Jacome php-Revista 1.1.2 allows remote attackers to bypass authentication controls by setting the ID_ADMIN and SUPER_ADMIN parameters to 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4608 
Multiple cross-site scripting (XSS) vulnerabilities in Longino Jacome php-Revista 1.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) cadena parameter in busqueda.php and the (2) email parameter in lista.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4609 
Multiple PHP remote file inclusion vulnerabilities in the Content Management module ("Content manager") for PHProjekt 0.6.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via the path_pre parameter in (1) cm_lib.inc.php, (2) doc/br.edithelp.php, (3) doc/de.edithelp.php, (4) doc/ct.edithelp.php, (5) userrating.php, and (6) listing.php, a different set of vectors than CVE-2006-4204.  NOTE: a third-party researcher has disputed the impact of the cm_lib.inc.php vector, stating that it is limited to local file inclusion. CVE analysis as of 20060905 concurs, although use of ftp URLs is also possible. The remaining five vectors have also been disputed by the same third party, stating that the path_pre variable is initialized before it is used
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4610 
PHP remote file inclusion vulnerability in index.php in GrapAgenda 0.11 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4611 
Buffer overflow in the _tor_resolve function in dsocks.c in dsocks before 1.4 allows remote attackers to execute arbitrary code via unspecified vectors, possibly involving a long node name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4612 
SQL injection vulnerability in ReplyNew.asp in ZIXForum 1.12 allows remote attackers to execute arbitrary SQL commands via the RepId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4613 
Multiple unspecified vulnerabilities in SnapGear before 3.1.4u1 allow remote attackers to cause a denial of service via unspecified vectors involving (1) IPSec replay windows and (2) the use of vulnerable versions of ClamAV before 0.88.4.  NOTE: it is possible that vector 2 is related to CVE-2006-4018.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4614 
PDAapps Verichat for Pocket PC 1.30bh stores usernames and passwords in plaintext in the Windows Mobile registry, which allows local users to obtain sensitive information via keys under \HKEY_CURRENT_USER\Software\PDAapps\VeriChat.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4615 
Shape Services IM+ Mobile Instant Messenger for Pocket PC 3.10 stores usernames and passwords in plaintext in %PROGRAMFILES%\IMPlus\implus.cfg, which allows local users to obtain sensitive information by reading the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4616 
SMTP service in MailEnable Standard, Professional, and Enterprise before ME-10014 (20060904) allows remote attackers to cause a denial of service via an SPF lookup for a domain with a large number of records, which triggers a null pointer exception.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4617 
Unrestricted file upload vulnerability in fileupload.html in vtiger CRM 4.2.4, and possibly earlier versions, allows remote attackers to upload and execute arbitrary files with executable extensions in the /cashe/mails folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4618 
PHP remote file inclusion vulnerability in adodb-postgres7.inc.php in John Lim ADOdb, possibly 4.01 and earlier, as used in Intechnic In-link 2.3.4, allows remote attackers to execute arbitrary PHP code via a URL in the ADODB_DIR parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4619 
The start update window in update.exe in Avira AntiVir PersonalEdition Classic 7.0 build 151 allows local users to gain system privileges via a "Shatter" style attack on the (1) IParam parameter, and the (2) PBM_GETRANGE and (3) PBM_SETRANGE messages in an unspecified progress bar.  NOTE: some details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4620 
The useredit_account.wdm module in Alt-N WebAdmin 3.2.5 running with MDaemon 9.0.6, and possibly earlier versions, allows remote authenticated domain administrators to gain privileges and obtain access to the system mail queue by modifying the mailbox of the MDaemon user account to use the mailbox of another account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4621 
PHP remote file inclusion vulnerability in settings.php in Pheap 1.2, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the lpref parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information. The lib/config.php vector is already covered by CVE-2006-4531.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4622 
PHP remote file inclusion vulnerability in annonce.php in AnnonceV (aka annoncesV) 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T00:00:00.000Z
CVE-2006-4623 
The Unidirectional Lightweight Encapsulation (ULE) decapsulation component in dvb-core/dvb_net.c in the dvb driver in the Linux kernel 2.6.17.8 allows remote attackers to cause a denial of service (crash) via an SNDU length of 0 in a ULE packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-11T17:00:00.000Z
CVE-2006-4624 
CRLF injection vulnerability in Utils.py in Mailman before 2.1.9rc1 allows remote attackers to spoof messages in the error log and possibly trick the administrator into visiting malicious URLs via CRLF sequences in the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T19:00:00.000Z
CVE-2006-4625 
PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-12T16:00:00.000Z
CVE-2006-4626 
Heap-based buffer overflow in alwil avast! Anti-virus Engine before 4.7.869 allows remote attackers to execute arbitrary code via a crafted LHA file that contains extended headers with file and directory names whose concatenation triggers the overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T21:00:00.000Z
CVE-2006-4627 
System Information ActiveX control (msinfo.dll), when accessed via Microsoft Internet Explorer, allows remote attackers to cause a denial of service (crash) via a SaveFile function with a long (1) computer and possibly (2) filename and (3) category argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-07T21:00:00.000Z
CVE-2006-4628 
Cross-site scripting (XSS) vulnerability in VCD-db before 0.983 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when handling comments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T20:00:00.000Z
CVE-2006-4629 
PHP remote file inclusion vulnerability in affichage/commentaires.php in C-News.fr C-News 1.0.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T20:00:00.000Z
CVE-2006-4630 
PHP remote file inclusion vulnerability in jscript.php in Sky GUNNING MySpeach 3.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the my_ms[root] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T20:00:00.000Z
CVE-2006-4631 
Direct static code injection vulnerability in admin/save_opt.php in SoftBB 0.1, and possibly earlier, allows remote authenticated users to upload and execute arbitrary PHP code via the cache_forum parameter, which saves the code to info_options.php, which is accessible via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T20:00:00.000Z
CVE-2006-4632 
Multiple SQL injection vulnerabilities in SoftBB 0.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) groupe parameter in addmembre.php and the (2) select parameter in moveto.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T20:00:00.000Z
CVE-2006-4633 
index.php in SoftBB 0.1, and possibly earlier, allows remote attackers to obtain the installation path via a null or invalid page[] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T20:00:00.000Z
CVE-2006-4634 
Cross-site scripting (XSS) vulnerability in index.php in VBZooM allows remote attackers to inject arbitrary web script or HTML via the UserID parameter, a different vector than CVE-2006-1133 and CVE-2005-2441.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T20:00:00.000Z
CVE-2006-4635 
Unspecified vulnerability in MySource Classic 2.14.6, and possibly earlier, allows remote authenticated users, with superuser privileges, to inject arbitrary PHP code via unspecified vectors related to the Equation attribute in Web_Extensions - Notitia (I/II).  NOTE: due to lack of details, it is not clear whether this issue is file inclusion, static code injection, or another type of issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T20:00:00.000Z
CVE-2006-4636 
Directory traversal vulnerability in SZEWO PhpCommander 3.0 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Directory parameter, as demonstrated by parameter values naming Apache HTTP Server log files that apparently contain PHP code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T20:00:00.000Z
CVE-2006-4637 
Multiple PHP remote file inclusion vulnerabilities in ACGV News 0.9.1 allow remote attackers to execute arbitrary PHP code via a URL in the PathNews parameter in (1) header.php or (2) news.php.  NOTE: portions of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T20:00:00.000Z
CVE-2006-4638 
PHP remote file inclusion vulnerability in article.php in ACGV News 0.9.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PathNews parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-08T20:00:00.000Z