rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-4746 
Multiple SQL injection vulnerabilities in Uniwin eCart Professional 2.0.17 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to (1) search.asp and (2) cartUtil.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-27T17:00:00.000Z
CVE-2008-4747 
Unspecified vulnerability in the search feature in Sun Java System LDAP JDK before 4.20 allows context-dependent attackers to obtain sensitive information via unknown attack vectors related to the LDAP JDK library.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-27T19:00:00.000Z
CVE-2008-4748 
Format string vulnerability in the URI handler in KVirc 3.4.0, when set as the default application for processing IRC URIs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in the irc:// URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-27T19:00:00.000Z
CVE-2008-4749 
Multiple insecure method vulnerabilities in the VImpX.VImpAX ActiveX control (VImpX.ocx) 4.8.8.0 in DB Software Laboratory VImp X, possibly 4.7.7, allow remote attackers to overwrite arbitrary files via (1) the LogFile property and ClearLogFile method, and (2) the SaveToFile method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-27T19:00:00.000Z
CVE-2008-4750 
Stack-based buffer overflow in the VImpX.VImpAX ActiveX control (VImpX.ocx) 4.8.8.0 in DB Software Laboratory VImp X, possibly 4.7.7, allows remote attackers to execute arbitrary code via a long LogFile property.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-27T19:00:00.000Z
CVE-2008-4751 
Cross-site scripting (XSS) vulnerability in index.php in iPei Guestbook 2.0 allows remote attackers to inject arbitrary web script or HTML via the pg parameter, a different vector than CVE-2005-4597.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-27T19:00:00.000Z
CVE-2008-4752 
TlNews 2.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlNews_login cookie to admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-27T19:00:00.000Z
CVE-2008-4753 
SQL injection vulnerability in EditUrl.php in AJ Square RSS Reader allows remote attackers to execute arbitrary SQL commands via the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-27T19:00:00.000Z
CVE-2008-4754 
SQL injection vulnerability in forum.php in Scripts for Sites (SFS) Ez Forum allows remote attackers to execute arbitrary SQL commands via the forum parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-27T19:00:00.000Z
CVE-2008-4755 
SQL injection vulnerability in gotourl.php in PozScripts Classified Auctions Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T00:00:00.000Z
CVE-2008-4756 
Cross-site scripting (XSS) vulnerability in add_prest_date.php in PHP-Daily allows remote attackers to inject arbitrary web script or HTML via the date parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T00:00:00.000Z
CVE-2008-4757 
Multiple SQL injection vulnerabilities in PHP-Daily allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) add_postit.php (b) delete.php, and (c) mod_prest_date.php; and the (2) prev parameter to (d) prest_detail.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T00:00:00.000Z
CVE-2008-4758 
Directory traversal vulnerability in download_file.php in PHP-Daily allows remote attackers to read arbitrary local files via a .. (dot dot) in the fichier parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T00:00:00.000Z
CVE-2008-4759 
Directory traversal vulnerability in download.php in BuzzyWall 1.3.1 allows remote attackers to read arbitrary local files via a .. (dot dot) in the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T00:00:00.000Z
CVE-2008-4760 
SQL injection vulnerability in lecture.php in Graphiks MyForum 1.3, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T00:00:00.000Z
CVE-2008-4761 
Cross-site scripting (XSS) vulnerability in includes/htmlArea/plugins/HtmlTidy/html-tidy-logic.php in Kayako eSupport 3.20.2 allows remote attackers to inject arbitrary web script or HTML via the jsMakeSrc parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: this issue is probably in the HTMLArea HTMLTidy (HTML Tidy) plugin, not eSupport.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T00:00:00.000Z
CVE-2008-4762 
Stack-based buffer overflow in freeSSHd 1.2.1 allows remote authenticated users to cause a denial of service (service crash) and potentially execute arbitrary code via a long argument to the (1) rename and (2) realpath parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T00:00:00.000Z
CVE-2008-4763 
Multiple cross-site scripting (XSS) vulnerabilities in sample.php in WiKID wClient-PHP 3.0-2 and earlier allow remote attackers to inject arbitrary web script or HTML via the PHP_SELF variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T01:00:00.000Z
CVE-2008-4764 
Directory traversal vulnerability in the eXtplorer module (com_extplorer) 2.0.0 RC2 and earlier in Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the dir parameter in a show_error action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T01:00:00.000Z
CVE-2008-4765 
SQL injection vulnerability in pollBooth.php in osCommerce Poll Booth Add-On 2.0 allows remote attackers to execute arbitrary SQL commands via the pollID parameter in a results operation.  NOTE: this issue was disclosed by an unreliable researcher, so it might be incorrect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T01:00:00.000Z
CVE-2008-4766 
SQL injection vulnerability in member.php in Oxygen Bulletin Board 1.1.3 allows remote attackers to execute arbitrary SQL commands via the member parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T01:00:00.000Z
CVE-2008-4767 
Unrestricted file upload vulnerability in the DownloadsPlus module in PHP-Nuke allows remote attackers to execute arbitrary code by uploading a file with (1) .htm, (2) .html, or (3) .txt extensions, then accessing it via a direct request to the file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: it is unclear how allowing the upload of .html or .txt files supports arbitrary code execution; this might be legitimate functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T10:00:00.000Z
CVE-2008-4768 
SQL injection vulnerability in TLM CMS 3.1 allows remote attackers to execute arbitrary SQL commands via the nom parameter to a-b-membres.php.  NOTE: the goodies.php vector is already covered by CVE-2007-4808.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T10:00:00.000Z
CVE-2008-4769 
Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remote attackers to include and possibly execute arbitrary PHP files via the cat parameter in index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T10:00:00.000Z
CVE-2008-4770 
The CMsgReader::readRect function in the VNC Viewer component in RealVNC VNC Free Edition 4.0 through 4.1.2, Enterprise Edition E4.0 through E4.4.2, and Personal Edition P4.0 through P4.4.2 allows remote VNC servers to execute arbitrary code via crafted RFB protocol data, related to "encoding type."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-16T21:00:00.000Z
CVE-2008-4771 
Stack-based buffer overflow in VATDecoder.VatCtrl.1 ActiveX control in (1) 4xem VatCtrl Class (VATDecoder.dll 1.0.0.27 and 1.0.0.51), (2) D-Link MPEG4 SHM Audio Control (VAPGDecoder.dll 1.7.0.5), (3) Vivotek RTSP MPEG4 SP Control (RtspVapgDecoderNew.dll 2.0.0.39), and possibly other products, allows remote attackers to execute arbitrary code via a long Url property.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T18:00:00.000Z
CVE-2008-4772 
SQL injection vulnerability in main/main.php in QuestCMS allows remote attackers to execute arbitrary SQL commands via the obj parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T19:00:00.000Z
CVE-2008-4773 
Directory traversal vulnerability in main/main.php in QuestCMS allows remote attackers to read arbitrary local files via a .. (dot dot) in the theme parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T19:00:00.000Z
CVE-2008-4774 
Cross-site scripting (XSS) vulnerability in main/main.php in QuestCMS allows remote attackers to inject arbitrary web script or HTML via the cx parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T19:00:00.000Z
CVE-2008-4775 
Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the db parameter, a different vector than CVE-2006-6942 and CVE-2007-5977.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T19:00:00.000Z
CVE-2008-4776 
libgadu before 1.8.2 allows remote servers to cause a denial of service (crash) via a contact description with a large length, which triggers a buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-28T19:00:00.000Z
CVE-2008-4777 
SQL injection vulnerability in the Showroom Joomlearn LMS (com_lms) component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the cat parameter in a showTests task.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-29T14:00:00.000Z
CVE-2008-4778 
SQL injection vulnerability in the gallery module in Koobi CMS 4.3.0 allows remote attackers to execute arbitrary SQL commands via the galid parameter in a showimages action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-29T14:00:00.000Z
CVE-2008-4779 
Stack-based buffer overflow in TUGzip 3.5.0.0 allows remote attackers to denial of service (crash) or execute arbitrary code via a long filename in a .zip file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-29T14:00:00.000Z
CVE-2008-4780 
Directory traversal vulnerability in admin/centre.php in MyForum 1.3, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the padmin parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-29T14:00:00.000Z
CVE-2008-4781 
Directory traversal vulnerability in update.php in MyKtools 2.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the langage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-29T14:00:00.000Z
CVE-2008-4782 
SQL injection vulnerability in public/code/cp_polls_results.php in All In One Control Panel (AIOCP) 1.4 allows remote attackers to execute arbitrary SQL commands via the poll_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-29T14:00:00.000Z
CVE-2008-4783 
tlAds 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the tlAds_login cookie to "admin."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-29T14:00:00.000Z
CVE-2008-4784 
aflog 1.01 allows remote attackers to bypass authentication and gain administrative access by setting the aflog_auth_a cookie to "A" or "O" in (1) edit_delete.php, (2) edit_cat.php, (3) edit_lock.php, and (4) edit_form.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-29T14:00:00.000Z
CVE-2008-4785 
SQL injection vulnerability in newuser.php in the alternate_profiles plugin, possibly 0.2, for e107 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-29T14:00:00.000Z
CVE-2008-4786 
SQL injection vulnerability in easyshop.php in the EasyShop plugin for e107 allows remote attackers to execute arbitrary SQL commands via the category_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-29T14:00:00.000Z
CVE-2008-4787 
Visual truncation vulnerability in Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar via a URL with a hostname containing many &nbsp; (Non-Blocking Space character) sequences, which are rendered as whitespace, aka MSRC ticket MSRC7899, a related issue to CVE-2003-1025.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-29T15:00:00.000Z
CVE-2008-4788 
Microsoft Internet Explorer 6 omits high-bit URL-encoded characters when displaying the address bar, which allows remote attackers to spoof the address bar via a URL with a domain name that differs from an important domain name only in these characters, as demonstrated by using exam%A9ple.com to spoof example.com, aka MSRC ticket MSRC7900.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-29T15:00:00.000Z
CVE-2008-4789 
The validation functionality in the core upload module in Drupal 6.x before 6.5 allows remote authenticated users to bypass intended access restrictions and "attach files to content," related to a "logic error."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-29T15:00:00.000Z
CVE-2008-4790 
The core upload module in Drupal 5.x before 5.11 allows remote authenticated users to bypass intended access restrictions and read "files attached to content" via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-29T15:00:00.000Z
CVE-2008-4791 
The user module in Drupal 5.x before 5.11 and 6.x before 6.5 might allow remote authenticated users to bypass intended login access rules and successfully login via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-29T15:00:00.000Z
CVE-2008-4792 
The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-29T15:00:00.000Z
CVE-2008-4793 
The node module API in Drupal 5.x before 5.11 allows remote attackers to bypass node validation and have unspecified other impact via unknown vectors related to contributed modules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-29T15:00:00.000Z
CVE-2008-4794 
Opera before 9.62 allows remote attackers to execute arbitrary commands via the History Search results page, a different vulnerability than CVE-2008-4696.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-30T20:49:00.000Z
CVE-2008-4795 
The links panel in Opera before 9.62 processes Javascript within the context of the "outermost page" of a frame, which allows remote attackers to inject arbitrary web script or HTML via cross-site scripting (XSS) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-30T20:49:00.000Z
CVE-2008-4796 
The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-30T20:49:00.000Z
CVE-2008-4797 
Directory traversal vulnerability in Arihiro Kurata Kantan WEB Server 1.8 and earlier allows remote attackers to read arbitrary files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-30T20:49:00.000Z
CVE-2008-4798 
The loadModule function in lib/WebGUI/Asset.pm in WebGUI before 7.5.30 (stable) allows remote attackers to execute arbitrary code by uploading a Perl module and accessing it via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-30T20:49:00.000Z
CVE-2008-4799 
pamperspective in Netpbm before 10.35.48 does not properly calculate a window height, which allows context-dependent attackers to cause a denial of service (crash) via a crafted image file that triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-30T22:00:00.000Z
CVE-2008-4800 
The DebugDiag ActiveX control in CrashHangExt.dll, possibly 1.0, in Microsoft Debug Diagnostic Tool allows remote attackers to cause a denial of service (NULL pointer dereference and Internet Explorer 6.0 crash) via a large negative integer argument to the GetEntryPointForThread method.  NOTE: this issue might only be exploitable in limited environments or non-default browser settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-30T22:00:00.000Z
CVE-2008-4801 
Heap-based buffer overflow in the Data Protection for SQL CAD service (aka dsmcat.exe) in the Client Acceptor Daemon (CAD) and the scheduler in the Backup-Archive client 5.1.0.0 through 5.1.8.1, 5.2.0.0 through 5.2.5.2, 5.3.0.0 through 5.3.6.1, 5.4.0.0 through 5.4.2.2, and 5.5.0.0 through 5.5.0.91 in IBM Tivoli Storage Manager (TSM); and the Backup-Archive client in TSM Express; allows remote attackers to execute arbitrary code by sending a large amount of crafted data to a TCP port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-30T22:00:00.000Z
CVE-2008-4802 
Cross-site scripting (XSS) vulnerability in complete.php in Simple PHP Scripts blog 0.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-31T16:42:00.000Z
CVE-2008-4803 
Cross-site scripting (XSS) vulnerability in index.php in Simple PHP Scripts gallery 0.1, 0.3, and 0.4 allows remote attackers to inject arbitrary web script or HTML via the gallery parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-31T16:42:00.000Z
CVE-2008-4804 
SQL injection vulnerability in the Gallery module 1.3 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the aid parameter in a showalbum action to index.php.  NOTE: some of these details are obtained from third party information.  NOTE: this issue was disclosed by an unreliable researcher, so it might be incorrect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-31T16:42:00.000Z
CVE-2008-4805 
Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Connections 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the community title, (2) API input, and vectors related to the (3) Homepage, (4) Blogs, (5) Profiles, (6) Dogear, (7) Activities, and (8) Global Search components.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-31T17:18:00.000Z
CVE-2008-4806 
Multiple SQL injection vulnerabilities in IBM Lotus Connections 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via the sortField parameter to unspecified components.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-31T17:18:00.000Z
CVE-2008-4807 
IBM Lotus Connections 2.x before 2.0.1 stores the password for the administrative user in the trace.log file, which allows local users to obtain sensitive information by reading this file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-31T17:18:00.000Z
CVE-2008-4808 
IBM Lotus Connections 2.x before 2.0.1 allows attackers to discover passwords via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-31T17:18:00.000Z
CVE-2008-4809 
Multiple unspecified vulnerabilities in the Profiles search pages in IBM Lotus Connections 2.x before 2.0.1 have unknown impact and attack vectors related to "Active" content.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-31T17:18:00.000Z
CVE-2008-4810 
The _expand_quoted_text function in libs/Smarty_Compiler.class.php in Smarty 2.6.20 before r2797 allows remote attackers to execute arbitrary PHP code via vectors related to templates and (1) a dollar-sign character, aka "php executed in templates;" and (2) a double quoted literal string, aka a "function injection security hole." NOTE: each vector affects slightly different SVN revisions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-31T17:18:00.000Z