rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-1394 
Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T00:00:00.000Z
CVE-2008-1395 
Plone CMS does not record users' authentication states, and implements the logout feature solely on the client side, which makes it easier for context-dependent attackers to reuse a logged-out session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T00:00:00.000Z
CVE-2008-1396 
Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T00:00:00.000Z
CVE-2008-1397 
Check Point VPN-1 Power/UTM, with NGX R60 through R65 and NG AI R55 software, allows remote authenticated users to cause a denial of service (site-to-site VPN tunnel outage), and possibly intercept network traffic, by configuring the local RFC1918 IP address to be the same as one of this tunnel's endpoint RFC1918 IP addresses, and then using SecuRemote to connect to a network interface at the other endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T00:00:00.000Z
CVE-2008-1398 
SQL injection vulnerability in online.php in AuraCMS 2.0 through 2.2.1 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For field (HTTP_X_FORWARDED_FOR environment variable) in an HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1399 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Clansphere 2008 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1400 
Directory traversal vulnerability in the Net Inspector HTTP Server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to read arbitrary files via a "..\" (dot dot backslash) or "../" (dot dot slash) in the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1401 
Format string vulnerability in the Net Inspector HTTP server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to execute arbitrary code via format string specifiers in the URI, which is recorded in a log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1402 
MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to cause a (1) denial of service (exception and crash) via a UDP packet to the SNMP Trap Service (MgWTrap3.exe) or (2) denial of service (device freeze or memory consumption) via a malformed request to the Net Inspector Server (niengine).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1403 
Stack-based buffer overflow in the TFTP server in BootManage TFTPD 1.99 and earlier in BootManage Administrator 7.1 and earlier allows remote attackers to execute arbitrary code via a request with a long filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1404 
SQL injection vulnerability in index.php in the Viso (Industry Book) 2.04 and 2.03 module for eXV2 allows remote attackers to execute arbitrary SQL commands via the kid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1405 
PHP remote file inclusion vulnerability in code/display.php in fuzzylime (cms) 3.01 allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1406 
SQL injection vulnerability in annonces-p-f.php in the MyAnnonces 1.8 module for eXV2 allows remote attackers to execute arbitrary SQL commands via the lid parameter in an ImprAnn action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1407 
SQL injection vulnerability in index.php in the WebChat 1.60 module for eXV2 allows remote attackers to execute arbitrary SQL commands via the roomid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1408 
SQL injection vulnerability in includes/functions/banners-external.php in phpBP 2 RC3 (2.204) FIX 4 allows remote attackers to execute arbitrary SQL commands via the id parameter in a banner_out action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1409 
Multiple directory traversal vulnerabilities in the Default theme in Exero CMS 1.0.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the theme parameter to (1) index.php, (2) editpassword.php, and (3) avatar.php in usercp/; (4) custompage.php; (5) errors/404.php; (6) memberslist.php and (7) profile.php in members/; (8) index.php and (9) fullview.php in news/; and (10) nopermission.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1410 
Directory traversal vulnerability in the PXE Server (pxesrv.exe) in Acronis Snap Deploy 2.0.0.1076 and earlier allows remote attackers to read arbitrary files via directory traversal sequences to the TFTP service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1411 
The PXE Server (pxesrv.exe) in Acronis Snap Deploy 2.0.0.1076 and earlier allows remote attackers to cause a denial of service (crash) via an incomplete TFTP request, which triggers a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1412 
Unspecified vulnerability in multiple F-Secure anti-virus products, including Internet Security 2006 through 2008, Anti-Virus 2006 through 2008, and others, allows remote attackers to execute arbitrary code or cause a denial of service (hang or crash) via a malformed archive that triggers an unhandled exception, as demonstrated by the PROTOS GENOME test suite for Archive Formats.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1413 
Cross-site scripting (XSS) vulnerability in search.php in SNewsCMS Rus 2.1 through 2.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1414 
Cross-site scripting (XSS) vulnerability in Multiple Time Sheets (MTS) 5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the tab parameter to (1) index.php, as demonstrated using mixed case and encoded whitespace characters in the tag; or (2) clientinfo.php, (3) invoices.php, (4) smartlinks.php, and (5) todo.php, as demonstrated using a META tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1415 
Directory traversal vulnerability in index.php in Multiple Time Sheets (MTS) 5.0 and earlier allows remote attackers to read arbitrary files via "../..//" (modified dot dot) sequences in the tab parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1416 
Multiple PHP remote file inclusion vulnerabilities in PHPauction GPL 2.51 allow remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to (1) converter.inc.php, (2) messages.inc.php, and (3) settings.inc.php in includes/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T10:00:00.000Z
CVE-2008-1417 
The prerm script in axyl 2.1.7 allows local users to overwrite arbitrary files via a symlink attack on the axyl.conf temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T17:00:00.000Z
CVE-2008-1419 
Xiph.org libvorbis 1.2.0 and earlier does not properly handle a zero value for codebook.dim, which allows remote attackers to cause a denial of service (crash or infinite loop) or trigger an integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-16T06:54:00.000Z
CVE-2008-1420 
Integer overflow in residue partition value (aka partvals) evaluation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to execute arbitrary code via a crafted OGG file, which triggers a heap overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-16T06:54:00.000Z
CVE-2008-1423 
Integer overflow in a certain quantvals and quantlist calculation in Xiph.org libvorbis 1.2.0 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted OGG file with a large virtual space for its codebook, which triggers a heap overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-16T06:54:00.000Z
CVE-2008-1425 
SQL injection vulnerability in index.php in the gallery module in Easy-Clanpage 2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a kate action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T18:00:00.000Z
CVE-2008-1426 
SQL injection vulnerability in album.asp in KAPhotoservice allows remote attackers to execute arbitrary SQL commands via the albumid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T18:00:00.000Z
CVE-2008-1427 
SQL injection vulnerability in the Joobi Acajoom (com_acajoom) 1.1.5 and 1.2.5 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mailingid parameter in a mailing view action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T18:00:00.000Z
CVE-2008-1428 
Multiple cross-site scripting (XSS) vulnerabilities in the Ubercart 5.x before 5.x-1.0-beta7 module for Drupal allow remote attackers to inject arbitrary web script or HTML via a text attribute value for a product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T18:00:00.000Z
CVE-2008-1429 
Secure Internet Live Conferencing (SILC) Server before 1.1.1 allows remote attackers to cause a denial of service (daemon crash) via a NEW_CLIENT packet without a nickname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T18:00:00.000Z
CVE-2008-1430 
SQL injection vulnerability in links.asp in ASPapp allows remote attackers to execute arbitrary SQL commands via the CatId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T18:00:00.000Z
CVE-2008-1431 
RaidSonic NAS-4220-B with 2.6.0-n(2007-10-11) firmware stores a partition encryption key in an unencrypted /system/.crypt file with base64 encoding, which allows local users to obtain the key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T18:00:00.000Z
CVE-2008-1432 
Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine SupportCenter Plus 7.0.0 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter, a related issue to CVE-2008-1299.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-20T18:00:00.000Z
CVE-2008-1434 
Use-after-free vulnerability in Microsoft Word in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 Office System SP1 and earlier allows remote attackers to execute arbitrary code via an HTML document with a large number of Cascading Style Sheets (CSS) selectors, related to a "memory handling error" that triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-13T22:00:00.000Z
CVE-2008-1435 
Windows Explorer in Microsoft Windows Vista up to SP1, and Server 2008, allows user-assisted remote attackers to execute arbitrary code via crafted saved-search (.search-ms) files that are not properly handled when saving, aka "Windows Saved Search Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-08T23:00:00.000Z
CVE-2008-1436 
Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2) LocalService accounts, which might allow context-dependent attackers to gain privileges by using one service process to capture a resource from a second service process that has a LocalSystem privilege-escalation ability, related to improper management of the SeImpersonatePrivilege user right, as originally reported for Internet Information Services (IIS), aka Token Kidnapping.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-21T17:00:00.000Z
CVE-2008-1437 
Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (engine hang and restart) via a crafted file, a different vulnerability than CVE-2008-1438.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-13T22:00:00.000Z
CVE-2008-1438 
Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (disk space exhaustion) via a file with "crafted data structures" that trigger the creation of large temporary files, a different vulnerability than CVE-2008-1437.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-13T22:00:00.000Z
CVE-2008-1440 
Microsoft Windows XP SP2 and SP3, and Server 2003 SP1 and SP2, does not properly validate the option length field in Pragmatic General Multicast (PGM) packets, which allows remote attackers to cause a denial of service (infinite loop and system hang) via a crafted PGM packet, aka the "PGM Invalid Length Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-12T01:30:00.000Z
CVE-2008-1441 
Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to cause a denial of service (system hang) via a series of Pragmatic General Multicast (PGM) packets with invalid fragment options, aka the "PGM Malformed Fragment Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-12T01:30:00.000Z
CVE-2008-1442 
Heap-based buffer overflow in the substringData method in Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code, related to an unspecified manipulation of a DOM object before a call to this method, aka the "HTML Objects Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-12T01:30:00.000Z
CVE-2008-1444 
Stack-based buffer overflow in Microsoft DirectX 7.0 and 8.1 on Windows 2000 SP4 allows remote attackers to execute arbitrary code via a Synchronized Accessible Media Interchange (SAMI) file with crafted parameters for a Class Name variable, aka the "SAMI Format Parsing Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-12T01:30:00.000Z
CVE-2008-1445 
Active Directory on Microsoft Windows 2000 Server SP4, XP Professional SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote authenticated users to cause a denial of service (system hang or reboot) via a crafted LDAP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-12T01:30:00.000Z
CVE-2008-1446 
Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote authenticated users to execute arbitrary code via an HTTP POST request that triggers an outbound IPP connection from a web server to a machine operated by the attacker, aka "Integer Overflow in IPP Service Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-15T00:00:00.000Z
CVE-2008-1447 
The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-08T23:00:00.000Z
CVE-2008-1448 
The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to UNC share pathnames, which allows remote attackers to bypass intended access restrictions and read arbitrary files via an mhtml: URI in conjunction with a redirection, aka "URL Parsing Cross-Domain Information Disclosure Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-13T00:00:00.000Z
CVE-2008-1451 
The WINS service on Microsoft Windows 2000 SP4, and Server 2003 SP1 and SP2, does not properly validate data structures in WINS network packets, which allows local users to gain privileges via a crafted packet, aka "Memory Overwrite Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-12T01:30:00.000Z
CVE-2008-1453 
The Bluetooth stack in Microsoft Windows XP SP2 and SP3, and Vista Gold and SP1, allows physically proximate attackers to execute arbitrary code via a large series of Service Discovery Protocol (SDP) packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-12T01:30:00.000Z
CVE-2008-1454 
Unspecified vulnerability in Microsoft DNS in Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 allows remote attackers to conduct cache poisoning attacks via unknown vectors related to accepting "records from a response that is outside the remote server's authority," aka "DNS Cache Poisoning Vulnerability," a different vulnerability than CVE-2008-1447.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-08T23:00:00.000Z
CVE-2008-1455 
A "memory calculation error" in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, 2003 SP2, and 2007 through SP1; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 through SP1; and Office 2004 for Mac allows remote attackers to execute arbitrary code via a PowerPoint file with crafted list values that trigger memory corruption, aka "Parsing Overflow Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-13T00:00:00.000Z
CVE-2008-1456 
Array index vulnerability in the Event System in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote authenticated users to execute arbitrary code via a crafted event subscription request that is used to access an array of function pointers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-13T10:00:00.000Z
CVE-2008-1457 
The Event System in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate per-user subscriptions, which allows remote authenticated users to execute arbitrary code via a crafted event subscription request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-13T10:00:00.000Z
CVE-2008-1458 
Cross-site scripting (XSS) vulnerability in index.php in CS-Cart 1.3.2 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a products search action.  NOTE: it was also reported that 1.3.5-SP2 trial edition is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-24T18:00:00.000Z
CVE-2008-1459 
SQL injection vulnerability in the Alberghi (com_alberghi) 2.1.3 and earlier component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-24T18:00:00.000Z
CVE-2008-1460 
SQL injection vulnerability in the Joovideo (com_joovideo) 1.0 and 1.2.2 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-24T18:00:00.000Z
CVE-2008-1461 
Buffer overflow in XnView 1.92.1 allows user-assisted remote attackers to execute arbitrary code via a long filename argument on the command line.  NOTE: it is unclear whether there are common handler configurations in which this argument is controlled by an attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-24T18:00:00.000Z
CVE-2008-1462 
SQL injection vulnerability in the sections (Section) module in RunCMS allows remote attackers to execute arbitrary SQL commands via the artid parameter in a viewarticle action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-24T21:00:00.000Z
CVE-2008-1463 
Cross-site scripting (XSS) vulnerability in the management GUI in Imperva SecureSphere MX Management Server 5.0 allows remote attackers to inject arbitrary web script or HTML via an invalid or prohibited request to a web server protected by SecureSphere, which triggers injection into the "corrective action" section of an alert page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-24T21:00:00.000Z
CVE-2008-1464 
Multiple SQL injection vulnerabilities in Gallarific Free Edition 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) query parameter to (a) search.php; (2) gusername and (3) gpassword parameters to (b) login.php; and the (4) username and (5) password parameters to (c) gadmin/index.php in a signin action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-24T21:00:00.000Z