rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-5856 
Quick Look Apple Mac OS X 10.5.1, when previewing an HTML file, does not prevent plug-ins from making network requests, which might allow remote attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-19T21:00:00.000Z
CVE-2007-5857 
Quick Look in Apple Mac OS X 10.5.1 does not prevent a movie from accessing URLs when the movie file is previewed or if an icon is created, which might allow remote attackers to obtain sensitive information via HREFTrack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-19T21:00:00.000Z
CVE-2007-5858 
WebKit in Safari in Apple Mac OS X 10.4.11 and 10.5.1, iPhone 1.0 through 1.1.2, and iPod touch 1.1 through 1.1.2 allows remote attackers to "navigate the subframes of any other page," which can be leveraged to conduct cross-site scripting (XSS) attacks and obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-19T21:00:00.000Z
CVE-2007-5859 
Unspecified vulnerability in Safari RSS in Apple Mac OS X 10.4.11 allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted feed: URL that triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-19T21:00:00.000Z
CVE-2007-5860 
Unspecified vulnerability in Spin Tracer in Apple Mac OS X 10.5.1 allows local users to execute arbitrary code via unspecified output files, involving an "insecure file operation."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-19T21:00:00.000Z
CVE-2007-5861 
Unspecified vulnerability in Spotlight in Apple Mac OS X 10.4.11 allows user-assisted attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted .XLS file that triggers memory corruption in the Microsoft Office Spotlight Importer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-19T21:00:00.000Z
CVE-2007-5862 
Java in Mac OS X 10.4 through 10.4.11 allows remote attackers to bypass Keychain access controls and add or delete arbitrary Keychain items via a crafted Java applet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-18T20:00:00.000Z
CVE-2007-5863 
Software Update in Apple Mac OS X 10.5.1 allows remote attackers to execute arbitrary commands via a man-in-the-middle (MITM) attack between the client and the server, using a modified distribution definition file with the "allow-external-scripts" option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-19T21:00:00.000Z
CVE-2007-5887 
SQL injection vulnerability in boards/printer.asp in ASP Message Board 2.2.1c allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-07T21:00:00.000Z
CVE-2007-5888 
Cross-site scripting (XSS) vulnerability in displayecard.php in Coppermine Photo Gallery (CPG) before 1.4.14 allows remote attackers to inject arbitrary web script or HTML via the data parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-07T21:00:00.000Z
CVE-2007-5889 
Multiple PHP remote file inclusion vulnerabilities in IDMOS 1.0 Alpha (aka Phoenix) allow remote attackers to execute arbitrary PHP code via a URL in the site_absolute_path parameter to (1) admin.php, (2) menu_add.php, and (3) menu_operation.php in administrator/, different vectors than CVE-2007-5294.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-08T02:00:00.000Z
CVE-2007-5890 
Directory traversal vulnerability in index.php in easyGB 2.1.1 allows remote attackers to include arbitrary files via the DatabaseType parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-08T02:00:00.000Z
CVE-2007-5891 
Multiple cross-site scripting (XSS) vulnerabilities in jsp/Login.do in ManageEngine OpManager MSP Edition and OpManager 7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) requestid, (2) fileid, (3) woMode, and (2) woID parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-08T02:00:00.000Z
CVE-2007-5892 
Stack-based buffer overflow in the pdg2.dll ActiveX control in SSReader 4.0 and earlier allow remote attackers to execute arbitrary code via a long argument to the Register method.  NOTE: some details were obtained from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-08T02:00:00.000Z
CVE-2007-5893 
HTTPSocket.cpp in the C++ Sockets Library before 2.2.5 allows remote attackers to cause a denial of service (crash) via an HTTP request with a missing protocol version number, which triggers an exception. NOTE: some of these details were obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-08T02:00:00.000Z
CVE-2007-5894 
The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors.  NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used.  NOTE: the vendor disputes this issue, stating " The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-06T02:00:00.000Z
CVE-2007-5896 
Mozilla Firefox 2.0.0.9 allows remote attackers to cause a denial of service (CPU consumption and crash) via an iframe with Javascript that sets the document.location to contain a leading NULL byte (\x00) and a (1) res://, (2) about:config, or (3) file:/// URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-08T20:00:00.000Z
CVE-2007-5897 
Buffer overflow in MDSYS.SDO_CS in Oracle Database Server 8iR3, 9iR1, 9iR2 up to 9.2.0.6, and 10gR1 up to 10.1.0.4 allows remote authenticated users to cause a denial of service (crash) and execute arbitrary code via the TRANSFORM function.  NOTE: this issue might already be covered by CVE-2007-5515, CVE-2007-5509, or CVE-2007-5505, but there are insufficient details to be sure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-08T21:00:00.000Z
CVE-2007-5898 
The (1) htmlentities and (2) htmlspecialchars functions in PHP before 5.2.5 accept partial multibyte sequences, which has unknown impact and attack vectors, a different issue than CVE-2006-5465.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-20T18:00:00.000Z
CVE-2007-5899 
The output_add_rewrite_var function in PHP before 5.2.5 rewrites local forms in which the ACTION attribute references a non-local URL, which allows remote attackers to obtain potentially sensitive information by reading the requests for this URL, as demonstrated by a rewritten form containing a local session ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-20T19:00:00.000Z
CVE-2007-5900 
PHP before 5.2.5 allows local users to bypass protection mechanisms configured through php_admin_value or php_admin_flag in httpd.conf by using ini_set to modify arbitrary configuration variables, a different issue than CVE-2006-4625.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-20T18:00:00.000Z
CVE-2007-5901 
Use-after-free vulnerability in the gss_indicate_mechs function in lib/gssapi/mechglue/g_initialize.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors.  NOTE: this might be the result of a typo in the source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-06T02:00:00.000Z
CVE-2007-5902 
Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (krb5) allows remote attackers to have an unknown impact via a large length value for a GSS client name in an RPC request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-06T02:00:00.000Z
CVE-2007-5904 
Multiple buffer overflows in CIFS VFS in Linux kernel 2.6.23 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long SMB responses that trigger the overflows in the SendReceive function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-09T18:00:00.000Z
CVE-2007-5905 
Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the (1) CFID or (2) CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-15T20:00:00.000Z
CVE-2007-5906 
Xen 3.1.1 allows virtual guest system users to cause a denial of service (hypervisor crash) by using a debug register (DR7) to set certain breakpoints.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-09T19:00:00.000Z
CVE-2007-5907 
Xen 3.1.1 does not prevent modification of the CR4 TSC from applications, which allows pv guests to cause a denial of service (crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-09T19:00:00.000Z
CVE-2007-5909 
Multiple stack-based buffer overflows in Autonomy (formerly Verity) KeyView Viewer, Filter, and Export SDK before 9.2.0.12, as used by ActivePDF DocConverter, IBM Lotus Notes before 7.0.3, Symantec Mail Security, and other products, allow remote attackers to execute arbitrary code via a crafted (1) AG file to kpagrdr.dll, (2) AW file to awsr.dll, (3) DLL or (4) EXE file to exesr.dll, (5) DOC file to mwsr.dll, (6) MIF file to mifsr.dll, (7) SAM file to lasr.dll, or (8) RTF file to rtfsr.dll.  NOTE: the WPD (wp6sr.dll) vector is covered by CVE-2007-5910.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5910 
Stack-based buffer overflow in Autonomy (formerly Verity) KeyView Viewer, Filter, and Export SDK before 9.2.0.12, as used by ActivePDF DocConverter, wp6sr.dll in IBM Lotus Notes 8.0 and before 7.0.3, Symantec Mail Security, and other products, allows remote attackers to execute arbitrary code via a crafted WordPerfect (WPD) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5911 
Multiple stack-based buffer overflows in the AxMetaStream ActiveX control in AxMetaStream.dll 3.3.2.26 in Viewpoint Media Player 3.2 allow remote attackers to execute arbitrary code via a long string argument to the (1) BroadcastKey, (2) BroadcastKeyFileURL, (3) Component, (4) ComponentClassID, (5) ComponentFileName, (6) ExtraProperty, (7) Properties, (8) RequiredVersions, (9) Source, or (10) XMLText method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5912 
SQL injection vulnerability in mailer.php in jPORTAL 2 allows remote attackers to execute arbitrary SQL commands via the to parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5913 
dirsys/modules/auth.php in JBC Explorer 7.20 RC1 and earlier does not require authentication, which allows remote attackers to (1) delete auth.inc.php via the suppr parameter, and (2) re-create the auth.inc.php file with contents that specify a new account name and password for JBC Explorer via the login and password parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5914 
Direct static code injection vulnerability in dirsys/modules/config/post.php in JBC Explorer 7.20 RC1 and earlier allows remote authenticated administrators to inject arbitrary PHP code via the DEBUG parameter, which can be executed by accessing config.inc.php.  NOTE: this can be exploited by unauthenticated remote attackers by leveraging CVE-2007-5913.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5915 
Directory traversal vulnerability in index.php in phphelpdesk 0.6.16 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the whattodo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5916 
SQL injection vulnerability in the login page in phphelpdesk 0.6.16 allows remote attackers to execute arbitrary SQL commands via unspecified parameters related to the "login procedures."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5917 
Cross-site request forgery (CSRF) vulnerability in admin/admin_account.php in Skalinks 1.5 and earlier allows remote attackers to add arbitrary privileged accounts as administrators via the admin_name, admin_password, admin_type, and Add_admin parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5918 
Cross-site request forgery (CSRF) vulnerability in edit.php in the MS TopSites add-on for PHP-Nuke does not verify that the uname parameter matches the current account, which allows remote authenticated users to change arbitrary accounts or change the SiteTitleName field as an arbitrary user via a modified uname value in an edit action to modules.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5919 
MyWebFTP, possibly 5.3.2, stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain an MD5 password hash via a direct request for pass/pass.txt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5920 
index.php in Domenico Mancini PicoFlat CMS before 0.4.18 allows remote attackers to include certain files via unspecified vectors, possibly due to a directory traversal vulnerability.  NOTE: this can be leveraged to bypass authentication and upload files by including pico_insert.php or unspecified other administrative scripts.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5921 
Unspecified vulnerability in the ioctl interface in the Solaris Volume Manager (SVM) in Sun Solaris 9 and 10 allows local users to cause a denial of service (panic) via unspecified vectors, a different vulnerability than CVE-2004-1346.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5922 
The modules/mdop.m in the Cypress 1.0k script for BitchX, as downloaded from a distribution site in November 2007, contains an externally introduced backdoor that e-mails sensitive information (hostnames, usernames, and shell history) to a fixed address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5923 
Cross-site scripting (XSS) vulnerability in forms/smpwservices.fcc in CA (formerly Computer Associates) eTrust SiteMinder Agent allows remote attackers to inject arbitrary web script or HTML via the SMAUTHREASON parameter, a different vector than CVE-2005-2204.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5924 
Cross-site scripting (XSS) vulnerability in the Web Server (HTTP) task in IBM Lotus Domino before 6.5.6 FP2, and 7.x before 7.0.2 FP2, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5925 
The convert_search_mode_to_innobase function in ha_innodb.cc in the InnoDB engine in MySQL 5.1.23-BK and earlier allows remote authenticated users to cause a denial of service (database crash) via a certain CONTAINS operation on an indexed column, which triggers an assertion error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5926 
OpenBase 10.0.5 and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to the (1) AsciiBackup, (2) OEMLicenseInstall, and possibly other stored procedures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5927 
Directory traversal vulnerability in OpenBase 10.0.5 and earlier allows remote authenticated users to create files with arbitrary contents via a .. (dot dot) in the first argument to the GlobalLog stored procedure.  NOTE: this can be leveraged to execute arbitrary code using CVE-2007-5926.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5928 
OpenBase 10.0.5 and earlier allows remote authenticated users to trigger a free of an arbitrary memory location via long strings in a SELECT statement.  NOTE: this might be a buffer overflow, but it is not clear.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5929 
Buffer overflow in OpenBase 10.0.5 and earlier might allow remote authenticated users to execute arbitrary code or cause a denial of service (daemon crash) by creating a stored procedure with a long name and invoking this procedure, which triggers heap corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T02:00:00.000Z
CVE-2007-5930 
Cross-site scripting (XSS) vulnerability in the web interface in Cerberus FTP Server before 2.46 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T11:00:00.000Z
CVE-2007-5931 
The reDirect function in lib/controllers/RepViewController.php in OrangeHRM before 2.2.2 does not verify the privileges of a user, which allows remote attackers to obtain access to data via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T11:00:00.000Z
CVE-2007-5932 
Multiple cross-site scripting (XSS) vulnerabilities in Fatwire Content Server (CS) CMS 6.3.0 allow remote attackers to inject arbitrary web script or HTML via unspecified form fields related to the (1) search function, (2) advanced search function, and possibly other components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-10T11:00:00.000Z
CVE-2007-5933 
Pioneers (formerly gnocatan) before 0.11.3 allows remote attackers to cause a denial of service (crash) by triggering a delete operation while the Session object is still being used, as demonstrated by causing a "Broken pipe" error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-13T20:00:00.000Z
CVE-2007-5934 
The LOB functionality in PEAR MDB2 before 2.5.0a1 interprets a request to store a URL string as a request to retrieve and store the contents of the URL, which might allow remote attackers to use MDB2 as an indirect proxy or obtain sensitive information via a URL into a form field in an MDB2 application, as demonstrated by a file:// URL or a URL for an intranet web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-13T22:00:00.000Z
CVE-2007-5935 
Stack-based buffer overflow in hpc.c in dvips in teTeX and TeXlive 2007 and earlier allows user-assisted attackers to execute arbitrary code via a DVI file with a long href tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-13T22:00:00.000Z
CVE-2007-5936 
dvips in teTeX and TeXlive 2007 and earlier allows local users to obtain sensitive information and modify certain data by creating certain temporary files before they are processed by dviljk, which can then be read or modified in place.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-13T22:00:00.000Z
CVE-2007-5937 
Multiple buffer overflows in dvi2xx.c in dviljk in teTeX and TeXlive 2007 and earlier might allow user-assisted attackers to execute arbitrary code via a crafted DVI input file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-13T22:00:00.000Z
CVE-2007-5938 
The iwl_set_rate function in compatible/iwl3945-base.c in iwlwifi 1.1.21 and earlier dereferences an iwl_get_hw_mode return value without checking for NULL, which might allow remote attackers to cause a denial of service (kernel panic) via unspecified vectors during module initialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-06T15:00:00.000Z
CVE-2007-5939 
The gss_userok function in appl/ftp/ftpd/gss_userok.c in Heimdal 0.7.2 does not allocate memory for the ticketfile pointer before calling free, which allows remote attackers to have an unknown impact via an invalid username.  NOTE: the vulnerability was originally reported for ftpd.c, but this is incorrect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-06T15:00:00.000Z
CVE-2007-5940 
feynmf.pl in feynmf 1.08, as used in TeXLive 2007, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the feynmf$$.pl temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-13T23:00:00.000Z
CVE-2007-5941 
Stack-based buffer overflow in the SWCtl.SWCtl ActiveX control in Adobe Shockwave allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long argument to the ShockwaveVersion method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-14T01:00:00.000Z
CVE-2007-5942 
Bandersnatch 0.4 allows remote attackers to obtain sensitive information via a malformed request for index.php with (1) a certain func parameter value; or (2) certain func, jid, page, and limit parameter values; which reveals the path in various error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-14T01:00:00.000Z
CVE-2007-5943 
Simple Machines Forum (SMF) 1.1.4 allows remote attackers to read a message in private forums by using the advanced search module with the "show results as messages" option, then searching for possible keywords contained in that message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-14T01:00:00.000Z