rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-4252 
The DataGrid ActiveX control in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "DataGrid Control Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-10T13:33:00.000Z
CVE-2008-4253 
The FlexGrid ActiveX control in Microsoft Visual Basic 6.0, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, Office FrontPage 2002 SP3, and Office Project 2003 SP3 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "FlexGrid Control Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-10T13:33:00.000Z
CVE-2008-4254 
Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allow remote attackers to execute arbitrary code via crafted (1) Rows and (2) Cols properties to the (a) ExpandAll and (b) CollapseAll methods, related to access of incorrectly initialized objects and corruption of the "system state," aka "Hierarchical FlexGrid Control Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-10T13:33:00.000Z
CVE-2008-4255 
Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, and Office Project 2003 SP3 and 2007 Gold and SP1 allows remote attackers to execute arbitrary code via an AVI file with a crafted stream length, which triggers an "allocation error" and memory corruption, aka "Windows Common AVI Parsing Overflow Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-10T13:33:00.000Z
CVE-2008-4256 
The Charts ActiveX control in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "Charts Control Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-10T13:33:00.000Z
CVE-2008-4258 
Microsoft Internet Explorer 5.01 SP4 and 6 SP1 does not properly validate parameters during calls to navigation methods, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka "Parameter Validation Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-10T13:33:00.000Z
CVE-2008-4259 
Microsoft Internet Explorer 7 sometimes attempts to access uninitialized memory locations, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, related to a WebDAV request for a file with a long name, aka "HTML Objects Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-10T13:33:00.000Z
CVE-2008-4260 
Microsoft Internet Explorer 7 sometimes attempts to access a deleted object, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka "Uninitialized Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-10T13:33:00.000Z
CVE-2008-4261 
Stack-based buffer overflow in Microsoft Internet Explorer 5.01 SP4, 6 SP1 on Windows 2000, and 6 on Windows XP and Server 2003 does not properly handle extraneous data associated with an object embedded in a web page, which allows remote attackers to execute arbitrary code via crafted HTML tags that trigger memory corruption, aka "HTML Rendering Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-10T13:33:00.000Z
CVE-2008-4264 
Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Excel spreadsheet that contains a malformed formula, which triggers "pointer corruption" during the loading of formulas from this spreadsheet, aka "File Format Parsing Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-10T13:33:00.000Z
CVE-2008-4265 
Microsoft Office Excel 2000 SP3 allows remote attackers to execute arbitrary code via a crafted Excel spreadsheet that contains a malformed object, which triggers memory corruption during the loading of records from this spreadsheet, aka "File Format Parsing Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-10T13:33:00.000Z
CVE-2008-4266 
Array index vulnerability in Microsoft Office Excel 2000 SP3, 2002 SP3, and 2003 SP3; Excel Viewer 2003 Gold and SP3; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via an Excel spreadsheet with a NAME record that contains an invalid index value, which triggers stack corruption, aka "Excel Global Array Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-10T13:33:00.000Z
CVE-2008-4268 
The Windows Search component in Microsoft Windows Vista Gold and SP1 and Server 2008 does not properly free memory during a save operation for a Windows Search file, which allows remote attackers to execute arbitrary code via a crafted saved-search file, aka "Windows Saved Search Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-10T13:33:00.000Z
CVE-2008-4269 
The search-ms protocol handler in Windows Explorer in Microsoft Windows Vista Gold and SP1 and Server 2008 uses untrusted parameter data obtained from incorrect parsing, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "Windows Search Parsing Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-10T13:33:00.000Z
CVE-2008-4278 
VMware VirtualCenter 2.5 before Update 3 build 119838 on Windows displays a user's password in cleartext when the password contains unspecified special characters, which allows physically proximate attackers to steal the password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-06T18:00:00.000Z
CVE-2008-4279 
The CPU hardware emulation for 64-bit guest operating systems in VMware Workstation 6.0.x before 6.0.5 build 109488 and 5.x before 5.5.8 build 108000; Player 2.0.x before 2.0.5 build 109488 and 1.x before 1.0.8; Server 1.x before 1.0.7 build 108231; and ESX 2.5.4 through 3.5 allows authenticated guest OS users to gain additional guest OS privileges by triggering an exception that causes the virtual CPU to perform an indirect jump to a non-canonical address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-06T18:00:00.000Z
CVE-2008-4281 
Directory traversal vulnerability in VMWare ESXi 3.5 before ESXe350-200810401-O-UG and ESX 3.5 before ESX350-200810201-UG allows administrators with the Datastore.FileManagement privilege to gain privileges via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-10T11:00:00.000Z
CVE-2008-4283 
CRLF injection vulnerability in the WebContainer component in IBM WebSphere Application Server (WAS) 5.1.1.19 and earlier 5.1.x versions allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-10T22:13:00.000Z
CVE-2008-4284 
Open redirect vulnerability in the ibm_security_logout servlet in IBM WebSphere Application Server (WAS) 5.1.1.19 and earlier 5.x versions, 6.0.x before 6.0.2.33, and 6.1.x before 6.1.0.23 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the logoutExitPage feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-10T22:13:00.000Z
CVE-2008-4285 
Unspecified vulnerability in the Performance Monitoring Infrastructure (PMI) feature in the Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.19, when a component statistic is enabled, allows attackers to cause a denial of service (daemon crash) via vectors related to "a gradual degradation in performance."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-17T17:00:00.000Z
CVE-2008-4292 
Opera before 9.52 does not check the CRL override upon encountering a certificate that lacks a CRL, which has unknown impact and attack vectors.  NOTE: it is not clear whether this is a vulnerability, but the vendor included it in a security section of the advisory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-27T00:00:00.000Z
CVE-2008-4293 
Unspecified vulnerability in Opera before 9.52 on Windows, when registered as a protocol handler, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors in which Opera is launched by other applications.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-27T00:00:00.000Z
CVE-2008-4294 
IBM Tivoli Netcool/Webtop 2.1 before 2.1.0.5 preserves cached user privileges after logout, which allows physically proximate attackers to hijack a session by visiting an unattended workstation, as demonstrated by a root session that is still valid after a subsequent read-only session has begun.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-27T00:00:00.000Z
CVE-2008-4295 
Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to establish a Bluetooth connection to a peer with a long name, which allows remote attackers to cause a denial of service (device reboot) by configuring a Bluetooth device with a long hci name and (1) connecting directly to the Windows Mobile system or (2) waiting for the Windows Mobile system to scan for nearby devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-27T00:00:00.000Z
CVE-2008-4296 
The Cisco Linksys WRT350N with firmware 1.0.3.7 has "admin" as its default password for the "admin" account, which makes it easier for remote attackers to obtain access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-27T00:00:00.000Z
CVE-2008-4297 
Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository via an "hg pull" request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-27T00:00:00.000Z
CVE-2008-4298 
Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-27T00:00:00.000Z
CVE-2008-4299 
A certain ActiveX control in the Microsoft Internet Authentication Service (IAS) Helper COM Component in iashlpr.dll allows remote attackers to cause a denial of service (browser crash) via a large integer value in the first argument to the PutProperty method.  NOTE: this issue was disclosed by an unreliable researcher, so it might be incorrect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-29T17:00:00.000Z
CVE-2008-4300 
A certain ActiveX control in adsiis.dll in Microsoft Internet Information Services (IIS) allows remote attackers to cause a denial of service (browser crash) via a long string in the second argument to the GetObject method.  NOTE: this issue was disclosed by an unreliable researcher, so it might be incorrect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-29T17:00:00.000Z
CVE-2008-4301 
A certain ActiveX control in iisext.dll in Microsoft Internet Information Services (IIS) allows remote attackers to set a password via a string argument to the SetPassword method.  NOTE: this issue could not be reproduced by a reliable third party.  In addition, the original researcher is unreliable.  Therefore the original disclosure is probably erroneous
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-29T17:00:00.000Z
CVE-2008-4302 
fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the add_to_page_cache_lru function, and subsequently attempts to unlock a page that was not locked, which allows local users to cause a denial of service (kernel BUG and system crash), as demonstrated by the fio I/O tool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-29T17:00:00.000Z
CVE-2008-4303 
Multiple SQL injection vulnerabilities in phpCollab 2.5 rc3, 2.4, and earlier allow remote attackers to execute arbitrary SQL commands via the loginForm parameter to general/login.php, and unspecified other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-23T18:13:00.000Z
CVE-2008-4304 
general/login.php in phpCollab 2.5 rc3 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified input related to the SSL_CLIENT_CERT environment variable. NOTE: in some environments, SSL_CLIENT_CERT always has a base64-encoded string value, which may impose constraints on injection for typical shells.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-23T18:13:00.000Z
CVE-2008-4305 
Static code injection vulnerability in installation/setup.php in phpCollab 2.5 rc3 and earlier allows remote authenticated administrators to inject arbitrary PHP code into include/settings.php via the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-23T18:13:00.000Z
CVE-2008-4306 
Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-04T20:00:00.000Z
CVE-2008-4307 
Race condition in the do_setlk function in fs/nfs/file.c in the Linux kernel before 2.6.26 allows local users to cause a denial of service (crash) via vectors resulting in an interrupted RPC call that leads to a stray FL_POSIX lock, related to improper handling of a race between fcntl and close in the EINTR case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-13T16:00:00.000Z
CVE-2008-4308 
The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-26T23:00:00.000Z
CVE-2008-4309 
Integer overflow in the netsnmp_create_subtree_cache function in agent/snmp_agent.c in net-snmp 5.4 before 5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1 allows remote attackers to cause a denial of service (crash) via a crafted SNMP GETBULK request, which triggers a heap-based buffer overflow,  related to the number of responses or repeats.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-31T20:00:00.000Z
CVE-2008-4310 
httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request.  NOTE: this issue exists because of an incomplete fix for CVE-2008-3656.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-09T00:00:00.000Z
CVE-2008-4311 
The default configuration of system.conf in D-Bus (aka DBus) before 1.2.6 omits the send_type attribute in certain rules, which allows local users to bypass intended access restrictions by (1) sending messages, related to send_requested_reply; and possibly (2) receiving messages, related to receive_requested_reply.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-10T00:00:00.000Z
CVE-2008-4313 
A certain Red Hat patch for tog-pegasus in OpenGroup Pegasus 2.7.0 does not properly configure the PAM tty name, which allows remote authenticated users to bypass intended access restrictions and send requests to OpenPegasus WBEM services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-27T00:00:00.000Z
CVE-2008-4314 
smbd in Samba 3.0.29 through 3.2.4 might allow remote attackers to read arbitrary memory and cause a denial of service via crafted (1) trans, (2) trans2, and (3) nttrans requests, related to a "cut&paste error" that causes an improper bounds check to be performed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-01T15:00:00.000Z
CVE-2008-4315 
tog-pegasus in OpenGroup Pegasus 2.7.0 on Red Hat Enterprise Linux (RHEL) 5, Fedora 9, and Fedora 10 does not log failed authentication attempts to the OpenPegasus CIM server, which makes it easier for remote attackers to avoid detection of password guessing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-27T00:00:00.000Z
CVE-2008-4316 
Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-14T18:00:00.000Z
CVE-2008-4318 
Observer 0.3.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter to (1) whois.php or (2) netcmd.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-29T18:00:00.000Z
CVE-2008-4319 
fileadmin.php in Libra File Manager (aka Libra PHP File Manager) 1.18 and earlier allows remote attackers to bypass authentication, and read arbitrary files, modify arbitrary files, and list arbitrary directories, by inserting certain user and isadmin parameters in the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-29T18:00:00.000Z
CVE-2008-4320 
Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.5.94 allow remote attackers to inject arbitrary web script or HTML via (1) the j_username parameter to j_acegi_security_check, (2) the username parameter to notification/list.jsp, and (3) the filter parameter to event/list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-29T18:00:00.000Z
CVE-2008-4321 
Buffer overflow in FlashGet (formerly JetCar) FTP 1.9 allows remote FTP servers to execute arbitrary code via a long response to the PWD command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-29T19:00:00.000Z
CVE-2008-4322 
Stack-based buffer overflow in RealFlex Technologies Ltd. RealWin Server 2.0, as distributed by DATAC, allows remote attackers to execute arbitrary code via a crafted FC_INFOTAG/SET_CONTROL packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-29T19:00:00.000Z
CVE-2008-4323 
Windows Explorer in Microsoft Windows XP SP3 allows user-assisted attackers to cause a denial of service (application crash) via a crafted .ZIP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-29T20:00:00.000Z
CVE-2008-4324 
The user interface event dispatcher in Mozilla Firefox 3.0.3 on Windows XP SP2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a series of keypress, click, onkeydown, onkeyup, onmousedown, and onmouseup events.  NOTE: it was later reported that Firefox 3.0.2 on Mac OS X 10.5 is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-29T20:00:00.000Z
CVE-2008-4325 
lib/viewvc.py in ViewVC 1.0.5 uses the content-type parameter in the HTTP request for the Content-Type header in the HTTP response, which allows remote attackers to cause content to be misinterpreted by the browser via a content-type parameter that is inconsistent with the requested object.  NOTE: this issue might not be a vulnerability, since it requires attacker access to the repository that is being viewed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-30T16:00:00.000Z
CVE-2008-4326 
The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a "</script" sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-30T16:00:00.000Z
CVE-2008-4327 
gdiplus.dll in GDI+ in Microsoft Windows XP SP3 does not properly handle crafted .ico files, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a certain crash.ico file on a web site, and allows user-assisted attackers to cause a denial of service (divide-by-zero error and persistent application crash) via this crash.ico file on the desktop, a different vulnerability than CVE-2007-2237.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-30T16:00:00.000Z
CVE-2008-4328 
SQL injection vulnerability in site_search.php in EasyRealtorPRO 2008 allows remote attackers to execute arbitrary SQL commands via the (1) item, (2) search_ordermethod, and (3) search_order parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-30T17:00:00.000Z
CVE-2008-4329 
PHP remote file inclusion vulnerability in cms/system/openengine.php in openEngine 2.0 beta4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the oe_classpath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-30T17:00:00.000Z
CVE-2008-4330 
Directory traversal vulnerability in index.php in LanSuite 3.3.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the design parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-30T17:00:00.000Z