rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-5648 
SQL injection vulnerability in admin/login.php in DeltaScripts PHP Shop 1.0 allows remote attackers to execute arbitrary SQL commands via the admin_username parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T18:00:00.000Z
CVE-2008-5649 
SQL injection vulnerability in admin/admin.php in AlstraSoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T18:00:00.000Z
CVE-2008-5650 
SQL injection vulnerability in the login directory in AlstraSoft Web Host Directory allows remote attackers to execute arbitrary SQL commands via the pwd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T18:00:00.000Z
CVE-2008-5651 
SQL injection vulnerability in plugins/bookmarker/bookmarker_backend.php in MyioSoft EasyBookMarker 4.0 allows remote attackers to execute arbitrary SQL commands via the Parent parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T18:00:00.000Z
CVE-2008-5652 
SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyBookMarker 4.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through the username parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T18:00:00.000Z
CVE-2008-5653 
SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through the username parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T18:00:00.000Z
CVE-2008-5654 
SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyCalendar 4.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through the username parameter, a different vector than CVE-2008-1344.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T18:00:00.000Z
CVE-2008-5655 
Multiple SQL injection vulnerabilities in MyioSoft EasyBookMarker 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) delete_folder and (2) delete_link parameters to unspecified vectors, possibly to (a) plugins/bookmarker/bookmarker_backend.php or (b) ajaxp.php, different vectors than CVE-2008-5654.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T18:00:00.000Z
CVE-2008-5656 
Cross-site scripting (XSS) vulnerability in the frontend plugin for the felogin system extension in TYPO3 4.2.0, 4.2.1 and 4.2.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T20:00:00.000Z
CVE-2008-5657 
CRLF injection vulnerability in Quassel Core before 0.3.0.3 allows remote attackers to spoof IRC messages as other users via a crafted CTCP message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T20:00:00.000Z
CVE-2008-5658 
Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier allows context-dependent attackers to write arbitrary files via a ZIP file with a file whose name contains .. (dot dot) sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T20:00:00.000Z
CVE-2008-5659 
The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T20:00:00.000Z
CVE-2008-5660 
Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24.2 might allow remote attackers to execute arbitrary code via format string specifiers in a crafted URI or VNC server response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T20:00:00.000Z
CVE-2008-5661 
The IPv4 Forwarding feature in Sun Solaris 10 and OpenSolaris snv_47 through snv_82, with certain patches installed, allows remote attackers to cause a denial of service (panic) via unknown vectors that trigger a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T20:00:00.000Z
CVE-2008-5662 
Multiple buffer overflows in Sun Java Wireless Toolkit (WTK) for CLDC 2.5.2 and earlier allow downloaded programs to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T20:00:00.000Z
CVE-2008-5663 
Multiple unrestricted file upload vulnerabilities in Kusaba 1.0.4 and earlier allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) load_receiver.php or (2) a shipainter action to paint_save.php, then accessing the uploaded file via a direct request to this file in their user directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-18T21:00:00.000Z
CVE-2008-5664 
Stack-based buffer overflow in Realtek Media Player (aka Realtek Sound Manager, RtlRack, or rtlrack.exe) 1.15.0.0 allows remote attackers to execute arbitrary code via a crafted playlist (PLA) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-18T21:00:00.000Z
CVE-2008-5665 
SQL injection vulnerability in index.php in the xhresim module in XOOPS allows remote attackers to execute arbitrary SQL commands via the no parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-18T21:00:00.000Z
CVE-2008-5666 
WinFTP FTP Server 2.3.0, when passive (aka PASV) mode is used, allows remote authenticated users to cause a denial of service via a sequence of FTP sessions that include an invalid "NLST -1" command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-18T21:00:00.000Z
CVE-2008-5667 
The scanning engine in VirusBlokAda VBA32 Personal Antivirus 3.12.8.x allows remote attackers to cause a denial of service (memory corruption and application crash) via a malformed RAR archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-18T21:00:00.000Z
CVE-2008-5668 
Multiple cross-site scripting (XSS) vulnerabilities in Textpattern (aka Txp CMS) 4.0.5 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to setup/index.php or (2) the name parameter to index.php in the comments preview section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-18T21:00:00.000Z
CVE-2008-5669 
index.php in the comments preview section in Textpattern (aka Txp CMS) 4.0.5 allows remote attackers to cause a denial of service via a long message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-18T21:00:00.000Z
CVE-2008-5670 
Textpattern (aka Txp CMS) 4.0.5 does not ask for the old password during a password reset, which makes it easier for remote attackers to change a password after hijacking a session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-18T21:00:00.000Z
CVE-2008-5671 
PHP remote file inclusion vulnerability in index.php in Joomla! 1.0.11 through 1.0.14, when RG_EMULATION is enabled in configuration.php, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-18T21:00:00.000Z
CVE-2008-5672 
Multiple cross-site request forgery (CSRF) vulnerabilities in PHParanoid before 0.4 allow remote attackers to hijack the authentication of arbitrary users for requests that use (1) admin.php or (2) private messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-18T21:00:00.000Z
CVE-2008-5673 
PHParanoid before 0.4 does not properly restrict access to the members area by unauthenticated users, which has unknown impact and remote attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-18T21:00:00.000Z
CVE-2008-5674 
Multiple array index errors in the HTTP server in Darkwet Network webcamXP 3.72.440.0 and earlier and beta 4.05.280 and earlier allow remote attackers to cause a denial of service (device crash) and read portions of memory via (1) an invalid camnum parameter to the pocketpc component and (2) an invalid id parameter to the show_gallery_pic component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-18T21:00:00.000Z
CVE-2008-5675 
Unspecified vulnerability in IBM WebSphere Portal 6.0 before 6.0.1.5 has unknown impact and attack vectors related to "Access problems with BasicAuthTAI."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-18T22:00:00.000Z
CVE-2008-5676 
Multiple unspecified vulnerabilities in the ModSecurity (aka mod_security) module 2.5.0 through 2.5.5 for the Apache HTTP Server, when SecCacheTransformations is enabled, allow remote attackers to cause a denial of service (daemon crash) or bypass the product's functionality via unknown vectors related to "transformation caching."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-18T22:00:00.000Z
CVE-2008-5677 
Unrestricted file upload vulnerability in Kwalbum 2.0.4, 2.0.2, and earlier, when PICS_PATH is located in the web root, allows remote authenticated users with upload capability to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under items/, related to the ReplaceBadFilenameChars function in include/ItemAdder.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-18T22:00:00.000Z
CVE-2008-5678 
Fretwell-Downing Informatics (FDI) OLIB7 WebView 2.5.1.1 allows remote authenticated users to obtain sensitive information from files via the infile parameter to the default URI under cgi/, as demonstrated by the (1) get_settings.ini, (2) setup.ini, and (3) text.ini files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-18T22:00:00.000Z
CVE-2008-5679 
The HTML parsing engine in Opera before 9.63 allows remote attackers to execute arbitrary code via crafted web pages that trigger an invalid pointer calculation and heap corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T16:09:00.000Z
CVE-2008-5680 
Multiple buffer overflows in Opera before 9.63 might allow (1) remote attackers to execute arbitrary code via a crafted text area, or allow (2) user-assisted remote attackers to execute arbitrary code via a long host name in a file: URL.  NOTE: this might overlap CVE-2008-5178.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T16:09:00.000Z
CVE-2008-5681 
Opera before 9.63 does not block unspecified "scripted URLs" during the feed preview, which allows remote attackers to read existing subscriptions and force subscriptions to arbitrary feed URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T16:09:00.000Z
CVE-2008-5682 
Cross-site scripting (XSS) vulnerability in Opera before 9.63 allows remote attackers to inject arbitrary web script or HTML via built-in XSLT templates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T16:09:00.000Z
CVE-2008-5683 
Unspecified vulnerability in Opera before 9.63 allows remote attackers to "reveal random data" via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T16:09:00.000Z
CVE-2008-5684 
Unspecified vulnerability in the X Inter Client Exchange library (aka libICE) in Sun Solaris 8 through 10 and OpenSolaris before snv_85 allows context-dependent attackers to cause a denial of service (application crash), as demonstrated by a port scan that triggers a segmentation violation in the Gnome session manager (aka gnome-session).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T17:00:00.000Z
CVE-2008-5685 
Sun ScApp firmware 5.18.x, 5.19.x, and 5.20.0 through 5.20.10 on Sun Fire and Netra platforms allows remote attackers to access the System Controller (SC), the system console, and possibly the host OS, and cause a denial of service (shutdown or reboot), via spoofed IP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T17:00:00.000Z
CVE-2008-5686 
IBM Tivoli Provisioning Manager (TPM) before 5.1.1.1 IF0006, when its LDAP service is shared with other applications, does not require that an LDAP user be listed in the TPM user records, which allows remote authenticated users to execute SOAP commands that access arbitrary TPM functionality, as demonstrated by running provisioning workflows.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T17:00:00.000Z
CVE-2008-5687 
MediaWiki 1.11, and other versions before 1.13.3, does not properly protect against the download of backups of deleted images, which might allow remote attackers to obtain sensitive information via requests for files in images/deleted/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T17:00:00.000Z
CVE-2008-5688 
MediaWiki 1.8.1, and other versions before 1.13.3, when the wgShowExceptionDetails variable is enabled, sometimes provides the full installation path in a debugging message, which might allow remote attackers to obtain sensitive information via unspecified requests that trigger an uncaught exception.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T17:00:00.000Z
CVE-2008-5689 
tun in IP Tunnel in Solaris 10 and OpenSolaris snv_01 through snv_76 allows local users to cause a denial of service (panic) and possibly execute arbitrary code via a crafted SIOCGTUNPARAM IOCTL request, which triggers a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T17:00:00.000Z
CVE-2008-5690 
The Kerberos credential renewal feature in Sun Solaris 8, 9, and 10, and OpenSolaris build snv_01 through snv_104, allows local users to cause a denial of service (authentication failure) via unspecified vectors related to incorrect cache file permissions, and lack of credential storage by the store_cred function in pam_krb5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T17:00:00.000Z
CVE-2008-5691 
Heap-based buffer overflow in the Phoenician Casino FlashAX ActiveX control 1.0.0.7 allows remote attackers to execute arbitrary code via a long argument to the SetID method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T17:00:00.000Z
CVE-2008-5692 
Ipswitch WS_FTP Server Manager before 6.1.1, and possibly other Ipswitch products, allows remote attackers to bypass authentication and read logs via a logLogout action to FTPLogServer/login.asp followed by a request to FTPLogServer/LogViewer.asp with the localhostnull account name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T18:00:00.000Z
CVE-2008-5693 
Ipswitch WS_FTP Server Manager 6.1.0.0 and earlier, and possibly other Ipswitch products, might allow remote attackers to read the contents of custom ASP files in WSFTPSVR/ via a request with an appended dot character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T18:00:00.000Z
CVE-2008-5694 
PHP remote file inclusion vulnerability in lib/jpgraph/jpgraph_errhandler.inc.php in Sandbox 1.4.1 might allow remote attackers to execute arbitrary PHP code via unspecified vectors.  NOTE: the issue, if any, may be located in Aditus JpGraph rather than Sandbox. If so, then this should not be treated as an issue in Sandbox.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T18:00:00.000Z
CVE-2008-5695 
wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remote authenticated users with manage_options and upload_files capabilities to execute arbitrary code by uploading a PHP script and adding this script's pathname to active_plugins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T18:00:00.000Z
CVE-2008-5696 
Novell NetWare 6.5 before Support Pack 8, when an OES2 Linux server is installed into the NDS tree, does not require a password for the ApacheAdmin console, which allows remote attackers to reconfigure the Apache HTTP Server via console operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-19T18:00:00.000Z
CVE-2008-5697 
The skype_tool.copy_num method in the Skype extension BETA 2.2.0.95 for Firefox allows remote attackers to write arbitrary data to the clipboard via a string argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-22T15:00:00.000Z
CVE-2008-5698 
HTMLTokenizer::scriptHandler in Konqueror in KDE 3.5.9 and 3.5.10 allows remote attackers to cause a denial of service (application crash) via an invalid document.load call that triggers use of a deleted object.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-22T15:00:00.000Z
CVE-2008-5699 
The name service cache daemon (nscd) in Sun Solaris 10 and OpenSolaris snv_50 through snv_104 does not properly check permissions, which allows local users to gain privileges and obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-22T15:00:00.000Z
CVE-2008-5700 
libata in the Linux kernel before 2.6.27.9 does not set minimum timeouts for SG_IO requests, which allows local users to cause a denial of service (Programmed I/O mode on drives) via multiple simultaneous invocations of an unspecified test program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-22T15:00:00.000Z
CVE-2008-5701 
Array index error in arch/mips/kernel/scall64-o32.S in the Linux kernel before 2.6.28-rc8 on 64-bit MIPS platforms allows local users to cause a denial of service (system crash) via an o32 syscall with a small syscall number, which leads to an attempted read operation outside the bounds of the syscall table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-22T15:00:00.000Z
CVE-2008-5702 
Buffer underflow in the ibwdt_ioctl function in drivers/watchdog/ib700wdt.c in the Linux kernel before 2.6.28-rc1 might allow local users to have an unknown impact via a certain /dev/watchdog WDIOC_SETTIMEOUT IOCTL call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-22T15:00:00.000Z
CVE-2008-5703 
gpsdrive (aka gpsdrive-scripts) 2.10~pre4 allows local users to overwrite arbitrary files via a symlink attack on the (a) /tmp/.smswatch or (b) /tmp/gpsdrivepos temporary file, related to (1) examples/gpssmswatch and (2) src/splash.c, different vectors than CVE-2008-4959 and CVE-2008-5380.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-22T15:00:00.000Z
CVE-2008-5704 
src/unit_test.c in gpsdrive (aka gpsdrive-scripts) 2.10~pre4 might allow local users to overwrite arbitrary files via a symlink attack on the /tmp/gpsdrive-unit-test/proc temporary file, a different vector than CVE-2008-4959 and CVE-2008-5380.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-22T15:00:00.000Z
CVE-2008-5705 
The cTrigger::DoIt function in src/ctrigger.cpp in the trigger mechanism in the daemon in Verlihub 0.9.8d-RC2 and earlier, when user triggers are enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in an argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-22T15:00:00.000Z
CVE-2008-5706 
The cTrigger::DoIt function in src/ctrigger.cpp in the trigger mechanism in the daemon in Verlihub 0.9.8d-RC2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the /tmp/trigger.tmp temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-22T15:00:00.000Z
CVE-2008-5707 
SQL injection vulnerability in urunler.asp in Iltaweb Alisveris Sistemi allows remote attackers to execute arbitrary SQL commands via the catno parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-23T22:00:00.000Z
CVE-2008-5708 
redirect.php in SlimCMS 1.0.0 does not require authentication, which allows remote attackers to create administrative users by using the newusername and newpassword parameters and setting the newisadmin parameter to 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-24T17:00:00.000Z
CVE-2008-5709 
Multiple unspecified vulnerabilities in the web management interface in Avaya Communication Manager (CM) 3.1 before 3.1.4 SP2, 4.0 before 4.0.3 SP1, and 5.0 before 5.0 SP3 allow remote authenticated users to execute arbitrary code via unknown attack vectors in the (1) Set Static Routes and (2) Backup History components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-24T17:00:00.000Z
CVE-2008-5710 
Multiple unspecified vulnerabilities in the web management interface in Avaya Communication Manager (CM) 3.1.x, 4.0.3, and 5.x allow remote attackers to read (1) configuration files, (2) log files, (3) binary image files, and (4) help files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-24T17:00:00.000Z
CVE-2008-5711 
Heap-based buffer overflow in the Facebook PhotoUploader ActiveX control 5.0.14.0 and earlier allows remote attackers to execute arbitrary code via a long FileMask property value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-24T17:00:00.000Z
CVE-2008-5712 
The HTML parser in KDE Konqueror 3.5.9 allows remote attackers to cause a denial of service (application crash) via (1) a long COLOR attribute in an HR element; or a long (a) BGCOLOR or (b) BORDERCOLOR attribute in a (2) TABLE, (3) TD, or (4) TR element.  NOTE: the FONT vector is already covered by CVE-2008-4514.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-24T17:00:00.000Z