rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-0757 
Multiple eval injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary PHP code via (1) the contactgroupid parameter in addressbook.update.php, (2) the messageid parameter in addressbook.add.php, (3) the folderid parameter in folders.update.php, and possibly certain parameters in (4) calendar.event.php, (5) index.php, (6) pop.download.php, (7) read.bounce.php, (8) rules.block.php, (9) language.php, and (10) certain other scripts, as demonstrated by an addressbook.update.php request with a contactgroupid value of phpinfo() preceded by facilitators.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-18T02:00:00.000Z
CVE-2006-0758 
Multiple cross-site scripting (XSS) vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via a URL encoded expression in the query string in (1) index.php and (2) possibly certain other scripts, which is not properly cleansed when accessed from the $_SERVER['PHP_SELF'] variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-18T02:00:00.000Z
CVE-2006-0759 
Multiple SQL injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the contactgroupid parameter in addressbook.update.php, (2) the messageid parameter in addressbook.add.php, (3) the folderid parameter in folders.update.php, and possibly certain parameters in (4) calendar.event.php, (5) index.php, (6) pop.download.php, (7) read.bounce.php, (8) rules.block.php, (9) language.php, and (10) certain other scripts; and allow remote authenticated users to execute arbitrary SQL commands via (11) the folderid parameter in index.php and (12) possibly other parameters in certain other scripts, because $_SERVER['PHP_SELF'] is improperly handled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-18T02:00:00.000Z
CVE-2006-0760 
LightTPD 1.4.8 and earlier, when the web root is on a case-insensitive filesystem, allows remote attackers to bypass URL checks and obtain sensitive information via file extensions with unexpected capitalization, as demonstrated by a request for index.PHP when the configuration invokes the PHP interpreter only for ".php" names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-18T02:00:00.000Z
CVE-2006-0761 
Buffer overflow in BlackBerry Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server 2.2 and 4.0 before SP3 Hotfix 4 for IBM Lotus Domino, 3.6 before SP7 and 5.0 before SP3 Hotfix 3 for Microsoft Exchangem, and 4.0 for Novell GroupWise before SP3 Hotfix 1 might allow user-assisted remote attackers to execute arbitrary code on the server via a crafted Microsoft Word document that is opened on a wireless device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-18T02:00:00.000Z
CVE-2006-0762 
WinAbility Folder Guard 4.11 allows local users to gain unauthorized access to certain capabilities of the application by renaming or moving the password file (FGuard.FGP), which disables the password requirement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-18T02:00:00.000Z
CVE-2006-0763 
Cross-site scripting (XSS) vulnerability in dowebmailforward.cgi in cPanel allows remote attackers to inject arbitrary web script or HTML via a URL encoded value in the fwd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-18T02:00:00.000Z
CVE-2006-0764 
The Authentication, Authorization, and Accounting (AAA) capability in versions 5.0(1) and 5.0(3) of the software used by multiple Cisco Anomaly Detection and Mitigation products, when running with an incomplete TACACS+ configuration without a "tacacs-server host" command, allows remote attackers to bypass authentication and gain privileges, aka Bug ID CSCsd21455.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-18T02:00:00.000Z
CVE-2006-0765 
GUI display truncation vulnerability in ICQ Inc. (formerly Mirabilis) ICQ 2003a, 2003b, Lite 4.0, Lite 4.1, and possibly other Windows versions allows user-assisted remote attackers to hide malicious file extensions, bypass Windows security warnings via a filename that is all uppercase and of a specific length, which truncates the malicious extension from the display and could trick a user into executing arbitrary programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-18T02:00:00.000Z
CVE-2006-0766 
ICQ Inc. (formerly Mirabilis) ICQ 2003a, 2003b, Lite 4.0, Lite 4.1, and possibly other Windows versions allows user-assisted remote attackers to hide malicious file extensions and bypass Windows security warnings via a filename that ends in an assumed-safe extension such as JPG, and possibly containing other modified properties such as company name, icon, and description, which could trick a user into executing arbitrary programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-18T02:00:00.000Z
CVE-2006-0767 
CGIWrap before 3.10 allows remote attackers to obtain sensitive information via unknown attack vectors that cause errors in scripts that reveal system information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-18T21:00:00.000Z
CVE-2006-0768 
Kadu 0.4.3 allows remote attackers to cause a denial of service (application crash) via a large number of image send requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-18T21:00:00.000Z
CVE-2006-0769 
Unspecified vulnerability in in.rexecd in Solaris 10 allows local users to gain privileges on Kerberos systems via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-18T21:00:00.000Z
CVE-2006-0770 
Cross-site scripting (XSS) vulnerability in calendar.php in MyBulletinBoard (MyBB) 1.0.4 allows remote attackers to inject arbitrary web script or HTML via a URL that is not sanitized before being returned as a link in "advanced details".  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-18T21:00:00.000Z
CVE-2006-0771 
Format string vulnerability in PunkBuster 1.180 and earlier, as used by Soldier of Fortune II and possibly other games, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in invalid cvar values, which are not properly handled when the server kicks the player and records the reason.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-18T21:00:00.000Z
CVE-2006-0772 
SQL injection vulnerability in Hitachi Business Logic - Container 02-03 through 03-00-/B on Windows, and 03-00 through 03-00-/B on Linux, allows remote attackers to execute arbitrary SQL commands via unspecified vectors in the extended receiving box function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T00:00:00.000Z
CVE-2006-0773 
Cross-site scripting (XSS) vulnerability in Hitachi Business Logic - Container 02-03 through 03-00-/B on Windows, and 03-00 through 03-00-/B on Linux, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the extended receiving box function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T00:00:00.000Z
CVE-2006-0774 
SQL injection vulnerability in deleteSession() in DB_eSession library 1.0.2 and earlier, as used in multiple products, allows remote attackers to execute arbitrary SQL commands via the $_sess_id_set variable, which is usually derived from PHPSESSID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T00:00:00.000Z
CVE-2006-0775 
Multiple SQL injection vulnerabilities in show.php in BirthSys 3.1 allow remote attackers to execute arbitrary SQL commands via the $month variable.  NOTE: a vector regarding the $date parameter and data.php (date.php) was originally reported, but this appears to be in error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T00:00:00.000Z
CVE-2006-0776 
Cross-site scripting (XSS) vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T00:00:00.000Z
CVE-2006-0777 
Unspecified vulnerability in guestex.pl in Teca Scripts Guestex 1.0 allows remote attackers to execute arbitrary shell commands via the email parameter, possibly involving shell metacharacters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T00:00:00.000Z
CVE-2006-0778 
Multiple SQL injection vulnerabilities in XMB Forums 1.9.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) $u2u_select array parameter to u2u.inc.php and (2) $val variable (fidpw0 cookie value) in today.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T00:00:00.000Z
CVE-2006-0779 
Cross-site scripting (XSS) vulnerability in u2u.php in XMB Forums 1.9.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter, as demonstrated using a URL-encoded iframe tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T00:00:00.000Z
CVE-2006-0780 
Multiple cross-site scripting (XSS) vulnerabilities in weblog.pl in PerlBlog 1.09b and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) email parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T11:00:00.000Z
CVE-2006-0781 
Directory traversal vulnerability in weblog.pl in PerlBlog 1.09b and earlier allows remote attackers to read certain files via the month parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T11:00:00.000Z
CVE-2006-0782 
Unspecified vulnerability in weblog.pl in PerlBlog 1.09b and earlier allows remote attackers to create arbitrary files and possibly execute arbitrary code via unspecified attack vectors related to improper handling of (1) the reply parameter, possibly involving injection of (2) the name parameter and (3) the body parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T11:00:00.000Z
CVE-2006-0783 
Cross-site scripting (XSS) vulnerability in page.php in in Siteframe Beaumont, possibly 5.0.2 or 5.0.1a, allows remote attackers to inject arbitrary web script or HTML via the comment_text parameter to the user comment page (/edit/Comment).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T11:00:00.000Z
CVE-2006-0784 
D-Link DWL-G700AP with firmware 2.00 and 2.01 allows remote attackers to cause a denial of service (CAMEO HTTP service crash) via a request composed of "GET" followed by a space and two newlines, possibly triggering the crash due to missing arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T11:00:00.000Z
CVE-2006-0785 
Absolute path traversal vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier allows remote attackers to include and execute arbitrary local files via a direct request with a path parameter with a null character and beginning with (1) '/' (slash) for an absolute pathname or (2) a drive letter (such as "C:"), which bypasses checks for ".." sequences and trailing ".php" extensions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T11:00:00.000Z
CVE-2006-0786 
Incomplete blacklist vulnerability in include.php in PHPKIT 1.6.1 Release 2 and earlier, with allow_url_fopen enabled, allows remote attackers to conduct PHP remote file include attacks via a path parameter that specifies a (1) UNC share or (2) ftps URL, which bypasses the check for "http://", "ftp://", and "https://" URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T11:00:00.000Z
CVE-2006-0787 
wimpy_trackplays.php in Plaino Wimpy MP3 Player, possibly 5.2 and earlier, allows remote attackers to insert arbitrary strings into trackme.txt via the (1) trackFile, (2) trackArtist, and (3) trackTitle parameters, which can result in providing false information about songs, occupying excessive disk space with very long parameter values, and storing executable code that might be invoked through a different vulnerability.  NOTE: since this issue, as described by the original researcher, is entirely dependent on the presence of another vulnerability, it could be argued that Wimpy cannot be responsible for how its data file is processed by applications outside of its control. Since this issue might only be useful as a facilitator manipulation in another vulnerability, perhaps it should not be included in CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T11:00:00.000Z
CVE-2006-0788 
Kyocera 3830 (aka FS-3830N) printers have a back door that allows remote attackers to read and alter configuration settings via strings that begin with "!R!SIOP0", as demonstrated using (1) a connection to to TCP port 9100 or (2) the UNIX lp command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T11:00:00.000Z
CVE-2006-0789 
Certain unspecified Kyocera printers have a default "admin" account with a blank password, which allows remote attackers to access an administrative menu via a telnet session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T11:00:00.000Z
CVE-2006-0790 
Rockliffe MailSite 7.0 and earlier allows remote attackers to cause a denial of service by sending crafted LDAP packets to port 389/TCP, as demonstrated by the ProtoVer LDAP testsuite.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T21:00:00.000Z
CVE-2006-0791 
PHP remote file inclusion vulnerability in index.php in DreamCost HostAdmin allows remote attackers to include arbitrary files via the $path variable, which is not initialized before use.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T21:00:00.000Z
CVE-2006-0792 
Cross-site scripting (XSS) vulnerability in preferences.personal.php in V-webmail 1.6.2 allows remote attackers to inject arbitrary web script or HTML via the newid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T21:00:00.000Z
CVE-2006-0793 
frameset.php in V-webmail 1.6.2 allows remote attackers to conduct phishing attacks by referencing arbitrary websites in the rframe parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T21:00:00.000Z
CVE-2006-0794 
help.php in V-webmail 1.6.2 allows remote attackers to obtain the installation path via unspecified invalid parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T21:00:00.000Z
CVE-2006-0795 
Absolute path traversal vulnerability in convert.cgi in Quirex 2.0.2 and earlier allows remote attackers to read arbitrary files, and possibly execute arbitrary code, via the (1) quiz_head, (2) quiz_foot, and (3) template variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T21:00:00.000Z
CVE-2006-0796 
Cross-site scripting (XSS) vulnerability in default.php in Clever Copy 3.0 allows remote attackers to inject arbitrary web script or HTML via the Subject field when sending private messages (privatemessages.php). NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T21:00:00.000Z
CVE-2006-0797 
Nokia N70 cell phone allows remote attackers to cause a denial of service (reboot or shutdown) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet whose length field is less than the actual length of the packet, possibly triggering a buffer overflow, as demonstrated using the Bluetooth Stack Smasher (BSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T21:00:00.000Z
CVE-2006-0798 
Multiple directory traversal vulnerabilities in the IMAP service in Macallan Mail Solution before 4.8.05.004 allow remote authenticated users to read e-mails of other users or create, modify, or delete directories via a .. (dot dot) in the argument to the (1) CREATE, (2) SELECT, (3) DELETE, or (4) RENAME commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T21:00:00.000Z
CVE-2006-0799 
Microsoft Internet Explorer allows remote attackers to spoof a legitimate URL in the status bar and conduct a phishing attack via a web page with an anchor element with a legitimate "href" attribute, a form whose action points to a malicious URL, and an INPUT submit element that is modified to look like a legitimate URL.  NOTE: this issue is very similar to CVE-2004-1104, although the manipulations are slightly different.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-19T21:00:00.000Z
CVE-2006-0800 
Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML tags with a trailing "<" character, which is interpreted as a ">" character by some web browsers but bypasses the blacklist protection in (1) the pnVarCleanFromInput function in pnAPI.php, (2) the pnSecureInput function in pnAntiCracker.php, and (3) the htmltext parameter in an edituser operation to user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-20T22:00:00.000Z
CVE-2006-0801 
SQL injection vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is off, allows remote attackers to execute arbitrary SQL commands via the language parameter to admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-20T22:00:00.000Z
CVE-2006-0802 
Cross-site scripting (XSS) vulnerability in the NS-Languages module for PostNuke 0.761 and earlier, when magic_quotes_gpc is enabled, allows remote attackers to inject arbitrary web script or HTML via the language parameter in a missing or translation operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-20T22:00:00.000Z
CVE-2006-0803 
The signature verification functionality in the YaST Online Update (YOU) script handling relies on a gpg feature that is not intended for signature verification, which prevents YOU from detecting malicious scripts or code that do not pass the signature check when gpg 1.4.x is being used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-23T20:00:00.000Z
CVE-2006-0804 
Off-by-one error in TIN 1.8.0 and earlier might allow attackers to execute arbitrary code via unknown vectors that trigger a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-21T01:00:00.000Z
CVE-2006-0805 
The CAPTCHA functionality in php-Nuke 6.0 through 7.9 uses fixed challenge/response pairs that only vary once per day based on the User Agent (HTTP_USER_AGENT), which allows remote attackers to bypass CAPTCHA controls by fixing the User Agent, performing a valid challenge/response, then replaying that pair in the random_num and gfx_check parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-21T02:00:00.000Z
CVE-2006-0806 
Multiple cross-site scripting (XSS) vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow remote attackers to inject arbitrary web script or HTML via (1) the next_page parameter in adodb-pager.inc.php and (2) other unspecified vectors related to PHP_SELF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-21T02:00:00.000Z
CVE-2006-0807 
Stack-based buffer overflow in NJStar Chinese and Japanese Word Processor 4.x and 5.x before 5.10 allows user-assisted attackers to execute arbitrary code via font names in NJStar (.njx) documents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-21T02:00:00.000Z
CVE-2006-0808 
MUTE 0.4 allows remote attackers to cause a denial of service (messages not forwarded) and obtain sensitive information about a target by filling a client's mWebCache cache with malicious "zombie" nodes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-21T02:00:00.000Z
CVE-2006-0809 
Multiple SQL injection vulnerabilities in Skate Board 0.9 allow remote attackers to execute arbitrary SQL commands via the (1) usern parameter in (a) sendpass.php, and the (2) usern and (3) passwd parameters and (4) sf_cookie cookie in (b) login.php and (c) logged.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-21T02:00:00.000Z
CVE-2006-0810 
Unspecified vulnerability in config.php in Skate Board 0.9 allows remote authenticated administrators to execute arbitrary PHP code by causing certain variables in config.php to be modified, possibly due to XSS or direct static code injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-21T02:00:00.000Z
CVE-2006-0811 
Cross-site scripting (XSS) vulnerability in reguser.php in Skate Board 0.9 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters involved with the registration form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-21T02:00:00.000Z
CVE-2006-0812 
The VisNetic AntiVirus Plug-in (DKAVUpSch.exe) for Mail Server 4.6.0.4, 4.6.1.1, and possibly other versions before 4.6.1.2, does not drop privileges before executing other programs, which allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-23T20:00:00.000Z
CVE-2006-0813 
Heap-based buffer overflow in WinACE 2.60 allows user-assisted attackers to execute arbitrary code via a large header block in an ARJ archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-24T11:00:00.000Z
CVE-2006-0814 
response.c in Lighttpd 1.4.10 and possibly previous versions, when run on Windows, allows remote attackers to read arbitrary source code via requests that contain trailing (1) "." (dot) and (2) space characters, which are ignored by Windows, as demonstrated by PHP files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-06T21:00:00.000Z
CVE-2006-0815 
NetworkActiv Web Server 3.5.15 allows remote attackers to read script source code via a crafted URL with a "/" (forward slash) after the file extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-06T23:00:00.000Z