rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-6683 
Cross-site scripting (XSS) vulnerability in listtest.php in Apartment Search Script allows remote attackers to inject arbitrary web script or HTML via the r parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6684 
Unrestricted file upload vulnerability in editimage.php in Apartment Search Script allows remote attackers to execute arbitrary code by uploading a file with an executable extension and a GIF header, then accessing this file via a direct request to a renamed file in Member_Admin/logo/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6685 
Unspecified vulnerability in Frontend Filemanager (air_filemanager) 0.6.1 and earlier extension for TYPO3 allows remote attackers to execute arbitrary commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6686 
SQL injection vulnerability in CoolURI (cooluri) 1.0.11 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6687 
Cross-site scripting (XSS) vulnerability in DCD GoogleMap (dcdgooglemap) 1.1.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6688 
Cross-site scripting (XSS) vulnerability in JobControl (dmmjobcontrol) 1.15.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6689 
SQL injection vulnerability in JobControl (dmmjobcontrol) 1.15.0 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6690 
Unspecified vulnerability in nepa-design.de Spam Protection (nd_antispam) extension 1.0.3 for TYPO3 allows remote attackers to modify configuration via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6691 
SQL injection vulnerability in Diocese of Portsmouth Calendar Today (pd_calendar_today) extension 0.0.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6692 
SQL injection vulnerability in Diocese of Portsmouth Training Courses (pd_trainingcourses) extension 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6693 
SQL injection vulnerability in Download system (sb_downloader) extension 0.1.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6694 
SQL injection vulnerability in Random Prayer (ste_prayer) 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6695 
SQL injection vulnerability in TIMTAB social bookmark icons (timtab_sociable) 2.0.4 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6696 
SQL injection vulnerability in Fussballtippspiel (toto) 0.1.1 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6697 
SQL injection vulnerability in TARGET-E WorldCup Bets (worldcup) 2.0.0 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6698 
Cross-site scripting (XSS) vulnerability in TARGET-E WorldCup Bets (worldcup) 2.0.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6699 
Cross-site scripting (XSS) vulnerability in Resource Library (tjs_reslib) 0.1.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6700 
Multiple cross-site scripting (XSS) vulnerabilities in Butterfly Organizer 2.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) mytable parameter to view.php, (2) mytable parameter to viewdb2.php, (3) tablehere parameter to category-rename.php, and (4) letter parameter to module-contacts.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6701 
NetScout (formerly Network General) Visualizer V2100 and InfiniStream i1730 do not restrict access to ResourceManager/en_US/domains/add_domain.jsp, which allows remote attackers to gain administrator privileges via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6702 
S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to cause a denial of service (crash) via a long nickname, which triggers an exception.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6703 
Stack-based buffer overflow in the IPureServer::_Recieve function in S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to execute arbitrary code via a compressed 0x39 packet, which is decompressed by the NET_Compressor::Decompress function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6704 
Integer overflow in the NET_Compressor::Decompress function in S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to cause a denial of service (server crash) via a crafted packet with a 0xc1 value that contains no compressed data, which triggers a copy of a large amount of memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6705 
The MultipacketReciever::RecievePacket function in S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to cause a denial of service (server termination) via a crafted packet without an expected 0xe0 or 0xe1 value, which triggers the INT3 instruction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6706 
Multiple unspecified vulnerabilities in the Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, allow remote attackers to obtain (1) application server configuration, (2) database server configuration including encrypted passwords, (3) a system utility that decrypts "subscriber table passwords," (4) a system utility that decrypts database passwords, and (5) a system utility that encrypts "subscriber table passwords."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6707 
The Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, does not perform authentication for certain functionality, which allows remote attackers to obtain sensitive information and access restricted functionality via (1) the certificate installation utility, (2) unspecified scripts in the objects folder, (3) an "unnecessary default application," (4) unspecified scripts in the states folder, (5) an unspecified "default application" that lists server configuration, and (6) "full system help."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6708 
Unspecified vulnerability in the Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x and 4.x, allows remote authenticated administrators to gain root privileges via unknown vectors related to configuration of "data viewing or restoring parameters."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6709 
Unspecified vulnerability in the Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, allows remote authenticated users to execute arbitrary commands via unknown vectors related to configuration of "local data viewing or restoring parameters."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6710 
Unspecified vulnerability in the Web administration interface in Avaya Communication Manager 3.1.x before CM 3.1.4 SP2 and 4.0.x before 4.0.3 SP1 allows remote authenticated administrators to gain root privileges via unknown vectors related to "configuring data viewing or restoring credentials."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6711 
Unspecified vulnerability in the Web administration interface in Avaya Communication Manager 3.1.x before CM 3.1.4 SP2 and 4.0.x before 4.0.3 SP1 allows remote authenticated users to execute arbitrary commands via unknown vectors related to "viewing system logs."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6712 
The HTTP/XML-RPC service in Crysis 1.21 (game version 1.1.1.6156) and earlier allows remote attackers to cause a denial of service (crash) via a long HTTP request, which triggers a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6713 
World in Conflict (WIC) 1.008 and earlier allows remote attackers to cause a denial of service (access violation and crash) via a zero-byte data block to TCP port 48000, which triggers a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6714 
admin.php in xeCMS 1.0.0 RC2 and earlier allows remote attackers to bypass authentication and access the admin panel by setting the xecms_username cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-10T15:00:00.000Z
CVE-2008-6715 
Multiple cross-site scripting (XSS) vulnerabilities in Pre ADS Portal 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the msg parameter to (1) homeadmin/adminhome.php and (2) homeadmin/signinform.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-13T15:00:00.000Z
CVE-2008-6716 
homeadmin/adminhome.php in Pre ADS Portal 2.0 and earlier does not require administrative authentication, which allows remote attackers to have an unspecified impact via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-13T15:00:00.000Z
CVE-2008-6717 
U&M Software Signup 1.0 and 1.1 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to (1) adminstart.php, (2) admineventtype.php, (3) admineventdetails.php, (4) admineventlist.php, (5) adminuserslist.php, (6) adminleaderslist.php, (7) admindatabase.php, and possibly (8) index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-13T15:00:00.000Z
CVE-2008-6718 
U&M Software JustBookIt 1.0 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to (1) user_manual.php, (2) user_config.php, (3) user_kundnamn.php, (4) user_kundlista.php, (5) user_aktiva_kunder.php, (6) database.php, and possibly (7) index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-13T15:00:00.000Z
CVE-2008-6719 
U&M Software Event Lister (aka JustListIt) 1.0 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to (1) start.php, (2) aktivitet.php, (3) prop_aktivitet.php, (4) kategorier.php, (5) konfig.php, (6) security.php, (7) manual.php, and possibly (8) index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-13T15:00:00.000Z
CVE-2008-6720 
SQL injection vulnerability in admin/adm_login.php in DeltaScripts PHP Links 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the admin_username parameter (aka the admin field).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-13T15:00:00.000Z
CVE-2008-6721 
SQL injection vulnerability in index.php in AJ Square AJ Article allows remote attackers to execute arbitrary SQL commands via the txtName parameter (aka the username field).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-14T16:00:00.000Z
CVE-2008-6722 
Novell Access Manager 3 SP4 does not properly expire X.509 certificate sessions, which allows physically proximate attackers to obtain a logged-in session by using a victim's web-browser process that continues to send the original and valid SSL sessionID, related to inability of Apache Tomcat to clear entries from its SSL cache.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-14T16:00:00.000Z
CVE-2008-6723 
TurnkeyForms Entertainment Portal 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the adminLogged cookie to Administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-14T16:00:00.000Z
CVE-2008-6724 
Cross-site scripting (XSS) vulnerability in index.pl in Perl Nopaste 1.0 allows remote attackers to inject arbitrary web script or HTML via the language parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-17T10:00:00.000Z
CVE-2008-6725 
Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) index.php in a mythings page (mythings.php) and (2) the users page in admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-17T10:00:00.000Z
CVE-2008-6726 
Multiple directory traversal vulnerabilities in CMScout 2.06, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the bit parameter to (1) admin.php and (2) index.php, different vectors than CVE-2008-3415.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-17T10:00:00.000Z
CVE-2008-6727 
Cross-site scripting (XSS) vulnerability in Ultimate PHP Board (UPB) 2.2.2, 2.2.1, and earlier 2.x versions allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-20T14:06:00.000Z
CVE-2008-6728 
SQL injection vulnerability in the Sections module in PHP-Nuke, probably before 8.0, allows remote attackers to execute arbitrary SQL commands via the artid parameter in a printpage action to modules.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-20T14:06:00.000Z
CVE-2008-6729 
Multiple cross-site request forgery (CSRF) vulnerabilities in password.php in PHPmotion 2.1 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that modify an account via the (1) password or (2) email_address parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-20T14:06:00.000Z
CVE-2008-6730 
Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPLink Pro 0.0.6 and 0.0.7, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the checkuser parameter (aka username field), or (2) the checkpass parameter (aka password field), to admin/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-20T14:06:00.000Z
CVE-2008-6731 
Unrestricted file upload vulnerability in submitlink.php in FlexPHPLink Pro 0.0.7 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the renamed file in linkphoto/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-20T14:06:00.000Z
CVE-2008-6732 
Cross-site scripting (XSS) vulnerability in the Language skin object in DotNetNuke before 4.8.4 allows remote attackers to inject arbitrary web script or HTML via "newly generated paths."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-21T18:07:00.000Z
CVE-2008-6733 
Cross-site scripting (XSS) vulnerability in the error handling page in DotNetNuke 4.6.2 through 4.8.3 allows remote attackers to inject arbitrary web script or HTML via the querystring parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-21T18:07:00.000Z
CVE-2008-6734 
Directory traversal vulnerability in Public/index.php in Keller Web Admin CMS 0.94 Pro allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-21T18:07:00.000Z
CVE-2008-6735 
Directory traversal vulnerability in qc/index.php in ThaiQuickCart 3 allows remote attackers to read arbitrary files via a .. (dot dot) in the sLanguage cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-21T18:07:00.000Z
CVE-2008-6736 
Flat Calendar 1.1 does not properly restrict access to administrative functions, which allows remote attackers to (1) add new events via calAdd.php, as reachable from admin/add.php, or (2) delete events via admin/deleteEvent.php.  NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's security documentation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-21T18:07:00.000Z
CVE-2008-6737 
Crysis 1.21 and earlier allows remote attackers to obtain sensitive player information such as real IP addresses by sending a keyexchange packet without a previous join packet, which causes Crysis to send a disconnect packet that includes unrelated log information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-21T18:07:00.000Z
CVE-2008-6738 
MyShoutPro 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin_access cookie to 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-21T18:07:00.000Z
CVE-2008-6739 
Todd Woolums ASP Download management script 1.03 does not require authentication for setupdownload.asp, which allows remote attackers to gain administrator privileges via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-21T18:07:00.000Z
CVE-2008-6740 
PHP remote file inclusion vulnerability in html/admin/modules/plugin_admin.php in HoMaP-CMS 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the _settings[pluginpath] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-21T18:07:00.000Z
CVE-2008-6741 
SQL injection vulnerability in Load.php in Simple Machines Forum (SMF) 1.1.4 and earlier allows remote attackers to execute arbitrary SQL commands by setting the db_character_set parameter to a multibyte character set such as big5, which causes the addslashes PHP function to produce a "\" (backslash) sequence that does not quote the "'" (single quote) character, as demonstrated via a manlabels action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-21T18:07:00.000Z
CVE-2008-6742 
Foxy P2P software allows remote attackers to cause a denial of service (memory consumption) via a foxy URI with a download action and a large fs value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-21T18:07:00.000Z
CVE-2008-6743 
RSMScript 1.21 allows remote attackers to bypass authentication and gain administrative privileges by setting the verified cookie to an arbitrary value and performing a direct request to (1) delete.php, (2) edit-submit.php, (3) edit.php, (4) submit.php, and (5) update.php, which bypasses the security check that is performed by verify.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-22T21:00:00.000Z
CVE-2008-6744 
Cross-site request forgery (CSRF) vulnerability in Cybozu Office 6, Cybozu Dezie before 6.0(1.0), and Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-23T17:00:00.000Z
CVE-2008-6745 
index.php in BlogPHP 2.0 allows remote attackers to gain administrator privileges via a crafted email parameter in a register2 action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-23T17:00:00.000Z
CVE-2008-6746 
Cross-site scripting (XSS) vulnerability in the contact display view in Turba Contact Manager H3 before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the contact name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-23T17:00:00.000Z
CVE-2008-6747 
dotProject before 2.1.2 does not properly restrict access to administrative pages, which allows remote attackers to gain privileges.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-23T17:00:00.000Z
CVE-2008-6748 
Eval injection vulnerability in Megacubo 5.0.7 allows remote attackers to inject and execute arbitrary PHP code via the play action in a mega:// URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-24T14:00:00.000Z