rainbutterfly/cve_corpus huggingface dataset:
CVE-2005-4161 
Multiple cross-site scripting (XSS) vulnerabilities in MilliScripts 1.4 redirect script allow remote attackers to inject arbitrary web script or HTML via the domainname parameter to register.php, and other unspecified vectors.  NOTE: the vendor has disputed this issue, stating "No invalid input can reach the script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-11T11:00:00.000Z
CVE-2005-4162 
Cross-site scripting (XSS) vulnerability in cal_make.pl in ACME PerlCal 2.99.20 allows remote attackers to inject arbitrary web script or HTML via the p0 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-11T11:00:00.000Z
CVE-2005-4163 
Directory traversal vulnerability in captcha.php in Captcha PHP 0.9 allows remote attackers to read arbitrary files via the _tcf parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-11T11:00:00.000Z
CVE-2005-4164 
SQL injection vulnerability in view.php in PHP-addressbook 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-11T11:00:00.000Z
CVE-2005-4165 
Multiple SQL injection vulnerabilities in ASP-DEV ASP Resources Forum allow remote attackers to execute arbitrary SQL commands via the (1) forum_id parameter to forum.asp, (2) unspecified parameters to register.asp, and (3) the "Search For" field in search.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-11T21:00:00.000Z
CVE-2005-4166 
Cross-site scripting (XSS) vulnerability in password.asp in DUWare DUportal Pro 3.4.3 allows remote attackers to inject arbitrary web script or HTML via the result parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-11T21:00:00.000Z
CVE-2005-4167 
Cross-site scripting (XSS) vulnerability in eFiction 1.0 and 1.1 allows remote attackers to inject arbitrary web script or HTML via the let parameter in a viewlist action to titles.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-11T21:00:00.000Z
CVE-2005-4168 
Multiple SQL injection vulnerabilities in eFiction 1.0, 1.1, and 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the let parameter in a viewlist action to titles.php and (2) the username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-11T21:00:00.000Z
CVE-2005-4169 
Multiple SQL injection vulnerabilities in eFiction 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) let parameter in a viewlist action to authors.php and (2) sid parameter to viewstory.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-11T21:00:00.000Z
CVE-2005-4170 
SQL injection vulnerability in eFiction 1.1 allows remote attackers to execute arbitrary SQL commands via the uid parameter to viewuser.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-11T21:00:00.000Z
CVE-2005-4171 
The "Upload new image" command in the "Manage Images" eFiction 1.1, when members are allowed to upload images, allows remote attackers to execute arbitrary PHP code by uploading a filename with a .php extension that contains a GIF header, which passes the image validity check but executes any PHP code within the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-11T21:00:00.000Z
CVE-2005-4172 
eFiction 1.0, 1.1, and 2.0 allows remote attackers to obtain sensitive information via a direct request to storyblock.php without arguments, which leaks the full pathname in the resulting PHP error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-11T21:00:00.000Z
CVE-2005-4173 
eFiction 1.0, 1.1, and 2.0 allows remote attackers to obtain sensitive information by accessing phpinfo.php, which executes the PHP phpinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-11T21:00:00.000Z
CVE-2005-4174 
eFiction 1.0, 1.1, and 2.0, in unspecified environments, might allow remote attackers to conduct unauthorized operations by directly accessing (1) install.php or (2) upgrade.php.  NOTE: it is unclear whether this is a vulnerability in eFiction itself or the result of incorrect system administration practices, e.g. by not removing utility scripts once they have been used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-11T21:00:00.000Z
CVE-2005-4175 
Insyde BIOS V190 does not clear the keyboard buffer after reading the BIOS password during system startup, which allows local administrators or users to read the password directly from physical memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-11T21:00:00.000Z
CVE-2005-4176 
AWARD Bios Modular 4.50pg does not clear the keyboard buffer after reading the BIOS password during system startup, which allows local administrators or users to read the password directly from physical memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-11T21:00:00.000Z
CVE-2005-4177 
Cross-site scripting (XSS) vulnerability in book.cfm in Magic Book Personal and Professional 2.0 allows remote attackers to inject arbitrary web script or HTML via the StartRow parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-12T01:00:00.000Z
CVE-2005-4178 
Buffer overflow in Dropbear server before 0.47 allows authenticated users to execute arbitrary code via unspecified inputs that cause insufficient memory to be allocated due to an incorrect expression that does not enforce the proper order of operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-12T21:00:00.000Z
CVE-2005-4189 
Multiple cross-site scripting (XSS) vulnerabilities in Horde Kronolith H3 before 2.0.6 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Calendar name field when creating calendars, (2) event title field when deleting events, the (3) Category and (4) Location search fields, and the (5) attendees email address fields when editing event attendees, and possibly other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4190 
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework before 3.0.8 allow remote authenticated users to inject arbitrary web script or HTML via multiple vectors, as demonstrated by (1) the identity field, (2) Category and (3) Label search fields, (4) the Mobile Phone field, and (5) Date and (6) Time fields when importing CSV files, as exploited through modules such as (a) Turba Address Book, (b) Kronolith, (c) Mnemo, and (d) Nag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4191 
Multiple cross-site scripting (XSS) vulnerabilities in templates/tasklists/tasklists.inc in Horde Nag Task List Manager H3 before 2.0.4 allow remote authenticated users to inject arbitrary web script or HTML via (1) the tasklist's name or (2) description, when creating a new tasklist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4192 
Multiple cross-site scripting (XSS) vulnerabilities in templates/notepads/notepads.inc in Horde Mnemo Note Manager H3 before 2.0.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) the notepad's name or (2) description, when creating a new notepad.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4193 
Cross-site scripting (XSS) vulnerability in UseBB before 0.7 allows remote attackers to inject arbitrary web script or HTML via the $_SERVER['PHP_SELF'] variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4194 
Buffer overflow in MediaServerList.exe in Sights 'n Sounds Streaming Media Server 2.0.3.a allows remote attackers to cause a denial of service (application crash) via a long query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4195 
Multiple SQL injection vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the ParentId parameter in SPT--BrowseResources.php, (2) ResourceId parameter in SPT--FullRecord.php, (3) ResourceOffset parameter in SPT--Home.php, and (4) F_UserName and (5) F_Password in SPT--UserLogin.php.  NOTE: it was later reported that vector 1 is also present in 1.4.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4196 
Multiple cross-site scripting (XSS) vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the ss parameter in SPT--QuickSearch.php; (2) ParentId parameter in SPT--BrowseResources.php; (3) the ResourceId parameter in SPT--FullRecord.php; (4) ResourceOffset parameter in SPT--Home.php, (5) F_SearchString parameter in SPT--QuickSearch.php; (6) F_UserName and (7) F_Password parameters in SPT--UserLogin.php; (8) F_SearchCat1, (9) F_TextField1, (10) F_SearchCat2, (11) F_TextField2, (12) F_SearchCat3, (13) F_TextField3, (14) F_SearchCat4, (15) F_TextField4, (16) ResourceType, (17) Language, (18) Audience, (19) Format parameters in SPT--AdvancedSearch.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4197 
tunnelform.yaws in Nortel SSL VPN 4.2.1.6 allows remote attackers to execute arbitrary commands via a link in the a parameter, which is executed with extra privileges in a cryptographically signed Java Applet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4198 
SQL injection vulnerability in index.php in Netref 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter. NOTE: the provenance of this issue is unknown; the details were obtained solely from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4199 
Multiple SQL injection vulnerabilities in MyBulletinBoard (MyBB) before 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) month, (2) day, and (3) year parameters in an addevent action in calendar.php; (4) threadmode and (5) showcodebuttons in an options action in usercp.php; (6) list parameter in an editlists action to usercp.php; (7) rating parameter in a rate action in member.php; and (8) rating parameter in either showthread.php or ratethread.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4200 
Multiple unspecified vulnerabilities in MyBulletinBoard (MyBB) before 1.0 have unknown impact and attack vectors, a different set of vulnerabilities than those identified by CVE-2005-4199.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4201 
Directory traversal vulnerability in My Album Online 1.0 allows remote attackers to access arbitrary files via ".../" (triple dot) sequences in unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4202 
Multiple directory traversal vulnerabilities in LogiSphere 0.9.9j allow remote attackers to access arbitrary files via (1) .. (dot dot), (2) "..." (triple dot), and (3) "..//" sequences in the URL, (4) "../" sequences in the source parameter to viewsource.jsp, or (5) "..\" (dot dot backslash) sequences in the NS-query-pat parameter to the search URL. URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4203 
LogiSphere 0.9.9j does not restrict the number of messages that can be sent, which allows remote attackers to cause a denial of service by sending a large number of messages via the msg command.  NOTE: due to lack of appropriate details by the original researcher, it is unclear whether this description accurately reflects the discloser's claim and is distinct from the XSS issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4204 
Cross-site scripting (XSS) vulnerability in LogiSphere 0.9.9j allows remote attackers to inject arbitrary Javascript via the msg command. NOTE: due to lack of appropriate details by the original researcher, it is unclear whether this issue is distinct from the msg DoS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4205 
Cross-site scripting (XSS) vulnerability in searchdb.asp in LocazoList 1.03c and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4206 
Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to redirect users to other URLs and conduct phishing attacks via a modified url parameter to frameset.jsp, which loads the URL into a frame and causes it to appear to be part of a valid page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4207 
SQL injection vulnerability in BTGrup Admin WebController Script allows remote attackers to execute SQL commands via the (1) Username and (2) Password fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4208 
Directory traversal vulnerability in Flatnuke 2.5.6 allows remote attackers to access arbitrary files via a .. (dot dot) and null byte (%00) in the id parameter of the read module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4209 
WorldClient webmail in Alt-N MDaemon 8.1.3 allows remote attackers to prevent arbitrary users from accessing their inboxes via script tags in the Subject header of an e-mail message, which prevents the user from being able to access the Inbox folder, possibly due to a cross-site scripting (XSS) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4210 
Opera before 8.51, when running on Windows with Input Method Editor (IME) installed, allows remote attackers to cause a denial of service (persistent application crash) by bookmarking a site with a long title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-13T11:00:00.000Z
CVE-2005-4211 
PHP remote file inclusion vulnerability in coin_includes/db.php in phpCOIN 1.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the $_CCFG[_PKG_PATH_DBSE] variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4212 
Directory traversal vulnerability in coin_includes/db.php in phpCOIN 1.2.2 allows remote attackers to read arbitrary local files via ".." (dot dot) sequences in the $_CCFG[_PKG_PATH_DBSE] variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4213 
SQL injection vulnerability in mod.php in phpCOIN 1.2.2 allows remote attackers to execute arbitrary SQL commands via the phpcoinsessid cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4214 
phpCOIN 1.2.2 allows remote attackers to obtain the installation path via a direct request to config.php, which leaks the path in an error message because the _CCFG['_PKG_PATH_DBSE'] variable is not defined.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4215 
Motorola SB5100E Cable Modem allows remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports, and with the SYN flag set (aka LAND).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4216 
The Administration Service (FMSAdmin.exe) in Macromedia Flash Media Server 2.0 r1145 allows remote attackers to cause a denial of service (application crash) via a malformed request with a single character to port 1111.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4217 
Perl in Apple Mac OS X Server 10.3.9 does not properly drop privileges when using the "$<" variable to set uid, which allows attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4218 
SQL injection vulnerability in forum.php in PHPWebThings 1.4 allows remote attackers to execute arbitrary SQL commands via the msg parameter, a different vulnerability than CVE-2005-3585.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4219 
setting.php in Innovative CMS (ICMS, formerly Imoel-CMS) contains username and password information in cleartext, which might allow attackers to obtain this information via a direct request to setting.php. NOTE: on a properly configured web server, it would be expected that a .php file would be processed before content is returned to the user, so this might not be a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4220 
Netgear RP114, and possibly other versions and devices, allows remote attackers to cause a denial of service via a SYN flood attack between one system on the internal interface and another on the external interface, which temporarily stops routing between the interfaces, as demonstrated using nmap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4221 
SQL injection vulnerability in link.php in Arab Portal System 2 Beta 2 allows remote attackers to execute arbitrary SQL commands via the (1) PHPSESSID (session ID) or (2) REQUEST_URI (query string).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4222 
Multiple cross-site scripting (XSS) vulnerabilities in guestbook.cgi in Lars Ellingsen Guestserver 4.13 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified message fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4223 
Multiple "potential" SQL injection vulnerabilities in Utopia News Pro (UNP) 1.1.4 might allow remote attackers to execute arbitrary SQL commands via (1) the newsid parameter in editnews.php, (2) the catid and question parameters in faq.php, (3) the poster parameter in postnews.php, (4) the tempid parameter in templates.php, and (5) the userid and groupid parameters in users.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4224 
Multiple "potential" SQL injection vulnerabilities in e107 0.7 might allow remote attackers to execute arbitrary SQL commands via (1) the email, hideemail, image, realname, signature, timezone, and xupexist parameters in signup.php, (2) the content_comment, content_rating, and content_summary parameters in subcontent.php, (3) the download_category and file_demo in upload.php, and (4) the email, hideemail, user_timezone, and user_xup parameters in usersettings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4225 
Multiple "potential" SQL injection vulnerabilities in myBloggie 2.1.3 beta might allow remote attackers to execute arbitrary SQL commands via (1) the category parameter in add.php, (2) the cat_desc parameter in addcat.php, (3) the level and user parameters in adduser.php, (4) the post_id parameter in del.php, (5) the cat_id parameter in delcat.php, (6) the comment_id parameter in delcomment.php, (7) the id parameter in deluser.php, (8) the post_id and category parameter in edit.php, (9) the cat_id and cat_desc parameters in editcat.php, and (10) the id, level, and user parameters in edituser.php.  NOTE: the username/login.php vector is already identified by CVE-2005-2838.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4226 
Multiple "potential" SQL injection vulnerabilities in phpWebThings 1.4 Patched might allow remote attackers to execute arbitrary SQL commands via (1) the ref parameter in download.php, (2) the direction, msg, sforum, reason, subname, and toform parameters in forum.php, (3) the msg and forum parameters in forum_edit.php, (4) the msg and forum parameters in forum_write.php, (5) the tekst parameter in guestbook.php, (6) the menuoption parameter in index.php, and the (7) sel_avatar parameter in myaccount.php.  NOTE: the forum.php/forum vector is already identified by CVE-2005-3585.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4227 
Multiple "potential" SQL injection vulnerabilities in DCP-Portal 6.1.1 might allow remote attackers to execute arbitrary SQL commands via (1) the password and username parameters in advertiser.php, (2) the aid parameter in announcement.php, (3) the dcp5_member_id, year, agid, day, day_s, hour, minute, month, month_s, and year_s parameters in calendar.php, (4) the cid parameter in contents.php, (5) the dcp5_member_id parameter in forums.php, (6) the bid parameter in go.php, (7) the lid parameter in golink.php, (8) the dcp5_member_id and mid parameters in inbox.php, (9) the catid, dcat, and dl parameters in index.php, (10) the dcp5_member_id in informer.php, (11) the nid parameter in news.php, (12) the type and rate parameters in rate.php, (13) the q parameter in search.php, and (14) the dcp5_member_id in update.php.  NOTE: other vectors in the PHP-CHECKER report are also covered by CVE-2005-3365 and CVE-2005-0454.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4228 
Multiple SQL injection vulnerabilities in PhpWebGallery 1.5.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) since, (2) sort_by, and (3) items_number parameters to comments.php, (4) the search parameter to category.php, and (5) image_id parameter to picture.php.  NOTE: it was later reported that the comments.php/sort_by vector also affects 1.7.2 and earlier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z
CVE-2005-4229 
Cross-site scripting (XSS) vulnerability in auction.pl in EveryAuction 1.53 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter.  NOTE: the provenance of this issue is unknown; the details were obtained solely from third party sources and independently verified using source code inspection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-14T11:00:00.000Z