rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-1782 
Unspecified vulnerability in Solaris 8 and 9 allows local users to obtain the LDAP Directory Server root Distinguished Name (rootDN) password when a privileged user (1) runs idsconfig; or "insecurely" runs LDAP2 commands with the -w option, including (2) ldapadd, (3) ldapdelete, (4) ldapmodify, (5) ldapmodrdn, and (6) ldapsearch.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1783 
Cross-site scripting (XSS) vulnerability in PatroNet CMS allows remote attackers to inject arbitrary web script or HTML via the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T10:00:00.000Z
CVE-2006-1784 
PHP remote file inclusion vulnerability in admin/configset.php in Sphider 1.3 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the settings_dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T22:00:00.000Z
CVE-2006-1785 
Adobe Document Server for Reader Extensions 6.0 allows remote authenticated users to inject arbitrary web script via a leading (1) ftp or (2) http URI in the ReaderURL variable in the "Update Download Site" section of ads-readerext.  NOTE: it is not clear whether the vendor advisory addresses this issue.  In addition, since the issue requires administrative privileges to exploit, it is not clear whether this crosses security boundaries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T22:00:00.000Z
CVE-2006-1786 
Cross-site scripting (XSS) vulnerability in Adobe Document Server for Reader Extensions 6.0 allows remote attackers to inject arbitrary web script or HTML via (1) the actionID parameter in ads-readerext and (2) the op parameter in AlterCast. NOTE: it is not clear whether the vendor advisory addresses this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T22:00:00.000Z
CVE-2006-1787 
Adobe Document Server for Reader Extensions 6.0 includes a user's session (jsession) ID in the HTTP Referer header, which allows remote attackers to gain access to PDF files that are being processed within that session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T22:00:00.000Z
CVE-2006-1788 
Adobe Document Server for Reader Extensions 6.0, during log on, provides different error messages depending on whether the user ID is valid or invalid, which allows remote attackers to more easily identify valid user IDs via brute force attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T22:00:00.000Z
CVE-2006-1789 
Directory traversal vulnerability in pajax_call_dispatcher.php in PAJAX 0.5.1 and earlier allows remote attackers to read arbitrary files via the $className variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T22:00:00.000Z
CVE-2006-1790 
A regression fix in Mozilla Firefox 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the InstallTrigger.install method, which leads to memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T19:00:00.000Z
CVE-2006-1791 
Directory traversal vulnerability in acc.php in QuickBlogger 1.4 allows remote attackers to read or include arbitrary local files via the request parameter.  NOTE: this issue can also produce resultant XSS when the associated include statement fails.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-14T23:00:00.000Z
CVE-2006-1792 
Unspecified vulnerability in the POP service in MailEnable Standard Edition before 1.94, Professional Edition before 1.74, and Enterprise Edition before 1.22 has unknown attack vectors and impact related to "authentication exploits".  NOTE: this is a different set of affected versions, and probably a different vulnerability than CVE-2006-1337.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-15T10:00:00.000Z
CVE-2006-1793 
Directory traversal vulnerability in runCMS 1.2 and earlier allows remote attackers to read arbitrary files via the bbPath[path] parameter to (1) class.forumposts.php and (2) forumpollrenderer.php. NOTE: this issue is closely related to CVE-2006-0659.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-17T10:00:00.000Z
CVE-2006-1794 
SQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via (1) the $username variable in the mosGetParam function and (2) the $task parameter in the mosMenuCheck function in (a) includes/mambo.php; and (3) the $filter variable to the showCategory function in the com_content component (content.php).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-17T10:00:00.000Z
CVE-2006-1795 
Cross-site scripting (XSS) vulnerability in tablepublisher.cgi in UPDI Network Enterprise @1 Table Publisher 2006-03-23 allows remote attackers to inject arbitrary web script or HTML via the Title of Table field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-17T10:00:00.000Z
CVE-2006-1796 
Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions before 2.0.1, allows remote attackers to inject arbitrary web script or HTML to Internet Explorer users via the request URI ($_SERVER['REQUEST_URI']).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-17T20:00:00.000Z
CVE-2006-1797 
The kernel in NetBSD-current before September 28, 2005 allows local users to cause a denial of service (system crash) by using the SIOCGIFALIAS ioctl to gather information on a non-existent alias of a network interface, which causes a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1798 
SQL injection vulnerability in rateit.php in RateIt 2.2 allows remote attackers to execute arbitrary SQL commands via the rateit_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1799 
censtore.cgi in Censtore 7.3.002 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1800 
Directory traversal vulnerability in posts.php in SimpleBBS 1.0.6 through 1.1 allows remote attackers to include and execute arbitrary files via ".." sequences in the language cookie, as demonstrated by by injecting the code into the gl_session cookie of users.php, which is stored in error.log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1801 
Cross-site scripting (XSS) vulnerability in planetsearchplus.php in planetSearch+ allows remote attackers to inject arbitrary web script or HTML via the search_exp parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1802 
Cross-site scripting (XSS) vulnerability in index.php in TinyWebGallery 1.3 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the twg_album parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1803 
Cross-site scripting (XSS) vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to inject arbitrary web script or HTML via the sql_query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1804 
SQL injection vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to execute arbitrary SQL commands via the sql_query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1805 
SQL injection vulnerability in member.php in PowerClan 1.14 allows remote attackers to execute arbitrary SQL commands via the memberid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1806 
Cross-site scripting (XSS) vulnerability in index.php in Musicbox 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the term parameter in a search action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1807 
Multiple SQL injection vulnerabilities in index.php in Musicbox 2.3.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) start parameter in a search action or (2) type parameter in a top action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1808 
Cross-site scripting (XSS) vulnerability in index.php in Lifetype 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the show parameter in a Template operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1809 
index.php in Lifetype 1.0.3 allows remote attackers to obtain sensitive information via an invalid show parameter, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1810 
Multiple cross-site scripting (XSS) vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to inject arbitrary web script or HTML via the (1) ICQ, (2) AIM, (3) MSN, (4) Google Talk, (5) Website Name, (6) Website Address, (7) Email Address, (8) Location, (9) Signature, and (10) Sub-Titles fields in the user profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1811 
Multiple SQL injection vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to execute arbitrary SQL commands via the (1) id, (2) forumid, or (3) threadid parameter to index.php; the (4) ICQ, (5) AIM, (6) MSN, (7) Google Talk, (8) Website Name, (9) Website Address, (10) Email Address, (11) Location, (12) Signature, and (13) Sub-Titles fields in the user profile; or (14) flexbb_password field in a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1812 
phpWebFTP 3.2 and earlier stores script.js under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1813 
Directory traversal vulnerability in index.php in phpWebFTP 3.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the language parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1814 
NetBSD 1.6, 2.0, 2.1 and 3.0 allows local users to cause a denial of service (memory exhaustion) by using the sysctl system call to lock a large buffer into physical memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1815 
Multiple cross-site scripting (XSS) vulnerabilities in register.php in Tritanium Bulletin Board (TBB) 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) newuser_realname and (2) newuser_icq parameters, a different vector than CVE-2006-1768.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1816 
PHP remote file inclusion vulnerability in VBulletin 3.5.1, 3.5.2, and 3.5.4 allows remote attackers to execute arbitrary code via a URL in the systempath parameter to (1) ImpExModule.php, (2) ImpExController.php, and (3) ImpExDisplay.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1817 
SQL injection vulnerability in authcheck.php in warforge.NEWS 1.0, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the (1) authusername and possibly the (2) authpassword cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1818 
Multiple cross-site scripting (XSS) vulnerabilities in warforge.NEWS 1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly including the (1) first_name and (2) last_name parameter in myaccounts.php.  NOTE: portions of these details were obtained from third party sources instead of the original disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1819 
Directory traversal vulnerability in the loadConfig function in index.php in phpWebSite 0.10.2 and earlier allows remote attackers to include arbitrary local files and execute arbitrary PHP code via the hub_dir parameter, as demonstrated by including access_log.  NOTE: in some cases, arbitrary remote file inclusion could be performed under PHP 5 using an SMB share argument such as "\\systemname\sharename".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1820 
Cross-site scripting (XSS) vulnerability in index.php in ModX 0.9.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: this might be resultant from the directory traversal vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1821 
Directory traversal vulnerability in index.php in ModX 0.9.1 allows remote attackers to read arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1822 
Cross-site scripting (XSS) vulnerability in search.php in FarsiNews 2.5.3 Pro and earlier allows remote attackers to inject arbitrary web script or HTML via the selected_search_arch parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1823 
Directory traversal vulnerability in FarsiNews 2.5.3 Pro and earlier allows remote attackers to obtain the installation path via ".." sequences in the archive parameter to index.php, which leaks the full pathname in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1824 
Multiple cross-site scripting (XSS) vulnerabilities in PhpGuestbook.php in PhpGuestbook 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) Website, and (3) Comment parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1825 
Cross-site scripting (XSS) vulnerability in index.php in phpLinks 2.1.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the term parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1826 
Multiple cross-site scripting (XSS) vulnerabilities in Snipe Gallery 3.1.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gallery_id parameter in view.php, (2) keyword parameter in search.php, and (3) image_id parameter in image.php.  NOTE: it is possible that vectors 1 and 3 are resultant from SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T10:00:00.000Z
CVE-2006-1827 
Integer signedness error in format_jpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a length check as a negative number, but triggers a buffer overflow when it is used as an unsigned length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-18T20:00:00.000Z
CVE-2006-1828 
SQL injection vulnerability in php121language.php in PHP121 1.4 allows remote attackers to execute arbitrary SQL commands and execute arbitrary code via the sess_username variable, as set by the php121un HTTP COOKIE parameter, which is used in multiple files including php121login.php.  NOTE: the code execution occurs because the SQL query results are used in an include statement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1829 
EAServer Manager in Sybase EAServer 5.2 and 5.3 allows remote authenticated users, possibly guests, to obtain password credentials of arbitrary users via unspecified vectors involving (1) connection caches, (2) open password prompts, and (3) stored custom connection profiles.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1830 
Sun Java Studio Enterprise 8, when installed as root, creates certain files with world-writable permissions, which allows local users to execute arbitrary commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1831 
Direct static code injection vulnerability in sysinfo.cgi in sysinfo 1.21 and possibly other versions before 2.25 allows remote attackers to execute arbitrary commands via a leading ; (semicolon) in the name parameter in a systemdoc action, which is injected into phpinfo.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1832 
sysinfo.cgi in sysinfo 1.21 allows remote attackers to obtain the installation path via the debugger action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1833 
Intel RNG Driver in NetBSD 1.6 through 3.0 may incorrectly detect the presence of the pchb interface, which will cause it to always generate the same random number, which allows remote attackers to more easily crack encryption keys generated from the interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1834 
Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a stylesheet attribute, which pass a length check.  NOTE: a sign extension problem makes the attack easier with shorter strings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1835 
Cross-site scripting (XSS) vulnerability in yearcal.php in Calendarix allows remote attackers to inject arbitrary web script or HTML via the ycyear parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1836 
Untrusted search path vulnerability in unspecified components in Symantec LiveUpdate for Macintosh 3.0.0 through 3.5.0 do not set the execution path, which allows local users to gain privileges via a Trojan horse program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1837 
SQL injection vulnerability in archiv2.php in Fuju News 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1838 
edit_kategorie.php in Fuju News 1.0 allows remote attackers to bypass authentication by setting the authorized cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1839 
PHP remote file inclusion vulnerability in language.php in PHP Album 0.3.2.3, when register_globals is enabled, allows remote attackers to execute arbitrary code via an FTP URL in the data_dir parameter, which satisfies the file_exists function call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1840 
Multiple format string vulnerabilities in Empire Server before 4.3.1 allow attackers to cause a denial of service (crash) via the (1) load, (2) spy and (3) bomb functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1841 
Cross-site scripting (XSS) vulnerability in search.php in boastMachine (bMachine) 2.7, and possibly other versions before 2.9b, allows remote attackers to inject arbitrary web script or HTML via the key parameter, as used by the search field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1842 
Cross-site scripting (XSS) vulnerability in global.php in ShoutBOOK 1.1 allows remote attackers to inject arbitrary web script or HTML via the (1) NAME and (2) COMMENTS parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1843 
Cross-site scripting (XSS) vulnerability in global.php in ShoutBOOK 1.1 allows remote attackers to inject arbitrary web script or HTML via the (1) LOCATION and (2) URL parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1844 
The Debian installer for the (1) shadow 4.0.14 and (2) base-config 2.53.10 packages includes sensitive information in world-readable log files, including preseeded passwords and pppoeconf passwords, which might allow local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1846 
Cross-site scripting (XSS) vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows remote attackers to inject arbitrary HTML and web script via the ublock parameter, which is saved in the user's personal menu.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. In addition, it is unclear whether this issue is a vulnerability, since it is related to the user's personal menu, which presumably is not modifiable by others.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1847 
SQL injection vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows remote attackers to execute arbitrary SQL commands via the user_id parameter in the Your_Home functionality.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z
CVE-2006-1848 
Multiple cross-site scripting (XSS) vulnerabilities in stats_view.php in LinPHA 1.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) date_from, (2) date_to, and (3) date parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-19T16:00:00.000Z