rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-1663 
Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) 2.1.10 and 2.1.11 on Linux and Windows allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T00:00:00.000Z
CVE-2008-1664 
Unspecified vulnerability in libc on HP HP-UX B.11.23 and B.11.31 allows remote attackers to cause a denial of service via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-08T19:00:00.000Z
CVE-2008-1665 
Multiple unspecified vulnerabilities in HP Select Identity (HPSI) Active Directory Bidirectional LDAP Connector 2.20, 2.20.001, 2.20.002, and 2.30 allow remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-17T10:00:00.000Z
CVE-2008-1666 
Unspecified vulnerability in HP Oracle for OpenView (OfO) 8.1.7, 9.1.01, 9.2, 9.2.0, 10g, and 10gR2 has unknown impact and attack vectors, possibly related to the July 2008 Oracle Critical Patch Update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-17T10:00:00.000Z
CVE-2008-1667 
The Probe Builder Service (aka PBOVISServer.exe) in European Performance Systems (EPS) Probe Builder 2.2 before A.02.20.901, as used in HP OpenView Internet Services (OVIS) on Windows, allows remote attackers to kill arbitrary processes via a process ID number in an unspecified opcode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-29T18:00:00.000Z
CVE-2008-1668 
ftpd.c in (1) wu-ftpd 2.4.2 and (2) ftpd in HP HP-UX B.11.11 assigns uid 0 to the FTP client in certain operating-system misconfigurations in which PAM authentication can succeed even though no passwd entry is available for a user, which allows remote attackers to gain privileges, as demonstrated by a login attempt for an LDAP account when nsswitch.conf does not specify LDAP for passwd information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-13T18:00:00.000Z
CVE-2008-1669 
Linux kernel before 2.6.25.2 does not apply a certain protection mechanism for fcntl functionality, which allows local users to (1) execute code in parallel or (2) exploit a race condition to obtain "re-ordered access to the descriptor table."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-08T00:00:00.000Z
CVE-2008-1670 
Heap-based buffer overflow in the progressive PNG Image loader (decoders/pngloader.cpp) in KHTML in KDE 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-28T17:00:00.000Z
CVE-2008-1671 
start_kdeinit in KDE 3.5.5 through 3.5.9, when installed setuid root, allows local users to cause a denial of service and possibly execute arbitrary code via "user-influenceable input" (probably command-line arguments) that cause start_kdeinit to send SIGUSR1 signals to other processes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-28T17:00:00.000Z
CVE-2008-1672 
OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS handshake that omits the Server Key Exchange message and uses "particular cipher suites," which triggers a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-29T16:00:00.000Z
CVE-2008-1673 
The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-10T00:00:00.000Z
CVE-2008-1675 
The bdx_ioctl_priv function in the tehuti driver (tehuti.c) in Linux kernel 2.6.x before 2.6.25.1 does not properly check certain information related to register size, which has unspecified impact and local attack vectors, probably related to reading or writing kernel memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-02T16:00:00.000Z
CVE-2008-1676 
Red Hat PKI Common Framework (rhpki-common) in Red Hat Certificate System (aka Certificate Server or RHCS) 7.1 through 7.3, and Netscape Certificate Management System 6.x, does not recognize Certificate Authority profile constraints on Extensions, which might allow remote attackers to bypass intended restrictions and conduct man-in-the-middle attacks by submitting a certificate signing request (CSR) and using the resulting certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-07T23:00:00.000Z
CVE-2008-1677 
Buffer overflow in the regular expression handler in Red Hat Directory Server 8.0 and 7.1 before SP6 allows remote attackers to cause a denial of service (slapd crash) and possibly execute arbitrary code via a crafted LDAP query that triggers the overflow during translation to a regular expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-12T16:00:00.000Z
CVE-2008-1678 
Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-10T17:00:00.000Z
CVE-2008-1679 
Multiple integer overflows in imageop.c in Python before 2.5.3 allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted images that trigger heap-based buffer overflows.  NOTE: this issue is due to an incomplete fix for CVE-2007-4965.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-21T20:00:00.000Z
CVE-2008-1680 
PHP-Nuke Platinum 7.6.b.5 allows remote attackers to obtain configuration information via a direct request to maintenance/index.php, which reveals settings such as magic_quotes_gpc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-04T00:00:00.000Z
CVE-2008-1681 
Unspecified vulnerability in IBM DB2 Content Manager before 8.3 FP8 has unknown impact and attack vectors related to the AllowedTrustedLogin privilege.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-04T19:00:00.000Z
CVE-2008-1682 
PHP remote file inclusion vulnerability in quiz/common/db_config.inc.php in the Online FlashQuiz (com_onlineflashquiz) 1.0.2 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the base_dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-04T19:00:00.000Z
CVE-2008-1684 
inetd on Sun Solaris 10, when debug logging is enabled, allows local users to write to arbitrary files via a symlink attack on the /var/tmp/inetd.log temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-06T23:00:00.000Z
CVE-2008-1685 
gcc 4.2.0 through 4.3.0 in GNU Compiler Collection, when casts are not used, considers the sum of a pointer and an int to be greater than or equal to the pointer, which might lead to removal of length testing code that was intended as a protection mechanism against integer overflow and buffer overflow attacks, and provide no diagnostic message about this removal. NOTE: the vendor has determined that this compiler behavior is correct according to section 6.5.6 of the C99 standard (aka ISO/IEC 9899:1999)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-06T23:00:00.000Z
CVE-2008-1686 
Array index vulnerability in Speex 1.1.12 and earlier, as used in libfishsound 0.9.0 and earlier, including Illiminable DirectShow Filters and Annodex Plugins for Firefox, xine-lib before 1.1.12, and many other products, allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-08T18:00:00.000Z
CVE-2008-1687 
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-09T19:00:00.000Z
CVE-2008-1688 
Unspecified vulnerability in GNU m4 before 1.4.11 might allow context-dependent attackers to execute arbitrary code, related to improper handling of filenames specified with the -F option.  NOTE: it is not clear when this issue crosses privilege boundaries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-09T19:00:00.000Z
CVE-2008-1689 
Stack consumption vulnerability in WebContainer.exe 1.0.0.336 and earlier in SLMail Pro 6.3.1.0 and earlier allows remote attackers to cause a denial of service (daemon crash) via a long request header in an HTTP request to TCP port 801.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-07T17:00:00.000Z
CVE-2008-1690 
WebContainer.exe 1.0.0.336 and earlier in SLMail Pro 6.3.1.0 and earlier allows remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a long URI in HTTP requests to TCP port 801.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-07T17:00:00.000Z
CVE-2008-1691 
Unspecified vulnerability in SLMail.exe in SLMail Pro 6.3.1.0 and earlier allows remote attackers to cause a denial of service (UDP service outage) via a large packet to UDP port 54.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-07T17:00:00.000Z
CVE-2008-1692 
Eterm 0.9.4 opens a terminal window on :0 if -display is not specified and the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections.  NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-07T18:00:00.000Z
CVE-2008-1693 
The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before 0.8.0, as used in Xpdf, Evince, ePDFview, KWord, and other applications, does not properly handle embedded fonts in PDF files, which allows remote attackers to execute arbitrary code via a crafted font object, related to dereferencing a function pointer associated with the type of this font object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-18T15:00:00.000Z
CVE-2008-1694 
vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via a symlink attack on temporary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-21T20:00:00.000Z
CVE-2008-1696 
Directory traversal vulnerability in makepost.php in DaZPHPNews 0.1-1, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the prefixdir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-08T17:00:00.000Z
CVE-2008-1697 
Stack-based buffer overflow in ovwparser.dll in HP OpenView Network Node Manager (OV NNM) 7.53, 7.51, and earlier allows remote attackers to execute arbitrary code via a long URI in an HTTP request processed by ovas.exe, as demonstrated by a certain topology/homeBaseView request.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-08T17:00:00.000Z
CVE-2008-1698 
Cross-site scripting (XSS) vulnerability in gallery.php in Simple Gallery 2.2 allows remote attackers to inject arbitrary web script or HTML via the album parameter to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-08T17:00:00.000Z
CVE-2008-1699 
SQL injection vulnerability in permalink.php in Desi Quintans Writer's Block CMS 3.8a allows remote attackers to execute arbitrary SQL commands via the PostID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-08T17:00:00.000Z
CVE-2008-1700 
The Web TransferCtrl Class 8,2,1,4 (iManFile.cab), as used in WorkSite Web 8.2 before SP1 P2, allows remote attackers to cause a denial of service (memory consumption) via a large number of SendNrlLink directives, which opens a separate window for each directive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-08T18:00:00.000Z
CVE-2008-1701 
Novell NetWare 6.5 allows attackers to cause a denial of service (ABEND) via a crafted Macintosh iPrint client request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-08T18:00:00.000Z
CVE-2008-1702 
Absolute path traversal vulnerability in dload.php in the my_gallery 2.3 plugin for e107 allows remote attackers to obtain sensitive information via a full pathname in the file parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-08T18:00:00.000Z
CVE-2008-1703 
Multiple buffer overflows in TIBCO Software Rendezvous before 8.1.0, as used in multiple TIBCO products, allow remote attackers to execute arbitrary code via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-11T10:00:00.000Z
CVE-2008-1704 
Multiple buffer overflows in TIBCO Software Enterprise Message Service (EMS) before 4.4.3, and iProcess Engine 10.6.0 through 10.6.1, allow remote attackers to execute arbitrary code via a crafted message to the EMS server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-11T10:00:00.000Z
CVE-2008-1705 
Format string vulnerability in the logging function in IBM solidDB 06.00.1018 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the (1) user name, (2) peer name, and possibly unspecified other fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-09T19:00:00.000Z
CVE-2008-1706 
Uncontrolled array index in IBM solidDB 06.00.1018 and earlier allows remote attackers to cause a denial of service (daemon crash) via a large value in a certain 32-bit field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-09T19:00:00.000Z
CVE-2008-1707 
IBM solidDB 06.00.1018 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a packet with an 0x11 value in a certain "type" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-09T19:00:00.000Z
CVE-2008-1708 
IBM solidDB 06.00.1018 and earlier does not validate a certain field that specifies an amount of memory to allocate, which allows remote attackers to cause a denial of service (daemon exit) via a packet with a large value in this field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-09T19:00:00.000Z
CVE-2008-1709 
Buffer overflow in Microsoft Visual InterDev 6.0 (SP6) allows user-assisted attackers to execute arbitrary code via a Studio Solution (.SLN) file with a long malformed Project line beginning with a 'Project("{}") =' sequence, probably a different vector than CVE-2008-0250.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-09T19:00:00.000Z
CVE-2008-1710 
Untrusted search path vulnerability in chnfsmnt in IBM AIX 6.1 allows local users to gain privileges via a modified PATH environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-09T19:00:00.000Z
CVE-2008-1711 
Terong PHP Photo Gallery (aka Advanced Web Photo Gallery) 1.0 stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-09T19:00:00.000Z
CVE-2008-1712 
PHP remote file inclusion vulnerability in includes/functions_weblog.php in mxBB mx_blogs 2.0.0 beta allows remote attackers to execute arbitrary PHP code via a URL in the mx_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-09T21:00:00.000Z
CVE-2008-1713 
MailServer.exe in NoticeWare Email Server 4.6.1.0 allows remote attackers to cause a denial of service (application crash) via a long string to IMAP port (143/tcp).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-09T21:00:00.000Z
CVE-2008-1714 
SQL injection vulnerability in show.php in FaScript FaPhoto 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-09T21:00:00.000Z
CVE-2008-1715 
SQL injection vulnerability in content/user.php in AuraCMS 2.2.1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the country parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-09T21:00:00.000Z
CVE-2008-1716 
Cross-site scripting (XSS) vulnerability in WoltLab Community Framework (WCF) 1.0.6 in WoltLab Burning Board 3.0.5 allows remote attackers to inject arbitrary web script or HTML via the (1) page and (2) form parameters, which are not properly handled when they are reflected back in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-09T21:00:00.000Z
CVE-2008-1717 
WoltLab Community Framework (WCF) 1.0.6 in WoltLab Burning Board 3.0.5 allows remote attackers to obtain the full path via invalid (1) page and (2) form parameters, which leaks the path from an exception handler when a valid class cannot be found.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-09T21:00:00.000Z
CVE-2008-1718 
Buffer overflow in mimesr.dll in Autonomy (formerly Verity) KeyView, as used in IBM Lotus Notes before 8.0, might allow user-assisted remote attackers to execute arbitrary code via an e-mail message with a crafted Text mail (MIME) attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-10T18:00:00.000Z
CVE-2008-1719 
Multiple cross-site request forgery (CSRF) vulnerabilities in Nuke ET 3.2 and 3.4 allow remote attackers to perform actions as administrators, as demonstrated by inserting an XSS sequence into a document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-10T19:00:00.000Z
CVE-2008-1720 
Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled, might allow remote attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-10T19:00:00.000Z
CVE-2008-1721 
Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers to execute arbitrary code via a negative signed integer, which triggers insufficient memory allocation and a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-10T19:00:00.000Z
CVE-2008-1722 
Multiple integer overflows in (1) filter/image-png.c and (2) filter/image-zoom.c in CUPS 1.3 allow attackers to cause a denial of service (crash) and trigger memory corruption, as demonstrated via a crafted PNG image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-10T19:00:00.000Z
CVE-2008-1724 
Stack-based buffer overflow in the IActiveXTransfer.FileTransfer method in the SecureTransport FileTransfer ActiveX control in vcst_en.dll 1.0.0.5 in Tumbleweed SecureTransport Server before 4.6.1 Hotfix 20 allows remote attackers to execute arbitrary code via a long remoteFile parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-11T19:00:00.000Z
CVE-2008-1725 
The IBizEBank.FIProfile.1 ActiveX control in fiprofile20.ocx in IBiz E-Banking Integrator (formerly IBiz OFX Integrator) 2.0.2932 exposes the unsafe WriteOFXDataFile method, which allows remote attackers to overwrite arbitrary files via a full pathname in the argument.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-11T19:00:00.000Z
CVE-2008-1726 
Multiple SQL injection vulnerabilities in KnowledgeQuest 2.6, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) kqid parameter to (a) articletext.php and (b) articletextonly.php and the (2) username parameter to (c) logincheck.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-11T19:00:00.000Z
CVE-2008-1727 
KnowledgeQuest 2.5 and 2.6 does not require authentication for access to admincheck.php, which allows remote attackers to create arbitrary admin accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-11T19:00:00.000Z
CVE-2008-1728 
ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service (daemon outage) by triggering large outgoing queues without reading messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-11T19:00:00.000Z
CVE-2008-1729 
The menu system in Drupal 6 before 6.2 has incorrect menu settings, which allows remote attackers to (1) edit the profile pages of arbitrary users, and obtain sensitive information from (2) tracker and (3) blog pages, related to a missing check for the "access content" permission; and (4) allows remote authenticated users, with administration page view access, to edit content types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-11T19:00:00.000Z
CVE-2008-1730 
Directory traversal vulnerability in download.html in ARWScripts Gallery Script Lite (aka gallery-script-lite or Free Photo Gallery Site Script), as of 20080411, allows remote attackers to read arbitrary local files via directory traversal sequences in the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-11T19:00:00.000Z