rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-7026 
PHP remote file inclusion vulnerability in sources/join.php in Aardvark Topsites PHP 4.2.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[path] parameter, a different vector than CVE-2006-2149.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z
CVE-2006-7027 
Microsoft Internet Security and Acceleration (ISA) Server 2004 logs unusual ASCII characters in the Host header, including the tab, which allows remote attackers to manipulate portions of the log file and possibly leverage this for other attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z
CVE-2006-7028 
Single CPU Sun systems running Solaris 7, 8, or 9, such as Netra, allows remote attackers to cause a denial of service (console hang) via a flood of small TCP/IP packets.  NOTE: this issue has not been replicated by third parties. In addition, the cause is unknown, although it might be related to "jabber" and generation of a large amount of interrupts within the console, or a hardware error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z
CVE-2006-7029 
Microsoft Internet Explorer 6 SP2 and earlier allows remote attackers to cause a denial of service (crash) via a frameset with only one frame that calls resizeTo with certain arguments.  NOTE: this issue might be related to CVE-2006-3637.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z
CVE-2006-7030 
Microsoft Internet Explorer 6 SP2 and earlier allows remote attackers to cause a denial of service (crash) via certain malformed HTML, possibly involving applet and base tags without required arguments, which triggers a null pointer dereference in mshtml.dll.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z
CVE-2006-7031 
Microsoft Internet Explorer 6.0.2900 SP2 and earlier allows remote attackers to cause a denial of service (crash) via a table element with a CSS attribute that sets the position, which triggers an "unhandled exception" in mshtml.dll.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z
CVE-2006-7032 
PHP remote file inclusion vulnerability in phpbb/getmsg.php in FlashBB 1.1.5 and earlier allows remote attackers to execute arbitrary code via a URL in the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z
CVE-2006-7033 
Cross-site scripting (XSS) vulnerability in Super Link Exchange Script 1.0 allows remote attackers to inject arbitrary web script or HTML via IMG tags in the search box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z
CVE-2006-7034 
SQL injection vulnerability in directory.php in Super Link Exchange Script 1.0 might allow remote attackers to execute arbitrary SQL queries via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z
CVE-2006-7035 
Directory traversal vulnerability in make_thumbnail.php in Super Link Exchange Script 1.0 allows remote attackers to read arbitrary files via ".." sequences in the imgpath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z
CVE-2006-7036 
PHP remote file inclusion vulnerability in register.php for Andys Chat 4.5 allows remote attackers to execute arbitrary code via the action parameter.  NOTE: this issue was announced by an unreliable researcher, but the vendor is no longer distributing the product, so the original claims can not be evaluated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z
CVE-2006-7037 
Mathcad 12 through 13.1 allows local users to bypass the security features by directly accessing or editing the XML representation of the worksheet with a text editor or other program, which allows attackers to (1) bypass password protection by replacing the password field with a hash of a known password, (2) modify timestamps to avoid detection of modifications, (3) remove locks by removing the "is-locked" attribute, and (4) view locked data, which is stored in plaintext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z
CVE-2006-7038 
Multiple buffer overflows in MERCUR Messaging 2005 before Service Pack 4 allow remote attackers to cause a denial of service (crash) via (1) "long command lines at port 32000" and (2) certain name service queries that are not properly handled by the SMTP service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z
CVE-2006-7039 
The IMAP4 service in MERCUR Messaging 2005 before Service Pack 4 allows remote attackers to cause a denial of service (crash) via a message with a long subject field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z
CVE-2006-7040 
Unspecified vulnerability in MERCUR Messaging 2005 before Service Pack 4 allows remote attackers to cause a denial of service (crash) via a TOP command to the POP3 service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z
CVE-2006-7041 
The SMTP service in MERCUR Messaging 2005 before Service Pack 4 allows remote attackers to cause a denial of service (infinite loop) via a message in which neither the originator nor recipient address is known.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z
CVE-2006-7042 
Cross-site scripting (XSS) vulnerability in directory/index.php in Chipmunk directory allows remote attackers to inject arbitrary web script or HTML via the start parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T00:00:00.000Z
CVE-2006-7043 
Multiple cross-site scripting (XSS) vulnerabilities in Chipmunk Blogger allow remote authenticated users to inject arbitrary web script or HTML via script tags in (1) posts and (2) profile names; and (3) a javascript URI in a URL argument in the photo gallery.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T00:00:00.000Z
CVE-2006-7044 
PHP remote file inclusion vulnerability in comment.core.inc.php in Clan Manager Pro (CMPRO) 1.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the sitepath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T00:00:00.000Z
CVE-2006-7045 
PHP remote file inclusion vulnerability in Clan Manager Pro (CMPRO) 1.1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the (1) rootpath and possibly (2) sitepath parameters to (a) cmpro.ext/comment.core.inc.php and (b) cmpro.intern/comment.core.inc.php.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T00:00:00.000Z
CVE-2006-7046 
PHP remote file inclusion vulnerability in cmpro.intern/login.inc.php for Clan Manager Pro (CMPRO) 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T00:00:00.000Z
CVE-2006-7047 
include.php in Shoutpro 1.0 might allow remote attackers to bypass IP ban restrictions via a URL in the path parameter that points to an alternate bannedips.php file.  NOTE: this issue was originally reported as remote file inclusion, but CVE analysis suggests that this cannot be used for code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T00:00:00.000Z
CVE-2006-7048 
Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) clarolineRepositorySys parameter to (a) atutor.inc.php (b) db-generic.inc.php (c) docebo.inc.php (d) dokeos.1.6.inc.php (e) dokeos.inc.php (f) ganesha.inc.php (g) mambo.inc.php (h) moodle.inc.php (i) phpnuke.inc.php (j) postnuke.inc.php and (k) spip.inc.php in claroline/auth/extauth/drivers/; (2) includePath parameter in mambo.inc.php, postnuke.inc.php, and (l) inc/lib/event/init_event_manager.inc.php; and (3) rootSys parameter in (m) inc/lib/export_exe_tracking.class.php, a different set of vectors than CVE-2006-2284.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T00:00:00.000Z
CVE-2006-7049 
The Method method in WikkaWiki (Wikka Wiki) before 1.1.6.2 calls the strstr and strrpos functions with the wrong argument order, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T00:00:00.000Z
CVE-2006-7050 
Cross-site scripting (XSS) vulnerability in WikkaWiki (Wikka Wiki) before 1.1.6.2 allows remote attackers to inject arbitrary javascript via (1) events in forced links (url parameter) that are not properly handled in formatters/wakka.php, and possibly (2) other vectors in wikka.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T00:00:00.000Z
CVE-2006-7051 
The sys_timer_create function in posix-timers.c for Linux kernel 2.6.x allows local users to cause a denial of service (memory consumption) and possibly bypass memory limits or cause other processes to be killed by creating a large number of posix timers, which are allocated in kernel memory but are not treated as part of the process' memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T00:00:00.000Z
CVE-2006-7052 
Multiple PHP remote file inclusion vulnerabilities in DotWidget For Articles (dotwidgeta) 0.2 allow remote attackers to execute arbitrary code via a URL in the (1) file_path parameter to (a) index.php, (b) showcatpicks.php, and (c) showarticle.php; and the (2) admin_header_file and (3) admin_footer_file parameters to (d) admin/authors.php, (e) admin/index.php, (f) admin/categories.php, (g) admin/editconfig.php, and (h) admin/articles.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T00:00:00.000Z
CVE-2006-7053 
Unspecified vulnerability in Arkoon FAST360 UTM appliances 3.0 through 3.0/29, 3.1, 3.2, and 3.3 allows remote attackers to bypass keyword filtering in the FAST HTTP module, and signatures in the IDPS HTTP module, via crafted URLs that are "misinterpreted."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T00:00:00.000Z
CVE-2006-7054 
The DNS module in Arkoon FAST360 UTM appliances 3.0 up to 3.0/29, 3.1 through 3.3, and 4.0 allows remote attackers to cause a denial of service (reboot) via a malformed DNS message, as demonstrated by the PROTOS DNS testing suite.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T00:00:00.000Z
CVE-2006-7055 
PHP remote file inclusion vulnerability in index.php in TotalCalendar 2.30 and earlier allows remote attackers to execute arbitrary code via a URL in the inc_dir parameter, a different vector than CVE-2006-1922.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T00:00:00.000Z
CVE-2006-7056 
Multiple PHP remote file inclusion vulnerabilities in DreamCost HostAdmin 3.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) functions.php and (2) members.php.  NOTE: the index.php vector is covered by CVE-2006-0791.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T00:00:00.000Z
CVE-2006-7057 
SQL injection vulnerability in search.php in Sphider before 1.3.1c allows remote attackers to execute arbitrary SQL commands via the category parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this issue might be primary to CVE-2006-2506.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T01:00:00.000Z
CVE-2006-7058 
Multiple cross-site scripting (XSS) vulnerabilities in Sphider before 1.3.1c allow remote attackers to inject arbitrary web script or HTML via the catid parameter to (1) templates/standard/search_form.html and (2) templates/dark/search_form.html.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T01:00:00.000Z
CVE-2006-7059 
Multiple cross-site scripting (XSS) vulnerabilities in Scriptsez.net E-Dating System allow remote attackers to inject arbitrary web script or HTML via encoded entities (&#0000039) in IMG tags to (1) messages, (2) profile fields, or (3) the id parameter in a dologin operation to cindex.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T01:00:00.000Z
CVE-2006-7060 
cindex.php in Scriptsez.net E-Dating System allows remote attackers to obtain the full path via an invalid id parameter in a dologin action, which leaks the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T01:00:00.000Z
CVE-2006-7061 
Scriptsez.net E-Dating System stores data files with predictable names under the web document root with insufficient access control, which allows remote attackers to read private messages and leverage them for cross-site scripting (XSS) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T01:00:00.000Z
CVE-2006-7062 
calendar.php in Kamgaing Email System (kmail) 2.3 and earlier allows remote attackers to obtain the full path of the server via an invalid d parameter, which leaks the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T01:00:00.000Z
CVE-2006-7063 
Directory traversal vulnerability in profile.php in TinyPHPforum 3.6 and earlier allows remote attackers to include and execute arbitrary files via ".." sequences in the uname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T01:00:00.000Z
CVE-2006-7064 
Cross-site scripting (XSS) vulnerability in forum/admin.php for Invision Power Board (IPB) 2.1.6 and earlier allows remote attackers to inject arbitrary web script or HTML as the administrator via the phpinfo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-24T01:00:00.000Z
CVE-2006-7065 
Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via an IFRAME with a certain XML file and XSL stylesheet that triggers a crash in mshtml.dll when a refresh is called, probably a null pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7066 
Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by creating an object inside an iframe, deleting the frame by setting its location.href to about:blank, then accessing a property of the object within the deleted frame, which triggers a NULL pointer dereference.  NOTE: it was later reported that 7.0.6000.16473 and earlier are also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7067 
Oracle 10g R2 and possibly other versions allows remote attackers to trigger internal errors, and possibly have other impacts, via an "alter session set events" command with invalid arguments.  NOTE: this issue was originally disputed by a third party, but the dispute was retracted.  NOTE: this issue was called an "integer overflow" in the original source, but this might be incorrect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7068 
PHP remote file inclusion vulnerability in CliServ Web Community 0.65 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cl_headers parameter to (1) menu.php3 and (2) login.php3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7069 
PHP remote file inclusion vulnerability in smarty_config.php in Socketwiz Bookmarks 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the root_dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7070 
Unrestricted file upload vulnerability in manager/media/ibrowser/scripts/rfiles.php in Etomite CMS 0.6.1 and earlier allows remote attackers to upload and execute arbitrary files via an nfile[] parameter with a filename that contains a .php extension followed by a valid image extension such as .gif or .jpg, then calling the rename function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7071 
SQL injection vulnerability in classes/class_session.php in Invision Power Board (IPB) 2.1 up to 2.1.6 allows remote attackers to execute arbitrary SQL commands via the CLIENT_IP parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7072 
Cross-site scripting (XSS) vulnerability in GeoClassifieds Enterprise 2.0.5.2 and earlier allows remote attackers to inject arbitrary web script and HTML via the (1) b[username] and (2) c parameters to (a) index.php, the b[username] parameter to (b) admin/index.php, and (3) c[phone] parameter to register.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7073 
Cross-site scripting (XSS) vulnerability in Opentools Attachment Mod before 2.4.5 allows remote attackers to inject arbitrary web script or HTML in Internet Explorer via unknown vectors related to the uploaded attachments form.  NOTE: some details were obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7074 
admin.php in SmartSiteCMS 1.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the userName cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7075 
Buffer overflow in the meta_read_flac function in meta_decoder.c for Aqualung 0.9beta5 and earlier, and CVS 0.193.2 and earlier, allows user-assisted attackers to execute arbitrary code via a long Vorbis comment in a Free Lossless Audio Codec (FLAC) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7076 
Cross-site scripting (XSS) vulnerability in guestbook.php in Advanced Guestbook 2.4 for phpBB allows remote attackers to inject arbitrary web script or HTML via the entry parameter.  NOTE: this issue might be resultant from SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7077 
SQL injection vulnerability in guestbook.php in Advanced Guestbook 2.4 for phpBB allows remote attackers to execute arbitrary SQl commands via the entry parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7078 
Multiple cross-site scripting (XSS) vulnerabilities in Professional Home Page Tools Login Script, as of July 2006, allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) vorname, and (3) nachname parameters in the register script.  NOTE: some details have been obtained from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7079 
Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite arbitrary program variables and conduct directory traversal attacks to execute arbitrary code by modifying the $xoopsOption['pagetype'] variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7080 
Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to delete arbitrary files via ".." sequences in the old_avatar parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7081 
Multiple PHP remote file inclusion vulnerabilities in PhpNews 1.0 allow remote attackers to execute arbitrary PHP code via the Include parameter to (1) Include/lib.inc.php3 and (2) Include/variables.php3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7082 
Rigter Portal System (RPS) 1.0, 2.0, and 3.0 allows remote attackers to bypass authentication and upload arbitrary files via direct requests to (1) adm/photos/images.php and (2) adm/down/files.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7083 
Directory traversal vulnerability in index.php in Rigter Portal System (RPS) 1.0, 2.0, and 3.0 allows remote attackers to read arbitrary files via ".." sequences in the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7085 
Rigter Portal System (RPS) 1.0, 2.0, and 3.0 allows remote attackers to add arbitrary content and conduct XSS attacks via a direct request to add_art.php.  NOTE: this issue was originally reported as SQL injection, but this is not likely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-27T18:00:00.000Z
CVE-2006-7086 
The (1) dlback.php and (2) dlback.cgi scripts in Hot Links allow remote attackers to obtain sensitive information and download the database via a direct request with a modified dl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-28T00:00:00.000Z
CVE-2006-7087 
CRLF injection vulnerability in the mail function in Dotdeb PHP before 5.2.0 Rev 3 allows remote attackers to bypass the protection scheme and inject arbitrary email headers via CRLF sequences in the query string, which is processed via the PHP_SELF variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-28T00:00:00.000Z
CVE-2006-7088 
Multiple SQL injection vulnerabilities in Simple PHP Forum before 0.4 allow remote attackers to execute arbitrary SQL commands via the username parameter to (1) logon_user.php and (2) update_profile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-28T00:00:00.000Z
CVE-2006-7089 
SQL injection vulnerability in connexion.php in Ban 0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-28T00:00:00.000Z