rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-6884 
Multiple directory traversal vulnerabilities in XOOPS 2.3.1, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the xoopsConfig[language] parameter to (1) blocks.php and (2) main.php in xoops_lib/modules/protector/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-31T20:00:00.000Z
CVE-2008-6885 
Cross-site scripting (XSS) vulnerability in pmlite.php in XOOPS 2.3.1 and 2.3.2a allows remote attackers to inject arbitrary web script or HTML via a STYLE attribute in a URL BBcode tag in a private message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-31T20:00:00.000Z
CVE-2008-6886 
RSA EnVision 3.5.0, 3.5.1, 3.5.2, and 3.7.0 does not properly restrict access to unspecified user profile functionality, which allows remote attackers to obtain the administrator password hash and conduct brute force guessing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-03T14:00:00.000Z
CVE-2008-6887 
SQL injection vulnerability in detailad.asp in Pre Classified Listings 1.0 allows remote attackers to execute arbitrary SQL commands via the siteid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-03T14:00:00.000Z
CVE-2008-6888 
Cross-site scripting (XSS) vulnerability in signup.asp in Pre Classified Listings 1.0 allows remote attackers to inject arbitrary web script or HTML via the address parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-03T14:00:00.000Z
CVE-2008-6889 
SQL injection vulnerability in Merchantsadd.asp in ASPReferral 5.3 allows remote attackers to execute arbitrary SQL commands via the AccountID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-03T14:00:00.000Z
CVE-2008-6890 
SQL injection vulnerability in messages.asp in ASP Forum Script allows remote attackers to execute arbitrary SQL commands via the message_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-03T14:00:00.000Z
CVE-2008-6891 
Multiple cross-site scripting (XSS) vulnerabilities in ASP Forum Script allow remote attackers to inject arbitrary web script or HTML via the (1) forum_id parameter to (a) new_message.asp and (b) messages.asp, and the (2) query string to default.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-03T14:00:00.000Z
CVE-2008-6892 
SQL injection vulnerability in lire/index.php in Peel 3.1 allows remote attackers to execute arbitrary SQL commands via the rubid parameter.  NOTE: this might be the same issue as CVE-2005-3572.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-03T18:00:00.000Z
CVE-2008-6893 
Cross-site scripting (XSS) vulnerability in Alt-N MDaemon WorldClient 10.0.2, when Internet Explorer 7 is used, allows remote attackers to inject arbitrary web script or HTML via a crafted img tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-03T18:00:00.000Z
CVE-2008-6894 
Multiple cross-site scripting (XSS) vulnerabilities in login.php in 3CX Phone System Free Edition 6.1793 and 6.0.806.0 allow remote attackers to inject arbitrary web script or HTML via the (1) fName and (2) fPassword parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-03T18:00:00.000Z
CVE-2008-6895 
3CX Phone System 6.0.806.0 allows remote attackers to cause a denial of service (unstable service or crash) via unspecified vectors, as demonstrated by vulnerability scans from Nessus or SAINT.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-03T18:00:00.000Z
CVE-2008-6896 
login.php in 3CX Phone System 6.0.806.0, when 100% disk capacity is reached, allows remote attackers to gain sensitive information via unspecified vectors that reveal the installation path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-03T18:00:00.000Z
CVE-2008-6897 
Multiple buffer overflows in Getleft.exe in Andres Garcia Getleft 1.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) "a" HTML tag; a long src attribute in (2) embed, (3) img, or (4) script tags; (5) a long background attribute in a body tag; and other unspecified tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-05T22:00:00.000Z
CVE-2008-6898 
Buffer overflow in the XHTTP Module 4.1.0.0 in the ActiveX control for SaschArt SasCam Webcam Server 2.6.5 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long argument to the Get method and other unspecified methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-05T22:00:00.000Z
CVE-2008-6899 
Multiple buffer overflows in freeSSHd 1.2.1 allow remote authenticated users to cause a denial of service (crash) and execute arbitrary code via a long (1) open, (2) unlink, (3) mkdir, (4) rmdir, or (5) stat SFTP command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-05T22:00:00.000Z
CVE-2008-6900 
Unrestricted file upload vulnerability in "Add Pen/Author Name" feature in addpen.php in AvailScript Article Script allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in photos/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-06T00:00:00.000Z
CVE-2008-6901 
Multiple directory traversal vulnerabilities in 2532designs 2532|Gigs 1.2.2 Stable, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter to (1) settings.php, (2) deleteuser.php, (3) mini_calendar.php, (4) manage_venues.php, and (5) manage_gigs.php, a different vector than CVE-2007-4585.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-06T00:00:00.000Z
CVE-2008-6902 
Unrestricted file upload vulnerability in upload_flyer.php in 2532designs 2532|Gigs 1.2.2 Stable allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in flyers/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-06T00:00:00.000Z
CVE-2008-6903 
Sophos Anti-Virus for Windows before 7.6.3, Anti-Virus for Windows NT/9x before 4.7.18, Anti-Virus for OS X before 4.9.18, Anti-Virus for Linux before 6.4.5, Anti-Virus for UNIX before 7.0.5, Anti-Virus for Unix and Netware before 4.37.0, Sophos EM Library, and Sophos small business solutions, when CAB archive scanning is enabled, allows remote attackers to cause a denial of service (segmentation fault) via a "fuzzed" CAB archive file, as demonstrated by the OUSPG PROTOS GENOME test suite for Archive Formats.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-06T00:00:00.000Z
CVE-2008-6904 
Multiple unspecified vulnerabilities in Sophos SAVScan 4.33.0 for Linux, and possibly other products and versions, allow remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via crafted files that have been packed with (1) armadillo, (2) asprotect, or (3) asprotectSKE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-06T01:00:00.000Z
CVE-2008-6905 
Cross-site request forgery (CSRF) vulnerability in index.php in BabbleBoard 1.1.6 allows remote authenticated users to hijack the authentication of administrators for requests that delete (1) categories or (2) groups; (3) ban users; or (4) delete users via the admin page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-06T17:00:00.000Z
CVE-2008-6906 
Cross-site scripting (XSS) vulnerability in index.php in BabbleBoard 1.1.6 allows remote attackers to inject arbitrary web script or HTML via the username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-06T17:00:00.000Z
CVE-2008-6907 
Multiple SQL injection vulnerabilities in checkuser.php in 2532designs 2532|Gigs 1.2.2 Stable, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, as accessible from a form generated by index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-06T17:00:00.000Z
CVE-2008-6908 
Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, uses an insecure hash when signing requests, which allows remote attackers to impersonate other users and gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-06T17:00:00.000Z
CVE-2008-6909 
Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not sign all required data in requests, which has unspecified impact, probably related to man-in-the-middle attacks that modify critical data and allow remote attackers to impersonate other users and gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-06T18:00:00.000Z
CVE-2008-6910 
Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not use timeouts for signed requests, which allows remote attackers to impersonate other users and gain privileges via a replay attack that sends the same request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-06T18:00:00.000Z
CVE-2008-6911 
SQL injection vulnerability in the authenticateUser function in includes/authentication.inc.php in BrewBlogger (BB) 2.1.0.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the loginUsername parameter to includes/logincheck.inc.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-06T22:00:00.000Z
CVE-2008-6912 
Zeeways SHAADICLONE 2.0 allows remote attackers to bypass authentication and gain administrative privileges via a direct request to admin/home.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-07T18:33:00.000Z
CVE-2008-6913 
Unrestricted file upload vulnerability in editresume_next.php in Zeeways ZEEJOBSITE 2.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a photo in a profile edit action, then accessing the file via a direct request to jobseekers/logos/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-07T18:33:00.000Z
CVE-2008-6914 
Unrestricted file upload vulnerability in viewprofile.php in Zeeways ZEEPROPERTY 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a photo in a profile modification, then accessing a related file via a direct request to the file in companylogo/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-07T18:33:00.000Z
CVE-2008-6915 
Cross-site scripting (XSS) vulnerability in view_prop_details.php in Zeeways ZEEPROPERTY 1.0 allows remote attackers to inject arbitrary web script or HTML via the propid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-07T18:33:00.000Z
CVE-2008-6916 
Siemens SpeedStream 5200 with NetPort Software 1.1 allows remote attackers to bypass authentication via an invalid Host header, possibly involving a trailing dot in the hostname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-07T18:33:00.000Z
CVE-2008-6917 
SQL injection vulnerability in admin.php in Exocrew ExoPHPDesk 1.2 Final allows remote attackers to execute arbitrary SQL commands via the username (user parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-07T18:33:00.000Z
CVE-2008-6918 
Unrestricted file upload vulnerability in admin/galeria.php in ThePortal2 2.2 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in galeria/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T16:00:00.000Z
CVE-2008-6919 
profileedit.php TaskDriver 1.3 and earlier allows remote attackers to bypass authentication and gain administrative access by setting the auth cookie to "fook!admin."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T16:00:00.000Z
CVE-2008-6920 
Unrestricted file upload vulnerability in auth.php in phpEmployment 1.8 allows remote attackers to execute arbitrary code by uploading a file with an executable extension during a regnew action, then accessing it via a direct request to the file in photoes/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T16:00:00.000Z
CVE-2008-6921 
Unrestricted file upload vulnerability in index.php in phpAdBoard 1.8 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in photoes/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T16:00:00.000Z
CVE-2008-6922 
Multiple stack-based buffer overflows in CMailCOM.dll in CMailServer 5.4.6 allow remote attackers to execute arbitrary code via a long argument to the (1) CreateUserPath, (2) Logout, (3) DeleteMailByUID, (4) MoveToInbox, (5) MoveToFolder, (6) DeleteMailEx, (7) GetMailDataEx, (8) SetReplySign, (9) SetForwardSign, and (10) SetReadSign methods, which are not properly handled by (a) the POP3 Class ActiveX control (CMailCom.POP3); or a long argument to the (11) AddAttach, (12) SetSubject, (13) SetBcc, (14) SetBody, (15) SetCc, (16) SetFrom, (17) SetTo, and (18) SetFromUID methods, which are not properly handled by the Class ActiveX control (CMailCOM.SMTP), as demonstrated via the indexOfMail parameter to mwmail.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T18:00:00.000Z
CVE-2008-6923 
SQL injection vulnerability in the content component (com_content) 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a blogcategory action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T18:00:00.000Z
CVE-2008-6924 
Multiple cross-site scripting (XSS) vulnerabilities in register.php in eSyndiCat Directory 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) email, (3) password, (4) password2, (5) security_code, and (6) register parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T20:00:00.000Z
CVE-2008-6925 
Cross-site scripting (XSS) vulnerability in function.php in Zenphoto 1.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the "request logging" feature.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T20:00:00.000Z
CVE-2008-6926 
Directory traversal vulnerability in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the scriptpath_show parameter in a GoAhead action.  NOTE: this issue only crosses privilege boundaries when security settings such as disable_functions and safe_mode are active, since exploitation requires uploading of executable code to a home directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T20:00:00.000Z
CVE-2008-6927 
Multiple cross-site scripting (XSS) vulnerabilities in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allow remote attackers to inject arbitrary web script or HTML via the (1) localapp, (2) updatedir, (3) scriptpath_show, (4) domain_show, (5) thispage, (6) thisapp, and (7) currentversion parameters in an Upgrade action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T20:00:00.000Z
CVE-2008-6928 
Unrestricted file upload vulnerability in PHPStore Complete Classifieds allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a logo, then accessing it via a direct request to the file in classifieds1/yellow_images/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T20:25:00.000Z
CVE-2008-6929 
Unrestricted file upload vulnerability in PHPStore Auto Classifieds allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a logo, then accessing it via a direct request to the file in cars/cars_images/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T20:25:00.000Z
CVE-2008-6930 
Unrestricted file upload vulnerability in PHPStore Real Estate allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a logo, then accessing it via a direct request to the file in realty/re_images/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T20:25:00.000Z
CVE-2008-6931 
Unrestricted file upload vulnerability in PHPStore Job Search (aka PHPCareers) allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a resume photo, then accessing it via a direct request to the file in jobseekers/jobseeker_profile_images.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T20:25:00.000Z
CVE-2008-6932 
Unrestricted file upload vulnerability in submit_file.php in AlstraSoft SendIt Pro allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in send/files/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T20:25:00.000Z
CVE-2008-6933 
Directory traversal vulnerability in index.php in MiniGal b13 (aka MG2) allows remote attackers to read the source code of .php files, and possibly the content of other files, via a .. (dot dot) in the list parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T20:25:00.000Z
CVE-2008-6934 
Static code injection vulnerability in Sanus|artificium (aka Sanusart) Free simple guestbook PHP script, when downloaded before 20081111, allows remote attackers to inject arbitrary PHP code into messages.txt via the message parameter to act.php, which is executed when guestbook/guestbook.php is accessed.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T20:25:00.000Z
CVE-2008-6935 
Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary files, and cause a denial of service via encoded spaces in an im:// URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T20:25:00.000Z
CVE-2008-6936 
Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary files, and cause a denial of service via encoded spaces in a pres:// URI, a different vector than CVE-2008-6935.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T20:25:00.000Z
CVE-2008-6937 
Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary files, and cause a denial of service via encoded spaces in an xmpp:// URI, a different vector than CVE-2008-6935 and CVE-2008-6936.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T20:25:00.000Z
CVE-2008-6938 
Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname of the server via a request to a file in the ISAPI directory that is not an executable DLL, which triggers the crash when the DLL load fails, as demonstrated using Isapi\users.txt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T20:25:00.000Z
CVE-2008-6939 
TurnkeyForms Web Hosting Directory allows remote attackers to bypass authentication and (1) gain administrative privileges by setting the adm cookie to 1 or (2) gain privileges as another user by setting the logged cookie to the target username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6940 
TurnkeyForms Web Hosting Directory stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain a database backup via a direct request to admin/backup/db.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6941 
SQL injection vulnerability in the login functionality in TurnkeyForms Web Hosting Directory allows remote attackers to execute arbitrary SQL commands via the password field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6942 
Unrestricted file upload vulnerability in ScriptsFeed Realtor Classifieds System (aka Real Estate Classifieds) allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile logo, then accessing it via a direct request to the file in re_images/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6943 
Unrestricted file upload vulnerability in ScriptsFeed Recipes Listing Portal allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a recipe photo, then accessing it via a direct request to the file in pictures/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6944 
Unrestricted file upload vulnerability in ScriptsFeed Auto Classifieds allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile logo, then accessing it via a direct request to the file in cars_images/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6945 
Multiple cross-site scripting (XSS) vulnerabilities in Interchange 5.7 before 5.7.1, 5.6 before 5.6.1, and 5.4 before 5.4.3 allow remote attackers to inject arbitrary web script or HTML via (1) the mv_order_item CGI variable parameter in Core, (2) the country-select widget, or (3) possibly the value specifier when used in the UserTag feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z