rainbutterfly/cve_corpus huggingface dataset:
CVE-2004-2777 
GE Healthcare Centricity Image Vault 3.x has a password of (1) gemnet for the administrator account, (2) webadmin for the webadmin administrator account of the ASACA DVD library, (3) an empty value for the gemsservice account of the Ultrasound Database, and possibly (4) gemnet2002 for the gemnet2002 account of the GEMNet license server, which has unspecified impact and attack vectors.  NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-04T10:00:00.000Z
CVE-2004-2778 
Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, which allows local users to read or write to restricted directories or execute restricted commands via navigating to the affected directories, or executing the affected commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-27T20:00:00.000Z
CVE-2004-2779 
id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-20T21:00:00.000Z
CVE-2005-0001 
Race condition in the page fault handler (fault.c) for Linux kernel 2.2.x to 2.2.7, 2.4 to 2.4.29, and 2.6 to 2.6.10, when running on multiprocessor machines, allows local users to execute arbitrary code via concurrent threads that share the same virtual memory space and simultaneously request stack expansion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0002 
poppassd_pam 1.0 and earlier, when changing a user password, does not verify that the user entered the old password correctly, which allows remote attackers to change passwords for arbitrary users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0003 
The 64 bit ELF support in Linux kernel 2.6 before 2.6.10, on 64-bit architectures, does not properly check for overlapping VMA (virtual memory address) allocations, which allows local users to cause a denial of service (system crash) or execute arbitrary code via a crafted ELF or a.out file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-20T05:00:00.000Z
CVE-2005-0004 
The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite arbitrary files or read temporary files via a symlink attack on temporary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-20T05:00:00.000Z
CVE-2005-0005 
Heap-based buffer overflow in psd.c for ImageMagick 6.1.0, 6.1.7, and possibly earlier versions allows remote attackers to execute arbitrary code via a .PSD image file with a large number of layers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0006 
The COPS dissector in Ethereal 0.10.6 through 0.10.8 allows remote attackers to cause a denial of service (infinite loop).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0007 
Unknown vulnerability in the DLSw dissector in Ethereal 0.10.6 through 0.10.8 allows remote attackers to cause a denial of service (application crash from assertion).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0008 
Unknown vulnerability in the DNP dissector in Ethereal 0.10.5 through 0.10.8 allows remote attackers to cause "memory corruption."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0009 
Unknown vulnerability in the Gnutella dissector in Ethereal 0.10.6 through 0.10.8 allows remote attackers to cause a denial of service (application crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0010 
Unknown vulnerability in the MMSE dissector in Ethereal 0.10.4 through 0.10.8 allows remote attackers to cause a denial of service by triggering a free of statically allocated memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0011 
Multiple vulnerabilities in fliccd, when installed setuid root as part of the kdeedu Kstars support for Instrument Neutral Distributed Interface (INDI) in KDE 3.3 to 3.3.2, allow local users and remote attackers to execute arbitrary code via stack-based buffer overflows.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-16T05:00:00.000Z
CVE-2005-0012 
Format string vulnerability in the a_Interface_msg function in Dillo before 0.8.3-r4 allows remote attackers to execute arbitrary code via format string specifiers in a web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0013 
nwclient.c in ncpfs before 2.2.6 does not drop root privileges before executing utilities using the NetWare client functions, which allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0014 
Buffer overflow in ncplogin in ncpfs before 2.2.6 allows remote malicious NetWare servers to execute arbitrary code on the NetWare client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0015 
diatheke.pl in Sword 1.5.7a allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0016 
Buffer overflow in the exported_display function in xatitv in gatos before 0.0.5 allows local users to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-22T05:00:00.000Z
CVE-2005-0017 
The f2c translator in the f2c package 3.1 allows local users to read arbitrary files via a symlink attack on temporary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0018 
The f2 shell script in the f2c package 3.1 allows local users to read arbitrary files via a symlink attack on temporary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0019 
Unknown vulnerability in hztty 2.0 and earlier allows local users to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-15T05:00:00.000Z
CVE-2005-0020 
Buffer overflow in playmidi before 2.4 allows local users to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-22T05:00:00.000Z
CVE-2005-0021 
Multiple buffer overflows in Exim before 4.43 may allow attackers to execute arbitrary code via (1) an IPv6 address with more than 8 components, as demonstrated using the -be command line option, which triggers an overflow in the host_aton function, or (2) the -bh command line option or dnsdb PTR lookup, which triggers an overflow in the dns_build_reverse function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-06T05:00:00.000Z
CVE-2005-0022 
Buffer overflow in the spa_base64_to_bits function in Exim before 4.43, as originally obtained from Samba code, and as called by the auth_spa_client function, may allow attackers to execute arbitrary code during SPA authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-06T05:00:00.000Z
CVE-2005-0023 
gnome-pty-helper in GNOME libzvt2 and libvte4 allows local users to spoof the logon hostname via a modified DISPLAY environment variable. NOTE: the severity of this issue has been disputed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-05T04:00:00.000Z
CVE-2005-0033 
Buffer overflow in the code for recursion and glue fetching in BIND 8.4.4 and 8.4.5 allows remote attackers to cause a denial of service (crash) via queries that trigger the overflow in the q_usedns array that tracks nameservers and addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0034 
An "incorrect assumption" in the authvalidated validator function in BIND 9.3.0, when DNSSEC is enabled, allows remote attackers to cause a denial of service (named server exit) via crafted DNS packets that cause an internal consistency test (self-check) to fail.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0035 
The Acrobat web control in Adobe Acrobat and Acrobat Reader 7.0 and earlier, when used with Internet Explorer, allows remote attackers to determine the existence of arbitrary files via the LoadFile ActiveX method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-21T04:00:00.000Z
CVE-2005-0036 
The DNS implementation in DeleGate 8.10.2 and earlier allows remote attackers to cause a denial of service via a compressed DNS packet with a label length byte with an incorrect offset, which could trigger an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-28T01:00:00.000Z
CVE-2005-0037 
The DNS implementation of DNRD before 2.10 allows remote attackers to cause a denial of service via a compressed DNS packet with a label length byte with an incorrect offset, which could trigger an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-28T01:00:00.000Z
CVE-2005-0038 
The DNS implementation of PowerDNS 2.9.16 and earlier allows remote attackers to cause a denial of service via a compressed DNS packet with a label length byte with an incorrect offset, which could trigger an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-28T01:00:00.000Z
CVE-2005-0039 
Certain configurations of IPsec, when using Encapsulating Security Payload (ESP) in tunnel mode, integrity protection at a higher layer, or Authentication Header (AH), allow remote attackers to decrypt IPSec communications by modifying the outer packet in ways that cause plaintext data from the inner packet to be returned in ICMP messages, as demonstrated using bit-flipping attacks and (1) Destination Address Rewriting, (2) a modified header length that causes portions of the packet to be interpreted as IP Options, or (3) a modified protocol field and source address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-10T04:00:00.000Z
CVE-2005-0040 
Multiple cross-site scripting (XSS) vulnerabilities in DotNetNuke before 3.0.12 allow remote attackers to inject arbitrary web script or HTML via the (1) register a new user page, (2) User-Agent, or (3) Username, which is not properly quoted before sending to the error log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-19T04:00:00.000Z
CVE-2005-0043 
Buffer overflow in Apple iTunes 4.7 allows remote attackers to execute arbitrary code via a long URL in (1) .m3u or (2) .pls playlist files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0044 
The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-08T05:00:00.000Z
CVE-2005-0045 
The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the "Server Message Block Vulnerability," and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-08T05:00:00.000Z
CVE-2005-0047 
Windows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-08T05:00:00.000Z
CVE-2005-0048 
Microsoft Windows XP SP2 and earlier, 2000 SP3 and SP4, Server 2003, and older operating systems allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IP packets with malformed options, aka the "IP Validation Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-13T04:00:00.000Z
CVE-2005-0049 
Windows SharePoint Services and SharePoint Team Services for Windows Server 2003 does not properly validate an HTTP redirection query, which allows remote attackers to inject arbitrary HTML and web script via a cross-site scripting (XSS) attack, or to spoof the web cache.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-08T05:00:00.000Z
CVE-2005-0050 
The License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, aka the "License Logging Service Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-08T05:00:00.000Z
CVE-2005-0051 
The Server service (srvsvc.dll) in Windows XP SP1 and SP2 allows remote attackers to obtain sensitive information (users who are accessing resources) via an anonymous logon using a named pipe, which is not properly authenticated, aka the "Named Pipe Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-08T05:00:00.000Z
CVE-2005-0053 
Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-08T05:00:00.000Z
CVE-2005-0054 
Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-08T05:00:00.000Z
CVE-2005-0055 
Internet Explorer 5.01, 5.5, and 6 does not properly validate buffers when handling certain DHTML methods including the createControlRange Javascript function, which allows remote attackers to execute arbitrary code, aka the "DHTML Method Heap Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-08T05:00:00.000Z
CVE-2005-0056 
Internet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-08T05:00:00.000Z
CVE-2005-0057 
The Hyperlink Object Library for Windows 98, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a crafted link that triggers an "unchecked buffer" in the library, possibly due to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-08T05:00:00.000Z
CVE-2005-0058 
Buffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to elevate privileges or execute arbitrary code via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-0059 
Buffer overflow in the Message Queuing component of Microsoft Windows 2000 and Windows XP SP1 allows remote attackers to execute arbitrary code via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-13T04:00:00.000Z
CVE-2005-0060 
Buffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-13T04:00:00.000Z
CVE-2005-0061 
The kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain access requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-13T04:00:00.000Z
CVE-2005-0063 
The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-13T04:00:00.000Z
CVE-2005-0064 
Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary code via a PDF file with a large /Encrypt /Length keyLength value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0065 
The original design of TCP does not check that the TCP sequence number in an ICMP error message is within the range of sequence numbers for data that has been sent but not acknowledged (aka "TCP sequence number checking"), which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using (1) blind connection-reset attacks with forged "Destination Unreachable" messages, (2) blind throughput-reduction attacks with forged "Source Quench" messages, or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced.  NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability.  While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0066 
The original design of TCP does not check that the TCP Acknowledgement number in an ICMP error message generated by an intermediate router is within the range of possible values for data that has already been acknowledged (aka "TCP acknowledgement number checking"), which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using (1) blind connection-reset attacks with forged "Destination Unreachable" messages, (2) blind throughput-reduction attacks with forged "Source Quench" messages, or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced.  NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability.  While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0067 
The original design of TCP does not require that port numbers be assigned randomly (aka "Port randomization"), which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using (1) blind connection-reset attacks with forged "Destination Unreachable" messages, (2) blind throughput-reduction attacks with forged "Source Quench" messages, or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced.  NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability.  While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0068 
The original design of ICMP does not require authentication for host-generated ICMP error messages, which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using (1) blind connection-reset attacks with forged "Destination Unreachable" messages, (2) blind throughput-reduction attacks with forged "Source Quench" messages, or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced.  NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability.  While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0069 
The (1) tcltags or (2) vimspell.sh scripts in vim 6.3 allow local users to overwrite or create arbitrary files via a symlink attack on temporary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0070 
Synaesthesia 2.1 and earlier, and possibly other versions, when installed setuid root, does not drop privileges before processing configuration and mixer files, which allows local users to read arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-16T05:00:00.000Z