rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-4124 
The session failover function in Cosminexus Component Container in Cosminexus 6, 6.7, and 7 before 20070731, as used in multiple Hitachi products, can use session data for the wrong user under unspecified conditions, which might allow remote authenticated users to obtain sensitive information, corrupt another user's session data, and possibly gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-01T16:00:00.000Z
CVE-2007-4125 
Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport functionality in HP-UX B.11.11, B.11.23, and B.11.31 allows remote attackers to cause an unspecified denial of service via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-01T16:00:00.000Z
CVE-2007-4126 
Unspecified vulnerability in the dynamic tracing framework (DTrace) on Sun Solaris 10 before 20070730 allows local users with PRIV_DTRACE_USER privileges to cause a denial of service (panic or hang) via unspecified use of certain DTrace programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-01T16:00:00.000Z
CVE-2007-4127 
PHP remote file inclusion vulnerability in check_entry.php in Ralf Image Gallery (RIG), aka Raphael Moll RIG Image Gallery, 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the dir_abs_src parameter.  NOTE: this issue is disputed by multiple third parties, who report that the product exits if register_globals is enabled, thereby blocking exploitation.  NOTE: CVE-2006-3210.a covers this issue in versions before 1.0
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-01T16:00:00.000Z
CVE-2007-4128 
SQL injection vulnerability in index.php in the Firestorm Technologies GMaps (com_gmaps) 1.00 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mapId parameter in a viewmap action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-01T16:00:00.000Z
CVE-2007-4129 
CoolKey 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files in the /tmp/.pk11ipc1/ directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-08T11:00:00.000Z
CVE-2007-4130 
The Linux kernel 2.6.9 before 2.6.9-67 in Red Hat Enterprise Linux (RHEL) 4 on Itanium (ia64) does not properly handle page faults during NUMA memory access, which allows local users to cause a denial of service (panic) via invalid arguments to set_mempolicy in an MPOL_BIND operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-04T23:00:00.000Z
CVE-2007-4131 
Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-25T00:00:00.000Z
CVE-2007-4132 
Unspecified vulnerability in Red Hat Network Satellite Server 5.0.0 allows remote authenticated users to execute arbitrary code via unknown vectors in a "back-end XMLRPC handler."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-30T22:00:00.000Z
CVE-2007-4133 
The (1) hugetlb_vmtruncate_list and (2) hugetlb_vmtruncate functions in fs/hugetlbfs/inode.c in the Linux kernel before 2.6.19-rc4 perform certain prio_tree calculations using HPAGE_SIZE instead of PAGE_SIZE units, which allows local users to cause a denial of service (panic) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-04T23:00:00.000Z
CVE-2007-4134 
Directory traversal vulnerability in extract.c in star before 1.5a84 allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-30T22:00:00.000Z
CVE-2007-4135 
The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the getpwnam_r function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T01:00:00.000Z
CVE-2007-4136 
The ricci daemon in Red Hat Conga 0.10.0 allows remote attackers to cause a denial of service (loss of new connections) by repeatedly sending data or attempting connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-14T00:00:00.000Z
CVE-2007-4137 
Off-by-one error in the QUtf8Decoder::toUnicode function in Trolltech Qt 3 allows context-dependent attackers to cause a denial of service (crash) via a crafted Unicode string that triggers a heap-based buffer overflow.  NOTE: Qt 4 has the same error in the QUtf8Codec::convertToUnicode function, but it is not exploitable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T19:00:00.000Z
CVE-2007-4138 
The Winbind nss_info extension (nsswitch/idmap_ad.c) in idmap_ad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the (1) RFC2307 or (2) Services for UNIX (SFU) primary group attribute is not defined.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-14T01:00:00.000Z
CVE-2007-4139 
Cross-site scripting (XSS) vulnerability in the Temporary Uploads editing functionality (wp-admin/includes/upload.php) in WordPress 2.2.1, allows remote attackers to inject arbitrary web script or HTML via the style parameter to wp-admin/upload.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T10:00:00.000Z
CVE-2007-4140 
Buffer overflow in Live for Speed (LFS) S2 ALPHA PATCH 0.5x allows user-assisted remote attackers to execute arbitrary code via a .mpr file (replay file) that contains a long car name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T10:00:00.000Z
CVE-2007-4141 
OpenRat CMS 0.8-beta1 and earlier allows remote attackers to obtain sensitive information via a request containing an XSS sequence in the action parameter to index.php, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T10:00:00.000Z
CVE-2007-4142 
Cross-site scripting (XSS) vulnerability in IBM Lotus Sametime Server 7.5.1 before 20070731 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a crafted Sametime meeting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T20:00:00.000Z
CVE-2007-4143 
user.php in the Billing Control Panel in phpCoupon allows remote authenticated users to obtain Premium Member status, and possibly acquire free coupons, via a modified URL containing a certain billing parameter and REQ=auth, status=success, and custom=upgrade substrings, possibly related to PayPal transactions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T20:00:00.000Z
CVE-2007-4144 
Cross-site scripting (XSS) vulnerability in sample-forms/simple-contact-form-with-preview/simple-contact-form-with-preview.html in MitriDAT eMail Form Processor Pro allows remote attackers to inject arbitrary web script or HTML via the base_path parameter, possibly related to (1) formprocessorpro.php in the PHP version of the product, and (2) formprocessorpro.pl in the Perl version of the product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T20:00:00.000Z
CVE-2007-4145 
Heap-based buffer overflow in the BlueSkychat (BlueSkyCat) ActiveX control (V2.V2Ctrl.1) in v2.ocx 8.1.2.0 and earlier allows remote attackers to execute arbitrary code via a long string in the second argument to the ConnecttoServer method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T20:00:00.000Z
CVE-2007-4146 
Cross-site scripting (XSS) vulnerability in webevent.cgi in WebEvent 2.61 through 4.03 allows remote attackers to inject arbitrary web script or HTML via the cmd parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T20:00:00.000Z
CVE-2007-4147 
Multiple unspecified vulnerabilities in Interspire ArticleLive NX before 1.7.1.2 have unknown impact and attack vectors, possibly related to (1) AL_SANITIZE and (2) "Calling the constructor to make sure things are checked, safe mode, etc."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T20:00:00.000Z
CVE-2007-4148 
Heap-based buffer overflow in the Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 allows remote attackers to cause a denial of service (persistent daemon crashes) or execute arbitrary code via a long filename in a "LOG." command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T20:00:00.000Z
CVE-2007-4149 
The Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 does not require authentication for (1) the "LOG." command, which allows remote attackers to create or overwrite arbitrary files; (2) the SETTINGSFILE command, which allows remote attackers to overwrite the ini file, and reconfigure VSAOD or cause a denial of service; or (3) the UNINSTALL command, which allows remote attackers to cause a denial of service (daemon shutdown).  NOTE: vector 1 can be leveraged for code execution by writing to a Startup folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T20:00:00.000Z
CVE-2007-4150 
The Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 uses weak cryptography (XOR) when (1) transmitting passwords, which allows remote attackers to obtain sensitive information by sniffing the network; and (2) storing passwords in the configuration file, which allows local users to obtain sensitive information by reading this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T20:00:00.000Z
CVE-2007-4151 
The Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 allows remote attackers to obtain sensitive information via (1) a LOG.ON command, which reveals the logging pathname in the server response; (2) a VER command, which reveals the version number in the server response; and (3) a connection, which reveals the version number in the banner.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T20:00:00.000Z
CVE-2007-4152 
The Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 allows remote attackers to conduct replay attacks by capturing and resending data from the DETAILS and PROCESS sections of a session that schedules an audit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T20:00:00.000Z
CVE-2007-4153 
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the Options Database Table in the Admin Panel, accessed through options.php; or (2) the opml_url parameter to link-import.php.  NOTE: this might not cross privilege boundaries in some configurations, since the Administrator role has the unfiltered_html capability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T20:00:00.000Z
CVE-2007-4154 
SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the page_options parameter to (1) options-general.php, (2) options-writing.php, (3) options-reading.php, (4) options-discussion.php, (5) options-privacy.php, (6) options-permalink.php, (7) options-misc.php, and possibly other unspecified components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T20:00:00.000Z
CVE-2007-4155 
Absolute path traversal vulnerability in a certain ActiveX control in vielib.dll in EMC VMware 6.0.0 allows remote attackers to execute arbitrary local programs via a full pathname in the first two arguments to the (1) CreateProcess or (2) CreateProcessEx method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T21:00:00.000Z
CVE-2007-4156 
Multiple SQL injection vulnerabilities in wolioCMS allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to member.php in a page action, related to a SELECT statement in common.php; and the (2) loginid parameter (uid variable), and possibly the (3) pwd parameter, to admin/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T21:00:00.000Z
CVE-2007-4157 
PHPBlogger stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing an admin password hash via a direct request for data/pref.db.  NOTE: this can be easily leveraged for administrative access because composing the authentication cookie only requires the password hash, not the cleartext version.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T21:00:00.000Z
CVE-2007-4158 
Memory leak in TIBCO Rendezvous (RV) daemon (rvd) 7.5.2, 7.5.3 and 7.5.4 allows remote attackers to cause a denial of service (memory consumption) via a packet with a length field of zero, a different vulnerability than CVE-2006-2830.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T21:00:00.000Z
CVE-2007-4159 
index.html in the HTTP administration interface in certain daemons in TIBCO Rendezvous (RV) 7.5.2 allows remote attackers to obtain sensitive information, such as a user name and IP addresses, via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T21:00:00.000Z
CVE-2007-4160 
The default configuration of TIBCO Rendezvous (RV) 7.5.2 clients, when -no-multicast is omitted, uses a multicast group as the destination for a network message, which might make it easier for remote attackers to capture message contents by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T21:00:00.000Z
CVE-2007-4161 
rvd in TIBCO Rendezvous (RV) 7.5.2, when -no-lead-wc is omitted, might allow remote attackers to cause a denial of service (network instability) via a subject name with a leading (1) '*' (asterisk) or (2) '>' (greater than) wildcard character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T21:00:00.000Z
CVE-2007-4162 
TIBCO Rendezvous (RV) 7.5.2 does not protect confidentiality or integrity of inter-daemon communication, which allows remote attackers to capture and spoof traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T21:00:00.000Z
CVE-2007-4163 
Multiple SQL injection vulnerabilities in IndexScript 2.7 and 2.8 before 20070726 allow remote attackers to execute arbitrary SQL commands via the (1) cat_id, (2) start_id, (3) row[parent_id], and (4) row[cat_id] parameters to unspecified components, related to use of these parameters within include/utils.php.  NOTE: the show_cat.php cat_id vector is already covered by CVE-2007-4069.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T21:00:00.000Z
CVE-2007-4164 
CRLF injection vulnerability in the redirect feature in Sun Java System Web Server 6.1 and 7.0 before 20070802, when the redirect Server Application Function (SAF) uses the url-prefix parameter and escape is disabled, or an Error directive uses the url-prefix parameter in obj.conf, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-07T10:00:00.000Z
CVE-2007-4165 
Cross-site scripting (XSS) vulnerability in index.php in the Blue Memories theme 1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, possibly a related issue to CVE-2007-2757 and CVE-2007-4014.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-07T10:00:00.000Z
CVE-2007-4166 
Cross-site scripting (XSS) vulnerability in index.php in the Unnamed theme 1.217, and Special Edition (SE) 1.02, before 20070804 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, possibly a related issue to CVE-2007-2757, CVE-2007-4014, and CVE-2007-4165.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-07T10:00:00.000Z
CVE-2007-4167 
PHP remote file inclusion vulnerability in cat_viewed.php in AL-Caricatier 2.5 allows remote attackers to execute arbitrary PHP code via a URL in the CatName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-07T10:00:00.000Z
CVE-2007-4169 
Multiple PHP remote file inclusion vulnerabilities in vgallite allow remote attackers to execute arbitrary PHP code via a URL in the (1) dirpath parameter to _functions.php or the (2) lang parameter to index.php.  NOTE: CVE disputes vector 1 because the applicable include_once is located in a function that is not called on a direct request, and because $dirpath is an argument to this function.  CVE disputes vector 2 because "lang" is a constant string within an include_once, not a variable.  The researcher is also unreliable
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-07T10:00:00.000Z
CVE-2007-4170 
Multiple PHP remote file inclusion vulnerabilities in AL-Athkar 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) include parameter to (a) Main.php and (b) get.php and the (2) exec parameter to (c) count.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-07T10:00:00.000Z
CVE-2007-4171 
SQL injection vulnerability in komentar.php in the Forum Module for auraCMS (Modul Forum Sederhana) allows remote attackers to execute arbitrary SQL commands via the id parameter to the default URI.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-07T10:00:00.000Z
CVE-2007-4172 
Multiple cross-site scripting (XSS) vulnerabilities in Open Webmail (OWM) 2.52 20060831 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) searchtype, (2) longpage, and (3) page parameters to (a) openwebmail-main.pl; the (4) prefs_caller, (5) userfirsttime, (6) page, (7) sort, (8) folder, and (9) message_id parameters to (b) openwebmail-prefs.pl; the (10) compose_caller, (11) msgdatetype, (12) keyword, (13) searchtype, (14) folder, (15) page, and (16) sort parameters to (c) openwebmail-send.pl; the (17) folder, (18) page, and (19) sort parameters to (d) openwebmail-folder.pl; the (20) searchtype, (21) page, (22) filesort, (23) singlepage, (24) showhidden, (25) showthumbnail, and (26) message_id parameters to (e) openwebmail-webdisk.pl; the (27) folder parameter to (f) openwebmail-advsearch.pl; and the (28) abookcollapse, (29) abooksearchtype, (30) abooksort, (31) abooklongpage, (32) abookpage, (33) message_id, (34) searchtype, (35) msgdatetype, (36) sort, (37) page, (38) rootxowmuid, and (39) listviewmode parameters to (g) openwebmail-abook.pl, different vectors than CVE-2005-2863, CVE-2006-2190, CVE-2006-3229, and CVE-2006-3233.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-07T10:00:00.000Z
CVE-2007-4173 
SQL injection vulnerability in duyuruoku.asp in Hunkaray Okul Portali 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2007-3080.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-07T10:00:00.000Z
CVE-2007-4174 
Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid authentication, as demonstrated by an HTML form (1) hosted on a web site or (2) injected by a Tor exit node.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-07T10:00:00.000Z
CVE-2007-4175 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in OpenRat CMS 0.8-beta1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) subaction and (2) action parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-08T01:11:00.000Z
CVE-2007-4176 
Multiple unspecified vulnerabilities in EQDKP Plus before 0.4.4.5 have unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-08T01:11:00.000Z
CVE-2007-4177 
Multiple cross-site scripting (XSS) vulnerabilities in Interact before 2.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this might overlap CVE-2007-3328.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-08T01:11:00.000Z
CVE-2007-4178 
Cross-site scripting (XSS) vulnerability in index.php in WebDirector 2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the deslocal parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-08T01:11:00.000Z
CVE-2007-4179 
Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport functionality in HP-UX B.11.11 and B.11.23 allows local users to cause an unspecified denial of service via unknown vectors.  NOTE: this is probably different from CVE-2007-0916, but this is not certain due to lack of vendor details.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-08T01:11:00.000Z
CVE-2007-4180 
Directory traversal vulnerability in data/inc/theme.php in Pluck 4.3, when register_globals is enabled, allows remote attackers to read arbitrary local files via a .. (dot dot) in the file parameter.  NOTE: CVE and a reliable third party dispute this vulnerability because the code uses a fixed argument when invoking fputs, which cannot be used to read files
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-08T01:11:00.000Z
CVE-2007-4181 
PHP remote file inclusion vulnerability in data/inc/theme.php in Pluck 4.3, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter.  NOTE: A reliable third party disputes this vulnerability because the applicable include is within a function that does not receive the dir parameter from an HTTP request
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-08T01:11:00.000Z