rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-2562 
ZyXEL P-335WT router allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T01:00:00.000Z
CVE-2006-2563 
The cURL library (libcurl) in PHP 4.4.2 and 5.1.4 allows attackers to bypass safe mode and read files via a file:// request containing null characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-29T16:00:00.000Z
CVE-2006-2564 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in AlstraSoft E-Friends allow remote attackers to inject arbitrary web script or HTML by (1) posting a blog, (2) posting a listing, (3) posting an event, (4) adding comments, or (5) sending a message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T20:00:00.000Z
CVE-2006-2565 
SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via (1) the author_id parameter in profile.php and (2) the aut_id parameter in userarticles.php.  NOTE: the aut_id vector can produce resultant path disclosure if the SQL manipulation is invalid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T20:00:00.000Z
CVE-2006-2566 
Alstrasoft Article Manager Pro 1.6 allows remote attackers to obtain sensitive information via (1) a quote character or possibly an invalid value in the action parameter in a request to mrarticles.php or (2) a login QUERY_STRING to admin.php without any additional parameters, which reveal the path in various error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T20:00:00.000Z
CVE-2006-2567 
Cross-site scripting (XSS) vulnerability in submit_article.php in Alstrasoft Article Manager Pro 1.6 allows remote attackers to inject arbitrary web script or HTML when submitting an article, as demonstrated using a javascript URI in a Cascading Style Sheets (CSS) property of a STYLE attribute of an element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T20:00:00.000Z
CVE-2006-2568 
PHP remote file inclusion vulnerability in addpost_newpoll.php in UBB.threads 6.4 through 6.5.2 and 6.5.1.1 (trial) allows remote attackers to execute arbitrary PHP code via a URL in the thispath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T23:00:00.000Z
CVE-2006-2569 
SQL injection vulnerability in links.php in 4R Linklist 1.0 RC2 and earlier, a module for Woltlab Burning Board, allows remote attackers to execute arbitrary SQL commands via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T23:00:00.000Z
CVE-2006-2570 
PHP remote file inclusion vulnerability in CaLogic Calendars 1.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS["CLPath"] parameter to (1) reconfig.php and (2) srxclr.php. NOTE: this might be due to a globals overwrite issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T23:00:00.000Z
CVE-2006-2571 
Cross-site scripting (XSS) vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T23:00:00.000Z
CVE-2006-2572 
Cross-site scripting (XSS) vulnerability in index.php in DGBook 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) homepage, (3) email, and (4) address parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T23:00:00.000Z
CVE-2006-2573 
SQL injection vulnerability in index.php in DGBook 1.0, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the (1) name, (2) email, (3) homepage, (4) address, (5) comment, and (6) ip parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T23:00:00.000Z
CVE-2006-2574 
Multiple unspecified vulnerabilities in Software Distributor in HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allow local users to gain privileges via unspecified attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T23:00:00.000Z
CVE-2006-2575 
The setFrame function in Lib/2D/Surface.hpp for NetPanzer 0.8 and earlier allows remote attackers to cause a denial of service (crash) via a client flag (frameNum) that is greater than 41, which triggers an assert error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T23:00:00.000Z
CVE-2006-2576 
Multiple PHP remote file inclusion vulnerabilities in Docebo 3.0.3 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in (1) GLOBALS[where_framework] to (a) lib.simplesel.php, (b) lib.filelist.php, (c) tree.documents.php, (d) lib.repo.php, and (e) lib.php, and (2) GLOBALS[where_scs] to (f) lib.teleskill.php.  NOTE: this issue might be resultant from a global overwrite vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T23:00:00.000Z
CVE-2006-2577 
Multiple PHP remote file inclusion vulnerabilities in Docebo 3.0.3 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in (1) where_cms, (2) where_lms, (3) where_upgrade, (4) BBC_LIB_PATH, and (5) BBC_LANGUAGE_PATH parameters in various unspecified scripts. NOTE: the provenance of some of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T23:00:00.000Z
CVE-2006-2578 
admin/cron.php in eSyndicat Directory 1.2, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include arbitrary files and possibly execute arbitrary PHP code via a null-terminated value in the path_to_config parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T23:00:00.000Z
CVE-2006-2579 
Unspecified vulnerability in HP OpenView Storage Data Protector 5.1 and 5.5 allows remote attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T23:00:00.000Z
CVE-2006-2580 
Multiple unspecified vulnerabilities in HP OpenView Network Node Manager (OV NNM) 6.20, 6.4x, 7.01, and 7.50 allow remote attackers to gain privileged access, execute arbitrary commands, or create arbitrary files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T23:00:00.000Z
CVE-2006-2581 
Cross-site scripting (XSS) vulnerability in Wiki content in RWiki 2.1.0pre1 through 2.1.0 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-25T10:00:00.000Z
CVE-2006-2582 
The editing form in RWiki 2.1.0pre1 through 2.1.0 allows remote attackers to execute arbitrary Ruby code via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-25T10:00:00.000Z
CVE-2006-2583 
PHP remote file inclusion vulnerability in nucleus/libs/PLUGINADMIN.php in Nucleus 3.22 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[DIR_LIBS] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-25T10:00:00.000Z
CVE-2006-2584 
Multiple cross-site scripting (XSS) vulnerabilities in post.php in SkyeBox 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) message parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information, although it was likely prompted by a vague announcement from a researcher who incorrectly referred to the product as "SkyeShoutbox."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-25T10:00:00.000Z
CVE-2006-2585 
SQL injection vulnerability in Destiney Links Script 2.1.2 allows remote attackers to execute arbitrary SQL commands via the ID parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-25T10:00:00.000Z
CVE-2006-2586 
Cross-site scripting (XSS) vulnerability in IpLogger 1.7 and earlier allows remote attackers to inject arbitrary HTML or web script via the HTTP_REFERER header in an HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-25T10:00:00.000Z
CVE-2006-2587 
Buffer overflow in the WebTool HTTP server component in (1) PunkBuster before 1.229, as used by multiple products including (2) America's Army 1.228 and earlier, (3) Battlefield 1942 1.158 and earlier, (4) Battlefield 2 1.184 and earlier, (5) Battlefield Vietnam 1.150 and earlier, (6) Call of Duty 1.173 and earlier, (7) Call of Duty 2 1.108 and earlier, (8) DOOM 3 1.159 and earlier, (9) Enemy Territory 1.167 and earlier, (10) Far Cry 1.150 and earlier, (11) F.E.A.R. 1.093 and earlier, (12) Joint Operations 1.187 and earlier, (13) Quake III Arena 1.150 and earlier, (14) Quake 4 1.181 and earlier, (15) Rainbow Six 3: Raven Shield 1.169 and earlier, (16) Rainbow Six 4: Lockdown 1.093 and earlier, (17) Return to Castle Wolfenstein 1.175 and earlier, and (18) Soldier of Fortune II 1.183 and earlier allows remote attackers to cause a denial of service (application crash) via a long webkey parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-25T10:00:00.000Z
CVE-2006-2588 
Russcom PHPImages allows remote attackers to upload files of arbitrary types by uploading a file with a .gif extension.  NOTE: due to lack of specific information about attack vectors do not depend on the existence of another vulnerability, it is not clear whether this is a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-25T10:00:00.000Z
CVE-2006-2589 
SQL injection vulnerability in rss.php in MyBB (aka MyBulletinBoard) 1.1.1 allows remote attackers to execute arbitrary SQL commands via the comma parameter.  NOTE: it is not clear from the original report how this attack can succeed, since the demonstration URL uses a variable that is overwritten with static data in the extracted source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-25T10:00:00.000Z
CVE-2006-2590 
SQL injection vulnerability in e107 before 0.7.5 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-25T10:00:00.000Z
CVE-2006-2591 
Unspecified vulnerability in e107 before 0.7.5 has unknown impact and remote attack vectors related to an "emailing exploit".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-25T10:00:00.000Z
CVE-2006-2592 
Unspecified vulnerability in DSChat 1.0 allows remote attackers to execute arbitrary PHP code via the Nickname field, which is not sanitized before creating a file in a user directory.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-25T10:00:00.000Z
CVE-2006-2605 
Cross-site scripting (XSS) vulnerability in DSChat 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the chatbox, probably involving the ctext parameter to send.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-25T10:00:00.000Z
CVE-2006-2606 
Cross-site scripting (XSS) vulnerability in Chatty, possibly 1.0.2 and other versions, allows remote attackers to inject arbitrary web script or HTML via the username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-25T10:00:00.000Z
CVE-2006-2607 
do_command.c in Vixie cron (vixie-cron) 4.1 does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits, as originally demonstrated by a program that exceeds the process limits as defined in /etc/security/limits.conf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-25T20:00:00.000Z
CVE-2006-2608 
artmedic newsletter 4.1 and possibly other versions, when register_globals is enabled, allows remote attackers to modify arbitrary files and execute arbitrary PHP code via the logfile parameter in a direct request to log.php, which causes the $logfile variable to be redefined to an attacker-controlled value, as demonstrated by injecting PHP code into info.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-26T01:00:00.000Z
CVE-2006-2609 
artmedic newsletter 4.1.2 and possibly other versions, when register_globals is enabled, allows remote attackers to modify arbitrary files and execute arbitrary PHP code via the email parameter to newsletter_log.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-26T01:00:00.000Z
CVE-2006-2610 
Cross-site scripting (XSS) vulnerability in view.php in phpRaid 2.9.5 allows remote attackers to inject arbitrary web script or HTML via the (1) URL query string and the (2) Sort parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-26T01:00:00.000Z
CVE-2006-2611 
Cross-site scripting (XSS) vulnerability in includes/Sanitizer.php in the variable handler in MediaWiki 1.6.x before r14349 allows remote attackers to inject arbitrary Javascript via unspecified vectors, possibly involving the usage of the | (pipe) character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-26T01:00:00.000Z
CVE-2006-2612 
Novell Client for Windows 4.8 and 4.9 does not restrict access to the clipboard contents while a machine is locked, which allows users with physical access to read the current clipboard contents by pasting them into the "User Name" field on the login prompt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-26T01:00:00.000Z
CVE-2006-2613 
Mozilla Suite 1.7.13, Mozilla Firefox 1.5.0.3 and possibly other versions before before 1.8.0, and Netscape 7.2 and 8.1, and possibly other versions and products, allows remote user-assisted attackers to obtain information such as the installation path by causing exceptions to be thrown and checking the message contents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-26T01:00:00.000Z
CVE-2006-2614 
Sun N1 System Manager 1.1 for Solaris 10 before patch 121161-01 records system passwords in the world-readable scripts (1) /cr/hd_jobs_db.sh, (2) /cr/hd_plan_checkin.sh, and (3) /cr/oracle_plan_checkin.sh, which allows local users to obtain System Manager passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-26T01:00:00.000Z
CVE-2006-2615 
ping.php in Russcom.Ping allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-26T01:00:00.000Z
CVE-2006-2616 
SQL injection vulnerability in the search script in (1) AlstraSoft Web Host Directory 1.2, aka (2) HyperStop WebHost Directory 1.2, allows remote attackers to execute arbitrary SQL commands via the uri parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-26T01:00:00.000Z
CVE-2006-2617 
(1) AlstraSoft Web Host Directory 1.2, aka (2) HyperStop WebHost Directory 1.2, allows remote attackers to obtain the installation path via an invalid entry in the Username field on the login page, which causes the path to be displayed in an SQL error.  NOTE: this issue might be resultant from SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-26T01:00:00.000Z
CVE-2006-2618 
Cross-site scripting (XSS) vulnerability in (1) AlstraSoft Web Host Directory 1.2, aka (2) HyperStop WebHost Directory 1.2, might allow remote attackers to inject arbitrary web script or HTML via the "write a review" box.  NOTE: since user reviews do not require administrator privileges, and an auto-approve mechanism exists, this issue is a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-26T01:00:00.000Z
CVE-2006-2629 
Race condition in Linux kernel 2.6.15 to 2.6.17, when running on SMP platforms, allows local users to cause a denial of service (crash) by creating and exiting a large number of tasks, then accessing the /proc entry of a task that is exiting, which causes memory corruption that leads to a failure in the prune_dcache function or a BUG_ON error in include/linux/list.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-27T10:00:00.000Z
CVE-2006-2630 
Stack-based buffer overflow in Symantec Antivirus 10.1 and Client Security 3.1 allows remote attackers to execute arbitrary code via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-27T21:00:00.000Z
CVE-2006-2631 
phpFoX allows remote authenticated users to modify arbitrary accounts via a modified NATIO cookie value, possibly the phpfox_user parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-27T21:00:00.000Z
CVE-2006-2632 
Cross-site scripting (XSS) vulnerability in Andrew Godwin ByteHoard 2.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via file descriptions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-30T10:00:00.000Z
CVE-2006-2633 
Absolute path traversal vulnerability in the copy action in index.php in Andrew Godwin ByteHoard 2.1 and earlier allows remote authenticated users to create or overwrite files in other users' directories by specifying the absolute path of the directory in the infolder parameter and simultaneously specifying the filename in the filepath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-30T10:00:00.000Z
CVE-2006-2634 
Cross-site scripting (XSS) vulnerability in Neocrome Land Down Under (LDU) in Neocrome Seditio 102 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-30T10:00:00.000Z
CVE-2006-2635 
Multiple cross-site scripting (XSS) vulnerabilities in Tikiwiki (aka Tiki CMS/Groupware) 1.9.x allow remote attackers to inject arbitrary web script or HTML via malformed nested HTML tags such as "<scr<script>ipt>" in (1) offset and (2) days parameters in (a) tiki-lastchanges.php, the (3) find and (4) offset parameters in (b) tiki-orphan_pages.php, the (5) offset and (6) initial parameters in (c) tiki-listpages.php, and (7) an unspecified field in (d) tiki-remind_password.php; and allow remote authenticated users with admin privileges to inject arbitrary web script or HTML via (8) an unspecified field in a metatags action in (e) tiki-admin.php, the (9) offset parameter in (f) tiki-admin_rssmodules.php, the (10) offset and (11) max parameters in (g) tiki-syslog.php, the (12) numrows parameter in (h) tiki-adminusers.php, (13) an unspecified field in (i) tiki-adminusers.php, (14) an unspecified field in (j) tiki-admin_hotwords.php, unspecified fields in (15) "Assign new module" and (16) "Create new user module" in (k) tiki-admin_modules.php, (17) an unspecified field in "Add notification" in (l) tiki-admin_notifications.php, (18) the offset parameter in (m) tiki-admin_notifications.php, the (19) Name and (20) Dsn fields in (o) tiki-admin_dsn.php, the (21) offset parameter in (p) tiki-admin_content_templates.php, (22) an unspecified field in "Create new template" in (q) tiki-admin_content_templates.php, and the (23) offset parameter in (r) tiki-admin_chat.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-30T10:00:00.000Z
CVE-2006-2636 
newsadmin.asp in Katy Whitton NewsCMSLite allows remote attackers to bypass authentication and gain administrative access by setting the loggedIn cookie to "xY1zZoPQ".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-30T10:00:00.000Z
CVE-2006-2637 
Cross-site scripting (XSS) vulnerability in view.php in TuttoPhp (1) Morris Guestbook 1, (2) Pretty Guestbook 1, and (3) Smile Guestbook 1 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element in the pagina parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-30T10:00:00.000Z
CVE-2006-2638 
SQL injection vulnerability in member.asp in qjForum allows remote attackers to execute arbitrary SQL commands via the uName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-30T10:00:00.000Z
CVE-2006-2639 
Cross-site scripting (XSS) vulnerability in the input forms in prattmic and Master5006 PHPSimpleChoose 0.3 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-30T10:00:00.000Z
CVE-2006-2640 
Cross-site scripting (XSS) vulnerability in OmegaMw7a.ASP in OMEGA (aka Omegasoft) INterneSErvicesLosungen (INSEL) allows remote attackers to inject arbitrary web script or HTML via the WCE parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-30T10:00:00.000Z
CVE-2006-2641 
** UNVERIFIABLE **  NOTE: this issue does not contain any verifiable or actionable details.  Cross-site scripting (XSS) vulnerability in John Frank Asset Manager (AssetMan) 2.4a and earlier allows remote attackers to inject arbitrary web script or HTML via "any of its input."  NOTE: the original disclosure is based on vague researcher claims without vendor acknowledgement; therefore this identifier cannot be linked with any future identifier that identifies more specific vectors.  Perhaps this should not be included in CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-30T10:00:00.000Z