rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-3067 
sudo in SUSE openSUSE 10.3 does not clear the stdin buffer when password entry times out, which might allow local users to obtain a password by reading stdin from the parent process after a sudo child process exits.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-07T23:00:00.000Z
CVE-2008-3068 
Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-07T23:00:00.000Z
CVE-2008-3069 
Multiple cross-site scripting (XSS) vulnerabilities in MyBB before 1.2.13 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) portal.php and (2) inc/functions_post.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-08T18:00:00.000Z
CVE-2008-3070 
Unspecified vulnerability in inc/datahandler/user.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $user['language'] variable, probably related to SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-08T18:00:00.000Z
CVE-2008-3071 
Directory traversal vulnerability in inc/class_language.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $language variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-08T18:00:00.000Z
CVE-2008-3072 
Simple Machines Forum (SMF) 1.1.x before 1.1.5 and 1.0.x before 1.0.13, when running in PHP before 4.2.0, does not properly seed the random number generator, which has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-08T18:00:00.000Z
CVE-2008-3073 
Unspecified vulnerability in Simple Machines Forum (SMF) 1.1.x before 1.1.5 and 1.0.x before 1.0.13 has unknown impact and attack vectors, probably cross-site scripting (XSS), related to "use of the html-tag."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-08T18:00:00.000Z
CVE-2008-3074 
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a tar archive and possibly (2) the filename of the first file in a tar archive, which is not properly handled by the VIM TAR plugin (tar.vim) v.10 through v.22, as demonstrated by the shellescape, tarplugin.v2, tarplugin, and tarplugin.updated test cases.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3075.  NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-21T22:00:00.000Z
CVE-2008-3075 
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a ZIP archive and possibly (2) the filename of the first file in a ZIP archive, which is not properly handled by zip.vim in the VIM ZIP plugin (zipPlugin.vim) v.11 through v.21, as demonstrated by the zipplugin and zipplugin.v2 test cases.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.  NOTE: this issue has the same root cause as CVE-2008-3074.  NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-21T22:00:00.000Z
CVE-2008-3076 
The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-21T22:00:00.000Z
CVE-2008-3077 
arch/x86/kernel/ptrace.c in the Linux kernel before 2.6.25.10 on the x86_64 platform leaks task_struct references into the sys32_ptrace function, which allows local users to cause a denial of service (system crash) or have unspecified other impact via unknown vectors, possibly a use-after-free vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T00:00:00.000Z
CVE-2008-3078 
Opera before 9.51 does not properly manage memory within functions supporting the CANVAS element, which allows remote attackers to read uninitialized memory contents by using JavaScript to read a canvas image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T00:00:00.000Z
CVE-2008-3079 
Unspecified vulnerability in Opera before 9.51 on Windows allows attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T00:00:00.000Z
CVE-2008-3080 
Cross-site request forgery (CSRF) vulnerability in admin.php in myWebland myBloggie 2.1.6 allows remote attackers to perform edit actions as administrators.  NOTE: this can be leveraged to execute SQL commands by also exploiting CVE-2007-1899.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T00:00:00.000Z
CVE-2008-3081 
Multiple unspecified "input validation" vulnerabilities in the Web management interface (aka Messaging Administration interface) in Avaya Message Storage Server (MSS) 3.x and 4.0, and possibly Communication Manager 3.1.x, allow remote authenticated administrators to execute arbitrary commands as user vexvm via vectors related to (1) SFTP Remote Store configuration; (2) remote FTP storage settings; (3) name server lookup; (4) pinging another host; (5) TCP/IP Networking parameter configuration; (6) the external hosts configuration main page; (7) adding and changing external hosts; (8) Windows domain parameter configuration; (9) date, time, and NTP server configuration; (10) alarm settings; (11) the command line history form; (12) the maintenance form; and (13) the server events form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T00:00:00.000Z
CVE-2008-3082 
Cross-site scripting (XSS) vulnerability in UPM/English/login/login.asp in Commtouch Enterprise Anti-Spam Gateway 4 and 5 allows remote attackers to inject arbitrary web script or HTML via the PARAMS parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T00:00:00.000Z
CVE-2008-3083 
SQL injection vulnerability in Brightcode Weblinks (com_brightweblinks) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T00:00:00.000Z
CVE-2008-3087 
Directory traversal vulnerability in Kasseler CMS 1.3.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to index.php, possibly related to the phpManual module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T19:00:00.000Z
CVE-2008-3088 
Cross-site scripting (XSS) vulnerability in the Files module in Kasseler CMS 1.3.0 and 1.3.1 Lite allows remote attackers to inject arbitrary web script or HTML via the cid parameter in a Category action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T19:00:00.000Z
CVE-2008-3089 
SQL injection vulnerability in user.html in Xpoze Pro 3.06 (aka Xpoze Pro CMS 2008) allows remote attackers to execute arbitrary SQL commands via the uid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T19:00:00.000Z
CVE-2008-3090 
Multiple SQL injection vulnerabilities in index.php in BlognPlus (BURO GUN +) 2.5.5 MySQL and PostgreSQL editions allow remote attackers to execute arbitrary SQL commands via the (1) p, (2) e, (3) d, and (4) m parameters, a different vulnerability than CVE-2008-2819.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T19:00:00.000Z
CVE-2008-3091 
Cross-site scripting (XSS) vulnerability in the Taxonomy Autotagger module 5.x before 5.x-1.8 for Drupal allows remote authenticated users, with create or edit post permissions, to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T19:00:00.000Z
CVE-2008-3092 
SQL injection vulnerability in the Taxonomy Autotagger module 5.x before 5.x-1.8 for Drupal allows remote authenticated users, with create or edit post permissions, to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T19:00:00.000Z
CVE-2008-3093 
Unrestricted file upload vulnerability in ImperialBB 2.3.5 and earlier allows remote authenticated users to upload and execute arbitrary PHP code by placing a .php filename in the Upload_Avatar parameter and sending the image/gif content type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T19:00:00.000Z
CVE-2008-3094 
The Organic Groups (OG) module 5.x before 5.x-7.3 and 6.x before 6.x-1.0-RC1, a module for Drupal, allows remote attackers to obtain sensitive information (private group names) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T19:00:00.000Z
CVE-2008-3095 
Cross-site scripting (XSS) vulnerability in the Organic Groups (OG) module 5.x before 5.x-7.3 and 6.x before 6.x-1.0-RC1, a module for Drupal, allows remote authenticated users, with group owner permissions, to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T19:00:00.000Z
CVE-2008-3096 
The Outline Designer module 5.x before 5.x-1.4 for Drupal changes each content reader's authentication level to match that of the content author, which might allow remote attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T19:00:00.000Z
CVE-2008-3097 
Cross-site scripting (XSS) vulnerability in the Tinytax module (aka Tinytax taxonomy block) 5.x before 5.x-1.10-1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML, probably by creating a crafted taxonomy term.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T19:00:00.000Z
CVE-2008-3098 
Cross-site scripting (XSS) vulnerability in admin/usercheck.php in fuzzylime (cms) before 3.03 allows remote attackers to inject arbitrary web script or HTML via the user parameter to the login form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-24T14:00:00.000Z
CVE-2008-3100 
Cross-site scripting (XSS) vulnerability in lib/owl.lib.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter in a getpasswd action to register.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-29T18:00:00.000Z
CVE-2008-3101 
Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the parenttab parameter in an index action to the Products module, as reachable through index.php; (2) the user_password parameter in an Authenticate action to the Users module, as reachable through index.php; or (3) the query_string parameter in a UnifiedSearch action to the Home module, as reachable through index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-03T14:00:00.000Z
CVE-2008-3102 
Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-24T10:00:00.000Z
CVE-2008-3103 
Unspecified vulnerability in the Java Management Extensions (JMX) management agent in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier, when local monitoring is enabled, allows remote attackers to "perform unauthorized operations" via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T23:00:00.000Z
CVE-2008-3104 
Multiple unspecified vulnerabilities in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allow remote attackers to violate the security model for an applet's outbound connections by connecting to localhost services running on the machine that loaded the applet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T23:00:00.000Z
CVE-2008-3105 
Unspecified vulnerability in the JAX-WS client and service in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to access URLs or cause a denial of service via unknown vectors involving "processing of XML data" by a trusted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T23:00:00.000Z
CVE-2008-3106 
Unspecified vulnerability in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier allows remote attackers to access URLs via unknown vectors involving processing of XML data by an untrusted (1) application or (2) applet, a different vulnerability than CVE-2008-3105.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T23:00:00.000Z
CVE-2008-3107 
Unspecified vulnerability in the Virtual Machine in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T23:00:00.000Z
CVE-2008-3108 
Buffer overflow in Sun Java Runtime Environment (JRE) in JDK and JRE 5.0 before Update 10, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allows context-dependent attackers to gain privileges via unspecified vectors related to font processing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T23:00:00.000Z
CVE-2008-3109 
Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T23:00:00.000Z
CVE-2008-3110 
Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to obtain sensitive information by using an applet to read information from another applet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T23:00:00.000Z
CVE-2008-3111 
Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T23:00:00.000Z
CVE-2008-3112 
Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR 6703909.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T23:00:00.000Z
CVE-2008-3113 
Unspecified vulnerability in Sun Java Web Start in JDK and JRE 5.0 before Update 16 and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create or delete arbitrary files via an untrusted application, aka CR 6704077.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T23:00:00.000Z
CVE-2008-3114 
Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR 6704074.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T23:00:00.000Z
CVE-2008-3115 
Secure Static Versioning in Sun Java JDK and JRE 6 Update 6 and earlier, and 5.0 Update 6 through 15, does not properly prevent execution of applets on older JRE releases, which might allow remote attackers to exploit vulnerabilities in these older releases.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T23:00:00.000Z
CVE-2008-3116 
Format string vulnerability in dx8render.dll in Snail Game (aka Suzhou Snail Electronic Company) 5th street (aka Hot Step or High Street 5) allows remote attackers to execute arbitrary code via format string specifiers in a chat message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-10T17:00:00.000Z
CVE-2008-3117 
Unrestricted file upload vulnerability in update_profile.php in PHPmotion 2.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a .php file with a content type of (1) image/gif, (2) image/jpeg, or (3) image/pjpeg, then accessing it via a direct request to the file under pictures/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-10T17:00:00.000Z
CVE-2008-3118 
SQL injection vulnerability in play.php in PHPmotion 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the vid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-10T17:00:00.000Z
CVE-2008-3119 
SQL injection vulnerability in index.php in DreamPics Builder allows remote attackers to execute arbitrary SQL commands via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-10T18:00:00.000Z
CVE-2008-3121 
Multiple cross-site scripting (XSS) vulnerabilities in Xerox CentreWare Web (CWW) before 4.6.46 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-10T18:00:00.000Z
CVE-2008-3122 
Multiple SQL injection vulnerabilities in Xerox CentreWare Web (CWW) before 4.6.46 allow remote authenticated users to execute arbitrary SQL commands via the unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-10T18:00:00.000Z
CVE-2008-3123 
SQL injection vulnerability in index.php in Mole Group Real Estate Script 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the listing_id parameter in a listings action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-10T18:00:00.000Z
CVE-2008-3124 
SQL injection vulnerability in index.php in Mole Group Hotel Script 1.0 allows remote attackers to execute arbitrary SQL commands via the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-10T18:00:00.000Z
CVE-2008-3125 
SQL injection vulnerability in index.php in Mole Group Lastminute Script 4.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-10T18:00:00.000Z
CVE-2008-3126 
Multiple stack-based buffer overflows in the ServerView web interface (SnmpGetMibValues.exe) in Fujitsu Siemens Computers ServerView 04.60.07 and earlier allow remote authenticated users to execute arbitrary code via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-10T18:00:00.000Z
CVE-2008-3127 
PHP remote file inclusion vulnerability in hioxBannerRotate.php in HIOX Banner Rotator (HBR) 1.3, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the hm parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-10T23:00:00.000Z
CVE-2008-3128 
Directory traversal vulnerability in search.php in Pivot 1.40.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the t parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-10T23:00:00.000Z
CVE-2008-3129 
Multiple SQL injection vulnerabilities in index.php in Catviz 0.4 beta 1 allow remote attackers to execute arbitrary SQL commands via the (1) foreign_key_value parameter in the news page and (2) webpage parameter in the webpage_multi_edit form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-10T23:00:00.000Z
CVE-2008-3130 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in OpenCart 0.7.7 allow remote attackers to inject arbitrary web script or HTML via the (1) firstname and (2) search parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-10T23:00:00.000Z
CVE-2008-3131 
SQL injection vulnerability in chatbox.php in pSys 0.7.0 Alpha, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the showid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-10T23:00:00.000Z