rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-6644 
PHP remote file inclusion vulnerability in pages/meeting_constants.php in the Meeting (mx_meeting) 1.1.2 and earlier module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6645 
PHP remote file inclusion vulnerability in language/lang_english/lang_admin.php in the Web Links (mx_links) 2.05 and earlier module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the mx_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6646 
Multiple cross-site scripting (XSS) vulnerabilities in Drupal (1) Project Issue Tracking 4.7.x-1.0 and 4.7.x-2.0, and (2) Project 4.6.x-1.0, 4.7.x-1.0, and 4.7.x-2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, which do not use the check_plain function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6647 
Cross-site scripting (XSS) vulnerability in the MySite 4.7.x before 4.7.x-3.3 and 5.x before 5.x-1.3 module for Drupal allows remote attackers to inject arbitrary web script or HTML via the Title field when editing a page.  NOTE: some details were obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6648 
PHP remote file inclusion vulnerability in main.inc.php in planetluc.com RateMe 1.3.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pathtoscript parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6649 
Cross-site scripting (XSS) vulnerability in display.php in HyperVM 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an encoded frm_action parameter.  NOTE: the vendor disputes this issue, but it is not certain whether the dispute is about the severity of the issue, or its existence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6650 
PHP remote file inclusion vulnerability in charts_constants.php in the Charts (mx_charts) 1.0.0 and earlier module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6651 
Race condition in W29N51.SYS in the Intel 2200BG wireless driver 9.0.3.9 allows remote attackers to cause memory corruption and execute arbitrary code via a series of crafted beacon frames.  NOTE: some details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6652 
Buffer overflow in the glob implementation (glob.c) in libc in NetBSD-current before 20050914, NetBSD 2.* and 3.* before 20061203, and Apple Mac OS X before 2007-004, as used by the FTP daemon and tnftpd, allows remote authenticated users to execute arbitrary code via a long pathname that results from path expansion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6653 
The accept function in NetBSD-current before 20061023, NetBSD 3.0 and 3.0.1 before 20061024, and NetBSD 2.x before 20061029 allows local users to cause a denial of service (socket consumption) via an invalid (1) name or (2) namelen parameter, which may result in the socket never being closed (aka "a dangling socket").
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6654 
The sendmsg function in NetBSD-current before 20061023, NetBSD 3.0 and 3.0.1 before 20061024, and NetBSD 2.x before 20061029, when run on a 64-bit architecture, allows attackers to cause a denial of service (kernel panic) via an invalid msg_controllen parameter to the sendit function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6655 
The procfs implementation in NetBSD-current before 20061023, NetBSD 3.0 and 3.0.1 before 20061024, and NetBSD 2.x before 20061029 allows local users to cause a denial of service (kernel panic) by attempting to access /emul/linux/proc/0/stat on a procfs filesystem that was mounted with mount_procfs -o linux, which results in a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6656 
Unspecified vulnerability in ptrace in NetBSD-current before 20061027, NetBSD 3.0 and 3.0.1 before 20061027, and NetBSD 2.x before 20061119 allows local users to read kernel memory and obtain sensitive information via certain manipulations of a PT_LWPINFO request, which leads to a memory leak and information leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6657 
The if_clone_list function in NetBSD-current before 20061027, NetBSD 3.0 and 3.0.1 before 20061027, and NetBSD 2.x before 20061119 allows local users to read potentially sensitive, uninitialized stack memory via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6658 
Inktomi Search 4.1.4 allows remote attackers to obtain sensitive information via direct requests with missing parameters to (1) help/header.html, (2) thesaurus.html, and (3) topics.html, which leak the installation path in the resulting error message, a related issue to CVE-2006-5970.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6659 
The Microsoft Office Outlook Recipient ActiveX control (ole32.dll) in Windows XP SP2 allows remote attackers to cause a denial of service (Internet Explorer 7 hang) via crafted HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-6660 
The nodeType function in KDE libkhtml 4.2.0 and earlier, as used by Konquerer, KMail, and other programs, allows remote attackers to cause a denial of service (crash) via malformed HTML tags, possibly involving a COL SPAN tag embedded in a RANGE tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T23:00:00.000Z
CVE-2006-6661 
Variable overwrite vulnerability in blog.php in PHP-Update 2.7 and earlier allows remote attackers to overwrite arbitrary program variables and execute arbitrary PHP code via multiple vectors that use the extract function, as demonstrated by the (1) f, (2) newmessage, (3) newusername, (4) adminuser, and (5) permission parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T23:00:00.000Z
CVE-2006-6662 
Unspecified vulnerability in Linux User Management (novell-lum) on SUSE Linux Enterprise Desktop 10 and Open Enterprise Server 9, under unspecified conditions, allows local users to log in to the console without a password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T23:00:00.000Z
CVE-2006-6663 
The server component in Marathon Aleph One before 0.17.1 and 2006-12-17 allows remote attackers to cause a denial of service (application crash) via unspecified vectors related to "gathering net games."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T23:00:00.000Z
CVE-2006-6664 
Format string vulnerability in Marathon Aleph One before 0.17.1 and 2006-12-17 might allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via format string specifiers in the TopLevelLogger::logMessageV function in Misc/Logging.cpp.  NOTE: some details were obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T23:00:00.000Z
CVE-2006-6665 
Buffer overflow in Astonsoft DeepBurner Pro and Free 1.8.0 and earlier allows user-assisted remote attackers to execute arbitrary code via a long file name tag in a dbr file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T23:00:00.000Z
CVE-2006-6666 
PHP remote file inclusion vulnerability in index.php in VerliAdmin 0.3 and earlier allows remote authenticated users to execute arbitrary PHP code via a URL in the q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T23:00:00.000Z
CVE-2006-6667 
Multiple SQL injection vulnerabilities in VerliAdmin 0.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) nick_mod or (2) nick parameter to (a) repass.php or (b) verify.php. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T23:00:00.000Z
CVE-2006-6668 
Cross-site scripting (XSS) vulnerability in VerliAdmin 0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T23:00:00.000Z
CVE-2006-6669 
Cross-site scripting (XSS) vulnerability in export_handler.php in WebCalendar 1.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T23:00:00.000Z
CVE-2006-6670 
Unspecified vulnerability in Nortel CallPilot 4.x Server has unknown impact and attack vectors, aka P-2006-0011-GLOBAL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T23:00:00.000Z
CVE-2006-6671 
SQL injection vulnerability in down.asp in Burak Yylmaz Download Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T01:00:00.000Z
CVE-2006-6672 
Multiple SQL injection vulnerabilities in Burak Yylmaz Download Portal allow remote attackers to execute arbitrary SQL commands via the (1) kid or possibly (2) id parameter to (a) HABERLER.ASP and (b) ASPKAT.ASP.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T01:00:00.000Z
CVE-2006-6673 
WinFtp Server 2.0.2 allows remote attackers to cause a denial of service (crash) via long (1) PASV, (2) LIST, (3) USER, (4) PORT, and possibly other commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T01:00:00.000Z
CVE-2006-6674 
Ozeki HTTP-SMS Gateway 1.0, and possibly earlier, stores usernames and passwords in plaintext in the HKLM\Software\Ozeki\SMSServer\CurrentVersion\Plugins\httpsmsgate registry key, which allows local users to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T01:00:00.000Z
CVE-2006-6675 
Cross-site scripting (XSS) vulnerability in Novell NetWare 6.5 Support Pack 5 and 6 and Novell Apache on NetWare 2.0.48 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters in Welcome web-app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T01:00:00.000Z
CVE-2006-6676 
Integer overflow in the (a) OLE2 and (b) CHM parsers for ESET NOD32 Antivirus before 1.1743 allows remote attackers to execute arbitrary code via a crafted (1) .DOC or (2) .CAB file that triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T01:00:00.000Z
CVE-2006-6677 
ESET NOD32 Antivirus before 1.1743 allows remote attackers to cause a denial of service (crash) via a crafted .CHM file that triggers a divide-by-zero error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T01:00:00.000Z
CVE-2006-6678 
The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields, which allows attackers to execute arbitrary commands via shell metacharacters in the filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T01:00:00.000Z
CVE-2006-6679 
Pedro Lineu Orso chetcpasswd before 2.4 relies on the X-Forwarded-For HTTP header when verifying a client's status on an IP address ACL, which allows remote attackers to gain unauthorized access by spoofing this header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T19:00:00.000Z
CVE-2006-6680 
Pedro Lineu Orso chetcpasswd before 2.3.1 does not document the need for 0400 permissions on /etc/chetcpasswd.allow, which might allow local users to gain sensitive information by reading this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T19:00:00.000Z
CVE-2006-6681 
Pedro Lineu Orso chetcpasswd 2.3.3 does not have a rate limit for client requests, which might allow remote attackers to determine passwords via a dictionary attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T19:00:00.000Z
CVE-2006-6682 
Pedro Lineu Orso chetcpasswd 2.3.3 provides a different error message when a request with a valid username fails, compared to a request with an invalid username, which allows remote attackers to determine valid usernames on the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T19:00:00.000Z
CVE-2006-6683 
Pedro Lineu Orso chetcpasswd 2.4.1 and earlier verifies and updates user accounts via custom code that processes /etc/shadow and does not follow the PAM configuration, which might allow remote attackers to bypass intended restrictions implemented through PAM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T19:00:00.000Z
CVE-2006-6684 
Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd before 2.4 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long X-Forwarded-For HTTP header.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T19:00:00.000Z
CVE-2006-6685 
Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd 2.3.3 allows local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long REMOTE_ADDR environment variable.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T19:00:00.000Z
CVE-2006-6686 
PHP remote file inclusion vulnerability in sender.php in Carsen Klock TextSend 1.5 allows remote attackers to execute arbitrary PHP code via a URL in the ROOT_PATH parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T21:00:00.000Z
CVE-2006-6687 
Cross-site scripting (XSS) vulnerability in Web Automated Perl Portal (WebAPP) 0.9.9.4, and 0.9.9.3.4 Network Edition (NE) (aka WebAPP.NET), allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T21:00:00.000Z
CVE-2006-6688 
Web Automated Perl Portal (WebAPP) 0.9.9.4, and 0.9.9.3.4 Network Edition (NE) (aka WebAPP.NET) allows remote attackers to bypass filtering mechanisms via unknown vectors.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T21:00:00.000Z
CVE-2006-6689 
Multiple PHP remote file inclusion vulnerabilities in Paristemi 0.8.3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the SERVER_DIRECTORY parameter to unspecified scripts, a different vector than CVE-2006-6739.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T21:00:00.000Z
CVE-2006-6690 
rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T21:00:00.000Z
CVE-2006-6691 
Multiple PHP remote file inclusion vulnerabilities in Valdersoft Shopping Cart 3.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the commonIncludePath parameter to (1) admin/include/common.php, (2) include/common.php, or (3) common_include/common.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T21:00:00.000Z
CVE-2006-6692 
Multiple format string vulnerabilities in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in information that would be recorded in the system log using (1) zabbix_log or (2) zabbix_syslog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T21:00:00.000Z
CVE-2006-6693 
Multiple buffer overflows in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via long strings to the (1) zabbix_log and (2) zabbix_syslog functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T21:00:00.000Z
CVE-2006-6694 
Directory traversal vulnerability in include/config.php in E-Uploader Pro 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a .. (dot dot) in the language parameter, as demonstrated by uploading a .JPG file containing PHP code, then accessing the file via config.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T21:00:00.000Z
CVE-2006-6695 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Carsen Klock TextSend 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) error or (2) success parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T21:00:00.000Z
CVE-2006-6696 
Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-22T02:00:00.000Z
CVE-2006-6697 
CRLF injection vulnerability in webapp/jsp/calendar.jsp in Oracle Portal 10g and earlier, including 9.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the enc parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-22T02:00:00.000Z
CVE-2006-6698 
The GConf daemon (gconfd) in GConf 2.14.0 creates temporary files under directories with names based on the username, even when GCONF_GLOBAL_LOCKS is not set, which allows local users to cause a denial of service by creating the directories ahead of time, which prevents other users from using Gnome.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-22T18:00:00.000Z
CVE-2006-6699 
Multiple CRLF injection vulnerabilities in Oracle Portal 9.0.2 and possibly other versions allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the enc parameter to (1) calendarDialog.jsp or (2) fred.jsp.  NOTE: the calendar.jsp vector is covered by CVE-2006-6697.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-23T01:00:00.000Z
CVE-2006-6700 
Cross-site scripting (XSS) vulnerability in @Mail WebMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-23T01:00:00.000Z
CVE-2006-6701 
Cross-site request forgery (CSRF) vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user, as demonstrated using a settings action in the SRC attribute of an IMG element in an HTML e-mail.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-23T01:00:00.000Z
CVE-2006-6702 
Cross-site scripting (XSS) vulnerability in Global.pm in @Mail before 4.61 allows remote attackers to inject arbitrary web script or HTML via crafted e-mail messages.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-23T01:00:00.000Z
CVE-2006-6703 
Multiple cross-site scripting (XSS) vulnerabilities in Oracle Portal 9i and 10g allow remote attackers to inject arbitrary JavaScript via the tc parameter in webapp/jsp/container_tabs.jsp, and other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-23T01:00:00.000Z
CVE-2006-6704 
Cross-site scripting (XSS) vulnerability in the Webadmin in @Mail before 4.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "unescaped data in the database."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-23T01:00:00.000Z
CVE-2006-6705 
Multiple unspecified vulnerabilities in the template files in Soumu Workflow for Groupmax 01-00 through 01-01, Soumu Workflow 02-00 through 03-03, and Koukyoumuke Soumu Workflow 01-00 through 01-01 allow remote attackers to bypass authentication mechanisms on web pages via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-23T01:00:00.000Z