rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-6691 
Multiple unspecified vulnerabilities in Menalto Gallery before 2.2.4 have unknown impact, related to (1) "hotlink protection" in the URL rewrite module, (2) a WebDAV view in the WebDAV module, (3) a comment view in the Comment module, (4) unspecified "item information disclosure attacks" in the Core module Gallery application, (5) the slideshow in the Slideshow module, and (6) multiple Print modules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T01:00:00.000Z
CVE-2007-6692 
Open redirect vulnerability in Menalto Gallery before 2.2.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) Core and (2) print modules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T01:00:00.000Z
CVE-2007-6693 
Unspecified vulnerability in the WebCam module in Menalto Gallery before 2.2.4 has unknown impact and attack vectors related to a "proxied request."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T01:00:00.000Z
CVE-2007-6694 
The chrp_show_cpuinfo function (chrp/setup.c) in Linux kernel 2.4.21 through 2.6.18-53, when running on PowerPC, might allow local users to cause a denial of service (crash) via unknown vectors that cause the of_get_property function to fail, which triggers a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-29T19:00:00.000Z
CVE-2007-6695 
Cross-site scripting (XSS) vulnerability in index.php in Drake CMS 0.4.9 allows remote attackers to inject arbitrary web script or HTML via the option parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-01T19:41:00.000Z
CVE-2007-6696 
Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.1.6 allow remote attackers to inject arbitrary web script or HTML via (1) an event description, (2) the query string to pref.php, and (3) the adv parameter to search.php.  NOTE: vector 1 requires user authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-01T19:41:00.000Z
CVE-2007-6697 
Buffer overflow in the LWZReadByte function in IMG_gif.c in SDL_image before 1.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted GIF file, a similar issue to CVE-2006-4484.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-01T19:41:00.000Z
CVE-2007-6698 
The BDB backend for slapd in OpenLDAP before 2.3.36 allows remote authenticated users to cause a denial of service (crash) via a potentially-successful modify operation with the NOOP control set to critical, possibly due to a double free vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-01T21:00:00.000Z
CVE-2007-6699 
Multiple buffer overflows in the AIM PicEditor 9.5.1.8 ActiveX control in YGPPicEdit.dll in AOL You've Got Pictures (YGP) Picture Editor allow remote attackers to cause a denial of service (browser crash) via a long string in the (1) DisplayName, (2) FinalSavePath, (3) ForceSaveTo, (4) HiddenControls, (5) InitialEditorScreen, (6) Locale, (7) Proxy, and (8) UserAgent property values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-04T22:00:00.000Z
CVE-2007-6700 
Cross-site scripting (XSS) vulnerability in cgi-bin/bgplg in the web interface for the BGPD daemon in OpenBSD 4.1 allows remote attackers to inject arbitrary web script or HTML via the cmd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-05T01:00:00.000Z
CVE-2007-6701 
Multiple stack-based buffer overflows in the Spooler service (nwspool.dll) in Novell Client 4.91 SP4 for Windows allow remote attackers to execute arbitrary code via long arguments to multiple unspecified RPC functions, aka Novell bug 287919, a different vulnerability than CVE-2007-2954.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-13T20:00:00.000Z
CVE-2007-6702 
goform/QuickStart_c0 on the GoAhead Web Server on the FS4104-AW (aka rooter) VDSL device contains a password in the typepassword field, which allows remote attackers to obtain this password by reading the HTML source, a different vulnerability than CVE-2002-1603.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-04T19:00:00.000Z
CVE-2007-6703 
Unspecified vulnerability in vdccm before 0.10.1 in SynCE (SynCE-dccm) might allow attackers to cause a denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-04T19:00:00.000Z
CVE-2007-6704 
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences are enabled, allow remote attackers to inject arbitrary web script or HTML via the query string to (1) my.activation.php3 and (2) my.logon.php3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-05T23:00:00.000Z
CVE-2007-6705 
The WebSphere MQ XA 5.3 before FP13 and 6.0.x before 6.0.2.1 client for Windows, when running in an MTS or a COM+ environment, grants the PROCESS_DUP_HANDLE privilege to the Everyone group upon connection to a queue manager, which allows local users to duplicate an arbitrary handle and possibly hijack an arbitrary process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-09T02:00:00.000Z
CVE-2007-6706 
Unspecified vulnerability in nlnotes.dll in the client in IBM Lotus Notes 6.5, 7.0.x before 7.0.2 CCH or 7.0.3, and possibly 8.0 allows remote attackers to execute arbitrary code via crafted text in an e-mail message sent over SMTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-09T02:00:00.000Z
CVE-2007-6707 
Multiple cross-site scripting (XSS) vulnerabilities on the Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.01.03 and earlier firmware allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2007-3574.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-13T18:00:00.000Z
CVE-2007-6708 
Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.01.03 and earlier firmware allow remote attackers to perform actions as administrators via an arbitrary valid request to an administrative URI, as demonstrated by (1) a Restore Factory Defaults action using the mtenRestore parameter to setup.cgi and (2) creation of a user account using the sysname parameter to setup.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-13T18:00:00.000Z
CVE-2007-6709 
The Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.01.03 and earlier firmware has "admin" as its default password for the "admin" account, which makes it easier for remote attackers to obtain access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-13T18:00:00.000Z
CVE-2007-6711 
Unspecified vulnerability in customer.php in FreeWebshop.org 2.2.5, 2.2.6 and 2.2.7WIP1/2 allows remote attackers to gain administrator privileges via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-24T23:00:00.000Z
CVE-2007-6712 
Integer overflow in the hrtimer_forward function (hrtimer.c) in Linux kernel 2.6.21-rc4, when running on 64-bit systems, allows local users to cause a denial of service (infinite loop) via a timer with a large expiry value, which causes the timer to always be expired.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-12T19:00:00.000Z
CVE-2007-6713 
Unspecified vulnerability in Flip4Mac WMV before 2.2.0.49 has unknown impact and attack vectors related to malformed WMV files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-16T20:00:00.000Z
CVE-2007-6714 
DBMail before 2.2.9, when using authldap with an LDAP server that supports anonymous login such as Active Directory, allows remote attackers to bypass authentication via an empty password, which causes the LDAP bind to indicate success based on anonymous authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-17T22:00:00.000Z
CVE-2007-6715 
Mozilla Firefox allows remote attackers to cause a denial of service (crash) via crafted image, as demonstrated by the zzuf lol-firefox.gif test case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-17T22:00:00.000Z
CVE-2007-6716 
fs/direct-io.c in the dio subsystem in the Linux kernel before 2.6.23 does not properly zero out the dio struct, which allows local users to cause a denial of service (OOPS), as demonstrated by a certain fio test.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-04T17:00:00.000Z
CVE-2007-6717 
Buffer overflow in tftp in bos.net.tcp.client in IBM AIX 5.2.0 and 5.3.0 allows local users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-10T15:00:00.000Z
CVE-2007-6718 
MPlayer, possibly 1.0rc1, allows remote attackers to cause a denial of service (SIGSEGV and application crash) via (1) a malformed MP3 file, as demonstrated by lol-mplayer.mp3; (2) a malformed Ogg Vorbis file, as demonstrated by lol-mplayer.ogg; (3) a malformed MPEG-1 file, as demonstrated by lol-mplayer.mpg; (4) a malformed MPEG-2 file, as demonstrated by lol-mplayer.m2v; (5) a malformed MPEG-4 AVI file, as demonstrated by lol-mplayer.avi; (6) a malformed FLAC file, as demonstrated by lol-mplayer.flac; (7) a malformed Ogg Theora file, as demonstrated by lol-mplayer.ogm; (8) a malformed WMV file, as demonstrated by lol-mplayer.wmv; or (9) a malformed AAC file, as demonstrated by lol-mplayer.aac.  NOTE: vector 5 might overlap CVE-2007-4938, and vector 6 might overlap CVE-2008-0486.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-20T17:00:00.000Z
CVE-2007-6719 
SQL injection vulnerability in Wiz-Ad 1.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-05T01:00:00.000Z
CVE-2007-6720 
libmikmod 3.1.9 through 3.2.0, as used by MikMod, SDL-mixer, and possibly other products, relies on the channel count of the last loaded song, rather than the currently playing song, for certain playback calculations, which allows user-assisted attackers to cause a denial of service (application crash) by loading multiple songs (aka MOD files) with different numbers of channels.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-20T16:00:00.000Z
CVE-2007-6721 
The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T01:00:00.000Z
CVE-2007-6722 
Vidalia bundle before 0.1.2.18, when running on Windows and Mac OS X, installs Privoxy with a configuration file (config.txt or config) that contains insecure (1) enable-remote-toggle and (2) enable-edit-actions settings, which allows remote attackers to bypass intended access restrictions and modify configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T17:00:00.000Z
CVE-2007-6723 
TorK before 0.22, when running on Windows and Mac OS X, installs Privoxy with a configuration file (config.txt or config) that contains insecure (1) enable-remote-toggle and (2) enable-edit-actions settings, which allows remote attackers to bypass intended access restrictions and modify configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T17:00:00.000Z
CVE-2007-6724 
Vidalia bundle before 0.1.2.18, when running on Windows, installs Privoxy with a configuration file (config.txt or config) that contains an insecure enable-remote-http-toggle setting, which allows remote attackers to bypass intended access restrictions and modify configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T17:00:00.000Z
CVE-2007-6725 
The CCITTFax decoding filter in Ghostscript 8.60, 8.61, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PDF file that triggers a buffer underflow in the cf_decode_2d function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-08T16:00:00.000Z
CVE-2007-6726 
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-09T15:00:00.000Z
CVE-2007-6727 
SQL injection vulnerability in topic.php in KerviNet Forum 1.1 allows remote attackers to execute arbitrary SQL commands via the forum parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2007-6728 
Cross-site scripting (XSS) vulnerability in XMB 1.5 allows remote attackers to inject arbitrary web script or HTML via the MSN field during user registration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2007-6729 
Cross-site scripting (XSS) vulnerability in the web management interface in the ZyXEL P-330W router allows remote attackers to inject arbitrary web script or HTML via the pingstr parameter and other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T10:00:00.000Z
CVE-2007-6730 
Multiple cross-site request forgery (CSRF) vulnerabilities in the web management interface in the ZyXEL P-330W router allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote router management via goform/formRmtMgt or (2) modify the administrator password via goform/formPasswordSetup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T10:00:00.000Z
CVE-2007-6731 
Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via an OXM file with a negative value, which bypasses a check in (1) test_oxm and (2) decrunch_oxm functions in misc/oxm.c, leading to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-13T22:00:00.000Z
CVE-2007-6732 
Multiple buffer overflows in the dtt_load function in loaders/dtt_load.c Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via unspecified vectors related to an untrusted length value and the (1) pofs and (2) plen arrays.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-13T22:00:00.000Z
CVE-2007-6733 
The nfs_lock function in fs/nfs/file.c in the Linux kernel 2.6.9 does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on an NFS filesystem and then changing this file's permissions, a related issue to CVE-2010-0727.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-16T19:00:00.000Z
CVE-2007-6734 
NWFTPD.nlm before 5.08.07 in the FTP server in Novell NetWare 6.5 SP7 does not properly implement the FTPREST.TXT NOREMOTE restriction, which allows remote authenticated users to access directories outside of the home server via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-05T15:15:00.000Z
CVE-2007-6735 
NWFTPD.nlm before 5.08.06 in the FTP server in Novell NetWare does not properly handle partial matches for container names in the FTPREST.TXT file, which allows remote attackers to bypass intended access restrictions via an FTP session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-05T15:15:00.000Z
CVE-2007-6736 
Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.2.0 allow remote authenticated users to access arbitrary files and directories via a .. (dot dot) in a (1) LIST, (2) STOR, or (3) RETR command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-19T19:00:00.000Z
CVE-2007-6737 
FTPServer.py in pyftpdlib before 0.2.0 does not increment the attempted_logins count for a USER command that specifies an invalid username, which makes it easier for remote attackers to obtain access via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-19T19:00:00.000Z
CVE-2007-6738 
pyftpdlib before 0.1.1 does not choose a random value for the port associated with the PASV command, which makes it easier for remote attackers to obtain potentially sensitive information about the number of in-progress data connections by reading the response to this command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-19T19:00:00.000Z
CVE-2007-6739 
FTPServer.py in pyftpdlib before 0.2.0 allows remote attackers to cause a denial of service via a long command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-19T19:00:00.000Z
CVE-2007-6740 
The ftp_STOU function in FTPServer.py in pyftpdlib before 0.2.0 does not limit the number of attempts to discover a unique filename, which might allow remote authenticated users to cause a denial of service via a STOU command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-19T19:00:00.000Z
CVE-2007-6741 
The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated users to conduct FTP bounce attacks via crafted FTP data, as demonstrated by an FTP bounce attack against a NAT server, a related issue to CVE-1999-0017.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-19T19:00:00.000Z
CVE-2007-6742 
The get_filter_list function in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0006 does not properly perform certain sub filter parsing, which allows remote authenticated users to cause a denial of service (infinite loop) via a malformed search filter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-21T10:00:00.000Z
CVE-2007-6743 
Double free vulnerability in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0005 allows remote authenticated users to cause a denial of service (ABEND) via search operations that trigger recursive filter_free calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-21T10:00:00.000Z
CVE-2007-6744 
Flexera Macrovision InstallShield before 2008 sends a digital-signature password to an unintended application during certain signature operations involving .spc and .pvk files, which might allow local users to obtain sensitive information via unspecified vectors, related to an incorrect interaction between InstallShield and Signcode.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-19T19:00:00.000Z
CVE-2007-6745 
clamav 0.91.2 suffers from a floating point exception when using ScanOLE2.
Problem types: description: Other
Affected products: vendor: clamav
product: clamav
Published: 2019-11-07T22:15:40.000Z
CVE-2007-6746 
telepathy-idle before 0.1.15 does not verify (1) that the issuer is a trusted CA, (2) that the server hostname matches a domain name in the subject's Common Name (CN), or (3) the expiration date of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-21T18:00:00.000Z
CVE-2007-6750 
The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-27T18:00:00.000Z
CVE-2007-6751 
Cross-site scripting (XSS) vulnerability in the MailForm plugin before 1.20 for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-04T19:00:00.000Z
CVE-2007-6752 
Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI.  NOTE: the vendor disputes the significance of this issue, by considering the "security benefit against platform complexity and performance impact" and concluding that a change to the logout behavior is not planned because "for most sites it is not worth the trade-off.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-28T10:00:00.000Z
CVE-2007-6753 
Untrusted search path vulnerability in Shell32.dll in Microsoft Windows 2000, Windows XP, Windows Vista, Windows Server 2008, and Windows 7, when using an environment configured with a string such as %APPDATA% or %PROGRAMFILES% in a certain way, allows local users to gain privileges via a Trojan horse DLL under the current working directory, as demonstrated by iTunes and Safari.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-28T19:00:00.000Z
CVE-2007-6754 
The ipalloc function in libc/stdlib/malloc.c in jemalloc in libc for FreeBSD 6.4 and NetBSD does not properly allocate memory, which makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, related to "integer rounding and overflow" errors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T19:00:00.000Z
CVE-2007-6755 
The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values.  NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-11T22:00:00.000Z