rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-0370 
Noah Medling RCBlog 1.03 stores the data and config directories under the web root with insufficient access control, which allows remote attackers to view account names and MD5 password hashes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-22T20:00:00.000Z
CVE-2006-0371 
Directory traversal vulnerability in index.php in Noah Medling RCBlog 1.03 allows remote attackers to read arbitrary .txt files, possibly including one that stores the administrator's account name and password, via a .. (dot dot) in the post parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-22T20:00:00.000Z
CVE-2006-0372 
Multiple SQL injection vulnerabilities in config.php in Insane Visions BlogPHP, possibly 1.0, allow remote attackers to execute arbitrary SQL commands via the (1) blogphp_username or (2) blogphp_password parameter in a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-22T20:00:00.000Z
CVE-2006-0373 
Cross-site scripting (XSS) vulnerability in register.aspx in Douran FollowWeb allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-22T20:00:00.000Z
CVE-2006-0374 
Advantage Century Telecommunication (ACT) P202S IP Phone 1.01.21 running firmware 1.1.21 has multiple undocumented ports available, which (1) might allow remote attackers to obtain sensitive information, such as memory contents and internal operating-system data, by directly accessing the VxWorks WDB remote debugging ONCRPC (aka wdbrpc) on UDP 17185, (2) reflect network data using echo (TCP 7), or (3) gain access without authentication using rlogin (TCP 513).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-22T20:00:00.000Z
CVE-2006-0375 
Advantage Century Telecommunication (ACT) P202S IP Phone 1.01.21 running firmware 1.1.21 on VxWorks uses a hardcoded Network Time Protocol (NTP) server in Taiwan, which could allow remote attackers to provide false time information, block access to time information, or conduct other attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-22T20:00:00.000Z
CVE-2006-0376 
The 802.11 wireless client in certain operating systems including Windows 2000, Windows XP, and Windows Server 2003 does not warn the user when (1) it establishes an association with a station in ad hoc (aka peer-to-peer) mode or (2) a station in ad hoc mode establishes an association with it, which allows remote attackers to put unexpected wireless communication into place.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-22T20:00:00.000Z
CVE-2006-0377 
CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP commands via newline characters in the mailbox parameter of the sqimap_mailbox_select command, aka "IMAP injection."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-24T00:00:00.000Z
CVE-2006-0378 
Cross-site scripting (XSS) vulnerability in Netrix X-Site Manager allows remote attackers to inject arbitrary web script or HTML via the product_id parameter, as originally demonstrated for a custom mp3players_details.php program.  NOTE: the name of the affected program might be installation-dependent, but it has been identified as "product_details.php" by some sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-23T20:00:00.000Z
CVE-2006-0379 
FreeBSD kernel 5.4-STABLE and 6.0 does not completely initialize a buffer before making it available to userland, which could allow local users to read portions of kernel memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T22:00:00.000Z
CVE-2006-0380 
A logic error in FreeBSD kernel 5.4-STABLE and 6.0 causes the kernel to calculate an incorrect buffer length, which causes more data to be copied to userland than intended, which could allow local users to read portions of kernel memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T22:00:00.000Z
CVE-2006-0381 
A logic error in the IP fragment cache functionality in pf in FreeBSD 5.3, 5.4, and 6.0, and OpenBSD, when a 'scrub fragment crop' or 'scrub fragment drop-ovl' rule is being used, allows remote attackers to cause a denial of service (crash) via crafted packets that cause a packet fragment to be inserted twice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T22:00:00.000Z
CVE-2006-0382 
Apple Mac OS X 10.4.5 and allows local users to cause a denial of service (crash) via an undocumented system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-14T22:00:00.000Z
CVE-2006-0383 
IPSec when used with VPN networks in Mac OS X 10.4 through 10.4.5 allows remote attackers to cause a denial of service (application crash) via unspecified vectors involving the "incorrect handling of error conditions".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-02T19:00:00.000Z
CVE-2006-0384 
automount in Mac OS X 10.4.5 and earlier allows remote file servers to cause a denial of service (unresponsiveness) or execute arbitrary code via unspecified vectors that cause automount to "mount file systems with reserved names".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-02T19:00:00.000Z
CVE-2006-0386 
FileVault in Mac OS X 10.4.5 and earlier does not properly mount user directories when creating a FileVault image, which allows local users to access protected files when FileVault is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-03T22:00:00.000Z
CVE-2006-0387 
Stack-based buffer overflow in Safari in Mac OS X 10.4.5 and earlier, and 10.3.9 and earlier, allows remote attackers to execute arbitrary code via unspecified vectors involving a web page with crafted JavaScript, a different vulnerability than CVE-2005-4504.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-06T20:00:00.000Z
CVE-2006-0388 
Safari in Mac OS X 10.3 before 10.3.9 and 10.4 before 10.4.5 allows remote attackers to redirect users to local files and execute arbitrary JavaScript via unspecified vectors involving HTTP redirection to local resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-03T22:00:00.000Z
CVE-2006-0389 
Cross-site scripting (XSS) vulnerability in Syndication (Safari RSS) in Mac OS X 10.4 through 10.4.5 allows remote attackers to execute arbitrary JavaScript via unspecified vectors involving RSS feeds.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-03T22:00:00.000Z
CVE-2006-0391 
Directory traversal vulnerability in the BOM framework in Mac OS X 10.x before 10.3.9 and 10.4 before 10.4.5 allows user-assisted attackers to overwrite or create arbitrary files via an archive that is handled by BOMArchiveHelper.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-03T22:00:00.000Z
CVE-2006-0392 
Buffer overflow in Apple Mac OS X 10.4.7 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Canon RAW image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-03T01:00:00.000Z
CVE-2006-0393 
OpenSSH in Apple Mac OS X 10.4.7 allows remote attackers to cause a denial of service or determine account existence by attempting to log in using an invalid user, which causes the server to hang.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-03T01:00:00.000Z
CVE-2006-0395 
The Download Validation in Mail in Mac OS X 10.4 does not properly recognize attachment file types to warn a user of an unsafe type, which allows user-assisted remote attackers to execute arbitrary code via crafted file types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-05T01:00:00.000Z
CVE-2006-0396 
Buffer overflow in Mail in Apple Mac OS X 10.4 up to 10.4.5, when patched with Security Update 2006-001, allows remote attackers to execute arbitrary code via a long Real Name value in an e-mail attachment sent in AppleDouble format, which triggers the overflow when the user double-clicks on an attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-14T11:00:00.000Z
CVE-2006-0397 
Unspecified vulnerability in Safari, LaunchServices, and/or CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows attackers to trick a user into opening an application that appears to be a safe file type. NOTE: due to the lack of specific information in the vendor advisory, it is not clear how CVE-2006-0397, CVE-2006-0398, and CVE-2006-0399 are different.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-14T11:00:00.000Z
CVE-2006-0398 
Unspecified vulnerability in Safari, LaunchServices, and/or CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows attackers to trick a user into opening an application that appears to be a safe file type. NOTE: due to the lack of specific information in the vendor advisory, it is not clear how CVE-2006-0397, CVE-2006-0398, and CVE-2006-0399 are different.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-14T11:00:00.000Z
CVE-2006-0399 
Unspecified vulnerability in Safari, LaunchServices, and/or CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows attackers to trick a user into opening an application that appears to be a safe file type. NOTE: due to the lack of specific information in the vendor advisory, it is not clear how CVE-2006-0397, CVE-2006-0398, and CVE-2006-0399 are different.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-14T11:00:00.000Z
CVE-2006-0400 
CoreTypes in Apple Mac OS X 10.4 up to 10.4.5 allows remote attackers to bypass the same-origin policy and execute Javascript in other domains via unknown vectors involving "crafted archives."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-14T11:00:00.000Z
CVE-2006-0401 
Unspecified vulnerability in Mac OS X before 10.4.6, when running on an Intel-based computer, allows attackers with physical access to bypass the firmware password and log on in Single User Mode via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-04-05T10:00:00.000Z
CVE-2006-0402 
SQL injection vulnerability in Zoph before 0.5pre1 allows remote attackers to execute arbitrary SQL commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T02:00:00.000Z
CVE-2006-0403 
Multiple SQL injection vulnerabilities in e-moBLOG 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) monthy parameter to index.php or (2) login parameter to admin/index.php. NOTE: some sources have reported item 1 as involving the "monthly" parameter, but this is incorrect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T02:00:00.000Z
CVE-2006-0404 
Note-A-Day Weblog 2.2 stores sensitive data under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to archive/.phpass-admin, which contains encrypted passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T02:00:00.000Z
CVE-2006-0405 
The TIFFFetchShortPair function in tif_dirread.c in libtiff 3.8.0 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers a NULL pointer dereference, possibly due to changes in type declarations and/or the TIFFVSetField function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T02:00:00.000Z
CVE-2006-0406 
search.php in MyBB 1.0.2 allows remote attackers to obtain sensitive information via a certain search request that reveals the table prefix in a SQL error message, possibly due to invalid parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T02:00:00.000Z
CVE-2006-0407 
Cross-site scripting (XSS) vulnerability in post.php in AZ Bulletin Board (AZbb) 1.1.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) nickname parameter and (2) an iframe tag in the topic parameter.  NOTE: the original disclosure specified the name parameter, but a correction was later provided. NOTE: followup posts have both disputed and confirmed the original claim.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T02:00:00.000Z
CVE-2006-0408 
rsh utility in Sun Grid Engine (SGE) before 6.0u7_1 allows local users to gain privileges and execute arbitrary code via unspecified vectors, possibly involving command line arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T02:00:00.000Z
CVE-2006-0409 
Cross-site scripting (XSS) vulnerability in index.php in Pixelpost Photoblog 1.4.3 allows remote attackers to inject arbitrary web script or HTML via the "Add Comment" field in a comment popup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T02:00:00.000Z
CVE-2006-0410 
SQL injection vulnerability in ADOdb before 4.71, when using PostgreSQL, allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors involving binary strings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T02:00:00.000Z
CVE-2006-0411 
claro_init_local.inc.php in Claroline 1.7.2 uses guessable session cookies (MD5 hash of connection time), which allows remote attackers to hijack sessions and possibly gain administrative privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T11:00:00.000Z
CVE-2006-0412 
SQL injection vulnerability in CyberShop allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in a login action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T11:00:00.000Z
CVE-2006-0413 
Multiple SQL injection vulnerabilities in index.php in NewsPHP allow remote attackers to execute arbitrary SQL commands via the (1) discuss, (2) tim, (3) id, (4) last, and (5) limit parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T11:00:00.000Z
CVE-2006-0414 
Tor before 0.1.1.20 allows remote attackers to identify hidden services via a malicious Tor server that attempts a large number of accesses of the hidden service, which eventually causes a circuit to be built through the malicious server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T11:00:00.000Z
CVE-2006-0415 
Cross-site scripting (XSS) vulnerability in index.php in SleeperChat 0.3f and earlier allows remote attackers to inject arbitrary web script or HTML via the pseudo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T11:00:00.000Z
CVE-2006-0416 
SleeperChat 0.3f and earlier allows remote attackers to bypass authentication and create new entries via the txt parameter to (1) chat_no.php and (2) chat_if.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T11:00:00.000Z
CVE-2006-0417 
SQL injection vulnerability in login.php in miniBloggie 1.0 and earlier, when gpc_magic_quotes is disabled, allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username and (2) password parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T11:00:00.000Z
CVE-2006-0418 
Eval injection vulnerability in 123 Flash Chat Server 5.0 and 5.1 allows attackers to execute arbitrary code via a crafted username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T11:00:00.000Z
CVE-2006-0419 
BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6 allows anonymous binds to the embedded LDAP server, which allows remote attackers to read user entries or cause a denial of service (unspecified) via a large number of connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T23:00:00.000Z
CVE-2006-0420 
BEA WebLogic Server and WebLogic Express 8.1 through SP4 and 7.0 through SP6 does not properly handle when servlets use relative forwarding, which allows remote attackers to cause a denial of service (slowdown) via unknown attack vectors that cause "looping stack overflow errors."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T23:00:00.000Z
CVE-2006-0421 
By design, BEA WebLogic Server and WebLogic Express 7.0 and 6.1, when creating multiple domains from the same WebLogic instance on the same machine, allows administrators of any created domain to access other created domains, which could allow administrators to gain privileges that were not intended.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T23:00:00.000Z
CVE-2006-0422 
Multiple unspecified vulnerabilities in BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allow remote attackers to access MBean attributes or cause an unspecified denial of service via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T23:00:00.000Z
CVE-2006-0423 
BEA WebLogic Portal 8.1 through SP3 stores the password for the RDBMS Authentication provider in cleartext in the config.xml file, which allows attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T23:00:00.000Z
CVE-2006-0424 
BEA WebLogic Server and WebLogic Express 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 allows remote authenticated guest users to read the server log and obtain sensitive configuration information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T23:00:00.000Z
CVE-2006-0425 
BEA WebLogic Portal 8.1 through SP4 allows remote attackers to obtain the source for a deployment descriptor file via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T23:00:00.000Z
CVE-2006-0426 
BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the old and new passwords in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T23:00:00.000Z
CVE-2006-0427 
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords, possibly by accessing functionality that should have been restricted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T23:00:00.000Z
CVE-2006-0428 
Unspecified vulnerability in BEA WebLogic Portal 8.1 SP3 through SP5, when using Web Services Remote Portlets (WSRP), allows remote attackers to access restricted web resources via crafted URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T23:00:00.000Z
CVE-2006-0429 
BEA WebLogic Server and WebLogic Express 9.0 causes new security providers to appear active even if they have not been activated by a server reboot, which could cause an administrator to perform inappropriate, security-relevant actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T23:00:00.000Z
CVE-2006-0430 
Certain configurations of BEA WebLogic Server and WebLogic Express 9.0, 8.1 through SP5, and 7.0 through SP6, when connection filters are enabled, cause the server to run more slowly, which makes it easier for remote attackers to cause a denial of service (server slowdown).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T23:00:00.000Z
CVE-2006-0431 
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP5 allows untrusted applications to obtain the server's SSL identity via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T23:00:00.000Z
CVE-2006-0432 
Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0, when an Administrator uses the WebLogic Administration Console to add custom security policies, causes incorrect policies to be created, which prevents the server from properly protecting JNDI resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-25T23:00:00.000Z
CVE-2006-0433 
Selective Acknowledgement (SACK) in FreeBSD 5.3 and 5.4 does not properly handle an incoming selective acknowledgement when there is insufficient memory, which might allow remote attackers to cause a denial of service (infinite loop).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-02T11:00:00.000Z
CVE-2006-0434 
Directory traversal vulnerability in action.php in phpXplorer allows remote attackers to read arbitrary files via ".." (dot dot) sequences and null bytes in the sAction parameter, a different vulnerability than CVE-2006-0244.  NOTE: if the functionality of phpXplorer supports the upload of PHP files, then this issue would not cross privilege boundaries and would not be a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-26T11:00:00.000Z
CVE-2006-0435 
Unspecified vulnerability in Oracle PL/SQL (PLSQL), as used in Database Server DS 9.2.0.7 and 10.1.0.5, Application Server 1.0.2.2, 9.0.4.2, 10.1.2.0.2, 10.1.2.1.0, and 10.1.3.0.0, E-Business Suite and Applications 11.5.10, and Collaboration Suite 10.1.1, 10.1.2.0, 10.1.2.1, and 9.0.4.2, allows attackers to bypass the PLSQLExclusion list and access excluded packages and procedures, aka Vuln# PLSQL01.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-26T11:00:00.000Z
CVE-2006-0436 
Unspecified vulnerability in HP HP-UX B.11.00, B.11.04, and B.11.11 allows local users to gain privileges via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-26T11:00:00.000Z
CVE-2006-0437 
Cross-site scripting (XSS) vulnerability in admin_smilies.php in phpBB 2.0.19 allows remote attackers to inject arbitrary web script or HTML via Javascript events such as "onmouseover" in the (1) smile_url or (2) smile_emotion parameters, which bypasses a check for "<" and ">" characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-06T22:00:00.000Z