rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-1592 
Buffer overflow in the is_client_wad_ok function in w_wad.cpp for (1) Zdaemon 1.08.01 and (2) X-Doom allows remote attackers to execute arbitrary code via a long filename argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-03T10:00:00.000Z
CVE-2006-1593 
The (1) ZD_MissingPlayer, (2) ZD_UseItem, and (3) ZD_LoadNewClientLevel functions in sv_main.cpp for (a) Zdaemon 1.08.01 and (b) X-Doom allows remote attackers to cause a denial of service (crash) via an invalid player slot or item number, which causes an invalid memory access, possibly due to an invalid array index.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-03T10:00:00.000Z
CVE-2006-1594 
Multiple directory traversal vulnerabilities in document/rqmkhtml.php in Claroline 1.7.4 and earlier allow remote attackers to use ".." (dot dot) sequences to (1) read arbitrary files via the file parameter in a rqEditHtml command to document/rqmkhtml.php or (2) execute arbitrary code via the includePath parameter to learnPath/include/scormExport.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-03T10:00:00.000Z
CVE-2006-1595 
Cross-site scripting (XSS) vulnerability in document/rqmkhtml.php in Claroline 1.7.4 and earlier allows remote attackers to read arbitrary files via ".." sequences in the file parameter in a rqEditHtml command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-03T10:00:00.000Z
CVE-2006-1596 
PHP remote file inclusion vulnerability in learnPath/include/scormExport.inc.php in Claroline 1.7.4 and earlier allows remote attackers to execute arbitrary PHP code via the includePath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-03T10:00:00.000Z
CVE-2006-1598 
AN HTTPD 1.42n, and possibly other versions before 1.42p, allows remote attackers to obtain source code of scripts via crafted requests with (1) dot and (2) space characters in the file extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-03T17:00:00.000Z
CVE-2006-1599 
Unspecified vulnerability in VCEngine.php in v-creator before 1.3-pre3, when the VC_CRYPTO_METHOD option is OPENSSL, allows remote attackers to execute arbitrary commands, possibly due to problems in the (1) encrypt and (2) decrypt functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-03T17:00:00.000Z
CVE-2006-1600 
SQL injection vulnerability in category.php in PhpWebGallery 1.4.1 allows remote attackers to execute arbitrary SQL commands via the search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-03T17:00:00.000Z
CVE-2006-1601 
Unspecified vulnerability in SunPlex Manager in Sun Cluster 3.1 4/04 allows local users with solaris.cluster.gui authorization to view arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-04T10:00:00.000Z
CVE-2006-1602 
PHP remote file inclusion vulnerability in includes/functions_common.php in the VWar Account module (vWar_Account) in PHPNuke Clan 3.0.1 allows remote attackers to include arbitrary files via a URL in the vwar_root2 parameter.  NOTE: it is possible that this issue stems from a problem in VWar itself, but this is not clear.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-04T10:00:00.000Z
CVE-2006-1603 
Cross-site scripting (XSS) vulnerability in profile.php in phpBB 2.0.19 allows remote attackers to inject arbitrary web script or HTML via the cur_password parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-04T10:00:00.000Z
CVE-2006-1604 
Unspecified vulnerability in Exponent CMS before 0.96.5 RC 1 has unknown impact and remote attack vectors related to variables that are not "typecasted."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-04T10:00:00.000Z
CVE-2006-1605 
Unspecified vulnerability in the image module in Exponent CMS before 0.96.5 RC 1 allows remote attackers to execute arbitrary code via unknown vectors involving "parsed PHP."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-04T10:00:00.000Z
CVE-2006-1606 
Unspecified vulnerability in the image module in Exponent CMS before 0.96.5 RC 1 allows "directory disclosure" with unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-04T10:00:00.000Z
CVE-2006-1607 
Unspecified vulnerability in the banner module in Exponent CMS before 0.96.5 RC 1 allows "php injection" via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-04T10:00:00.000Z
CVE-2006-1608 
The copy function in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass safe mode and read arbitrary files via a source argument containing a compress.zlib:// URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-10T19:00:00.000Z
CVE-2006-1609 
Unspecified vulnerability in Hitachi XFIT/S, XFIT/S/JCA, XFIT/S/ZGN, and XFIT/S ZENGIN TCP/IP Procedure allows remote attackers to cause a denial of service (server process and transfer control process stop) when the products "receive data unexpectedly".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-04T10:00:00.000Z
CVE-2006-1610 
PHP remote file inclusion vulnerability in lib/armygame.php in SQuery 4.5 and earlier, as used in products such as Autonomous LAN party (ALP), allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter.  NOTE: this only occurs when register_globals is disabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-04T10:00:00.000Z
CVE-2006-1611 
Directory traversal vulnerability in KGB Archiver before 1.1.5.22 allows remote attackers to overwrite arbitrary files wile decompressing an archive, possibly due to directory traversal sequences in a filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-04T10:00:00.000Z
CVE-2006-1612 
Multiple cross-site scripting (XSS) vulnerabilities in visview.php in aWebNews 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) yname, (2) emailadd, (3) subject, and (4) comment parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-04T10:00:00.000Z
CVE-2006-1613 
Multiple SQL injection vulnerabilities in aWebNews 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) user123 variable in (a) login.php or (b) fpass.php; or (2) cid parameter to (c) visview.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-04T10:00:00.000Z
CVE-2006-1614 
Integer overflow in the cli_scanpe function in the PE header parser (libclamav/pe.c) in Clam AntiVirus (ClamAV) before 0.88.1, when ArchiveMaxFileSize is disabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T22:00:00.000Z
CVE-2006-1615 
Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code.  NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are actually being sanitized properly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T22:00:00.000Z
CVE-2006-1616 
Multiple SQL injection vulnerabilities in Advanced Poll 2.02 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to comments.php or (2) poll_id parameter to page.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-05T10:00:00.000Z
CVE-2006-1617 
Multiple cross-site scripting (XSS) vulnerabilities in Advanced Poll 2.02 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to comments.php or (2) poll_id parameter to page.php.  NOTE: it is possible that this issue is resultant from CVE-2006-1616.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-05T10:00:00.000Z
CVE-2006-1618 
Format string vulnerability in the (1) Con_message and (2) conPrintf functions in con_main.c in Doomsday engine 1.8.6 allows remote attackers to execute arbitrary code via format string specifiers in an argument to the JOIN command, and possibly other command arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-05T10:00:00.000Z
CVE-2006-1619 
IBM WebSphere Application Server 4.0.1 through 4.0.3 allows remote attackers to cause a denial of service (application crash) via an HTTP request with a large header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-05T10:00:00.000Z
CVE-2006-1620 
admin/accounts/AccountActions.asp in Hosting Controller 2002 RC 1 allows remote attackers to modify passwords of other users, probably via an "Update User" ActionType with a modified UserName parameter and the PassCheck parameter set to TRUE.  It was later reported that the vulnerability is present in 6.1 Hotfix 3.3 and earlier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-05T10:00:00.000Z
CVE-2006-1621 
Directory traversal vulnerability in admin/folders/saveuploadfiles.asp in Hosting Controller 2002 RC 1 allows remote authenticated users to overwrite arbitrary files via an absolute path in the OpenPath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-05T10:00:00.000Z
CVE-2006-1622 
Cross-site scripting (XSS) vulnerability in PHPSelect linksubmit allows remote attackers to inject arbitrary web script or HTML via (1) the description parameter to linklist.php and possibly other vectors involving (2) index.php and (3) linksubmit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-05T10:00:00.000Z
CVE-2006-1623 
Unspecified vulnerability in main.php in an unspecified "file created by Andries Bruinsma," possibly a FleXiBle Development (FXB) application, allows remote attackers to include and execute arbitrary PHP code.  NOTE: this disclosure is extremely vague and has very little information about the specific vulnerability type.  In addition, there is little public information on the named product. Finally, an XSS vector is implied in the subject line, but because there is no other information and evidence of a cut-and-paste error, it will not be assigned a separate CVE identifier unless additional information is provided.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-05T10:00:00.000Z
CVE-2006-1624 
The default configuration of syslogd in the Linux sysklogd package does not enable the -x (disable name lookups) option, which allows remote attackers to cause a denial of service (traffic amplification) via messages with spoofed source IP addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-05T10:00:00.000Z
CVE-2006-1625 
Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.10 allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a BBCode email tag, as demonstrated using the onmousemove event.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-05T10:00:00.000Z
CVE-2006-1626 
Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading.  NOTE: this is a different vulnerability than CVE-2006-1192.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-05T10:00:00.000Z
CVE-2006-1627 
Adobe Document Server for Reader Extensions 6.0 does not provide proper access control, which allows remote authenticated users to perform privileged actions by modifying the (1) actionID and (2) pageID parameters.  NOTE: due to an error during reservation, this identifier was inadvertently associated with multiple issues.  Other CVE identifiers have been assigned to handle other problems that are covered by the same disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T18:00:00.000Z
CVE-2006-1628 
Adobe LiveCycle Workflow 7.01 and LiveCycle Forum Manager 7.01 allows users to authenticate and perform privileged actions when their account is marked "OBSOLETE" but the account is also active, within the authentication system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-13T18:00:00.000Z
CVE-2006-1629 
OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LD_PRELOAD environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T22:00:00.000Z
CVE-2006-1630 
The cli_bitset_set function in libclamav/others.c in Clam AntiVirus (ClamAV) before 0.88.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger an "invalid memory access."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T22:00:00.000Z
CVE-2006-1631 
Unspecified vulnerability in the HTTP compression functionality in Cisco CSS 11500 Series Content Services switches allows remote attackers to cause a denial of service (device reload) via (1) "valid, but obsolete" or (2) "specially crafted" HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-05T18:00:00.000Z
CVE-2006-1634 
Cross-site scripting (XSS) vulnerability in index.php in LucidCMS 2.0.0 RC4 allows remote attackers to inject arbitrary web script or HTML via the command parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1635 
LucidCMS 2.0.0 RC4 allows remote attackers to obtain sensitive information via a direct request to /lucid_phplib/translator.php, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1636 
PHP remote file inclusion vulnerability in get_header.php in VWar 1.5.0 R12 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter.  NOTE: this is a different vulnerability than CVE-2006-1503.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1637 
Multiple cross-site scripting (XSS) vulnerabilities in aWebBB 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) tname or (2) fpost parameters to (a) post.php; (3) fullname, (4) emailadd, (5) country, (6) sig, or (7) otherav parameters to (b) editac.php; or (8) fullname, (9) emailadd, or (10) country parameters to (c) register.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1638 
Multiple SQL injection vulnerabilities in aWebBB 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) Username parameter to (a) accounts.php, (b) changep.php, (c) editac.php, (d) feedback.php, (e) fpass.php, (f) login.php, (g) post.php, (h) reply.php, or (i) reply_log.php; (2) p parameter to (j) dpost.php; (3) c parameter to (k) list.php or (l) ndis.php; or (12) q parameter to (m) search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1639 
SQL injection vulnerability in index.php in wpBlog 0.4 allows remote attackers to execute arbitrary SQL commands via the postid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1640 
Cross-site scripting (XSS) vulnerability in news.php in CzarNews 1.14 allows remote attackers to inject arbitrary web script or HTML via the email parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1641 
Multiple SQL injection vulnerabilities in CzarNews 1.14 allow remote attackers to execute arbitrary SQL commands via the (1) usern or (2) passw parameters to (a) cn_auth.php, (3) s parameter to (b) news.php, or (4) a parameter to (c) dpost.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1642 
Cross-site scripting (XSS) vulnerability in Interact 2.1.1 allows remote attackers to inject arbitrary web script or HTML via (1) the search_terms parameter to (a) search.php, and (2) the first_name, (3) last_name, (4) email, (5) password, and (6) confirm_password parameters to (b) userinput.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party.  In addition, the lack of precision in the third party descriptions makes it unclear whether the named vectors are correct.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1643 
SQL injection vulnerability in login.php in Interact 2.1.1 allows remote attackers to execute arbitrary SQL commands via the user_name parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1644 
login.php in Interact 2.1.1 generates different responses depending on whether or not a username is valid, which allows remote attackers to determine valid usernames.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1645 
Cross-site scripting (XSS) vulnerability in Anton Vlasov and Rostislav Gaitkuloff ReloadCMS 1.2.5 and earlier allows remote attackers to inject arbitrary web script or HTML and gain leverage to execute arbitrary PHP code via the User-Agent HTTP header, which is displayed by admin/modules/general/statistic.php in the administration panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1646 
The Internet Key Exchange version 1 (IKEv1) implementation (isakmp_agg.c) in the Shoichi Sakane KAME Project racoon, as used by NetBSD 1.6, 2.x before 20060119, certain FreeBSD releases, and possibly other distributions of BSD or Linux operating systems, when running in aggressive mode, allows remote attackers to cause a denial of service (daemon crash) via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1647 
An unspecified "logical programming mistake" in SMART SynchronEyes Student and Teacher 6.0, and possibly earlier versions, allows remote attackers to cause a denial of service via a large packet to the Teacher discovery port (UDP port 5496), which causes a thread to terminate and prevents communications on that port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1648 
SMART SynchronEyes Student and Teacher 6.0, and possibly earlier versions, allows remote attackers to cause a denial of service (memory consumption) via a certain packet to the Teacher discovery port that causes SynchronEyes to connect to the attacker's machine and read a value that is used as a parameter to malloc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1649 
The "restore to" selection in the "quarantine a file" capability of ESET NOD32 before 2.51.26 allows a restore to any directory that permits read access by the invoking user, which allows local users to create new files despite write-access directory permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1650 
Firefox 1.5.0.1 allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading.  NOTE: a followup was unable to replicate this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1651 
Microsoft ISA Server 2004 allows remote attackers to bypass certain filtering rules, including ones for (1) ICMP and (2) TCP, via IPv6 packets.  NOTE: An established researcher has disputed this issue, saying that "Neither ISA Server 2004 nor Windows 2003 Basic Firewall support IPv6 filtering ... This is different network protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1652 
Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-assisted remote attackers to execute arbitrary code via a malicious server that sends a long string to a client that connects on TCP port 5900, which triggers an overflow in Log::ReallyPrint; and (2) allow remote attackers to cause a denial of service (server crash) via a long HTTP GET request to TCP port 5800, which triggers an overflow in VNCLog::ReallyPrint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1653 
PHP remote file inclusion vulnerability in loadkernel.php in AngelineCMS 0.8.1 allows remote attackers to execute arbitrary PHP code via a URL in the installPath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1654 
Directory traversal vulnerability in the HP Color LaserJet 2500 Toolbox and Color LaserJet 4600 Toolbox on Microsoft Windows before 20060402 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request to TCP port 5225.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1655 
Multiple buffer overflows in mpg123 0.59r allow user-assisted attackers to trigger a segmentation fault and possibly have other impacts via a certain MP3 file, as demonstrated by mpg1DoS3.  NOTE: this issue might be related to CVE-2004-0991, but it is not clear.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z
CVE-2006-1656 
vserver in util-vserver 0.30.209 executes a command as root when the suexec userid parameter is invalid and non-numeric, which might cause local users to inadvertently execute dangerous commands as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-06T10:00:00.000Z