rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-5722 
Stack-based buffer overflow in a certain ActiveX control in GLChat.ocx 2.5.1.32 in GlobalLink 2.7.0.8, as used in Ourgame GLWorld and possibly other products, allows remote attackers to execute arbitrary code via a long first argument to the ConnectAndEnterRoom method, possibly involving the GLCHAT.GLChatCtrl.1 control, as originally exploited in the wild in October 2007.  NOTE: some of these details are obtained from third party information.  NOTE: this was originally reported as a heap-based issue by some sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T21:00:00.000Z
CVE-2007-5723 
Heap-based buffer overflow in the samp_send function in nuauth/sasl.c in NuFW before 2.2.7 allows remote attackers to cause a denial of service via unspecified input on which base64 encoding is performed. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T21:00:00.000Z
CVE-2007-5724 
Multiple cross-site scripting (XSS) vulnerabilities in Omnistar Live allow remote attackers to inject arbitrary web script or HTML via (1) the category_id parameter to users/kb.php, and possibly (3) the Email Box field in profile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T21:00:00.000Z
CVE-2007-5725 
Multiple cross-site scripting (XSS) vulnerabilities in Smart-Shop allow remote attackers to inject arbitrary web script or HTML via (1) the email parameter to index.php; or the command parameter to index.php in (2) the default action for the home page, (3) a currencies action, or (4) a basket action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T21:00:00.000Z
CVE-2007-5726 
Unspecified vulnerability in the Stream Control Transmission Protocol (sctp) functionality in Sun Solaris 10, when at least one SCTP socket is in the LISTEN state, allows remote attackers to cause a denial of service (panic) via unspecified vectors related to "INIT processing."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T21:00:00.000Z
CVE-2007-5727 
Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly other versions, allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary web script or HTML via XSS sequences without SCRIPT tags in the description parameter to (1) tcreate.php or (2) tupdate.php, as demonstrated using an onmouseover event in a b tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T21:00:00.000Z
CVE-2007-5728 
Cross-site scripting (XSS) vulnerability in phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, allows remote attackers to inject arbitrary web script or HTML via certain input available in PHP_SELF in (1) redirect.php, possibly related to (2) login.php, different vectors than CVE-2007-2865.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T21:00:00.000Z
CVE-2007-5729 
The NE2000 emulator in QEMU 0.8.2 allows local users to execute arbitrary code by writing Ethernet frames with a size larger than the MTU to the EN0_TCNT register, which triggers a heap-based buffer overflow in the slirp library, aka NE2000 "mtu" heap overflow.  NOTE: some sources have used CVE-2007-1321 to refer to this issue as part of "NE2000 network driver and the socket code," but this is the correct identifier for the mtu overflow vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T22:00:00.000Z
CVE-2007-5730 
Heap-based buffer overflow in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to execute arbitrary code via crafted data in the "net socket listen" option, aka QEMU "net socket" heap overflow.  NOTE: some sources have used CVE-2007-1321 to refer to this issue as part of "NE2000 network driver and the socket code," but this is the correct identifier for the individual net socket listen vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T22:00:00.000Z
CVE-2007-5731 
Absolute path traversal vulnerability in Apache Jakarta Slide 2.1 and earlier allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag, a related issue to CVE-2007-5461.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T23:00:00.000Z
CVE-2007-5732 
Directory traversal vulnerability in downloadfile.php in eLouai's Force Download of media files script, as available on 20071030 and earlier, allows remote attackers to read arbitrary files via the file parameter.  NOTE: this issue only occurs in environments where the system administrator has not followed the vendor recommendations that this product should only be used internally.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T23:00:00.000Z
CVE-2007-5733 
Unrestricted file upload vulnerability in upload/upload.php in Japanese PHP Gallery Hosting, when Open directory mode is enabled, allows remote attackers to upload and execute arbitrary PHP code via a ServerPath parameter specifying a filename with a double extension. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T23:00:00.000Z
CVE-2007-5734 
Unrestricted file upload vulnerability in eFileMan 7.1.0.87-88 allows remote attackers to upload arbitrary files, with "uploads/upload_file." destination filenames, via unspecified vectors to upload.cgi, accessed from upload.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T23:00:00.000Z
CVE-2007-5735 
eFileMan 7.1.0.87-88 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain unspecified user information via a direct request for cgi-bin/efileman/efileman_config.pm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T23:00:00.000Z
CVE-2007-5736 
Unrestricted file upload vulnerability in upload.php in SeeBlick 1.0 Beta allows remote attackers to upload arbitrary files via unspecified vectors.  NOTE: these files are stored with .html extensions, so the scope of the attack might be limited to resource consumption and possibly XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T23:00:00.000Z
CVE-2007-5737 
Unrestricted file upload vulnerability in component/upload.jsp in Korean GHBoard allows remote attackers to upload arbitrary files via unspecified vectors, probably involving a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T23:00:00.000Z
CVE-2007-5738 
The FlashUpload component in Korean GHBoard uses a client-side protection mechanism to prevent uploading of dangerous file extensions, which allows remote attackers to bypass restrictions and upload arbitrary files via a modified copy of component/flashupload/upload.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T23:00:00.000Z
CVE-2007-5739 
Directory traversal vulnerability in component/flashupload/download.jsp in the FlashUpload component in Korean GHBoard allows remote attackers to read arbitrary files via a .. (dot dot) in the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T23:00:00.000Z
CVE-2007-5740 
The format string protection mechanism in IMAPD for Perdition Mail Retrieval Proxy 1.17 and earlier allows remote attackers to execute arbitrary code via an IMAP tag with a null byte followed by a format string specifier, which is not counted by the mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-31T16:00:00.000Z
CVE-2007-5741 
Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-07T21:00:00.000Z
CVE-2007-5742 
Directory traversal vulnerability in the WML engine preprocessor for Wesnoth 1.2.x before 1.2.8, and 1.3.x before 1.3.12, allows remote attackers to read arbitrary files via ".." sequences in unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-01T02:00:00.000Z
CVE-2007-5743 
viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-07T21:55:32.000Z
CVE-2007-5745 
Multiple heap-based buffer overflows in OpenOffice.org before 2.4 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Quattro Pro (QPRO) file with crafted (1) Attribute and (2) Font Description records.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-17T17:00:00.000Z
CVE-2007-5746 
Integer overflow in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an EMF file with a crafted EMR_STRETCHBLT record, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-17T17:00:00.000Z
CVE-2007-5747 
Integer underflow in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Quattro Pro (QPRO) file with crafted values that trigger an excessive loop and a stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-17T17:00:00.000Z
CVE-2007-5751 
Liferea before 1.4.6 uses weak permissions (0644) for the feedlist.opml backup file, which allows local users to obtain credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-31T17:00:00.000Z
CVE-2007-5752 
adduser.php in PHP-AGTC Membership (AGTC-Membership) System 1.1a does not require authentication, which allows remote attackers to create accounts via a modified form, as demonstrated by an account with admin (userlevel 4) privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-31T17:00:00.000Z
CVE-2007-5753 
Unspecified vulnerability in Light FMan PHP (lfman or lightfman) before 2.0rc1 has unknown impact and attack vectors related to "actions."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-31T17:00:00.000Z
CVE-2007-5754 
PHP remote file inclusion vulnerability in urlinn_includes/config.php in phpFaber URLInn 2.0.5 allows remote attackers to execute arbitrary PHP code via a URL in the dir_ws parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-31T17:00:00.000Z
CVE-2007-5755 
Multiple stack-based buffer overflows in the AOL AmpX ActiveX control in AmpX.dll 2.6.1.11 in AOL Radio allow remote attackers to execute arbitrary code via long arguments to unspecified methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-14T01:00:00.000Z
CVE-2007-5756 
Multiple array index errors in the bpf_filter_init function in NPF.SYS in WinPcap before 4.0.2, when run in monitor mode (aka Table Management Extensions or TME), and as used in Wireshark and possibly other products, allow local users to gain privileges via crafted IOCTL requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-14T01:00:00.000Z
CVE-2007-5757 
Untrusted search path vulnerability in db2pd in IBM DB2 Universal Database (UDB) 8 before FixPak 16 and 9 before Fix Pack 4 allows local users to gain root privileges via a modified DB2INSTANCE environment variable that points to a malicious library.  NOTE: this might be the same issue as CVE-2008-0697.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-12T23:00:00.000Z
CVE-2007-5758 
Stack-based buffer overflow in db2dasrrm in the DB2 Administration Server (DAS) in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to execute arbitrary code via a long DASPROF environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-16T18:00:00.000Z
CVE-2007-5760 
Array index error in the XFree86-Misc extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to execute arbitrary code via a PassMessage request containing a large array index.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-18T22:00:00.000Z
CVE-2007-5761 
The NantSys device 5.0.0.115 in Motorola netOctopus 5.1.2 build 1011 has weak permissions for the \\.\NantSys device interface (nantsys.sys), which allows local users to gain privileges or cause a denial of service (system crash), as demonstrated by modifying the SYSENTER_EIP_MSR CPU Model Specific Register (MSR) value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T00:00:00.000Z
CVE-2007-5762 
NICM.SYS driver 3.0.0.4, as used in Novell NetWare Client 4.91 SP4, allows local users to execute arbitrary code by opening the \\.\nicm device and providing crafted kernel addresses via IOCTLs with the METHOD_NEITHER buffering mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T22:00:00.000Z
CVE-2007-5764 
Buffer overflow in the pioout program in printers.rte in IBM AIX 5.2, 5.3, and 6.1 allows local users to gain privileges via a long command line option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-25T00:00:00.000Z
CVE-2007-5766 
SQL injection vulnerability in okxLOV.jsp in Oracle E-Business Suite 11 and 12 allows remote attackers to execute arbitrary SQL commands via unknown vectors.  NOTE: this is probably the same issue as CVE-2007-5527 or CVE-2007-5528, but there are insufficient details to be sure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-08T20:00:00.000Z
CVE-2007-5767 
Heap-based buffer overflow in the Client Trust application (clntrust.exe) in Novell BorderManager 3.8 before Update 1.5 allows remote attackers to execute arbitrary code via a validation request in which the Novell tree name is not properly delimited with a wide-character backslash or NULL character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-02T23:00:00.000Z
CVE-2007-5768 
The Globe7 soft phone client 7.3 sends username and password information in cleartext, which allows remote attackers to obtain sensitive information by sniffing the HTTP traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-31T22:00:00.000Z
CVE-2007-5769 
Double free vulnerability in the getreply function in ftp.c in netkit ftp (netkit-ftp) 0.17 20040614 and later allows remote FTP servers to cause a denial of service (application crash) and possibly have unspecified other impact via some types of FTP protocol behavior. NOTE: the netkit-ftpd issue is covered by CVE-2007-6263.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-06T15:00:00.000Z
CVE-2007-5770 
The (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, and (5) Net::smtp libraries in Ruby 1.8.5 and 1.8.6 do not verify that the commonName (CN) field in a server certificate matches the domain name in a request sent over SSL, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site, different components than CVE-2007-5162.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-14T01:00:00.000Z
CVE-2007-5771 
Flatnuke 3 (aka FlatnuX) allows remote attackers to obtain administrative access via a myforum%00 cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5772 
Direct static code injection vulnerability in the download module in Flatnuke 3 allows remote authenticated administrators to inject arbitrary PHP code into a description.it.php file in a subdirectory of Download/ by saving a description and setting fneditmode to 1.  NOTE: unauthenticated remote attackers can exploit this by leveraging a cookie manipulation issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5773 
Cross-site request forgery (CSRF) vulnerability in index.php in the File Manager module in Flatnuke 3 allows remote attackers to perform certain actions as administrators via requests containing the pathname in the dir parameter and the filename in the ffile parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5774 
index.php in the File Manager module in Flatnuke 3 allows remote attackers to obtain sensitive information via an invalid argumentname parameter in a disc op action, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5775 
Unspecified vulnerability in BitDefender allows attackers to execute arbitrary code via unspecified vectors, aka EEYEB-20071024.  NOTE: as of 20071029, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5776 
Directory traversal vulnerability in igallery.asp in Blue-Collar Productions i-Gallery 3.4 allows remote attackers to read arbitrary files via encoded backslash sequences in the d parameter, as demonstrated by a "%5c../../%5c" sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5777 
Blue-Collar Productions i-Gallery 3.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing a base64-encoded password via a direct request for igallery.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5778 
Mobile Spy (1) stores login credentials in cleartext under the RetinaxStudios registry key, and (2) sends login credentials and log data over a cleartext HTTP connection, which allows attackers to obtain sensitive information by reading the registry or sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5779 
Buffer overflow in the GomManager (GomWeb Control) ActiveX control in GomWeb3.dll 1.0.0.12 in Gretech Online Movie Player (GOM Player) 2.1.6.3499 allows remote attackers to execute arbitrary code via a long argument to the OpenUrl method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5780 
PHP remote file inclusion vulnerability in pub/pub08_comments.php in teatro 1.6 allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5781 
PHP remote file inclusion vulnerability in inc/sige_init.php in Sige 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the SYS_PATH parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5782 
Directory traversal vulnerability in dl.php in FireConfig 0.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5783 
SQL injection vulnerability in emc.asp in emagiC CMS.Net 4.0 allows remote attackers to execute arbitrary SQL commands via the pageId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5784 
PHP remote file inclusion vulnerability in index.php in CaupoShop Pro 2.x allows remote attackers to execute arbitrary PHP code via a URL in the action parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5785 
SQL injection vulnerability in file.php in JobSite Professional 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5786 
Multiple PHP remote file inclusion vulnerabilities in GoSamba 1.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to (1) HTML_oben.php, (2) inc_freigabe.php, (3) inc_freigabe1.php, or (4) inc_freigabe3.php in include/; (5) inc_group.php; (6) inc_manager.php; (7) inc_newgroup.php; (8) inc_smb_conf.php; (9) inc_user.php; or (10) main.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5787 
Micro Login System 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing a password via a direct request for userpwd.txt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5788 
Buffer overflow in the SIP parser on the Grandstream HT-488 0.1 allows remote attackers to cause a denial of service (device crash) via a crafted SIP INVITE message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5789 
The Grandstream HT-488 0.1 allows remote attackers to cause a denial of service (device crash) via a flood of fragmented packets to port 5060.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5790 
The Globe7 soft phone client 7.3 uses weak cryptography (reversed sequence of binary values) for the password, which might allow local users to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5791 
The Vonage Motorola Phone Adapter VT 2142-VD does not properly verify that a SIP INVITE message originated from a legitimate server, which allows remote attackers to send spoofed INVITE messages, as demonstrated by a flood of messages triggering a denial of service, and by phone calls with malicious content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z
CVE-2007-5792 
The Vonage Motorola Phone Adapter VT 2142-VD does not encrypt RTP packets, which might allow remote attackers to eavesdrop by sniffing the network and reconstructing the RTP session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-01T16:04:00.000Z