rainbutterfly/cve_corpus huggingface dataset:
CVE-2005-4431 
SQL injection vulnerability in WowBB 1.65 allows remote attackers to execute arbitrary SQL commands via the q parameter to search.php. NOTE: the view_user.php/sort_by vector is already covered by CVE-2005-1554 and CVE-2004-2181.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T00:00:00.000Z
CVE-2005-4432 
Cross-site scripting (XSS) vulnerability in index.php in PlaySMS 0.8 allows remote attackers to inject arbitrary web script or HTML via the err parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T00:00:00.000Z
CVE-2005-4433 
Cross-site scripting (XSS) vulnerability in search.php in Esselbach Storyteller CMS 1.8 allows remote attackers to inject arbitrary web script or HTML via the query parameter, which is used by the Search field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T01:00:00.000Z
CVE-2005-4434 
Cross-site scripting (XSS) vulnerability in AbleDesign ReSearch 2.x allows remote attackers to inject arbitrary web script or HTML via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T01:00:00.000Z
CVE-2005-4435 
Cross-site scripting (XSS) vulnerability in index.php AbleDesign D-Man 3.x allows remote attackers to inject arbitrary web script or HTML via the title parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T01:00:00.000Z
CVE-2005-4436 
Extended Interior Gateway Routing Protocol (EIGRP) 1.2, as implemented in Cisco IOS after 12.3(2), 12.3(3)B, and 12.3(2)T and other products, allows remote attackers to cause a denial of service by sending a "spoofed neighbor announcement" with (1) mismatched k values or (2) "goodbye message" Type-Length-Value (TLV).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T01:00:00.000Z
CVE-2005-4437 
MD5 Neighbor Authentication in Extended Interior Gateway Routing Protocol (EIGRP) 1.2, as implemented in Cisco IOS 11.3 and later, does not include the Message Authentication Code (MAC) in the checksum, which allows remote attackers to sniff message hashes and (1) replay EIGRP HELLO messages or (2) cause a denial of service by sending a large number of spoofed EIGRP neighbor announcements, which results in an ARP storm on the local network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T01:00:00.000Z
CVE-2005-4438 
Heap-based buffer overflow in Dec2Rar.dll 3.2.14.3, as distributed in the Symantec Antivirus Library and used by various Symantec products, allows remote attackers to execute arbitrary code via RAR archives with sub-block headers that contain incorrect values in the length field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T01:00:00.000Z
CVE-2005-4439 
Buffer overflow in ELOG elogd 2.6.0-beta4 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a URL with a long (1) cmd or (2) mode parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T01:00:00.000Z
CVE-2005-4440 
The 802.1q VLAN protocol allows remote attackers to bypass network segmentation and spoof VLAN traffic via a message with two 802.1q tags, which causes the second tag to be redirected from a downstream switch after the first tag has been stripped, as demonstrated by Yersinia, aka "double-tagging VLAN jumping attack."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T02:00:00.000Z
CVE-2005-4441 
The PVLAN protocol allows remote attackers to bypass network segmentation and spoof PVLAN traffic via a PVLAN message with a target MAC address that is set to a gateway router, which causes the packet to be sent to the router, where the source MAC is modified, aka "Modification of the MAC spoofing PVLAN jumping attack," as demonstrated by pvlan.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T02:00:00.000Z
CVE-2005-4442 
Untrusted search path vulnerability in OpenLDAP before 2.2.28-r3 on Gentoo Linux allows local users in the portage group to gain privileges via a malicious shared object in the Portage temporary build directory, which is part of the RUNPATH.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T02:00:00.000Z
CVE-2005-4443 
Untrusted search path vulnerability in Gauche before 0.8.6-r1 on Gentoo Linux allows local users in the portage group to gain privileges via a malicious shared object in the Portage temporary build directory, which is part of the RUNPATH.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T02:00:00.000Z
CVE-2005-4444 
Stack-based buffer overflow in the trace message functionality in Pegasus Mail 4.21a through 4.21c and 4.30PB1 allow remote attackers to execute arbitrary code via a long POP3 reply.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T02:00:00.000Z
CVE-2005-4445 
Off-by-one error in Pegasus Mail 4.21a through 4.21c and 4.30PB1 allows remote attackers to execute arbitrary code via a long email message header, which triggers a one-byte buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T02:00:00.000Z
CVE-2005-4446 
Cross-site scripting (XSS) vulnerability in index.asp in ASPBite 8.x allows remote attackers to inject arbitrary web script or HTML via the strSearch parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T02:00:00.000Z
CVE-2005-4447 
SQL injection vulnerability in articles\articles_funcs.php in phpCOIN 1.2.2 allows remote attackers to modify SQL syntax and possibly execute SQL in limited circumstances via the rec_next parameter. NOTE: the original disclosure suggests that command injection is not feasible because the injection occurs after an "ORDER BY" clause, but it is likely that this bug could result in an error message path disclosure due to a syntax error, in some environments.  Therefore this is an exposure and should be included in CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T02:00:00.000Z
CVE-2005-4448 
FlatNuke 2.5.6 verifies authentication credentials based on an MD5 checksum of the admin name and the hashed password rather than the plaintext password, which allows attackers to gain privileges by obtaining the password hash (possibly via CVE-2005-2813), then calculating the credentials and including them in the secid cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T11:00:00.000Z
CVE-2005-4449 
verify.php in FlatNuke 2.5.6 allows remote authenticated administrators to modify arbitrary PHP files by setting the file parameter to an arbitrary file and injecting the code into the body parameter.  NOTE: if a FlatNuke administrator is normally assumed to be able to modify arbitrary content, then this issue does not cross privilege boundaries and would not be a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T11:00:00.000Z
CVE-2005-4450 
Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.7.0 allows remote attackers to perform unauthorized actions as a logged-in user via a link or IMG tag to server_privileges.php, as demonstrated using the dbname and checkprivs parameters.  NOTE: the provenance of this issue is unknown, although third parties imply that it is related to the disclosure of CVE-2005-4349, which was labeled as SQL injection but disputed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T11:00:00.000Z
CVE-2005-4451 
Unspecified vulnerability in Software Distributor in HP-UX B.11.11 allows remote attackers to gain access via unspecified attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T11:00:00.000Z
CVE-2005-4452 
Information Call Center stores the CallCenterData.mdb database under the web root with insufficient access control, which allows remote attackers to obtain sensitive information such as usernames and passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T11:00:00.000Z
CVE-2005-4453 
UserProfile.cs in Ultraapps Issue Manager before 2.1 allows remote authenticated users to gain administrator privileges by modifying the original (1) p_User_user_id and (2) User_user_id parameters to UserProfile.aspx, then modifying the password field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T11:00:00.000Z
CVE-2005-4454 
Validate-before-filter vulnerability in cleanhtml.pl 1.129 in LiveJournal CVS before Dec 7 2005, when the cleancss option is enabled, allows remote attackers to conduct cross-site scripting (XSS) attacks via a "\" (backslash) within a "javascript" scheme in a style property (such as "javas\cript"), which bypasses the "javascript" check before the "\" is stripped and then rendered in web browsers that allow scripting in style sheets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T11:00:00.000Z
CVE-2005-4455 
cleanhtml.pl 1.129 in LiveJournal CVS before Dec 13 2005 allows remote attackers to inject scripting languages via the XSL namespace in XML, via vectors such as customview.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T11:00:00.000Z
CVE-2005-4456 
Multiple buffer overflows in MailEnable Professional 1.71 and Enterprise 1.1 before patch ME-10009 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long (1) LIST, (2) LSUB, and (3) UID FETCH commands.  NOTE: it is possible that these are alternate vectors for the issue described in CVE-2005-4402.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T11:00:00.000Z
CVE-2005-4457 
MailEnable Enterprise 1.1 before patch ME-10009 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via several "..." (triple dot) sequences in a UID FETCH command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T11:00:00.000Z
CVE-2005-4458 
Group.pm in Metadot Portal Server 6.4.4 and earlier does not properly reset the $IS_OWNER, $IS_ADMIN, and $IS_MANAGER global variables when performing checks for special privileges, which allows users to gain administrator privileges by adding themselves to the SITE_MGR group.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T11:00:00.000Z
CVE-2005-4459 
Heap-based buffer overflow in the NAT networking components vmnat.exe and vmnet-natd in VMWare Workstation 5.5, GSX Server 3.2, ACE 1.0.1, and Player 1.0 allows remote authenticated attackers, including guests, to execute arbitrary code via crafted (1) EPRT and (2) PORT FTP commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T20:00:00.000Z
CVE-2005-4460 
Cross-site scripting (XSS) vulnerability in Beehive Forum 0.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) Description, and (3) Comment fields to (a) links.php and (b) links_add.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T20:00:00.000Z
CVE-2005-4461 
SQL injection vulnerability in index.php in Beehive Forum 0.6.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user_sess parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T20:00:00.000Z
CVE-2005-4462 
PHP remote file include vulnerability in usermods.php in Tolva PHP website system 0.1.0 allows remote attackers to execute arbitrary code via a URL in the ROOT parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T22:00:00.000Z
CVE-2005-4463 
WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to (1) wp-includes/vars.php, (2) wp-content/plugins/hello.php, (3) wp-admin/upgrade-functions.php, (4) wp-admin/edit-form.php, (5) wp-settings.php, and (6) wp-admin/edit-form-comment.php, which leaks the path in an error message related to undefined functions or failed includes.  NOTE: the wp-admin/menu-header.php vector is already covered by CVE-2005-2110. NOTE: the vars.php, edit-form.php, wp-settings.php, and edit-form-comment.php vectors were also reported to affect WordPress 2.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-21T22:00:00.000Z
CVE-2005-4464 
Ingate Firewall before 4.3.4 and SIParator before 4.3.4 allows remote attackers to cause a denial of service (kernel deadlock) by sending a SYN packet for a TCP stream, which requires an RST packet in response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T00:00:00.000Z
CVE-2005-4465 
The Internet Key Exchange version 1 (IKEv1) implementation in NEC UNIVERGE IX1000, IX2000, and IX3000 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the advisory, it is unclear which of CVE-2005-3666, CVE-2005-3667, and/or CVE-2005-3668 this issue applies to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T00:00:00.000Z
CVE-2005-4466 
Heap-based buffer overflow in the SIPParser function in i3sipmsg.dll in Interaction SIP Proxy before 3.0.011 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a REGISTER request with a SPI version number that contains a large number of space or tab characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T00:00:00.000Z
CVE-2005-4467 
Directory traversal vulnerability in help_text_vars.php in PHPGedView 3.3.7 and earlier allows remote attackers to read and include arbitrary files via a .. (dot dot) in the PGV_BASE_DIRECTORY parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T00:00:00.000Z
CVE-2005-4468 
PHP remote file include vulnerability in help_text_vars.php in PHPGedView 3.3.7 and earlier allows remote attackers to execute arbitrary code via a URL in the PGV_BASE_DIRECTORY parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T00:00:00.000Z
CVE-2005-4469 
Multiple direct static code injection vulnerabilities in PHPGedView 3.3.7 and earlier allow remote attackers to execute arbitrary PHP code via (1) the username field in login.php, or the (2) user_language, (3) user_email, and (4) user_gedcomid parameters in login_register.php, which is directly inserted into authenticate.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T00:00:00.000Z
CVE-2005-4470 
Heap-based buffer overflow in the get_bhead function in readfile.c in Blender BlenLoader 2.0 through 2.40pre allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a .blend file with a negative bhead.len value, which causes less memory to be allocated than expected, possibly due to an integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T00:00:00.000Z
CVE-2005-4471 
POP3 service in Avaya Modular Messaging Message Storage Server (MSS) 2.0 SP 4 and earlier allows remote attackers to cause a denial of service (infinite loop) via crafted packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T00:00:00.000Z
CVE-2005-4472 
Stack-based buffer overflow in the Macromedia JRun 4 web server (JWS) allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long request that is not properly handled during conversion to wide characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T00:00:00.000Z
CVE-2005-4473 
Unspecified vulnerability in Macromedia JRun 4 web server (JWS) allows remote attackers to view web application source code via "a malformed URL."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T00:00:00.000Z
CVE-2005-4474 
Buffer overflow in the "Add to archive" command in WinRAR 3.51 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code by tricking the user into adding a file whose filename contains a non-default code page and non-ANSI characters, as demonstrated using a Chinese filename, possibly due to buffer expansion when using the WideCharToMultiByte API.  NOTE: it is not clear whether this problem can be exploited for code execution. If not, then perhaps the user-assisted nature of the attack should exclude the issue from inclusion in CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T01:00:00.000Z
CVE-2005-4475 
Cross-site scripting (XSS) vulnerability in OpenCms 6.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4476 
Cross-site scripting (XSS) vulnerability in store/search/results.html in OpenEdit 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) oe-action and (2) page parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4477 
Cross-site scripting (XSS) vulnerability in papaya CMS 4.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the bab[searchfor] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4478 
Multiple SQL injection vulnerabilities in Papoo 2.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) menuid parameter to (a) index.php and (b) guestbook.php, and the (2) forumid and (3) reporeid_print parameters to (c) print.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4479 
SQL injection vulnerability in article.php in phpSlash 0.8.1 and earlier allows remote attackers to execute arbitrary SQL commands via the story_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4480 
Cross-site scripting (XSS) vulnerability in Plexcor CMS 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4481 
Cross-site scripting (XSS) vulnerability in Polopoly 9 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters. NOTE: the vendor has disputed this vulnerability, stating that the "XSS flaw was only part of the custom implementation of the [polopoly] site".  As of 20061003, CVE has no further information on this issue, except that the original researcher has a history of testing live sites and assuming that discoveries indicate vulnerabilities in the associated package
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4482 
Cross-site scripting (XSS) vulnerability in login.asp in PortalApp 3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the ret_page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4483 
Cross-site scripting (XSS) vulnerability in login.asp in SiteEnable 3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the ret_page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4484 
Multiple cross-site scripting (XSS) vulnerabilities in IntranetApp 3.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ret_page parameter to login.asp or the (2) do_search and (3) search parameters to content.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4485 
Multiple cross-site scripting (XSS) vulnerabilities in ProjectApp 3.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the keywords parameter to (1) forums.asp, (2) search_employees.asp, (3) cat.asp, and (4) links.asp; (5) projectid parameter to pmprojects.asp, (6) ret_page parameter to login.asp, and (7) skin_number parameter to default.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4486 
SQL injection vulnerability in Quantum Art QP7.Enterprise (formerly Q-Publishing) allows remote attackers to execute arbitrary SQL commands via the p_news_id parameter to (1) news_and_events_new.asp and (2) news.asp.  NOTE: on 20060227, the vendor disputed the accuracy of this report, saying that the p_news_id, news_and_events_new.asp, and news.asp are not specifically part of their product, although they could be dynamically generated through use of the product.  Some investigation by CVE suggests evidence that the news_and_events_new.asp page has at least a forced invalid SQL syntax error, but this could not be repeated for news.asp
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4487 
Cross-site scripting (XSS) vulnerability in RAMSite R|1 CMS 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchfield parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4488 
Multiple cross-site scripting (XSS) vulnerabilities in index.tpl in Redakto WCMS 3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) iid, (2) iid2, (3) r, (4) cart, (5) str, (6) nf, and (7) a parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4489 
Cross-site scripting (XSS) vulnerability in Scoop 1.1 RC1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) type and (2) count parameters, and (3) the query string in a story.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4490 
Multiple cross-site scripting (XSS) vulnerabilities in SCOOP! 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) keyword and (2) invalid parameter to articleSearch.asp; (3) username and (4) invalid parameter to lostPassword.asp; (5) Username, (6) Password, and (7) invalid parameter to account_login.asp; (8) area, (9) articleZoneID, (10) r, and (11) invalid parameters to category.asp; and invalid parameters to (12) articleZone.asp, (13) prePurchaserRegistration.asp, and (14) requestDemo.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z