rainbutterfly/cve_corpus huggingface dataset:
CVE-2005-4630 
SQL injection vulnerability in index.php in ClientExec 2.3 allows remote attackers to execute arbitrary SQL commands via the (1) billshowid, (2) billdetailid, (3) fuse, and (4) frmClientID parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-07T01:00:00.000Z
CVE-2005-4631 
SQL injection vulnerability in index.php in Zina 0.12.07 and earlier allows remote attackers to execute arbitrary SQL commands via the p parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-07T01:00:00.000Z
CVE-2005-4632 
SQL injection vulnerability in poll_frame.php in Vote! Pro 4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the poll_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-07T01:00:00.000Z
CVE-2005-4634 
SQL injection vulnerability in index.php in ActiveCampaign SupportTrio 1.4 allows remote attackers to execute arbitrary SQL commands via the page parameter.  NOTE: the provenance of this information is unknown because the source URL is not available; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-09T11:00:00.000Z
CVE-2005-4635 
The nl_fib_input function in fib_frontend.c in the Linux kernel before 2.6.15 does not check for valid lengths of the header and payload, which allows remote attackers to cause a denial of service (invalid memory reference) via malformed fib_lookup netlink messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-09T11:00:00.000Z
CVE-2005-4636 
OpenOffice.org 2.0 and earlier, when hyperlinks has been disabled, does not prevent the user from clicking the WWW-browser button in the Hyperlink dialog, which makes it easier for attackers to trick the user into bypassing intended security settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-09T23:00:00.000Z
CVE-2005-4637 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Kayako SupportSuite 3.00.26 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) nav parameter in the downloads module, (2) Full Name and (3) Email fields in the core module, (4) Full Name, (5) Email, and (6) Subject fields in the tickets module, or (7) Registered Email field in the lostpassword feature in the core module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-09T23:00:00.000Z
CVE-2005-4638 
index.php in Kayako SupportSuite 3.00.26 and earlier allow remote attackers to obtain the full path via (1) _a and (2) newsid parameters in the news module, (3) downloaditemid parameter in the downloads module, and (4) kbarticleid parameter in the knowledgebase module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-09T23:00:00.000Z
CVE-2005-4639 
Buffer overflow in the CA-driver (dst_ca.c) for TwinHan DST Frontend/Card in Linux kernel 2.6.12 and other versions before 2.6.15 allows local users to cause a denial of service (crash) and possibly execute arbitrary code by "reading more than 8 bytes into an 8 byte long array".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-10T11:00:00.000Z
CVE-2005-4640 
SQL injection vulnerability in index.php in class-1 Poll Software 0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) pollid or (2) previouspoll parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-10T11:00:00.000Z
CVE-2005-4641 
SQL injection vulnerability in home.php in eazyCMS 2.0 allows remote attackers to execute arbitrary SQL commands via the page_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-10T11:00:00.000Z
CVE-2005-4642 
Multiple cross-site scripting (XSS) vulnerabilities in HydroBB 1.0.0 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the s parameter to (1) search.php, (2) members.php, (3) stats.php, (4) viewforum.php, (5) register.php, (6) usercp.php, (7) groups.php, (8) pms.php, and (9) calendar.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-10T21:00:00.000Z
CVE-2005-4643 
SQL injection vulnerability in index.php in Antharia OnContent // CMS allows remote attackers to execute arbitrary SQL commands via the pid parameter.  NOTE: it is not clear, but this might be an application service provider, in which case it might be excluded from CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-10T21:00:00.000Z
CVE-2005-4644 
Cross-site scripting (XSS) vulnerability in the HTML WikiProcessor in Edgewall Trac 0.9.2 allows remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-11T21:00:00.000Z
CVE-2005-4645 
SQL injection vulnerability in index.php in 3CFR allows remote attackers to execute arbitrary SQL commands via the LangueID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-11T21:00:00.000Z
CVE-2005-4646 
Unspecified vulnerability in index.php in PEARLINGER Pearl Forums 2.4 allows remote attackers to include arbitrary files via the mode parameter, possibly due to a directory traversal vulnerability.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-11T21:00:00.000Z
CVE-2005-4647 
Multiple SQL injection vulnerabilities in PEARLINGER Pearl Forums 2.4 allow remote attackers to execute arbitrary SQL commands via the (1) forumsId and (2) topicId parameters in index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-11T21:00:00.000Z
CVE-2005-4648 
Buffer overflow in Illustrate dBpowerAMP Music Converter 11.5 and earlier, possibly including (1) MusicConverter.exe, (2) playlist.exe, and (3) amp.exe, allows user-assisted attackers to cause a denial of service or execute arbitrary code via a .m3u playlist with a long entry, possibly involving large field names, as demonstrated by SecuBox.Labs.m3u.  NOTE: this issue might be the same as the .m3u vulnerability in CVE-2004-1569, but if so, then CD:SF-LOC suggests creating a different identifier since the .m3u issue would affect different versions than the .pls issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-12T11:00:00.000Z
CVE-2005-4649 
Multiple cross-site scripting (XSS) vulnerabilities in Advanced Guestbook 2.2 and 2.3.1 allow remote attackers to inject arbitrary web script or HTML via (1) the entry parameter in index.php and (2) the gb_id parameter in comment.php.  NOTE: The index.php/entry vector might be resultant from CVE-2005-1548.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T23:00:00.000Z
CVE-2005-4650 
Joomla! 1.03 does not restrict the number of "Search" Mambots, which allows remote attackers to cause a denial of service (resource consumption) via a large number of Search Mambots.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-14T01:00:00.000Z
CVE-2005-4651 
SQL injection vulnerability in index.php in AlstraSoft EPay Pro 2.0 allows remote attackers to execute arbitrary SQL commands via the pmodule parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-14T01:00:00.000Z
CVE-2005-4652 
SQL injection vulnerability in PHlyMail 3.02.01 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-14T01:00:00.000Z
CVE-2005-4653 
Unspecified vulnerability in ss.php in AL-Caricatier 2.5 and earlier allows remote attackers to bypass login authentication by requesting view_caricatier.php, and then requesting any file in the admin directory with a cookie_username=admin argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2005-4654 
Multiple unspecified vulnerabilities in Oracle for OpenView (OfO) 8.1.7, 9.1.01, and 9.2, and OfO for Linux, allow remote attackers to have an unknown impact via unknown attack vectors.  NOTE: because of the lack of details in the vendor advisory, it is unclear which set of existing CVEs this advisory might refer to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2005-4655 
Cross-site scripting (XSS) vulnerability in submit.php in PHP-Fusion 6.0.204 allows remote attackers to inject arbitrary web script or HTML via nested tags in the news_body parameter, as demonstrated by elements such as "<me<meta>ta" and "<sc<script>ript>".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2005-4656 
SQL injection vulnerability in index.php in TClanPortal 1.1.3 and earlier allows remote attackers to execute arbitrary SQL commands, and retrieve all usernames and passwords, via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2005-4657 
Ocean12 Calendar Manager Pro 1.01 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to /admin/view.asp.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2005-4658 
Multiple cross-site scripting (XSS) vulnerabilities in ASP-Programmers.com ASPKnowledgebase allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in the administrative interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2005-4659 
IPCop (aka IPCop Firewall) before 1.4.10 has world-readable permissions for the backup.key file, which might allow local users to overwrite system configuration files and gain privileges by creating a malicious encrypted backup archive owned by "nobody", then executing ipcoprscfg to restore from this backup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2005-4660 
Race condition in IPCop (aka IPCop Firewall) before 1.4.10 might allow local users to overwrite system configuration files and gain privileges by replacing a backup archive during the time window when the archive is owned by "nobody" but not yet encrypted, then executing ipcoprscfg to restore from this backup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2005-4661 
The notifyendsubs cron job in Campsite before 2.3.3 sends an e-mail message containing a certain unencrypted MySQL password, which allows remote attackers to sniff the password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2005-4662 
Multiple SQL injection vulnerabilities in OcoMon 1.20, and possibly earlier versions, allow remote attackers to execute arbitrary SQL commands via unknown attack vectors in an unspecified input form, a different vulnerability than CVE-2005-4664.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2005-4663 
Cross-site scripting (XSS) vulnerability in OcoMon 1.20, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2005-4664 
SQL injection vulnerability in OcoMon 1.21, and possibly other versions, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the logon page, a different vulnerability than CVE-2005-4662.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2005-4665 
Cross-site scripting (XSS) vulnerability in PunBB 1.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via Javascript contained in nested, malformed BBcode url tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-19T01:00:00.000Z
CVE-2005-4666 
Cross-site scripting (XSS) vulnerability in PHlyMail before 3.3 Beta1 allows remote attackers to inject arbitrary Javascript via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-19T21:00:00.000Z
CVE-2005-4667 
Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument.  NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T21:00:00.000Z
CVE-2005-4668 
The embedded HSQLDB in ParosProxy before 3.2.7, when running with JDK 1.4.2 before 1.4.2_08, allows local users to execute arbitrary comands via crafted SQL commands that interact with HSQLDB through JDBC, a similar vulnerability to CVE-2003-0845.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-26T22:00:00.000Z
CVE-2005-4669 
SQL injection vulnerability in RT Internet Solutions (RTIS) WebAdmin allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-26T22:00:00.000Z
CVE-2005-4670 
Cross-site scripting (XSS) vulnerability in message.php in CityPost Automated Link Exchange (LNKX) allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-27T23:00:00.000Z
CVE-2005-4671 
Cross-site scripting (XSS) vulnerability in simple-upload-53.php in CityPost Simple PHP Upload 5.3 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-27T23:00:00.000Z
CVE-2005-4672 
Cross-site scripting (XSS) vulnerability in image-editor-52/index.php in CityPost Simple Image-Editor 0.52 allows remote attackers to inject arbitrary web script or HTML via the (1) m1, (2) m2, (3) m3, (4) imgsrc, and (5) m4 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-27T23:00:00.000Z
CVE-2005-4673 
ioFTPD 0.5.84 u responds with different messages depending on whether or not a username exists, which allows remote attackers to enumerate valid usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-27T23:00:00.000Z
CVE-2005-4674 
Multiple SQL injection vulnerabilities in list.php in Complete PHP Counter allow remote attackers to execute arbitrary SQL commands via the (1) c or (2) s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-27T23:00:00.000Z
CVE-2005-4675 
Cross-site scripting (XSS) vulnerability in list.php in Complete PHP Counter allows remote attackers to inject arbitrary web script or HTML via the c parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-27T23:00:00.000Z
CVE-2005-4676 
Buffer overflow in Andreas Huggel Exiv2 before 0.9 does not null terminate strings before calling the sscanf function, which allows remote attackers to cause a denial of service (application crash) via images with crafted IPTC metadata.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-31T11:00:00.000Z
CVE-2005-4677 
SQL injection vulnerability in additional_images.php (aka the Additional Images module) before 1.14 in osCommerce allows remote attackers to execute arbitrary SQL commands via the products_id parameter to product_info.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2005-4678 
Apple Safari 2.0.2 (aka 416.12) allows remote attackers to spoof the URL in the status bar via the title in an image in a link to a trusted site within a form to the malicious site.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2005-4679 
Internet Explorer 6 for Windows XP Service Pack 2 allows remote attackers to spoof the URL in the status bar via the title in an image in a link to a trusted site within a form to the malicious site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2005-4680 
Sophos Anti-Virus before 4.02, 4.5.x before 4.5.9, 4.6.x before 4.6.9, and 5.x before 5.1.4 allow remote attackers to hide arbitrary files and data via crafted ARJ archives, which are not properly scanned.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2005-4681 
Buffer overflow in mIRC 5.91, 6.03, 6.12, and 6.16 allows local users to execute arbitrary code via a long string that is entered after reaching the DCC Get Folder Dialog.  NOTE: this issue has been disputed by the vendor, saying "as far as I can tell, this is neither an exploit nor a vulnerability. The above report describes a local bug in mIRC."  It could be that this is only exploitable by the user of the application, and thus would not cross privilege boundaries unless under an otherwise restrictive environment such as a kiosk
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2005-4682 
Cross-site scripting (XSS) vulnerability in error.asp in AudienceView allows remote attackers to inject arbitrary web script or HTML via the TSerrorMessage parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2005-4683 
PADL MigrationTools 46, when a failure occurs, stores contents of /etc/shadow in a world-readable /tmp/nis.$$.ldif file, and possibly other sensitive information in other temporary files, which are not properly managed by (1) migrate_all_online.sh, (2) migrate_all_offline.sh, (3) migrate_all_netinfo_online.sh, (4) migrate_all_netinfo_offline.sh, (5) migrate_all_nis_online.sh, (6) migrate_all_nis_offline.sh, (7) migrate_all_nisplus_online.sh, and (8) migrate_all_nisplus_offline.sh.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2005-4684 
Konqueror can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers to trick a user into accepting a cookie for a hostname formed via search-list expansion of the hostname entered by the user, or steal a cookie for an expanded hostname, as demonstrated by an attacker who operates an ap1.com Internet web site to steal cookies associated with an ap1.com.example.com intranet web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2005-4685 
Firefox and Mozilla can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers to trick a user into accepting a cookie for a hostname formed via search-list expansion of the hostname entered by the user, or steal a cookie for an expanded hostname, as demonstrated by an attacker who operates an ap1.com Internet web site to steal cookies associated with an ap1.com.example.com intranet web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2005-4686 
PunBB 1.2.9, when used alone or with F-ART BLOG:CMS, includes config.php before calling the unregister_globals function, which allows attackers to obtain unspecified sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2005-4687 
PunBB 1.2.9, used alone or with F-ART BLOG:CMS, may trust a client's IP address as specified in the X-Forwarded-For HTTP header rather than the TCP/IP stack, which allows remote attackers to misrepresent their IP address by sending a modified header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2005-4688 
PunBB 1.2.9 does not require password entry when changing the e-mail address in an account's profile, which might allow an attacker to make an address change via a hijacked login session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2005-4689 
Six Apart Movable Type 3.16 stores account names and password hashes in a cookie, which allows remote attackers to login to an account by sniffing the cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2005-4690 
Six Apart Movable Type 3.16 allows local users with blog-creation privileges to create or overwrite arbitrary files of certain types (such as HTML and image files) by selecting an arbitrary directory as a blog's top-level directory.  NOTE: this issue can be used in conjunction with CVE-2005-3102 to create or overwrite arbitrary files of all types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2005-4691 
imake in NetBSD before 2.0.3, NetBSD-current before 12 September 2005, certain versions of X.Org, and certain versions of XFree86 allows local users to overwrite arbitrary files via a symlink attack on the temporary file for the file.0 target, which is used for a pre-formatted manual page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2005-4692 
Unspecified vulnerability in mroovca stats (mroovcastats) before 0.4.5b has unknown attack vectors and impact, related to cookies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z
CVE-2005-4693 
Gaim-Encryption 2.38-1 on Debian Linux allows remote attackers to cause a denial of service (crash) via a crafted message from an ICQ buddy, possibly involving the GE_received_key function in keys.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z
CVE-2005-4694 
Unspecified vulnerability in the www_add method in Asset.pm in Plain Black WebGUI 6.3.0 and other versions before 6.7.6 allows attackers to execute arbitrary code via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z