rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-0185 
Multiple cross-site scripting vulnerabilities in the (1) Pool or (2) News Modules in Php-Nuke allow remote attackers to inject arbitrary web script or HTML via javascript in the SRC attribute of an IMG tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-12T11:00:00.000Z
CVE-2006-0187 
By design, Microsoft Visual Studio 2005 automatically executes code in the Load event of a user-defined control (UserControl1_Load function), which allows user-assisted attackers to execute arbitrary code by tricking the user into opening a malicious Visual Studio project file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-12T11:00:00.000Z
CVE-2006-0188 
webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the right_frame parameter.  NOTE: this has been called a cross-site scripting (XSS) issue, but it is different than what is normally identified as XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-24T00:00:00.000Z
CVE-2006-0189 
Buffer overflow in eStara Softphone 3.0.1.14 through 3.0.1.46 allows remote attackers to execute arbitrary code via a long attribute (aka "a") field in the SDP data of a SIP packet on UDP port 5060.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T11:00:00.000Z
CVE-2006-0190 
Unspecified vulnerability in Sun Solaris 9 and 10 for the x86 platform allows local users to gain privileges or cause a denial of service (panic) via unspecified vectors, possibly involving functions from the mm driver.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T11:00:00.000Z
CVE-2006-0191 
Unspecified vulnerability in Sun Solaris 10 allows local users to cause a denial of service (null dereference) via unspecified vectors involving the use of the find command on the "/proc" filesystem. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this is related to CVE-2005-3250.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T11:00:00.000Z
CVE-2006-0192 
SQL injection vulnerability in Login_Validate.asp in ASPSurvey 1.10 allows remote attackers to execute arbitrary SQL commands via the Password parameter to login.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T11:00:00.000Z
CVE-2006-0193 
Cross-site scripting (XSS) vulnerability in the Hosting Control Panel (psoft.hsphere.CP) in Positive Software H-Sphere 2.4.3 Patch 8 and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter in a login action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T11:00:00.000Z
CVE-2006-0194 
Cross-site scripting (XSS) vulnerability in default.asp in FogBugz 4.029, and other versions before 4.0.33, allows remote attackers to inject arbitrary web script or HTML via the dest parameter in the pgLogon page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T11:00:00.000Z
CVE-2006-0195 
Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via style sheet specifiers with invalid (1) "/*" and "*/" comments, or (2) a newline in a "url" specifier, which is processed by certain web browsers including Internet Explorer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-24T00:00:00.000Z
CVE-2006-0196 
Unspecified vulnerability in Serial line sniffer (aka slsnif) 0.4.4 allows local users to gain privileges via a long value of the HOME environment variable, possibly because of a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T23:00:00.000Z
CVE-2006-0197 
The XClientMessageEvent struct used in certain components of X.Org 6.8.2 and earlier, possibly including (1) the X server and (2) Xlib, uses a "long" specifier for elements of the l array, which results in inconsistent sizes in the struct on 32-bit versus 64-bit platforms, and might allow attackers to cause a denial of service (application crash) and possibly conduct other attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T23:00:00.000Z
CVE-2006-0198 
Cross-site scripting (XSS) vulnerability in a certain module, possibly poll or Pool, for XOOPS allows remote attackers to inject arbitrary web script or HTML via JavaScript in the SRC attribute of an IMG element in a comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T23:00:00.000Z
CVE-2006-0199 
SQL injection vulnerability in news.asp in Mini-Nuke CMS System 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the hid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T23:00:00.000Z
CVE-2006-0200 
Format string vulnerability in the error-reporting feature in the mysqli extension in PHP 5.1.0 and 5.1.1 might allow remote attackers to execute arbitrary code via format string specifiers in MySQL error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T23:00:00.000Z
CVE-2006-0201 
Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50, and possibly earlier versions, allows remote attackers to enter false payment entries into the log file via HTTP POST requests to ipn_success.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T23:00:00.000Z
CVE-2006-0202 
Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier has (1) world-readable permissions for ipn/logs/ipn_success.txt, which allows local users to view sensitive information (payment data), and (2) world-writable permissions for ipn/logs, which allows local users to delete or replace payment data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T23:00:00.000Z
CVE-2006-0203 
membership.asp in Mini-Nuke CMS System 1.8.2 and earlier does not verify the old password when changing a password, which allows remote attackers to change the passwords of other members via a lostpassnew action with a modified x parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T23:00:00.000Z
CVE-2006-0204 
Multiple cross-site scripting (XSS) vulnerabilities in Wordcircle 2.17 allow remote attackers to inject arbitrary web script or HTML via (1) the "Course name" field in index.php when the frm parameter has the value "mine" and (2) possibly certain other fields in unspecified scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T23:00:00.000Z
CVE-2006-0205 
Multiple SQL injection vulnerabilities in Wordcircle 2.17 allow remote attackers to (1) execute arbitrary SQL commands and bypass authentication via the password field in the login action to index.php (involving v_login.php and s_user.php) and (2) have other unknown impact via certain other fields in unspecified scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T23:00:00.000Z
CVE-2006-0206 
Eval injection vulnerability in Light Weight Calendar (LWC) 1.0 (20040909) and earlier allows remote attackers to execute arbitrary PHP code via the date parameter in cal.php, which is included by index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T23:00:00.000Z
CVE-2006-0207 
Multiple HTTP response splitting vulnerabilities in PHP 5.1.1 allow remote attackers to inject arbitrary HTTP headers via a crafted Set-Cookie header, related to the (1) session extension (aka ext/session) and the (2) header function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T23:00:00.000Z
CVE-2006-0208 
Multiple cross-site scripting (XSS) vulnerabilities in PHP 4.4.1 and 5.1.1, when display_errors and html_errors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-13T23:00:00.000Z
CVE-2006-0209 
SQL injection vulnerability in general_functions.php in TankLogger 2.4 allows remote attackers to execute arbitrary SQL commands via the (1) livestock_id parameter to showInfo.php and (2) tank_id parameter, possibly to livestock.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-14T01:00:00.000Z
CVE-2006-0210 
Cross-site scripting (XSS) vulnerability in index.php in Interspire TrackPoint NX before 0.1 allows remote attackers to inject arbitrary web script or HTML via the username parameter when using the Login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-14T01:00:00.000Z
CVE-2006-0211 
Cross-site scripting (XSS) vulnerability in forgotPassword.asp in Helm Hosting Control Panel 3.2.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the txtEmailAddress parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-14T01:00:00.000Z
CVE-2006-0212 
Directory traversal vulnerability in OBEX Push services in Toshiba Bluetooth Stack 4.00.23(T) and earlier allows remote attackers to upload arbitrary files to arbitrary remote locations specified by .. (dot dot) sequences, as demonstrated by ..\\ sequences in the RFILE argument of ussp-push.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-14T01:00:00.000Z
CVE-2006-0213 
Kolab Server 2.0.1, 2.0.2 and development versions pre-2.1-20051215 and earlier, when authenticating users via secure SMTP, stores authentication credentials in plaintext in the postfix.log file, which allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-14T01:00:00.000Z
CVE-2006-0214 
Eval injection vulnerability in ezDatabase 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the db_id parameter to visitorupload.php, as demonstrated using phpinfo and include function calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-15T11:00:00.000Z
CVE-2006-0215 
Cross-site scripting (XSS) vulnerability in admin.php in QualityEBiz Quality PPC (QPPC) 1.0 build 1644 allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.  NOTE: this issue might be resultant from CVE-2006-0216.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T19:00:00.000Z
CVE-2006-0216 
admin.php in QualityEBiz Quality PPC (QPPC) 1.0 build 1644 allows remote attackers to obtain sensitive information, possibly the installation path of the application, via unspecified "meta characters" to the cpage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T19:00:00.000Z
CVE-2006-0217 
Multiple cross-site scripting (XSS) vulnerabilities in Ultimate Auction 3.67 allow remote attackers to inject arbitrary web script or HTML via the (1) item parameter in item.pl and (2) category parameter in itemlist.pl, which reflects the XSS in an error message. NOTE: the affected version might be wrong since the current version as of 20060116 is 3.6.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T19:00:00.000Z
CVE-2006-0218 
Multiple unspecified vulnerabilities in MyBulletinBoard (MyBB) before 1.0.2 have unspecified impact and attack vectors, related to (1) admin/moderate.php, (2) admin/themes.php, (3) inc/functions.php, (4) inc/functions_upload.php, (5) printthread.php, and (6) usercp.php, and probably related to SQL injection.  NOTE: it is likely that this issue subsumes CVE-2005-4602 and CVE-2005-4603.  However, since the vendor advisory is vague and additional files are mentioned, is is likely that this contains at least one distinct vulnerability from CVE-2005-4602 and CVE-2005-4603.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2006-0219 
The original distribution of MyBulletinBoard (MyBB) to update from older versions to 1.0.2 omits or includes older versions of certain critical files, which allows attackers to conduct (1) SQL injection attacks via an attachment name that is not properly handled by inc/functions_upload.php (CVE-2005-4602), and possibly (2) other attacks related to threadmode in usercp.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2006-0220 
Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 5.3 through 6.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the day parameter in calendar.php and (2) the input form in search.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  It is possible that this issue is resultant from an SQL injection problem in CVE-2005-4227.3 and CVE-2005-4227.13.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2006-0221 
SQL injection vulnerability in index.asp in the Admin Panel in Dragon Design Services Network (DDSN) cm3 content manager (CM3CMS) allows remote attackers to execute arbitrary SQL commands via the (1) username or (2) password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2006-0222 
Cross-site scripting (XSS) vulnerability in fullview.php in AlstraSoft Template Seller Pro allows remote attackers to inject arbitrary web script or HTML via the tempid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2006-0223 
Directory traversal vulnerability in Shanghai TopCMM 123 Flash Chat Server Software 5.1 allows attackers to create or overwrite arbitrary files on the server via ".." (dot dot) sequences in the username field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-16T21:00:00.000Z
CVE-2006-0224 
Buffer overflow in Library of Assorted Spiffy Things (LibAST) 0.6.1 and earlier, as used in Eterm and possibly other software, allows local users to execute arbitrary code as the utmp user via a long -X command line argument (alternative configuration file name).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T02:00:00.000Z
CVE-2006-0225 
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T11:00:00.000Z
CVE-2006-0226 
Integer overflow in IEEE 802.11 network subsystem (ieee80211_ioctl.c) in FreeBSD before 6.0-STABLE, while scanning for wireless networks, allows remote attackers to execute arbitrary code by broadcasting crafted (1) beacon or (2) probe response frames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-19T01:00:00.000Z
CVE-2006-0227 
Multiple unspecified vulnerabilities in lpsched in Sun Solaris 8, 9, and 10 allow local users to delete arbitrary files or disable the LP print service via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-17T20:00:00.000Z
CVE-2006-0228 
The RBAC functionality in grsecurity before 2.1.8 does not properly handle when the admin role creates a service and then exits the shell without unauthenticating, which causes the service to be restarted with the admin role still active.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-17T21:00:00.000Z
CVE-2006-0229 
Unquoted Windows search path vulnerability in Wehntrust might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run when Wehntrust creates the autostart key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-17T21:00:00.000Z
CVE-2006-0230 
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remote attackers to gain administrator privileges via a modified client that sends certain XML requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-25T01:00:00.000Z
CVE-2006-0231 
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses the same private DSA key for each installation, which allows remote attackers to conduct man-in-the-middle attacks and decrypt communications.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-25T01:00:00.000Z
CVE-2006-0232 
Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, stores sensitive log and virus definition files under the web root with insufficient access control, which allows remote attackers to obtain the information via direct requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-25T01:00:00.000Z
CVE-2006-0233 
Cross-site scripting (XSS) vulnerability in functions.php in microBlog 2.0 RC-10 allows remote attackers to inject arbitrary web script and HTML via a javascript: URI in a [url] BBcode tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-18T00:00:00.000Z
CVE-2006-0234 
SQL injection vulnerability in index.php in microBlog 2.0 RC-10 allows remote attackers to execute arbitrary SQL commands via the (1) month and (2) year parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-18T00:00:00.000Z
CVE-2006-0235 
SQL injection vulnerability in WhiteAlbum 2.5 allows remote attackers to execute arbitrary SQL commands via the dir parameter to pictures.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-18T01:00:00.000Z
CVE-2006-0236 
GUI display truncation vulnerability in Mozilla Thunderbird 1.0.2, 1.0.6, and 1.0.7 allows user-assisted attackers to execute arbitrary code via an attachment with a filename containing a large number of spaces ending with a dangerous extension that is not displayed by Thunderbird, along with an inconsistent Content-Type header, which could be used to trick a user into downloading dangerous content by dragging or saving the attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-18T01:00:00.000Z
CVE-2006-0237 
Cross-site scripting (XSS) vulnerability in index.php in GTP iCommerce allows remote attackers to inject arbitrary web script or HTML via the (1) cat and (2) subcat parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-18T01:00:00.000Z
CVE-2006-0238 
SQL injection vulnerability in wp-stats.php in GaMerZ WP-Stats 2.0 allows remote attackers to execute arbitrary SQL commands via the author parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-18T01:00:00.000Z
CVE-2006-0239 
Multiple cross-site scripting (XSS) vulnerabilities in Simple Blog 2.1 allow remote attackers to inject arbitrary web script or HTML via (1) a comment to comments.asp and (2) possibly certain other fields in unspecified scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-18T01:00:00.000Z
CVE-2006-0240 
Multiple SQL injection vulnerabilities in Simple Blog 2.1 allow remote attackers to execute arbitrary SQL commands via the month parameter in an archives view operation and possibly certain other parameters in unspecified scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-18T01:00:00.000Z
CVE-2006-0241 
Cross-site scripting vulnerability in WBNews 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-18T01:00:00.000Z
CVE-2006-0242 
Cross-site scripting vulnerability in index.php in PHP Fusebox 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-18T01:00:00.000Z
CVE-2006-0243 
Cross-site scripting (XSS) vulnerability in SMBCMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the text parameter, which is used by the "Search Site" field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-18T02:00:00.000Z
CVE-2006-0244 
Directory traversal vulnerability in workspaces.php in phpXplorer 0.9.33 allows remote attackers to include arbitrary files via a .. (dot dot) and trailing null byte (%00) in the sShare parameter.  NOTE: a followup post claims that this is not a vulnerability since the functionality of phpXplorer supports the upload of PHP files, which would not cross privilege boundaries since the PHP functionality would support read access outside the web root
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-18T02:00:00.000Z
CVE-2006-0245 
Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.7-pl1 allow remote attackers to inject arbitrary web script or HTML via the (3) redir, (4) productId, (5) docId, (6) act, and (7) catId parameters in index.php; and the (8) username field in a login action in index.php.  NOTE: the cart.php/redir and index.php/searchStr vectors are already covered by CVE-2005-3152.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-18T02:00:00.000Z
CVE-2006-0246 
Cross-site scripting (XSS) vulnerability in down.pl in Widexl Download Tracker 1.06 allows remote attackers to inject arbitrary web script or HTML via the ID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-18T02:00:00.000Z
CVE-2006-0247 
Cross-site scripting (XSS) vulnerability in anyboard.cgi in Netbula Anyboard 9.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the tK parameter in a find command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-18T02:00:00.000Z
CVE-2006-0248 
Virata-EmWeb web server 6_1_0, as used in (1) Intracom JetSpeed 500 and 520 and (2) Allied Data Technologies CopperJet 811 RouterPlus, allows remote attackers to access privileged information, such as user lists and configuration settings, via direct HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-18T02:00:00.000Z
CVE-2006-0249 
SQL injection vulnerability in viewcat.php in BitDamaged geoBlog MOD_1.0 allows remote attackers to execute arbitrary SQL commands, then steal credentials and upload files, via the cat parameter ($tmpCategory variable).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-18T02:00:00.000Z