rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-5926 
Multiple SQL injection vulnerabilities in mail.php in Vallheru before 1.0.7 allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) to parameters.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-16T00:00:00.000Z
CVE-2006-5927 
SQL injection vulnerability in cpLogin.asp in ASP Scripter Easy Portal 1.4 and Live Support 1.3 allows remote attackers to execute arbitrary SQL commands via the Password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-16T00:00:00.000Z
CVE-2006-5928 
Multiple PHP remote file inclusion vulnerabilities in Phpjobscheduler 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the installed_config_file parameter to (1) add-modify.php, (2) delete.php, (3) modify.php, and (4) phpjobscheduler.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-16T00:00:00.000Z
CVE-2006-5929 
PHP remote file inclusion vulnerability in firepjs.php in Phpjobscheduler 3.0 allows remote attackers to execute arbitrary PHP code via a URL in the installed_config_file parameter.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-16T00:00:00.000Z
CVE-2006-5930 
Multiple PHP remote file inclusion vulnerabilities in Aigaion Web based bibliography management system 1.2.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to (1) _basicfunctions.php, or (2) pageactionauthor.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-16T00:00:00.000Z
CVE-2006-5931 
Multiple PHP remote file inclusion vulnerabilities in Aigaion Web based bibliography management system 1.2.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to certain PHP scripts in (1) lib/actions/, (2) lib/displays/, (3) lib/editforms/, (4) lib/functions/, (5) scheme/, and (6) the root directory.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-16T00:00:00.000Z
CVE-2006-5932 
Kahua before 0.7, when running multiple applications under a single supervisor, grants application access on the basis of username instead of username and database name, which allows remote authenticated users to obtain unauthorized access if different databases assign the same username to different user accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-16T00:00:00.000Z
CVE-2006-5933 
SQL injection vulnerability in update.asp in UltraSite 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-16T00:00:00.000Z
CVE-2006-5934 
SQL injection vulnerability in admin/default.asp in Estate Agent Manager 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the UserName field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-16T00:00:00.000Z
CVE-2006-5935 
SQL injection vulnerability in index.php in ShopSystems 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the sessid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-16T00:00:00.000Z
CVE-2006-5936 
SQL injection vulnerability in dept.asp in SiteXpress E-Commerce System allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-16T00:00:00.000Z
CVE-2006-5937 
Multiple integer overflows in Grisoft AVG Anti-Virus before 7.1.407 allow remote attackers to execute arbitrary code via crafted (1) CAB or (2) RAR archives that trigger a heap-based buffer overflow.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-16T00:00:00.000Z
CVE-2006-5938 
Grisoft AVG Anti-Virus before 7.1.407 has unknown impact and remote attack vectors involving an uninitialized variable and a crafted CAB file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-16T00:00:00.000Z
CVE-2006-5939 
Grisoft AVG Anti-Virus before 7.1.407 allows remote attackers to cause a denial of service (crash) via a crafted DOC file that triggers a divide-by-zero error.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-16T00:00:00.000Z
CVE-2006-5940 
Unspecified vulnerability in Grisoft AVG Anti-Virus before 7.1.407 has unknown impact and remote attack vectors related to "Integer Issues" and parsing of .EXE files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-16T00:00:00.000Z
CVE-2006-5942 
Cross-site scripting (XSS) vulnerability in inventory/display/display_results.asp in Website Designs For Less Inventory Manager allows remote attackers to inject arbitrary web script or HTML via the category parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T00:00:00.000Z
CVE-2006-5943 
Multiple SQL injection vulnerabilities in inventory/display/imager.asp in Website Designs for Less Inventory Manager allow remote attackers to execute arbitrary SQL commands via the (1) pictable, (2) picfield, or (3) where parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T00:00:00.000Z
CVE-2006-5944 
Cross-site scripting (XSS) vulnerability in csm/asp/listings.asp in MGinternet Car Site Manager (CSM) allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T00:00:00.000Z
CVE-2006-5945 
Multiple SQL injection vulnerabilities in MGinternet Car Site Manager (CSM) allow remote attackers to execute arbitrary SQL commands via the (1) p parameter to (a) csm/asp/detail.asp, or the (2) l, (3) typ, or (4) loc parameter to (b) csm/asp/listings.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T00:00:00.000Z
CVE-2006-5946 
SQL injection vulnerability in demo/glossary/glossary.asp in FunkyASP Glossary 1.0 allows remote attackers to execute arbitrary SQL commands via the alpha parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T00:00:00.000Z
CVE-2006-5947 
Multiple directory traversal vulnerabilities in Conxint FTP Server 2.2.0603, and possibly earlier, allow remote attackers to read arbitrary files and list arbitrary directories via directory traversal sequences in (1) DIR (LIST or NLST) and (2) GET (RETR) commands. NOTE: the provenance of this information is unknown; details are obtained from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T00:00:00.000Z
CVE-2006-5948 
PHP remote file inclusion vulnerability in pntUnit/Inspect.php in phpPeanuts 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the Include parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T00:00:00.000Z
CVE-2006-5949 
Directory traversal vulnerability in ALTools ALFTP FTP Server 4.1 beta 1, and possibly earlier, allows remote attackers to create arbitrary directories via directory traversal sequences in a MKD request.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T00:00:00.000Z
CVE-2006-5950 
Unspecified vulnerability in ALTools ALFTP FTP Server 4.1 beta 1, and possibly earlier, allows remote authenticated users to obtain the installation path via unknown vectors related to the REN command, probably due to response messages.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T00:00:00.000Z
CVE-2006-5951 
PHP remote file inclusion vulnerability in pipe.php in Exophpdesk 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the lang_file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T00:00:00.000Z
CVE-2006-5952 
SQL injection vulnerability in admin/default.asp in ASP Smiley 1.0 allows remote attackers to execute arbitrary SQL commands via the Username field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T00:00:00.000Z
CVE-2006-5953 
SQL injection vulnerability in viewcart.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to execute arbitrary SQL commands via the zoneid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T00:00:00.000Z
CVE-2006-5954 
SQL injection vulnerability in page.asp in NetVIOS 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the NewsID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T00:00:00.000Z
CVE-2006-5955 
SQL injection vulnerability in listings.asp in 20/20 DataShed (aka Real Estate Listing System) allows remote attackers to execute arbitrary SQL commands via the itemID parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T00:00:00.000Z
CVE-2006-5956 
XLineSoft PHPRunner 3.1 stores the (1) database server name, (2) database names, (3) usernames, and (4) passwords in plaintext in %WINDIR%\PHPRunner.ini, which allows local users to obtain sensitive information by reading the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T00:00:00.000Z
CVE-2006-5957 
Multiple SQL injection vulnerabilities in INFINICART allow remote attackers to execute arbitrary SQL commands via the (1) groupid parameter in (a) browse_group.asp, (2) productid parameter in (b) added_to_cart.asp, and (3) catid and (4) subid parameter in (c) browsesubcat.asp.  NOTE: the vendor has disputed this report, saying "The vulnerabilities mentioned were never present in our official released products but only in the unofficial demo version. However we do appreciate the information. We have update our demo version and made sure all those vulnerabilities are fixed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T01:00:00.000Z
CVE-2006-5958 
Multiple cross-site scripting (XSS) vulnerabilities in INFINICART allow remote attackers to inject arbitrary web script or HTML via the (1) username and (2) password fields in (a) login.asp, (3) search field in (b) search.asp, and (4) email field in (c) sendpassword.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T01:00:00.000Z
CVE-2006-5959 
SQL injection vulnerability in browse.asp in A+ Store E-Commerce allows remote attackers to execute arbitrary SQL commands via the ParentID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T01:00:00.000Z
CVE-2006-5960 
Multiple cross-site scripting (XSS) vulnerabilities in account_login.asp in A+ Store E-Commerce allow remote attackers to inject arbitrary web script or HTML via the (1) username (txtUserName) and (2) password (txtPassword) parameters.  NOTE: portions of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T01:00:00.000Z
CVE-2006-5961 
Buffer overflow in Mercury Mail Transport System 4.01b for Windows has unknown impact and attack vectors, as originally reported in a GLEG VulnDisco pack.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.  The original researcher is reliable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T01:00:00.000Z
CVE-2006-5962 
Multiple SQL injection vulnerabilities in Hpecs Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields in the (a) login screen, and (3) searchstring parameter in (b) insearch_list.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T01:00:00.000Z
CVE-2006-5963 
Directory traversal vulnerability in PentaZip 8.5.1.190 and PentaSuite-PRO 8.5.1.221 allows user-assisted remote attackers to extract files to arbitrary pathnames via a ../ (dot dot slash) in a filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-19T01:00:00.000Z
CVE-2006-5964 
choShilA.bpl in PentaZip 8.5.1.190 and PentaSuite-PRO 8.5.1.221 allows local users, and user-assisted remote attackers to cause a denial of service (system crash) by right clicking on a file with a long filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-19T01:00:00.000Z
CVE-2006-5965 
PassGo SSO Plus 2.1.0.32, and probably earlier versions, uses insecure permissions (Everyone/Full Control) for the PassGo Technologies directory, which allows local users to gain privileges by modifying critical programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-26T23:00:00.000Z
CVE-2006-5966 
Panda ActiveScan 5.53.00, and other versions before 5.54.01, allows remote attackers to (1) reboot the system using the Reinicializar method in the ActiveScan.1 ActiveX control, or (2) determine arbitrary file existence and size via the ObtenerTamano method in the PAVPZ.SOS.1 ActiveX control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T22:00:00.000Z
CVE-2006-5967 
Race condition in Panda ActiveScan 5.53.00, and other versions before 5.54.01, allows remote attackers to cause memory corruption and execute arbitrary code via unknown vectors related to multiple invocations of the Analizar method in the ActiveScan.1 ActiveX control, which is not thread safe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T22:00:00.000Z
CVE-2006-5968 
MDaemon 9.0.5, 9.0.6, 9.51, and 9.53, and possibly other versions, installs the MDaemon application folder with insecure permissions (Users create files/directories), which allows local users to execute arbitrary code by creating malicious RASAPI32.DLL or MPRAPI.DLL libraries in the MDaemon\APP folder, which is an untrusted search path element due to insecure permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T22:00:00.000Z
CVE-2006-5969 
CRLF injection vulnerability in the evalFolderLine function in fvwm 2.5.18 and earlier allows local users to execute arbitrary commands via carriage returns in a directory name, which is not properly handled by fvwm-menu-directory, a variant of CVE-2003-1308.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-17T23:00:00.000Z
CVE-2006-5970 
Verity Ultraseek before 5.7 allows remote attackers to obtain sensitive information via direct requests with (1) a null ("%00") terminated url parameter to help/urlstatusgo.html; or missing parameters to (2) help/header.html, (3) help/footer.html, (4) spell.html, (5) coreforma.html, (6) daterange.html, (7) hits.html, (8) hitsnavbottom.html, (9) indexform.html, (10) indexforma.html, (11) languages.html, (12) nohits.html, (13) onehit1.html, (14) onehit2.html, (15) query.html, (16) queryform0.html, (17) queryform0a.html, (18) queryform1.html, (19) queryform1a.html, (20) queryform2.html, (21) queryform2a.html, (22) quicklinks.html, (23) relatedtopics.html, (24) signin.html, (25) subtopics.html, (26) thesaurus.html, (27) topics.html, (28) hitspagebar.html, (29) highlight/highlight.html, (30) highlight/highlight_one.html, and (31) highlight/topnav.html, which leaks the installation path in the resulting error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-18T00:00:00.000Z
CVE-2006-5971 
Absolute path traversal vulnerability in admin/logfile.txt in Verity Ultraseek before 5.6.2 allows remote attackers to read arbitrary files via the name variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-18T00:00:00.000Z
CVE-2006-5972 
Stack-based buffer overflow in WG111v2.SYS in NetGear WG111v2 wireless adapter (USB) allows remote attackers to execute arbitrary code via a long 802.11 beacon request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-18T01:00:00.000Z
CVE-2006-5973 
Off-by-one buffer overflow in Dovecot 1.0test53 through 1.0.rc14, and possibly other versions, when index files are used and mmap_disable is set to "yes," allows remote authenticated IMAP or POP3 users to cause a denial of service (crash) via unspecified vectors involving the cache file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-20T19:00:00.000Z
CVE-2006-5974 
fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger a NULL pointer dereference when calling the (1) ferror or (2) fflush functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-09T00:00:00.000Z
CVE-2006-5975 
Multiple cross-site scripting (XSS) vulnerabilities in comments.asp in BlogMe 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) URL, or (3) Comments field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-20T21:00:00.000Z
CVE-2006-5976 
Multiple SQL injection vulnerabilities in admin_login.asp in BlogMe 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) Username or (2) Password field.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-20T21:00:00.000Z
CVE-2006-5977 
Multiple SQL injection vulnerabilities in MultiCalendars allow remote attackers to execute arbitrary SQL commands via the (1) M or (2) Y parameter to rss_out.asp, or the (3) cate parameter to all_calendars.asp.  NOTE: the all_calendars.asp/calsids vector is already covered by CVE-2006-2293.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-20T21:00:00.000Z
CVE-2006-5978 
Unspecified vulnerability in E-Xoopport before 2.2.0 has unknown impact and attack vectors, as addressed by "Some security fix."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-20T21:00:00.000Z
CVE-2006-5979 
Renasoft NetJetServer 2.5.3.939, and possibly earlier, uses insecure permissions for Global.asa, which allows remote attackers to obtain sensitive information.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-20T21:00:00.000Z
CVE-2006-5980 
adm_lgn_admin.asp in Renasoft NetJetServer 2.5.3.939, and possibly earlier, does not properly perform login authentication, which allows remote attackers to obtain administrative privileges.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-20T21:00:00.000Z
CVE-2006-5981 
Multiple directory traversal vulnerabilities in SeleniumServer FTP Server 1.0, and possibly earlier, allow remote attackers to list arbitrary directories, read arbitrary files, and upload arbitrary files via directory traversal sequences in the (1) DIR (LIST or NLST), (2) GET (RETR), and (3) PUT (STOR) commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-20T21:00:00.000Z
CVE-2006-5982 
SeleniumServer FTP Server 1.0, and possibly earlier, stores user passwords in plaintext in the Servers directory, which allows attackers to obtain passwords by reading the file.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-20T21:00:00.000Z
CVE-2006-5983 
Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user parameter to (a) CMD_SHOW_RESELLER or (b) CMD_SHOW_USER in the Admin level; the (2) TYPE parameter to (c) CMD_TICKET_CREATE or (d) CMD_TICKET, the (3) user parameter to (e) CMD_EMAIL_FORWARDER_MODIFY, (f) CMD_EMAIL_VACATION_MODIFY, or (g) CMD_FTP_SHOW, and the (4) name parameter to (h) CMD_EMAIL_LIST in the User level; or the (5) user parameter to (i) CMD_SHOW_USER in the Reseller level.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-20T21:00:00.000Z
CVE-2006-5984 
Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3.2.10 allow remote authenticated users to inject arbitrary web script or HTML via the (1) txtCompanyName, (2) txtEmail, or (3) txtUserAccNum parameter to (a) users.asp, or the (4) setThemeColour parameter to (b) default.asp in the Reseller and Admin levels; or the (5) setThemeColour parameter to default.asp in the User level.  NOTE: the txtDomainName parameter to domains.asp is covered by CVE-2006-1407, which suggests that this vector is fixed in 3.2.10 stable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-20T21:00:00.000Z
CVE-2006-5985 
Multiple cross-site scripting (XSS) vulnerabilities in admin/options.php in Extreme CMS 0.9, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) bg1, (2) bg2, (3) text, or (4) size parameters.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-20T21:00:00.000Z
CVE-2006-5986 
admin/options.php in Extreme CMS 0.9, and possibly earlier, does not require authentication, which might allow remote attackers to conduct unauthorized activities.  NOTE: this issue can be combined with another vulnerability to expand the scope of a cross-site scripting (XSS) attack without authentication.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-20T21:00:00.000Z
CVE-2006-5987 
SQL injection vulnerability in default.asp in ASPintranet, possibly 1.2, allows remote attackers to execute arbitrary SQL commands via the a parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-20T21:00:00.000Z