rainbutterfly/cve_corpus huggingface dataset:
CVE-2005-4695 
Symantec Brightmail AntiSpam 6.0 build 1 and 2 allows remote attackers to cause a denial of service (bmserver component termination) via malformed MIME messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z
CVE-2005-4696 
The Microsoft Wireless Zero Configuration system (WZCS) stores WEP keys and pair-wise Master Keys (PMK) of the WPA pre-shared key in plaintext in memory of the explorer process, which allows attackers with access to process memory to steal the keys and access the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z
CVE-2005-4697 
The Microsoft Wireless Zero Configuration system (WZCS) allows local users to access WEP keys and pair-wise Master Keys (PMK) of the WPA pre-shared key via certain calls to the WZCQueryInterface API function in wzcsapi.dll.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z
CVE-2005-4698 
Cross-site scripting (XSS) vulnerability in TellMe 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the 91) q_IP (IP) or (2) q_Host (HOST) parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z
CVE-2005-4699 
Argument injection vulnerability in TellMe 1.2 and earlier allows remote attackers to modify command line arguments for the Whois program and obtain sensitive information via "--" style options in the q_Host parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z
CVE-2005-4700 
TellMe 1.2 and earlier, when the Server (o_Server) and HEAD (o_Head) options are enabled, allows remote attackers to obtain sensitive information via an invalid q_Host parameter, which reveals the full pathname of the application in an fsockopen error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z
CVE-2005-4701 
Unspecified vulnerability in Process File System (procfs) in Sun Solaris 10 allows local users to obtain sensitive information such as process working directories via unknown attack vectors, possibly pwdx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z
CVE-2005-4702 
SQL injection vulnerability in the favorites module in index.php in IPBProArcade 2.5.2 allows remote attackers to inject arbitrary SQL commands via the gameid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. In addition, the demonstration code as used by third parties suggests that this might be a different type of vulnerability related to shell metacharacters.  Finally, this could be a rediscovery of CVE-2004-1430.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z
CVE-2005-4703 
Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z
CVE-2005-4704 
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 through SP3, 7.0 through SP6, and 6.1 through SP7, when SSL is intended to be used, causes an unencrypted protocol to be used in certain unspecified circumstances, which causes user credentials to be sent across the network in cleartext and allows remote attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z
CVE-2005-4705 
BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7, when a Java client application creates an SSL connection to the server after it has already created an insecure connection, will use the insecure connection, which allows remote attackers to sniff the connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z
CVE-2005-4706 
Unspecified vulnerability in the "privilege management" feature of Sun Solaris 10 allows local users to cause a denial of service (panic) via unknown vectors that trigger a null dereference in the secpolicy_fs_common function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z
CVE-2005-4707 
Multiple cross-site scripting (XSS) vulnerabilities in PHP GEN before 1.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z
CVE-2005-4708 
Adobe Macromedia MX 2004 products, Captivate, Contribute 2, Contribute 3, and eLicensing client install the Macromedia Licensing Service with the Users group permitted to configure the service, including the path to executable, which allows local users to execute arbitrary code as Local System.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T11:00:00.000Z
CVE-2005-4709 
The popSubjectContext method in the SecurityAssociation class in JBoss Enterprise Java Beans (EJB) 3.0 RC3 maintains the threadPrincipal and threadCredential values from a previous client's authentication after termination of a client session, which allows remote attackers to gain the roles of an arbitrary previous client who had the same JBoss server thread.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T11:00:00.000Z
CVE-2005-4710 
Unspecified vulnerability in multiple Autodesk and AutoCAD products and product families from 2006 and earlier allows remote attackers to "gain inappropriate access to another local user's computer," aka ID DL5549329.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-10T11:00:00.000Z
CVE-2005-4711 
SQL injection vulnerability in Neocrome Land Down Under (LDU) 801 allows remote attackers to execute arbitrary SQL commands via an HTTP Referer header.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-10T11:00:00.000Z
CVE-2005-4712 
CRLF injection vulnerability in process_signup.php in PHP Handicapper allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the login parameter.  NOTE: the vendor has disputed CVE-2005-3497, and it is possible that the dispute was intended to include this issue as well.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-11T11:00:00.000Z
CVE-2005-4713 
Unspecified vulnerability in the SQL logging facility in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors, probably involving the pam_mysql_sql_log function when being used in vsftpd, which does not include the IP address argument to an sprintf call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-13T11:00:00.000Z
CVE-2005-4714 
Format string vulnerability in the vmps_log function in OpenVMPS (VLAN Management Policy Server) 1.3 allows remote attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-13T22:00:00.000Z
CVE-2005-4715 
Multiple SQL injection vulnerabilities in modules.php in PHP-Nuke 7.8, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) name, (2) sid, and (3) pid parameters in a POST request, which bypasses security checks that are performed for GET requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-13T22:00:00.000Z
CVE-2005-4716 
Hitachi TP1/Server Base and TP1/NET/Library 2 on IBM AIX allow remote attackers to (1) cause a denial of service (OpenTP1 system outage) via invalid data to a port used by a system-server process, and (2) cause a denial of service (process failure) via invalid data to a port used by any of certain other processes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-15T11:00:00.000Z
CVE-2005-4717 
Microsoft Internet Explorer 6.0 on Windows NT 4.0 SP6a, Windows 2000 SP4, Windows XP SP1, Windows XP SP2, and Windows Server 2003 SP1 allows remote attackers to cause a denial of service (client crash) via a certain combination of a malformed HTML file and a CSS file that triggers a null dereference, probably related to rendering of a DIV element that contains a malformed IMG tag, as demonstrated by IEcrash.htm and IEcrash.rar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-15T11:00:00.000Z
CVE-2005-4718 
Opera 8.02 and earlier allows remote attackers to cause a denial of service (client crash) via (1) a crafted HTML file with a "content: url(0);" style attribute, a "bodyA" tag, a long string, and a "u" tag with a long attribute, as demonstrated by opera.html; and (2) a BGSOUND element with a "margin:-99;" STYLE attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-15T11:00:00.000Z
CVE-2005-4719 
Multiple SQL injection vulnerabilities in Sysbotz Systems Panel 1.0.6 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the cid parameter in knowledgebase/index.php, (2) the aid parameter in knowledgebase/view.php, (3) the cid parameter in contact/update.php, (4) the letter parameter in links/index.php, (5) the mid parameter in messageboard/view.php, and (6) the tid parameter in tickets/view.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-15T11:00:00.000Z
CVE-2005-4720 
Mozilla Firefox 1.0.7 and earlier on Linux allows remote attackers to cause a denial of service (client crash) via an IFRAME element with a large value of the WIDTH attribute, which triggers a problem related to representation of floating-point numbers, leading to an infinite loop of widget resizes and a corresponding large number of function calls on the stack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-15T11:00:00.000Z
CVE-2005-4721 
Cross-site scripting (XSS) vulnerability in search.cfm in tmsPUBLISHER 3.3 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-15T11:00:00.000Z
CVE-2005-4722 
_Request_Message.cfm in tmsPUBLISHER 3.3 allows remote attackers to obtain sensitive information via an invalid id argument to pagename.cfm, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-15T11:00:00.000Z
CVE-2005-4723 
D-Link DI-524 Wireless Router, DI-624 Wireless Router, and DI-784 allow remote attackers to cause a denial of service (device reboot) via a series of crafted fragmented UDP packets, possibly involving a missing fragment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-15T11:00:00.000Z
CVE-2005-4724 
SQL injection vulnerability in post.php in PhpTagCool 1.0.3 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For field in an HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-18T21:00:00.000Z
CVE-2005-4725 
Geeklog before 1.3.11sr3 allows remote attackers to bypass intended access restrictions and comment on an arbitrary story or topic by guessing the story ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-20T20:00:00.000Z
CVE-2005-4726 
MUTE 0.4 uses improper flood protection algorithms, which allows remote attackers to obtain sensitive information (privacy leak and search result data) by controlling a drop chain neighbor that is near the end of a message chain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-21T02:00:00.000Z
CVE-2005-4727 
Cross-site scripting (XSS) vulnerability in gbook.cgi in gBook before 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-23T02:00:00.000Z
CVE-2005-4728 
Untrusted search path vulnerability (RPATH) in amaya 9.2.1 on Debian GNU/Linux allows local users to gain privileges via a malicious Mesa library in the /home/anand directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-09T11:00:00.000Z
CVE-2005-4729 
SQL injection vulnerability in show.php in VBZooM Forum allows remote attackers to execute arbitrary SQL commands via the SubjectID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-10T02:00:00.000Z
CVE-2005-4730 
Unspecified vulnerability in PEAR Text_Password 1.0 has unknown impact and attack vectors, related to "problematic seeding" of the random number generator, possibly predictable seeds.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-14T19:00:00.000Z
CVE-2005-4731 
The Next action in PEAR HTML_QuickForm_Controller 1.0.4 includes the SID in the URL even when session.use_only_cookies is configured, which allows remote attackers to obtain the SID via an HTTP Referer field and possibly other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-15T17:00:00.000Z
CVE-2005-4732 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Tux Racer TuxBank 0.7x and 0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) description parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-19T23:00:00.000Z
CVE-2005-4733 
NetBSD 2.0 before 20050316 and NetBSD-current before 20050112 allow local users to cause a denial of service (infinite loop and system hang) by calling the F_CLOSEM fcntl with a parameter value of 0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-19T23:00:00.000Z
CVE-2005-4734 
Stack-based buffer overflow in IISWebAgentIF.dll in RSA Authentication Agent for Web (aka SecurID Web Agent) 5.2 and 5.3 for IIS allows remote attackers to execute arbitrary code via a long url parameter in the Redirect method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-19T23:00:00.000Z
CVE-2005-4735 
IBM DB2 Universal Database (UDB) 810 before 8.1 FP10 allows remote authenticated users to cause a denial of service (application crash) via (1) certain equality predicates that trigger self-removal, aka IY70808; and (2) a query with more than 32000 elements in the IN-list, aka LI70817.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-19T23:00:00.000Z
CVE-2005-4736 
IBM DB2 Universal Database (UDB) 820 before 8.2 FP10 allows remote authenticated users to cause a denial of service (disk consumption) via a hash join (hsjn) that triggers an infinite loop in sqlri_hsjnFlushBlocks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-19T23:00:00.000Z
CVE-2005-4737 
IBM DB2 Universal Database (UDB) 820 before ESE AIX 5765F4100 allows remote authenticated users to cause a denial of service (CPU consumption) by "abnormally" terminating a connection, which prevents db2agents from being properly cleared.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-19T23:00:00.000Z
CVE-2005-4738 
IBM DB2 Universal Database (UDB) 810 before ESE AIX 5765F4100 does not ensure that a user has execute privileges before permitting object creation based on routines, which allows remote authenticated users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-19T23:00:00.000Z
CVE-2005-4739 
IBM DB2 Universal Database (UDB) 820 before version 8 FixPak 10 (s050811) allows remote authenticated users to cause a denial of service (application crash) by using a table function for an instance of snapshot_tbreorg, which triggers a trap in sqlnr_EStoE_action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-19T23:00:00.000Z
CVE-2005-4740 
IBM DB2 Universal Database (UDB) 810 before version 8 FixPak 10 allows remote authenticated users to cause a denial of service (db2jd service crash) by "connecting from a downlevel client."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-19T23:00:00.000Z
CVE-2005-4741 
NetBSD 1.6, NetBSD 2.0 through 2.1, and NetBSD-current before 20051031 allows local users to gain privileges by attaching a debugger to a setuid/setgid (P_SUGID) process that performs an exec without a reset of real credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-19T23:00:00.000Z
CVE-2005-4742 
Unspecified vulnerability in Echelog 0.6.2 allows attackers to "exploit function stacks on some architectures," with unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-19T23:00:00.000Z
CVE-2005-4743 
Multiple SQL injection vulnerabilities in index.php in NeLogic Nephp Publisher 4.5.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) nnet_catid parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-19T23:00:00.000Z
CVE-2005-4744 
Off-by-one error in the sql_error function in sql_unixodbc.c in FreeRADIUS 1.0.2.5-5, and possibly other versions including 1.0.4, might allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing the external database query to fail.  NOTE: this single issue is part of a larger-scale disclosure, originally by SUSE, which reported multiple issues that were disputed by FreeRADIUS.  Disputed issues included file descriptor leaks, memory disclosure, LDAP injection, and other issues.  Without additional information, the most recent FreeRADIUS report is being regarded as the authoritative source for this CVE identifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-28T11:00:00.000Z
CVE-2005-4745 
SQL injection vulnerability in the rlm_sqlcounter module in FreeRADIUS 1.0.3 and 1.0.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-28T11:00:00.000Z
CVE-2005-4746 
Multiple buffer overflows in FreeRADIUS 1.0.3 and 1.0.4 allow remote attackers to cause denial of service (crash) via (1) the rlm_sqlcounter module or (2) unknown vectors "while expanding %t".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-28T11:00:00.000Z
CVE-2005-4747 
Cross-site scripting (XSS) vulnerability in WebHost Automation Ltd Helm before 3.2.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors involving the default page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-28T11:00:00.000Z
CVE-2005-4748 
PHP remote file include vulnerability in functions_admin.php in Virtual War (VWar) 1.5.0 R10 allows remote attackers to include and execute arbitrary PHP code via unspecified attack vectors.  NOTE: this issue has been referred to as XSS, but it is clear from the vendor description that it is a file inclusion problem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-30T01:00:00.000Z
CVE-2005-4749 
HTTP request smuggling vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allows remote attackers to inject arbitrary HTTP headers via unspecified attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-01T02:00:00.000Z
CVE-2005-4750 
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier allow remote attackers to cause a denial of service (server thread hang) via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-01T02:00:00.000Z
CVE-2005-4751 
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and WebLogic Express 9.0, 8.1 SP4 and earlier, 7.0 SP6 and earlier, and 6.1 SP7 and earlier allow remote attackers to inject arbitrary web script or HTML and gain administrative privileges via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-01T02:00:00.000Z
CVE-2005-4752 
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, might allow local users to gain privileges by using the run-as deployment descriptor element to change the privileges of a web application or EJB from the Deployer security role to the Admin security role.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-01T02:00:00.000Z
CVE-2005-4753 
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain "heavy usage" scenarios, report incorrect severity levels for an audit event, which might allow attackers to perform unauthorized actions and avoid detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-01T02:00:00.000Z
CVE-2005-4754 
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allow remote attackers to obtain sensitive information (intranet IP addresses) via unknown attack vectors involving "network address translation."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-01T02:00:00.000Z
CVE-2005-4755 
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private key passphrase in cleartext (2) on a terminal or (3) in a log file, which might allow local users to obtain cryptographic keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-01T02:00:00.000Z
CVE-2005-4756 
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP5 and earlier, do not properly validate derived Principals with multiple PrincipalValidators, which might allow attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-01T02:00:00.000Z
CVE-2005-4757 
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly "constrain" a "/" (slash) servlet root URL pattern, which might allow remote attackers to bypass intended servlet protections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-01T02:00:00.000Z
CVE-2005-4758 
Unspecified vulnerability in the Administration server in BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allows remote authenticated Admin users to read arbitrary files via unknown attack vectors related to an "internal servlet" accessed through HTTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-01T02:00:00.000Z