rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-2955 
Multiple unspecified "input validation error" vulnerabilities in multiple ActiveX controls in NavComUI.dll, as used in multiple Norton AntiVirus, Internet Security, and System Works products for 2006, allows remote attackers to execute arbitrary code via (1) the AnomalyList property to AxSysListView32 and (2) Anomaly property to AxSysListView32OAA.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-09T21:00:00.000Z
CVE-2007-2956 
Stack-based buffer overflow in the readRadianceHeader function in (1) src/fileformat/rgbeio.cpp in pfstools 1.6.2 and (2) src/Fileformat/rgbeio.cpp in Qtpfsgui 1.8.11 allows remote attackers to execute arbitrary code via a crafted Radiance RGBE (.hdr) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-13T17:00:00.000Z
CVE-2007-2957 
Integer overflow in McAfee E-Business Server before 8.5.3 for Solaris, and before 8.1.2 for Linux, HP-UX, and AIX, allows remote attackers to execute arbitrary code via a large length value in an authentication packet, which results in a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-31T22:00:00.000Z
CVE-2007-2958 
Format string vulnerability in the inc_put_error function in src/inc.c in Sylpheed 2.4.4, and Sylpheed-Claws (Claws Mail) 1.9.100 and 2.10.0, allows remote POP3 servers to execute arbitrary code via format string specifiers in crafted replies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-27T17:00:00.000Z
CVE-2007-2959 
SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the id_manufacturer parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-31T23:00:00.000Z
CVE-2007-2960 
Multiple directory traversal vulnerabilities in Scallywag 2005-04-25 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skin_name parameter to template.php in (1) skin/dark/, (2) skin/gold/, or (3) skin/original/, a different vector than CVE-2007-2900.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-31T23:00:00.000Z
CVE-2007-2961 
Unrestricted file upload vulnerability in FileCloset before 1.1.5 allows remote attackers to upload arbitrary PHP files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-31T23:00:00.000Z
CVE-2007-2962 
Cross-site scripting (XSS) vulnerability in search.php in Particle Gallery 1.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the order parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-31T23:00:00.000Z
CVE-2007-2963 
Multiple cross-site scripting (XSS) vulnerabilities in Invision Power Board (IPB or IP.Board) 2.2.2, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via (1) module_bbcodeloader.php, (2) module_div.php, (3) module_email.php, (4) module_image.php, (5) module_link.php, or (6) the editorid parameter to module_table.php in jscripts/folder_rte_files/.  NOTE: some details were obtained from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-31T23:00:00.000Z
CVE-2007-2964 
The fsmsh.dll host module in F-Secure Policy Manager Server 7.00 and earlier allows remote attackers to cause a denial of service (application crash) via NTFS reserved words in filenames in URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-31T23:00:00.000Z
CVE-2007-2965 
Unspecified vulnerability in the Real-time Scanning component in multiple F-Secure products, including Internet Security 2005, 2006 and 2007; Anti-Virus 2005, 2006 and 2007; and Solutions based on F-Secure Protection Service for Consumers 6.40 and earlier allows local users to gain privileges via a crafted I/O request packet (IRP), related to IOCTL (Input/Output Control) and "access validation of the address space."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-31T23:00:00.000Z
CVE-2007-2966 
Buffer overflow in the LHA decompression component in F-Secure anti-virus products for Microsoft Windows and Linux before 20070529 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted LHA archive, related to an integer wrap, a similar issue to CVE-2006-4335.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-31T23:00:00.000Z
CVE-2007-2967 
Multiple F-Secure anti-virus products for Microsoft Windows and Linux before 20070522 allow remote attackers to cause a denial of service (file scanning infinite loop) via certain crafted (1) ARJ archives or (2) FSG packed files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-31T23:00:00.000Z
CVE-2007-2968 
Cross-site scripting (XSS) vulnerability in register.php in cpCommerce 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter (Full Name field).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T01:00:00.000Z
CVE-2007-2969 
PHP remote file inclusion vulnerability in newsletter.php in WAnewsletter 2.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the waroot parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T01:00:00.000Z
CVE-2007-2970 
Multiple cross-site scripting (XSS) vulnerabilities in cgi/block.cgi in 8e6 R3000 Internet Filter allow remote attackers to inject arbitrary web script or HTML via the (1) URL, (2) CAT, and (3) USER parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T01:00:00.000Z
CVE-2007-2971 
SQL injection vulnerability in getnewsitem.php in gCards 1.46 and earlier allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T01:00:00.000Z
CVE-2007-2972 
The file parsing engine in Avira Antivir Antivirus before 7.04.00.24 allows remote attackers to cause a denial of service (application crash) via a crafted UPX compressed file, which triggers a divide-by-zero error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T01:00:00.000Z
CVE-2007-2973 
Avira Antivir Antivirus before 7.03.00.09 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed TAR archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T01:00:00.000Z
CVE-2007-2974 
Buffer overflow in the file parsing engine in Avira Antivir Antivirus before 7.03.00.09 allows remote attackers to execute arbitrary code via a crafted LZH archive file, resulting from an "integer cast around."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T01:00:00.000Z
CVE-2007-2975 
The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not properly specify a filter mapping in web.xml, which allows remote attackers to gain privileges and execute arbitrary code by accessing functionality that is exposed through DWR, as demonstrated using the downloader.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T01:00:00.000Z
CVE-2007-2976 
Centrinity FirstClass 8.3 and earlier, and Server and Internet Services 8.0 and earlier, do not properly handle a URL with a null ("%00") character, which allows remote attackers to conduct cross-site scripting (XSS) attacks.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T01:00:00.000Z
CVE-2007-2977 
Buffer overflow in the receive function in submit/submitcommon.c in the submit daemon in DOMjudge before 2.0.0RC1 allows remote attackers to cause a denial of service or have other unspecified impact.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T01:00:00.000Z
CVE-2007-2978 
Session fixation vulnerability in eggblog 3.1.0 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T01:00:00.000Z
CVE-2007-2979 
Techno Dreams Web Directory / Search Engine 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for Database.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T01:00:00.000Z
CVE-2007-2980 
Heap-based buffer overflow in a certain ActiveX control in LEADTOOLS LEAD Raster ISIS Object (LTRIS14e.DLL) 14.5.0.44 allows remote attackers to cause a denial of service (Internet Explorer crash) or execute arbitrary code via a long DriverName property, a different ActiveX control than CVE-2007-2827.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T01:00:00.000Z
CVE-2007-2981 
Buffer overflow in a certain ActiveX control in LEAD Technologies LEADTOOLS Raster OCR Document Object Library (ltrdc14e.dll) 14.5.0.44 allows remote attackers to execute arbitrary code via a long DictionaryFileName property.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T01:00:00.000Z
CVE-2007-2982 
Multiple buffer overflows in the British Telecommunications Business Connect webhelper ActiveX control before 1.0.0.7 in btbconnectwebcontrol.dll allow remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T01:00:00.000Z
CVE-2007-2983 
Multiple buffer overflows in the British Telecommunications Consumer webhelper ActiveX control before 2.0.0.8 in btwebcontrol.dll allow remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-25T18:00:00.000Z
CVE-2007-2984 
Multiple stack-based buffer overflows in the Media Technology Group CDPass ActiveX control in CDPass.dll allow remote attackers to execute arbitrary code via unspecified vectors, possibly involving the GetTOC2 method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T10:00:00.000Z
CVE-2007-2985 
Pheap 2.0 allows remote attackers to bypass authentication by setting a pheap_login cookie value to the administrator's username, which can be used to (1) obtain sensitive information, including the administrator password, via settings.php or (2) upload and execute arbitrary PHP code via an update_doc action in edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T10:00:00.000Z
CVE-2007-2986 
PHP remote file inclusion vulnerability in lib/live_status.lib.php in AdminBot MX 9.0.5 allows remote attackers to execute arbitrary PHP code via a URL in the ROOT parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T10:00:00.000Z
CVE-2007-2987 
Multiple buffer overflows in certain ActiveX controls in sasatl.dll in Zenturi ProgramChecker allow remote attackers to execute arbitrary code via unspecified vectors, possibly involving the (1) DebugMsgLog or (2) DoFileProperties methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T10:00:00.000Z
CVE-2007-2988 
A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a request to admin/create_engine.php followed by a request to admin/generate_tabs.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T10:00:00.000Z
CVE-2007-2989 
The libike library in Sun Solaris 9 before 20070529 contains a logic error related to a certain pointer, which allows remote attackers to cause a denial of service (in.iked daemon crash) by sending certain UDP packets with a source port different from 500.  NOTE: this issue might overlap CVE-2006-2298.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T10:00:00.000Z
CVE-2007-2990 
Unspecified vulnerability in inetd in Sun Solaris 10 before 20070529 allows local users to cause a denial of service (daemon termination) via unspecified manipulations of the /var/run/.inetd.uds Unix domain socket file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-01T10:00:00.000Z
CVE-2007-2991 
Cross-site scripting (XSS) vulnerability in includes/send.inc.php in Evenzia CMS allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T16:00:00.000Z
CVE-2007-2992 
Multiple SQL injection vulnerabilities in OmegaMw7.asp in OMEGA (aka Omegasoft) INterneSErvicesLosungen (INSEL) allow remote attackers to execute arbitrary SQL commands via (1) user-created text fields; the (2) F05003, (3) F05005, and (4) F05015 fields; and other unspecified standard fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T16:00:00.000Z
CVE-2007-2993 
Multiple cross-site scripting (XSS) vulnerabilities in OmegaMw7.asp in OMEGA (aka Omegasoft) INterneSErvicesLosungen (INSEL) allow remote attackers to inject arbitrary web script or HTML via (1) user-created text fields; the (2) F05003, (3) F05005, and (4) F05015 fields; and other unspecified standard fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T16:00:00.000Z
CVE-2007-2994 
SQL injection vulnerability in news.php in DGNews 2.1 allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a fullnews action, a different vector than CVE-2007-0693.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T17:00:00.000Z
CVE-2007-2995 
Unspecified vulnerability in sysmgt.websm.rte in IBM AIX 5.2.0 and 5.3.0 has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T17:00:00.000Z
CVE-2007-2996 
Unspecified vulnerability in perl.rte 5.8.0.10 through 5.8.0.95 on IBM AIX 5.2, and 5.8.2.10 through 5.8.2.50 on AIX 5.3, allows local users to gain privileges via unspecified vectors related to the installation and "waiting for a legitimate user to execute a binary that ships with Perl."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T17:00:00.000Z
CVE-2007-2997 
Multiple SQL injection vulnerabilities in cgi-bin/reorder2.asp in SalesCart Shopping Cart allow remote attackers to execute arbitrary SQL commands via the password field and other unspecified vectors. NOTE: the vendor disputes this issue, stating "We were able to reproduce this sql injection on an old out-of-date demo on the website but not on the released product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T17:00:00.000Z
CVE-2007-2998 
The Pascal run-time library (PAS$RTL.EXE) before 20070418 on OpenVMS for Integrity Servers 8.3, and PAS$RTL.EXE before 20070419 on OpenVMS Alpha 8.3, does not properly restore PC and PSL values, which allows local users to cause a denial of service (system crash) via certain Pascal code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T17:00:00.000Z
CVE-2007-2999 
Microsoft Windows Server 2003, when time restrictions are in effect for user accounts, generates different error messages for failed login attempts with a valid user name than for those with an invalid user name, which allows context-dependent attackers to determine valid Active Directory account names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T17:00:00.000Z
CVE-2007-3000 
Multiple SQL injection vulnerabilities in PHP JackKnife (PHPJK) allow remote attackers to execute arbitrary SQL commands via (1) the iCategoryUnq parameter to G_Display.php or (2) the iSearchID parameter to Search/DisplayResults.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T17:00:00.000Z
CVE-2007-3001 
Multiple cross-site scripting (XSS) vulnerabilities in PHP JackKnife (PHPJK) allow remote attackers to inject arbitrary web script or HTML via (1) the sUName parameter to UserArea/Authenticate.php, (2) the sAccountUnq parameter to UserArea/NewAccounts/index.php, or the (3) iCategoryUnq, (4) iDBLoc, (5) iTtlNumItems, (6) iNumPerPage, or (7) sSort parameter to G_Display.php, different vectors than CVE-2005-4239.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T17:00:00.000Z
CVE-2007-3002 
PHP JackKnife (PHPJK) allows remote attackers to obtain sensitive information via (1) a request to index.php with an invalid value of the iParentUnq[] parameter, or a request to G_Display.php with an invalid (2) iCategoryUnq[] or (3) sSort[] array parameter, which reveals the path in various error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T17:00:00.000Z
CVE-2007-3003 
Multiple SQL injection vulnerabilities in myBloggie 2.1.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cat_id or (2) year parameter to index.php in a viewuser action, different vectors than CVE-2005-1500 and CVE-2005-4225.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T17:00:00.000Z
CVE-2007-3006 
Buffer overflow in Acoustica MP3 CD Burner 4.32 allows user-assisted remote attackers to execute arbitrary code via a .asx playlist file with a REF element containing a long string in the HREF attribute. NOTE: it was later claimed that 4.51 Build 147 is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T17:00:00.000Z
CVE-2007-3007 
PHP 5 before 5.2.3 does not enforce the open_basedir or safe_mode restriction in certain cases, which allows context-dependent attackers to determine the existence of arbitrary files by checking if the readfile function returns a string.  NOTE: this issue might also involve the realpath function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T17:00:00.000Z
CVE-2007-3008 
Mbedthis AppWeb before 2.2.2 enables the HTTP TRACE method, which has unspecified impact probably related to remote information leaks and cross-site tracing (XST) attacks, a related issue to CVE-2004-2320 and CVE-2005-3398.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T17:00:00.000Z
CVE-2007-3009 
Format string vulnerability in the MprLogToFile::logEvent function in Mbedthis AppWeb 2.0.5-4, when the build supports logging but the configuration disables logging, allows remote attackers to cause a denial of service (daemon crash) via format string specifiers in the HTTP scheme, as demonstrated by a "GET %n://localhost:80/" request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T17:00:00.000Z
CVE-2007-3010 
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T21:00:00.000Z
CVE-2007-3011 
The DBAsciiAccess CGI Script in the web interface in Fujitsu-Siemens Computers ServerView before 4.50.09 allows remote attackers to execute arbitrary commands via shell metacharacters in the Servername subparameter of the ParameterList parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T19:00:00.000Z
CVE-2007-3012 
The web interface in Fujitsu-Siemens Computers PRIMERGY BX300 Switch Blade allows remote attackers to obtain sensitive information by canceling the authentication dialog when accessing a sub-page, which still displays the form field contents of the sub-page, as demonstrated using (1) config/ip_management.htm and (2) config/snmp_config.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T19:00:00.000Z
CVE-2007-3013 
SQL injection vulnerability in activeWeb contentserver before 5.6.2964 allows remote authenticated users with edit permission to execute arbitrary SQL commands via the id parameter to admin/picture/picture_real_edit.asp, and probably other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T23:00:00.000Z
CVE-2007-3014 
Multiple cross-site scripting (XSS) vulnerabilities in activeWeb contentserver before 5.6.2964 allow remote attackers to inject arbitrary web script or HTML via the msg parameter to (1) errors/rights.asp or (2) errors/transaction.asp, or (3) the name of a MIME type (mimetype).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T23:00:00.000Z
CVE-2007-3017 
The WYSIWYG editor applet in activeWeb contentserver CMS before 5.6.2964 only filters malicious tags from articles sent to admin/applets/wysiwyg/rendereditor.asp, which allows remote authenticated users to inject arbitrary JavaScript via a request to admin/worklist/worklist_edit.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T00:00:00.000Z
CVE-2007-3018 
activeWeb contentserver CMS before 5.6.2964 does not limit the file-creation ability of editors who have restricted accounts, which allows these editors to create files in arbitrary directories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T00:00:00.000Z
CVE-2007-3021 
Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition (SAV CE) 10.1 and later, does not initialize a critical variable, which allows attackers to create arbitrary executable files via unknown manipulations of a file that is created during data export.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-05T21:00:00.000Z
CVE-2007-3022 
Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition (SAV CE) 10.1 and later, displays the password hash for a user after a failed login attempt, which makes it easier for remote attackers to conduct brute force attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-05T21:00:00.000Z