rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-2362 
Multiple buffer overflows in MyDNS 1.1.0 allow remote attackers to (1) cause a denial of service (daemon crash) and possibly execute arbitrary code via a certain update, which triggers a heap-based buffer overflow in update.c; and (2) cause a denial of service (daemon crash) via unspecified vectors that trigger an off-by-one stack-based buffer overflow in update.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2363 
Buffer overflow in IrfanView 4.00 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted .IFF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2364 
Multiple PHP remote file inclusion vulnerabilities in burnCMS 0.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the root parameter to (1) mysql.class.php or (2) postgres.class.php in lib/db/; or (3) authuser.php, (4) misc.php, or (5) connect.php in lib/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2365 
Buffer overflow in Adobe Photoshop CS2 and CS3, Photoshop Elements 5.0, Illustrator CS3, and GoLive 9 allows user-assisted remote attackers to execute arbitrary code via a crafted .PNG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2366 
Buffer overflow in Corel Paint Shop Pro 11.20 allows user-assisted remote attackers to execute arbitrary code via a crafted .PNG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2367 
Buffer overflow in wserve_console.exe in Wserve HTTP Server (whttp) 4.6 allows remote attackers to cause a denial of service (forced application exit) via a long directory name in the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2368 
picture.php in WebSPELL 4.01.02 and earlier allows remote attackers to read arbitrary files via the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2369 
Directory traversal vulnerability in picture.php in WebSPELL 4.01.02 and earlier, when PHP before 4.3.0 is used, allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2370 
SQL injection vulnerability in index.php in the John Mordo Jobs 2.4 and earlier module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter in a jobsview action. NOTE: the module name was originally reported as Job Listings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2371 
admin/index.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier provides access to configuration modification before login, which allows remote attackers to cause a denial of service (loss of configuration data), and possibly perform direct static code injection, via a saveGlobalconfig action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2372 
admin/send_mod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative credentials are missing, which allows remote attackers to compose an e-mail message via a post with the subject, message, format, and list_id fields; and send the message via a direct request for the MsgId value under admin/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2373 
SQL injection vulnerability in viewcat.php in the WF-Links (wflinks) 1.03 and earlier module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2374 
Unspecified vulnerability in Microsoft Windows 2000, XP, and Server 2003 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors.  NOTE: this information is based upon a vague pre-advisory with no actionable information. However, the advisory is from a reliable source.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2375 
The agent remote upgrade interface in Symantec Enterprise Security Manager (ESM) before 20070405 does not verify the authenticity of upgrades, which allows remote attackers to execute arbitrary code via software that implements the agent upgrade protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2376 
The Dojo framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2377 
The Getahead Direct Web Remoting (DWR) framework 1.1.4 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2378 
The Google Web Toolkit (GWT) framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2379 
The jQuery framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2380 
The Microsoft Atlas framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2381 
The MochiKit framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2382 
The Moo.fx framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2383 
The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2384 
The Script.aculo.us framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2385 
The Yahoo! UI framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2007-2386 
Buffer overflow in mDNSResponder in Apple Mac OS X 10.4 up to 10.4.9 allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted UPnP Internet Gateway Device (IGD) packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-24T22:00:00.000Z
CVE-2007-2387 
Apple Xserve Lights-Out Management before Firmware Update 1.0 on Intel hardware does not require a password for remote access to IPMI, which allows remote attackers to gain administrative access via unspecified requests with ipmitool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-04T17:00:00.000Z
CVE-2007-2388 
Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not properly restrict QTObject subclassing, which allows remote attackers to execute arbitrary code via a web page containing a user-defined class that accesses unsafe functions that can be leveraged to write to arbitrary memory locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-29T21:00:00.000Z
CVE-2007-2389 
Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not clear potentially sensitive memory before use, which allows remote attackers to read memory from a web browser via unknown vectors related to Java applets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-29T21:00:00.000Z
CVE-2007-2390 
Buffer overflow in iChat in Apple Mac OS X 10.3.9 and 10.4.9 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted UPnP Internet Gateway Device (IGD) packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-24T22:00:00.000Z
CVE-2007-2391 
Cross-site scripting (XSS) vulnerability in Apple Safari Beta 3.0.1 for Windows allows remote attackers to inject arbitrary web script or HTML via a web page that includes a windows.setTimeout function that is activated after the user has moved from the current page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-14T18:00:00.000Z
CVE-2007-2392 
Apple Quicktime before 7.2 on Mac OS X 10.3.9 and 10.4.9 allows user-assisted remote attackers to execute arbitrary code via a crafted movie file that triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T21:00:00.000Z
CVE-2007-2393 
The design of QuickTime for Java in Apple Quicktime before 7.2 allows remote attackers to bypass certain security controls and write to process memory via Java applets, possibly leading to arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T21:00:00.000Z
CVE-2007-2394 
Integer overflow in Apple Quicktime before 7.2 on Mac OS X 10.3.9 and 10.4.9 allows user-assisted remote attackers to execute arbitrary code via crafted (1) title and (2) author fields in an SMIL file, related to improper calculations for memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T21:00:00.000Z
CVE-2007-2395 
Unspecified vulnerability in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via a crafted image description atom in a movie file, related to "memory corruption."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-07T20:00:00.000Z
CVE-2007-2396 
The JDirect support in QuickTime for Java in Apple Quicktime before 7.2 exposes certain dangerous interfaces, which allows remote attackers to execute arbitrary code via crafted Java applets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T21:00:00.000Z
CVE-2007-2397 
QuickTime for Java in Apple Quicktime before 7.2 does not properly check permissions, which allows remote attackers to disable security controls and execute arbitrary code via crafted Java applets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T21:00:00.000Z
CVE-2007-2398 
Apple Safari 3.0.1 beta (522.12.12) on Windows allows remote attackers to modify the window title and address bar while filling the main window with arbitrary content by setting the location bar and using setTimeout() to create an event that modifies the window content, which could facilitate phishing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T10:00:00.000Z
CVE-2007-2399 
WebKit in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1 performs an "invalid type conversion", which allows remote attackers to execute arbitrary code via unspecified frame sets that trigger memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-25T19:00:00.000Z
CVE-2007-2400 
Race condition in Apple Safari 3 Beta before 3.0.2 on Mac OS X, Windows XP, Windows Vista, and iPhone before 1.0.1, allows remote attackers to bypass the JavaScript security model and modify pages outside of the security domain and conduct cross-site scripting (XSS) attacks via vectors related to page updating and HTTP redirects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-25T19:00:00.000Z
CVE-2007-2401 
CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the setRequestHeader function.  NOTE: this issue can be leveraged for cross-site scripting (XSS) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-25T19:00:00.000Z
CVE-2007-2402 
QuickTime for Java in Apple Quicktime before 7.2 does not perform sufficient "access control," which allows remote attackers to obtain sensitive information (screen content) via crafted Java applets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T21:00:00.000Z
CVE-2007-2403 
CFNetwork on Apple Mac OS X 10.3.9 and 10.4.10 does not properly validate ftp: URIs, which allows remote attackers to trigger the transmission of arbitrary FTP commands to arbitrary FTP servers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T10:00:00.000Z
CVE-2007-2404 
CRLF injection vulnerability in CFNetwork on Apple Mac OS X 10.3.9 and 10.4.10 before 20070731 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in an unspecified context.  NOTE: this can be leveraged for cross-site scripting (XSS) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T10:00:00.000Z
CVE-2007-2405 
Integer underflow in Preview in PDFKit on Apple Mac OS X 10.4.10 allows remote attackers to execute arbitrary code via a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T10:00:00.000Z
CVE-2007-2406 
Quartz Composer on Apple Mac OS X 10.4.10 does not initialize a certain object pointer, which might allow user-assisted remote attackers to execute arbitrary code via a crafted Quartz Composer file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T10:00:00.000Z
CVE-2007-2407 
The Samba server on Apple Mac OS X 10.3.9 and 10.4.10, when Windows file sharing is enabled, does not enforce disk quotas after dropping privileges, which allows remote authenticated users to use disk space in excess of quota.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T10:00:00.000Z
CVE-2007-2408 
WebKit in Apple Safari 3 Beta before Update 3.0.3 does not properly recognize an unchecked "Enable Java" setting, which allows remote attackers to execute Java applets via a crafted web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T20:00:00.000Z
CVE-2007-2409 
Cross-domain vulnerability in WebCore on Apple Mac OS X 10.3.9 and 10.4.10 allows remote attackers to obtain sensitive information via a popup window, which is able to read the current URL of the parent window.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T10:00:00.000Z
CVE-2007-2410 
WebCore on Apple Mac OS X 10.3.9 and 10.4.10 retains properties of certain global objects when a new URL is visited in the same window, which allows remote attackers to conduct cross-site scripting (XSS) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T10:00:00.000Z
CVE-2007-2411 
PHP remote file inclusion vulnerability in index.php in Sphider 1.2.x allows remote attackers to execute arbitrary PHP code via a URL in the include_dir parameter.  NOTE: a third party disputes this vulnerability, stating that "the application is not vulnerable to this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-01T10:00:00.000Z
CVE-2007-2412 
Directory traversal vulnerability in modules/file.php in Seir Anphin allows remote attackers to obtain sensitive information via a .. (dot dot) in the a[filepath] parameter.  NOTE: a third party has disputed this issue because the a array is populated by a database query before use
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-01T10:00:00.000Z
CVE-2007-2414 
MyServer before 0.8.8 allows remote attackers to cause a denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-01T10:00:00.000Z
CVE-2007-2415 
Pi3Web Web Server 2.0.3 PL1 allows remote attackers to cause a denial of service (application exit) via a long URI.  NOTE: this issue was originally reported as a crash, but the vendor states that the impact is a "clean" exit in which "the server I/O loop finishes and the process exits normally."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-01T10:00:00.000Z
CVE-2007-2416 
SQL injection vulnerability in home.php in E-Annu allows remote attackers to execute arbitrary SQL commands via the a parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-01T10:00:00.000Z
CVE-2007-2417 
Heap-based buffer overflow in _mprosrv.exe in Progress Software Progress 9.1E and OpenEdge 10.1x, as used by the RSA Authentication Manager 6.0 and 6.1, SecurID Appliance 2.0, ACE/Server 5.2, and possibly other products, allows remote attackers to execute arbitrary code via crafted packets.  NOTE: this issue might overlap CVE-2007-3491.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T21:00:00.000Z
CVE-2007-2418 
Heap-based buffer overflow in the Rendezvous / Extensible Messaging and Presence Protocol (XMPP) component (plugins\rendezvous.dll) for Cerulean Studios Trillian Pro before 3.1.5.1 allows remote attackers to execute arbitrary code via a message that triggers the overflow from expansion that occurs during encoding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-02T22:00:00.000Z
CVE-2007-2419 
Multiple buffer overflows in an ActiveX control (boisweb.dll) in Macrovision FLEXnet Connect 6.0 and Update Service 3.x to 5.x allow remote attackers to execute arbitrary code via the (1) the second parameter to the DownloadAndExecute method and (2) third parameter to the AddFileEx method, a different vulnerability than CVE-2007-0328.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-06T10:00:00.000Z
CVE-2007-2420 
SQL injection vulnerability in bry.asp in Burak Yilmaz Blog 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-02T00:00:00.000Z
CVE-2007-2421 
Buffer overflow in Hitachi Groupmax Mobile Option for Mobile-Phone 07-00 through 07-30, 5 for i-mode 05-11 through 05-23, and 6 for EZweb 06-00 through 06-04 allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-02T00:00:00.000Z
CVE-2007-2422 
Multiple PHP remote file inclusion vulnerabilities in Modules Builder (modbuild) 4.1 for Comdev One Admin allow remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter to (1) config-bak.php or (2) config.php.  NOTE: CVE disputes this vulnerability because the unmodified scripts set the applicable variable to the empty string; reasonable modified copies would use a fixed pathname string
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-02T00:00:00.000Z
CVE-2007-2423 
Cross-site scripting (XSS) vulnerability in index.php in MoinMoin 1.5.7 allows remote attackers to inject arbitrary web script or HTML via the do parameter in an AttachFile action, a different vulnerability than CVE-2007-0857.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-02T00:00:00.000Z
CVE-2007-2424 
PHP remote file inclusion vulnerability in help/index.php in The Merchant (themerchant) 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the show parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-02T00:00:00.000Z
CVE-2007-2425 
Directory traversal vulnerability in fileview.php in Imageview 5.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the album parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-02T00:00:00.000Z