rainbutterfly/cve_corpus huggingface dataset:
CVE-2005-2136 
Raritan Dominion SX (DSX) Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 set (1) world-readable permissions for /etc/shadow and (2) world-writable permissions for /bin/busybox, which allows local users to obtain hashed passwords or execute arbitrary code as other users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-05T04:00:00.000Z
CVE-2005-2137 
Unknown vulnerability in NateOn Messenger 3.0 allows remote attackers to list arbitrary directories via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-05T04:00:00.000Z
CVE-2005-2138 
Cross-site scripting (XSS) vulnerability in index.php in Comdev eCommerce 3.0 and 3.1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the onMouseOver event of an "A" tag in a review message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-05T04:00:00.000Z
CVE-2005-2139 
PHP remote file inclusion vulnerability in user_check.php for Pavsta Auto Site allows remote attackers to execute arbitrary PHP code via the sitepath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-05T04:00:00.000Z
CVE-2005-2140 
Directory traversal vulnerability in default.asp for FSboard 2.0 allows remote attackers to read arbitrary files via ".." sequences in the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-05T04:00:00.000Z
CVE-2005-2141 
TCP Chat 1.0 allows remote attackers to cause a denial of service (crash) via a long string to the chat service, possibly triggering a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-05T04:00:00.000Z
CVE-2005-2142 
Directory traversal vulnerability in Golden FTP Server 2.60 allows remote authenticated attackers to list arbitrary directories via a "\.."  (backslash dot dot) in an LS (LIST) command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-05T04:00:00.000Z
CVE-2005-2143 
Microsoft Front Page allows attackers to cause a denial of service (crash) via a crafted style tag in a web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-05T04:00:00.000Z
CVE-2005-2144 
Prevx Pro 2005 1.0 allows local users to bypass file protection and modify files by using MapViewOfFile to perform memory mapping on the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-05T04:00:00.000Z
CVE-2005-2145 
The kernel driver in Prevx Pro 2005 1.0 does not verify the source of certain messages, which allows local users to bypass protection by sending certain messages to the driver, as demonstrated by sending an "allow" message to bypass a warning message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-05T04:00:00.000Z
CVE-2005-2146 
SSH Tectia Server 4.3.1 and earlier, and SSH Secure Shell for Windows Servers, uses insecure permissions when generating the Secure Shell host identification key, which allows local users to access the key and spoof the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-05T04:00:00.000Z
CVE-2005-2147 
Trac before 0.8.4 allows remote attackers to read or upload arbitrary files via a full pathname in the id parameter to the (1) upload or (2) attachment viewer scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2148 
Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks, which allows remote attackers to execute arbitrary commands or SQL by sending a legitimate value in a POST request or cookie, then specifying the attack string in the URL, which causes the get_request_var function to return the wrong value in the $_REQUEST variable, which is cleansed while the original malicious $_GET value remains unmodified, as demonstrated in (1) graph_image.php and (2) graph.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2149 
config.php in Cacti 0.8.6e and earlier allows remote attackers to set the no_http_headers switch, then modify session information to gain privileges and disable the use of addslashes to conduct SQL injection attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2150 
Windows NT 4.0 and Windows 2000 before URP1 for Windows 2000 SP4 does not properly prevent NULL sessions from accessing certain alternate named pipes, which allows remote attackers to (1) list Windows services via svcctl or (2) read eventlogs via eventlog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z
CVE-2005-2151 
spf.c in Courier Mail Server does not properly handle DNS failures when looking up Sender Policy Framework (SPF) records, which could allow attackers to cause memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2152 
SQL injection vulnerability in Geeklog before 1.3.11 allows remote attackers to execute arbitrary SQL commands via user comments for an article.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2153 
SQL injection vulnerability in class.ticket.php in osTicket 1.3.1 beta and earlier allows remote attackers to execute arbitrary SQL commands via the ticket variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2154 
PHP local file inclusion vulnerability in (1) view.php and (2) open.php in osTicket 1.3.1 beta and earlier allows remote attackers to include and possibly execute arbitrary local files via the inc parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2155 
PHP remote file inclusion vulnerability in EasyPHPCalendar 6.1.5 and earlier allows remote attackers to execute arbitrary code via the serverPath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2156 
SQL injection vulnerability in news.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the prevnext parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2157 
PHP remote file inclusion vulnerability in survey.inc.php for nabopoll 1.2 allows remote attackers to execute arbitrary PHP code via the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2158 
A regression error in the embedded HSQLDB in JBoss jBPM 2.0 allows remote attackers to execute arbitrary comands, a re-introduction of a vulnerability that was originally identified by CVE-2003-0845.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2159 
mshftp.dll in PlanetDNS PlanetFileServer 2.0.1.3 allows remote attackers to cause a denial of service (application crash) via a long request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2160 
IMail stores usernames and passwords in cleartext in a cookie, which allows remote attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2161 
Cross-site scripting (XSS) vulnerability in phpBB 2.0.16 allows remote attackers to inject arbitrary web script or HTML via nested [url] tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2162 
PHP remote file inclusion vulnerability in form.inc.php3 in MyGuestbook 0.6.1 allows remote attackers to execute arbitrary PHP code via the lang parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2163 
Cross-site scripting (XSS) vulnerability in index.php in AutoIndex PHP Script 1.5.2 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2164 
SQL injection vulnerability in Covide Groupware-CRM allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2165 
read.cgi in GlobalNoteScript allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2166 
SQL injection vulnerability in index.php in Plague News System 0.6 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2167 
Cross-site scripting (XSS) vulnerability in index.php in Plague News System 0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the cid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2168 
delete.php in Plague News System 0.6 and earlier allows remote unauthenticated attackers to delete news, comments, and shoutbox posts by modifying the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2169 
Directory traversal vulnerability in source.php in Quick & Dirty PHPSource Printer 1.1 and earlier allows remote attackers to read arbitrary files via ".../...//" sequences in the file parameter, which are reduced to "../" when PHPSource Printer uses a regular expression to remove "../" sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-2170 
The LCF component (lcfd) in IBM Tivoli Management Framework Endpoint allows remote attackers to cause a denial of service (process exit and connection loss) by connecting to LCF and ending the connection without sending any data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z
CVE-2005-2173 
The Flag::validate and Flag::modify functions in Bugzilla 2.17.1 to 2.18.1 and 2.19.1 to 2.19.3 do not verify that the flag ID is appropriate for the given bug or attachment ID, which allows users to change flags on arbitrary bugs and obtain a bug summary via process_bug.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-08T04:00:00.000Z
CVE-2005-2174 
Bugzilla 2.17.x, 2.18 before 2.18.2, 2.19.x, and 2.20 before 2.20rc1 inserts a bug into the database before it is marked private, which introduces a race condition and allows attackers to access information about the bug via buglist.cgi before MySQL replication is complete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-08T04:00:00.000Z
CVE-2005-2175 
The web interface for Lotus Notes mail automatically processes HTML in an attachment without prompting the user to save or open it, which makes it easier for remote attackers to conduct web-based attacks and steal cookies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-09T04:00:00.000Z
CVE-2005-2176 
Novell NetMail automatically processes HTML in an attachment without prompting the user to save or open it, which makes it easier for remote attackers to conduct web-based attacks and steal cookies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-09T04:00:00.000Z
CVE-2005-2177 
Net-SNMP 5.0.x before 5.0.10.2, 5.2.x before 5.2.1.2, and 5.1.3, when net-snmp is using stream sockets such as TCP, allows remote attackers to cause a denial of service (daemon hang and CPU consumption) via a TCP packet of length 1, which triggers an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-10T04:00:00.000Z
CVE-2005-2178 
probe.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the olddat parameter.  NOTE: it is unclear which product or vendor this program is associated with, if any.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-10T04:00:00.000Z
CVE-2005-2179 
PHP remote file inclusion vulnerability in BlogModel.php in Jaws 0.5.2 and earlier allows remote attackers to execute arbitrary PHP code via the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-10T04:00:00.000Z
CVE-2005-2180 
gen-index in GNATS 4.0, 4.1.0, and possibly earlier versions, when installed setuid, does not properly check files passed to the -o argument and opens the file with write access, which allows local users to overwrite arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-10T04:00:00.000Z
CVE-2005-2181 
Cisco 7940/7960 Voice over IP (VoIP) phones do not properly check the Call-ID, branch, and tag values in a NOTIFY message to verify a subscription, which allows remote attackers to spoof messages such as the "Messages waiting" message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-10T04:00:00.000Z
CVE-2005-2182 
Grandstream BudgeTone (BT) 100 Voice over IP (VoIP) phones do not properly check the Call-ID, branch, and tag values in a NOTIFY message to verify a subscription, which allows remote attackers to spoof messages such as the "Messages waiting" message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-10T04:00:00.000Z
CVE-2005-2183 
class.xmail.php in PhpXmail 0.7 through 1.1 does not properly handle large passwords, which prevents an error message from being returned and allows remote attackers to bypass authentication and gain unauthorized access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-10T04:00:00.000Z
CVE-2005-2184 
eRoom 6.x does not properly restrict files that can be attached, which allows remote attackers to execute arbitrary commands via a .lnk file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-10T04:00:00.000Z
CVE-2005-2185 
eRoom does not set an expiration for Cookies, which allows remote attackers to capture cookies and conduct replay attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-10T04:00:00.000Z
CVE-2005-2186 
Multiple cross-site scripting (XSS) vulnerabilities in McAfee IntruShield Security Management System allow remote authenticated users to inject arbitrary web script or HTML via the (1) thirdMenuName or (2) resourceName parameter to SystemEvent.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-10T04:00:00.000Z
CVE-2005-2187 
McAfee IntruShield Security Management System allows remote authenticated users to access the "Generate Reports" feature and modify alerts by setting the Access option to true, as demonstrated using the (1) fullAccess or (2) fullAccessRight parameter in reports-column-center.jsp, or (3) fullAccess parameter to SystemEvent.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-10T04:00:00.000Z
CVE-2005-2188 
McAfee IntruShield Security Management System obtains the user ID from the URL, which allows remote attackers to guess the Manager account and possibly gain privileges via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-10T04:00:00.000Z
CVE-2005-2189 
Lantronix SecureLinx console server running firmware 2.0 and 3.0 stores /etc/ssh under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as SSH private keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-10T04:00:00.000Z
CVE-2005-2190 
Multiple SQL injection vulnerabilities in Comersus shopping cart allow remote attackers to execute arbitrary SQL commands via the (1) email parameter to comersus_optAffiliateRegistrationExec.asp or (2) idProduct parameter to comersus_optReviewReadExec.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-10T04:00:00.000Z
CVE-2005-2191 
Multiple cross-site scripting (XSS) vulnerabilities in Comersus shopping cart allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter to comersus_backoffice_listAssignedPricesToCustomer.asp or (2) message parameter to comersus_backoffice_message.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-10T04:00:00.000Z
CVE-2005-2192 
SimplePHPBlog 0.4.0 stores password hashes in config/password.txt with insufficient access control, which allows remote attackers to obtain passwords via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-10T04:00:00.000Z
CVE-2005-2193 
SQL injection vulnerability in the user profile edit module in profile.php for PunBB 1.2.5 and earlier allows remote attackers to execute arbitrary SQL statements via the temp array, which is not initialized before it is used and prevents the attacker-supplied portions of the array from being properly escaped.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-10T04:00:00.000Z
CVE-2005-2194 
Unspecified vulnerability in the Apple Mac OS X kernel before 10.4.2 allows remote attackers to cause a denial of service (kernel panic) via a crafted TCP packet, possibly related to source routing or loose source routing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-05T01:00:00.000Z
CVE-2005-2195 
Apple Darwin Streaming Server 5.5 and earlier allows remote attackers to cause a denial of service (application crash) via a URL with a filename containing a .cgi extension and an MS-DOS device name such as AUX, CON, PRN, COM1, or LPT1, a different vulnerability than CVE-2003-0421 and CVE-2003-0502.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-17T04:00:00.000Z
CVE-2005-2196 
The Apple AirPort card uses a default WEP key when not connected to a known or trusted network, which can cause it to automatically connect to a malicious network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-19T04:00:00.000Z
CVE-2005-2197 
SQL injection vulnerability in sql.cls.php in Id Board 1.1.3 allows remote attackers to modify SQL queries, as demonstrated using the f parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z
CVE-2005-2198 
PHP remote file inclusion vulnerability in lang.php in SPiD before 1.3.1 allows remote attackers to execute arbitrary code via the lang_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z
CVE-2005-2199 
PHP remote file inclusion vulnerability in inc/functions.inc.php in PPA web photo gallery 0.5.6 allows remote attackers to execute arbitrary code via the config[ppa_root_path] variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z
CVE-2005-2200 
Multiple unknown vulnerabilities in the MicroServer Web Server for Xerox WorkCentre Pro Color 2128, 2636, and 3545, version 0.001.04.044 through 0.001.04.504, allow attackers to bypass authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z
CVE-2005-2201 
Unknown vulnerability in the MicroServer Web Server for Xerox WorkCentre Pro Color 2128, 2636, and 3545, version 0.001.04.044 through 0.001.04.504, allow attackers to cause a denial of service or access files via crafted HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z
CVE-2005-2202 
Cross-site scripting (XSS) vulnerability in the MicroServer Web Server for Xerox WorkCentre Pro Color 2128, 2636, and 3545, version 0.001.04.044 through 0.001.04.504, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z
CVE-2005-2203 
login.php in phpWishlist before 0.1.15 allows remote attackers to bypass authentication via a direct request to admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z
CVE-2005-2204 
Cross-site scripting (XSS) vulnerability in Computer Associates (CA) eTrust SiteMinder 5.5, when the "CSSChecking" parameter is set to "NO," allows remote attackers to inject arbitrary web script or HTML via the (1) PASSWORD or (2) BUFFER parameters to smpwservicescgi.exe, (3) the TARGET parameter to login.fcc, and possibly other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z
CVE-2005-2205 
The ReadLog function in kaiseki.cgi in pngren allows remote attackers to execute arbitrary commands via shell metacharacters in the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z
CVE-2005-2206 
Multiple SQL injection vulnerabilities in CartWIZ allow remote attackers to modify SQL statements via the (1) idProduct parameter to tellAFriend.asp, (2) sortType parameter to viewSupportTickets.asp, or the id parameter to (3) updateCreditCards.asp or (4) deleteCreditCards.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z
CVE-2005-2207 
Cross-site scripting (XSS) vulnerability in store/login.asp in CartWIZ allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z
CVE-2005-2208 
PrivaShare 1.1b allows remote attackers to cause a denial of service (crash) via a malformed message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z
CVE-2005-2209 
Capturix ScanShare 1.06 build 50 stores sensitive information such as the password in cleartext in capturixss_cfg.ini, which is readable by local users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z
CVE-2005-2210 
Stack-based buffer overflow in Internet Download Manager 4.05 allows remote attackers to execute arbitrary code via a long URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z
CVE-2005-2211 
Backup Manager 0.5.8a creates temporary files insecurely, which allows local users to conduct unauthorized file operations when a user is burning a CDR.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z