rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-3853 
Buffer overflow in the DAS server program in the Core DAS function component in IBM DB2 9.1 before FP4a and 9.5 before FP1 allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via unspecified vectors. NOTE: this might be related to CVE-2007-3676.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-28T17:00:00.000Z
CVE-2008-3854 
Multiple stack-based buffer overflows in IBM DB2 9.1 before Fixpak 5 and 9.5 before Fixpak 1 allow remote attackers to cause a denial of service (system outage) via vectors related to (1) use of XQuery to issue statements; the (2) XMLQUERY, (3) XMLEXISTS, and (4) XMLTABLE statements; and the (5) sqlrlaka function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-28T17:00:00.000Z
CVE-2008-3855 
Unspecified vulnerability in the DB2 Administration Server (DAS) in the Core DAS function component in IBM DB2 9.1 before Fixpak 5 allows local users to gain privileges, aka a "FILE CREATION VULNERABILITY." NOTE: this may be the same as CVE-2007-5664.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-28T17:00:00.000Z
CVE-2008-3856 
The routine infrastructure component in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP1 on Unix and Linux does not change the ownership of the db2fmp process, which has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-28T17:00:00.000Z
CVE-2008-3857 
The Base Service Utilities component in IBM DB2 9.1 before Fixpak 5 retains a cleartext password in memory after the database connection that sent the password is fully established, which might allow local users to obtain sensitive information by reading a memory dump.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-28T17:00:00.000Z
CVE-2008-3858 
The Downlevel DB2RA Support component in IBM DB2 9.1 before Fixpak 4a allows remote attackers to cause a denial of service (instance crash) via a crafted CONNECT data stream that simulates a V7 client connect request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-28T17:00:00.000Z
CVE-2008-3859 
Davlin Thickbox Gallery 2 allows remote attackers to obtain the administrative username and MD5 password hash via a direct request to conf/admins.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-29T16:22:00.000Z
CVE-2008-3860 
Multiple cross-site scripting (XSS) vulnerabilities (1) in the WYSIWYG editors, (2) during local group creation, (3) during HTML redirects, (4) in the HTML import, (5) in the Rich text editor, and (6) in link-page in IBM Lotus Quickr 8.1 services for Lotus Domino before Hotfix 15 allow remote attackers to inject arbitrary web script or HTML via unknown vectors, including (7) the Imported Page.  NOTE: the vulnerability in the WYSIWYG editors may exist because of an incomplete fix for CVE-2008-2163.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-29T16:22:00.000Z
CVE-2008-3861 
Multiple SQL injection vulnerabilities in phpMyRealty (PMR) 1.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in pages.php and (2) the price_max parameter in search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-29T16:22:00.000Z
CVE-2008-3862 
Stack-based buffer overflow in CGI programs in the server in Trend Micro OfficeScan 7.3 Patch 4 build 1367 and other builds before 1374, and 8.0 SP1 Patch 1 before build 3110, allows remote attackers to execute arbitrary code via an HTTP POST request containing crafted form data, related to "parsing CGI requests."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-23T21:00:00.000Z
CVE-2008-3863 
Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-23T21:00:00.000Z
CVE-2008-3864 
The ApiThread function in the firewall service (aka TmPfw.exe) in Trend Micro Network Security Component (NSC) modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, allows remote attackers to cause a denial of service (service crash) via a packet with a large value in an unspecified size field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T20:00:00.000Z
CVE-2008-3865 
Multiple heap-based buffer overflows in the ApiThread function in the firewall service (aka TmPfw.exe) in Trend Micro Network Security Component (NSC) modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, allow remote attackers to execute arbitrary code via a packet with a small value in an unspecified size field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T20:00:00.000Z
CVE-2008-3866 
The Trend Micro Personal Firewall service (aka TmPfw.exe) in Trend Micro Network Security Component (NSC) modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, relies on client-side password protection implemented in the configuration GUI, which allows local users to bypass intended access restrictions and change firewall settings by using a modified client to send crafted packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T20:00:00.000Z
CVE-2008-3867 
SQL injection vulnerability in spaces/emailuser.php in Interact 2.4.1 allows remote attackers to execute arbitrary SQL commands via the email_user_key parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-03T19:04:00.000Z
CVE-2008-3868 
Cross-site request forgery (CSRF) vulnerability in Interact 2.4.1 allows remote attackers to hijack the authentication of super administrators for requests that create super administrator accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-03T19:04:00.000Z
CVE-2008-3869 
Heap-based buffer overflow in sadmind in Sun Solaris 8 and 9 allows remote attackers to execute arbitrary code via a crafted RPC request, related to improper decoding of request parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-26T21:00:00.000Z
CVE-2008-3870 
Integer overflow in sadmind in Sun Solaris 8 and 9 allows remote attackers to execute arbitrary code via a crafted RPC request that triggers a heap-based buffer overflow, related to improper memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-26T21:00:00.000Z
CVE-2008-3871 
Multiple format string vulnerabilities in UltraISO 9.3.1.2633, and possibly other versions before 9.3.3.2685, allow user-assisted attackers to execute arbitrary code via format string specifiers in the filename of a (1) DAA or (2) ISZ file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-01T17:00:00.000Z
CVE-2008-3872 
Adobe Flash Player 8.0.39.0 and earlier, and 9.x up to 9.0.115.0, allows remote attackers to bypass the allowScriptAccess parameter setting via a crafted SWF file with unspecified "Filter evasion" manipulations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-06T17:00:00.000Z
CVE-2008-3873 
The System.setClipboard method in ActionScript in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to populate the clipboard with a URL that is difficult to delete and does not require user interaction to populate the clipboard, as exploited in the wild in August 2008.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-29T17:00:00.000Z
CVE-2008-3874 
Cross-site scripting (XSS) vulnerability in account.php in Lussumo Vanilla 1.1.5-rc1, 1.1.4, and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Value field (aka Label ==> Value pairs).  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-29T17:00:00.000Z
CVE-2008-3875 
The kernel in Sun Solaris 8 through 10 and OpenSolaris before snv_90 allows local users to bypass chroot, zones, and the Solaris Trusted Extensions multi-level security policy, and establish a covert communication channel, via unspecified vectors involving system calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-02T14:00:00.000Z
CVE-2008-3876 
Apple iPhone 2.0.2, in some configurations, allows physically proximate attackers to bypass intended access restrictions, and obtain sensitive information or make arbitrary use of the device, via an Emergency Call tap and a Home double-tap, followed by a tap of any contact's blue arrow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-02T14:00:00.000Z
CVE-2008-3877 
Stack-based buffer overflow in Acoustica Mixcraft 4.1 Build 96 and 4.2 Build 98 allows user-assisted attackers to execute arbitrary code via a crafted .mx4 file.  NOTE: it was later reported that version 3 is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-02T15:00:00.000Z
CVE-2008-3878 
Stack-based buffer overflow in the Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 in Ultra Shareware Ultra Office Control allows remote attackers to execute arbitrary code via long strUrl, strFile, and strPostData parameters to the HttpUpload method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-02T15:00:00.000Z
CVE-2008-3879 
The Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 and earlier in Ultra Shareware Ultra Office Control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction with a full destination pathname in the first argument (SaveAsDocument argument) to the Save method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-02T15:00:00.000Z
CVE-2008-3880 
SQL injection vulnerability in zm_html_view_event.php in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary SQL commands via the filter array parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-02T15:00:00.000Z
CVE-2008-3881 
Multiple cross-site scripting (XSS) vulnerabilities in ZoneMinder 1.23.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified "zm_html_view_*.php" files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-02T15:00:00.000Z
CVE-2008-3882 
Unspecified "Command Injection" vulnerability in ZoneMinder 1.23.3 and earlier allows remote attackers to execute arbitrary commands via (1) the executeFilter function in zm_html_view_events.php and (2) the run_state parameter to zm_html_view_state.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-02T15:00:00.000Z
CVE-2008-3883 
configvar in Caudium 1.4.12 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/roken#####.pike temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-02T15:00:00.000Z
CVE-2008-3884 
Cross-site scripting (XSS) vulnerability in Blogn (BURO GUN) 1.9.7 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2006-6176.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-02T15:00:00.000Z
CVE-2008-3885 
Cross-site request forgery (CSRF) vulnerability in Blogn (BURO GUN) 1.9.7 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make content modifications. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-02T15:00:00.000Z
CVE-2008-3886 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in dotProject 2.1.2 allow remote attackers to inject arbitrary web script or HTML via (1) the inactive parameter in a tasks action, (2) the date parameter in a calendar day_view action, (3) the callback parameter in a public calendar action, or (4) the type parameter in a ticketsmith action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-02T15:00:00.000Z
CVE-2008-3887 
Multiple SQL injection vulnerabilities in index.php in dotProject 2.1.2 allow (1) remote authenticated users to execute arbitrary SQL commands via the tab parameter in a projects action, and (2) remote authenticated administrators to execute arbitrary SQL commands via the user_id parameter in a viewuser action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-02T15:00:00.000Z
CVE-2008-3888 
SQL injection vulnerability in members.asp in Mini-NUKE Freehost 2.3 allows remote attackers to execute arbitrary SQL commands via the uid parameter in a member_details action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-02T15:00:00.000Z
CVE-2008-3889 
Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6-20080902, when used with the Linux 2.6 kernel, leaks epoll file descriptors during execution of "non-Postfix" commands, which allows local users to cause a denial of service (application slowdown or exit) via a crafted command, as demonstrated by a command in a .forward file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-12T16:00:00.000Z
CVE-2008-3890 
The kernel in FreeBSD 6.3 through 7.0 on amd64 platforms can make an extra swapgs call after a General Protection Fault (GPF), which allows local users to gain privileges by triggering a GPF during the kernel's return from (1) an interrupt, (2) a trap, or (3) a system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-05T16:00:00.000Z
CVE-2008-3891 
The SAML Single Sign-On (SSO) Service for Google Apps allows remote service providers to impersonate users at arbitrary service providers via vectors related to authentication responses that lack a request identifier and recipient field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-03T14:00:00.000Z
CVE-2008-3892 
Buffer overflow in a certain ActiveX control in the COM API in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a call to the GuestInfo method in which there is a long string argument, and an assignment of a long string value to the result of this call.  NOTE: this may overlap CVE-2008-3691, CVE-2008-3692, CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, or CVE-2008-3696.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-03T14:00:00.000Z
CVE-2008-3893 
Microsoft Bitlocker in Windows Vista before SP1 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer during boot, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-03T14:00:00.000Z
CVE-2008-3894 
IBM Lenovo firmware 7CETB5WW 2.05 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-03T14:00:00.000Z
CVE-2008-3895 
LILO 22.6.1 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-03T14:00:00.000Z
CVE-2008-3896 
Grub Legacy 0.97 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-03T14:00:00.000Z
CVE-2008-3897 
DiskCryptor 0.2.6 on Windows stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-03T14:00:00.000Z
CVE-2008-3898 
Secu Star DriveCrypt Plus Pack 3.9 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-03T14:00:00.000Z
CVE-2008-3899 
TrueCrypt 5.0 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.  NOTE: the researcher mentions a response from the vendor denying the vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-03T14:00:00.000Z
CVE-2008-3900 
Intel firmware PE94510M.86A.0050.2007.0710.1559 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-03T14:00:00.000Z
CVE-2008-3901 
Software suspend 2 2-2.2.1, when used with the Linux kernel 2.6.16, stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-03T14:00:00.000Z
CVE-2008-3902 
HP firmware 68DTT F.0D stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer, aka SSRT080104.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-03T19:00:00.000Z
CVE-2008-3903 
Asterisk Open Source 1.2.x before 1.2.32, 1.4.x before 1.4.24.1, and 1.6.0.x before 1.6.0.8; Asterisk Business Edition A.x.x, B.x.x before B.2.5.8, C.1.x.x before C.1.10.5, and C.2.x.x before C.2.3.3; s800i 1.3.x before 1.3.0.2; and Trixbox PBX 2.6.1, when Digest authentication and authalwaysreject are enabled, generates different responses depending on whether a SIP username is valid, which allows remote attackers to enumerate valid usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-04T19:00:00.000Z
CVE-2008-3904 
src/main-win.c in GPicView 0.1.9 in Lightweight X11 Desktop Environment (LXDE) allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-04T17:00:00.000Z
CVE-2008-3905 
resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-04T17:00:00.000Z
CVE-2008-3906 
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-04T17:00:00.000Z
CVE-2008-3907 
The open-in-browser command in newsbeuter before 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a feed URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-04T17:00:00.000Z
CVE-2008-3908 
Multiple buffer overflows in Princeton WordNet (wn) 3.0 allow context-dependent attackers to execute arbitrary code via (1) a long argument on the command line; a long (2) WNSEARCHDIR, (3) WNHOME, or (4) WNDBVERSION environment variable; or (5) a user-supplied dictionary (aka data file).  NOTE: since WordNet itself does not run with special privileges, this issue only crosses privilege boundaries when WordNet is invoked as a third party component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-04T17:00:00.000Z
CVE-2008-3909 
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-04T17:00:00.000Z
CVE-2008-3910 
dns2tcp before 0.4.1 does not properly handle negative values in a certain length field in the input argument to the (1) dns_simple_decode or (2) dns_decode function, which allows remote attackers to overwrite a buffer and have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-04T17:00:00.000Z
CVE-2008-3911 
The proc_do_xprt function in net/sunrpc/sysctl.c in the Linux kernel 2.6.26.3 does not check the length of a certain buffer obtained from userspace, which allows local users to overflow a stack-based buffer and have unspecified other impact via a crafted read system call for the /proc/sys/sunrpc/transports file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-04T17:00:00.000Z
CVE-2008-3912 
libclamav in ClamAV before 0.94 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to an out-of-memory condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-09T14:00:00.000Z