rainbutterfly/cve_corpus huggingface dataset:
CVE-2005-0071 
vdr before 1.2.6 does not securely create files, which allows attackers to overwrite arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0072 
zhcon before 0.2 does not drop privileges before reading a user configuration file, which allows local users to read arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0073 
Buffer overflow in queue.c in a support script for sympa 3.3.3, when running setuid, allows local users to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-11T05:00:00.000Z
CVE-2005-0074 
Buffer overflow in pcdsvgaview in xpcd 2.08 allows local users to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-11T05:00:00.000Z
CVE-2005-0075 
prefs.php in SquirrelMail before 1.4.4, with register_globals enabled, allows remote attackers to inject local code into the SquirrelMail code via custom preference handlers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0076 
Multiple buffer overflows in the XView library 3.2 may allow local users to execute arbitrary code via setuid applications that use the library.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-10T05:00:00.000Z
CVE-2005-0077 
The DBI library (libdbi-perl) for Perl allows local users to overwrite arbitrary files via a symlink attack on a temporary PID file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0078 
The KDE screen saver in KDE before 3.0.5 does not properly check the return value from a certain function call, which allows attackers with physical access to cause a crash and access the desktop session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0079 
Buffer overflow in xtrlock 2.0 allows local users to cause a denial of service (application crash) and hijack the desktop session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0080 
The 55_options_traceback.dpatch patch for mailman 2.1.5 in Ubuntu 4.10 displays a different error message depending on whether the e-mail address is subscribed to a private list, which allows remote attackers to determine the list membership for a given e-mail address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0081 
MySQL MaxDB 7.5.0.0, and other versions before 7.5.0.21, allows remote attackers to cause a denial of service (crash) via an HTTP request with invalid headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-20T05:00:00.000Z
CVE-2005-0082 
The sapdbwa_GetUserData function in MySQL MaxDB 7.5.0.0, and other versions before 7.5.0.21, allows remote attackers to cause a denial of service (crash) via invalid parameters to the WebDAV handler code, which triggers a null dereference that causes the SAP DB Web Agent to crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-20T05:00:00.000Z
CVE-2005-0083 
MySQL MaxDB 7.5.00 for Windows, and possibly earlier versions and other platforms, allows remote attackers to cause a denial of service (application crash) via invalid parameters to the (1) DBMCli_String::ReallocString, (2) DBMCli_String::operator, (3) DBMCli_Buffer::ForceResize, (4) DBMCli_Wizard::InstallDatabase, (5) DBMCli_Devspaces::Complete, (6) DBMWeb_TemplateWizard::askForWriteCountStep5, or (7) DBMWeb_DBMWeb::wizardDB functions, which triggers a null dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-17T05:00:00.000Z
CVE-2005-0084 
Buffer overflow in the X11 dissector in Ethereal 0.8.10 through 0.10.8 allows remote attackers to execute arbitrary code via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0085 
Cross-site scripting (XSS) vulnerability in ht://dig (htdig) before 3.1.6-r7 allows remote attackers to execute arbitrary web script or HTML via the config parameter, which is not properly sanitized before it is displayed in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-15T05:00:00.000Z
CVE-2005-0086 
Heap-based buffer overflow in less in Red Hat Enterprise Linux 3 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted file, as demonstrated using the UTF-8 locale.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0087 
The alsa-lib package in Red Hat Linux 4 disables stack protection for the libasound.so library, which makes it easier for attackers to execute arbitrary code if there are other vulnerabilities in the library.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-15T05:00:00.000Z
CVE-2005-0088 
The publisher handler for mod_python 2.7.8 and earlier allows remote attackers to obtain access to restricted objects via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-10T05:00:00.000Z
CVE-2005-0089 
The SimpleXMLRPCServer library module in Python 2.2, 2.3 before 2.3.5, and 2.4, when used by XML-RPC servers that use the register_instance method to register an object without a _dispatch method, allows remote attackers to read or modify globals of the associated module, and possibly execute arbitrary code, via dotted attributes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0090 
A regression error in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch omits an "access check," which allows local users to cause a denial of service (crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-21T05:00:00.000Z
CVE-2005-0091 
Unknown vulnerability in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch, when using the hugemem kernel, allows local users to read and write to arbitrary kernel memory and gain privileges via certain syscalls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-21T05:00:00.000Z
CVE-2005-0092 
Unknown vulnerability in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch, when running on x86 with the hugemem kernel, allows local users to cause a denial of service (crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-21T05:00:00.000Z
CVE-2005-0094 
Buffer overflow in the gopherToHTML function in the Gopher reply parser for Squid 2.5.STABLE7 and earlier allows remote malicious Gopher servers to cause a denial of service (crash) via crafted responses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0095 
The WCCP message parsing code in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (crash) via malformed WCCP messages with source addresses that are spoofed to reference Squid's home router and invalid WCCP_I_SEE_YOU cache numbers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0096 
Memory leak in the NTLM fakeauth_auth helper for Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (memory consumption).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0097 
The NTLM component in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (crash) via a malformed NTLM type 3 message that triggers a NULL dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0098 
Multiple buffer overflows in the SDL port of abuse (abuse-SDL) before 2.00 allow local users to execute arbitrary code via the command line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-08T05:00:00.000Z
CVE-2005-0099 
The SDL port of abuse (abuse-SDL) before 2.00 does not properly drop privileges before creating certain files, which allows local users to create or overwrite arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-08T05:00:00.000Z
CVE-2005-0100 
Format string vulnerability in the movemail utility in (1) Emacs 20.x, 21.3, and possibly other versions, and (2) XEmacs 21.4 and earlier, allows remote malicious POP3 servers to execute arbitrary code via crafted packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-08T05:00:00.000Z
CVE-2005-0101 
Buffer overflow in the socket_getline function in Newspost 2.1.1 and earlier allows remote malicious NNTP servers to execute arbitrary code via a long string without a newline character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0102 
Integer overflow in camel-lock-helper in Evolution 2.0.2 and earlier allows local users or remote malicious POP3 servers to execute arbitrary code via a length value of -1, which leads to a zero byte memory allocation and a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0103 
PHP remote file inclusion vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to execute arbitrary PHP code by modifying a URL parameter to reference a URL on a remote web server that contains the code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0104 
Cross-site scripting (XSS) vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to inject arbitrary web script or HTML via certain integer variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0105 
Unknown vulnerability in typespeed 0.4.1 and earlier allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-16T05:00:00.000Z
CVE-2005-0106 
SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGD_PATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-03T04:00:00.000Z
CVE-2005-0107 
bsmtpd 2.3 and earlier does not properly sanitize e-mail addresses, which allows remote attackers to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-25T05:00:00.000Z
CVE-2005-0108 
Apache mod_auth_radius 1.5.4 and libpam-radius-auth allow remote malicious RADIUS servers to cause a denial of service (crash) via a RADIUS_REPLY_MESSAGE with a RADIUS attribute length of 1, which leads to a memcpy operation with a -1 length argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0109 
Hyper-Threading technology, as used in FreeBSD and other operating systems that are run on Intel Pentium and other processors, allows local users to use a malicious thread to create covert channels, monitor the execution of other threads, and obtain sensitive information such as cryptographic keys, via a timing attack on memory cache misses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-03-08T05:00:00.000Z
CVE-2005-0110 
Internet Explorer 6 on Windows XP SP2 allows remote attackers to bypass the file download warning dialog and possibly trick an unknowledgeable user into executing arbitrary code via a web page with a body element containing an onclick tag, as demonstrated using the createElement function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0111 
Stack-based buffer overflow in the websql CGI program in MySQL MaxDB 7.5.00 allows remote attackers to execute arbitrary code via a long password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0112 
The web-based administrative interface for 3Com OfficeConnect Wireless 11g Access Point (AP) 1.00.08, and possibly earlier versions before 1.03.07A, allows remote attackers to bypass authentication and obtain sensitive information by directly accessing the (1) config.bin (2) profile.wlp?PN=ggg or (3) event.logs URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-22T05:00:00.000Z
CVE-2005-0113 
inpview in SGI IRIX allows local users to execute arbitrary commands via the SUN_TTSESSION_CMD environment variable, which is executed by inpview without dropping privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0114 
vsdatant.sys in Zone Lab ZoneAlarm before 5.5.062.011, ZoneAlarm Wireless before 5.5.080.000, Check Point Integrity Client 4.x before 4.5.122.000 and 5.x before 5.1.556.166 do not properly verify that the ServerPortName argument to the NtConnectPort function is a valid memory address, which allows local users to cause a denial of service (system crash) when ZoneAlarm attempts to dereference an invalid pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-11T05:00:00.000Z
CVE-2005-0115 
Stack-based buffer overflow in DataRescue Interactive Disassembler (IDA) Pro 4.7 allows attackers to execute arbitrary code via a PE file with an Import Address Table containing a long import library name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0116 
AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0117 
Buffer overflow in XShisen before 1.36 allows local users to execute arbitrary code via a long GECOS field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0118 
helvis 1.8h2_1 and earlier stores recovery files in world readable directories with world readable permissions, which allows local users to read the recovered files of other users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0119 
helvis 1.8h2_1 and earlier allows local users to recover and read the files of other users via the elvrec setuid program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0120 
helvis 1.8h2_1 and earlier allows local users to delete arbitrary files via the elvprsv setuid program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0121 
Multiple buffer overflows in golddig 2.0 and earlier allow local users to execute arbitrary code via (1) a long map name command line argument or (2) a long username as recorded in the USER environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-19T05:00:00.000Z
CVE-2005-0124 
The coda_pioctl function in the coda functionality (pioctl.c) for Linux kernel 2.6.9 and 2.4.x before 2.4.29 may allow local users to cause a denial of service (crash) or execute arbitrary code via negative vi.in_size or vi.out_size values, which may trigger a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-20T05:00:00.000Z
CVE-2005-0125 
The "at" commands on Mac OS X 10.3.7 and earlier do not properly drop privileges, which allows local users to (1) delete arbitrary files via atrm, (2) execute arbitrary programs via the -f argument to batch, or (3) read arbitrary files via the -f argument to batch, which generates a job file that is readable by the local user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0126 
ColorSync on Mac OS X 10.3.7 and 10.3.8 allows attackers to execute arbitrary code via malformed ICC color profiles that modify the heap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0127 
Mail in Mac OS X 10.3.7, when generating a Message-ID header, generates a GUUID that includes information that identifies the Ethernet hardware being used, which allows remote attackers to link mail messages to a particular machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0129 
The Quick Buttons feature in Konversation 0.15 allows remote attackers to execute certain IRC commands via a channel name containing "%" variables, which are recursively expanded by the Server::parseWildcards function when the Part Button is selected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-22T05:00:00.000Z
CVE-2005-0130 
Certain Perl scripts in Konversation 0.15 allow remote attackers to execute arbitrary commands via shell metacharacters in (1) channel names or (2) song names that are not properly quoted when the user runs IRC scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-22T05:00:00.000Z
CVE-2005-0131 
The Quick Connection dialog in Konversation 0.15 inadvertently uses the user-provided password as the nickname instead of the user-provided nickname when connecting to the IRC server, which could leak the password to other users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-22T05:00:00.000Z
CVE-2005-0133 
ClamAV 0.80 and earlier allows remote attackers to cause a denial of service (clamd daemon crash) via a ZIP file with malformed headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-06T05:00:00.000Z
CVE-2005-0134 
The X server in SCO UnixWare 7.1.1, 7.1.3, and 7.1.4 does not properly create socket directories in /tmp, which could allow attackers to hijack local sockets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-05-18T04:00:00.000Z
CVE-2005-0135 
The unw_unwind_to_user function in unwind.c on Itanium (ia64) architectures in Linux kernel 2.6 allows local users to cause a denial of service (system crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-24T04:00:00.000Z
CVE-2005-0136 
The Linux kernel before 2.6.11 on the Itanium IA64 platform has certain "ptrace corner cases" that allow local users to cause a denial of service (crash) via crafted syscalls, possibly related to MCA/INIT, a different vulnerability than CVE-2005-1761.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-01T00:00:00.000Z
CVE-2005-0137 
Linux kernel 2.6 on Itanium (ia64) architectures allows local users to cause a denial of service via a "missing Itanium syscall table entry."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-04-24T04:00:00.000Z
CVE-2005-0138 
rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not correctly allow access to anonymous clients that connect from a system whose hostname can not be determined.  NOTE: while this issue occurs in a security mechanism, there is no apparent attacker role and probably does not satisfy the CVE definition of a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-21T04:00:00.000Z
CVE-2005-0139 
Unknown vulnerability in rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not sufficiently restrict access rights for read-mostly exports, which allows attackers to conduct unauthorized activities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-21T04:00:00.000Z
CVE-2005-0140 
Buffer overflow in PeID allows attackers to execute arbitrary code via a PE file with an Import Address Table containing a long import library name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0141 
Firefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to load local files via links "with a custom getter and toString method" that are middle-clicked by the user to be opened in a new tab.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0142 
Firefox 0.9, Thunderbird 0.6 and other versions before 0.9, and Mozilla 1.7 before 1.7.5 save temporary files with world-readable permissions, which allows local users to read certain web content or attachments that belong to other users, e.g. content that is managed by helper applications such as PDF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0143 
Firefox before 1.0 and Mozilla before 1.7.5 display the SSL lock icon when an insecure page loads a binary file from a trusted site, which could facilitate phishing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0144 
Firefox before 1.0 and Mozilla before 1.7.5 display the secure site lock icon when a view-source: URL references a secure SSL site while an insecure page is being loaded, which could facilitate phishing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0145 
Firefox before 1.0 does not properly distinguish between user-generated and synthetic click events, which allows remote attackers to use Javascript to bypass the file download prompt when the user uses the Alt-click feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0146 
Firefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to obtain sensitive data from the clipboard via Javascript that generates a middle-click event on systems for which a middle-click performs a paste operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z
CVE-2005-0147 
Firefox before 1.0 and Mozilla before 1.7.5, when configured to use a proxy, respond to 407 proxy auth requests from arbitrary servers, which allows remote attackers to steal NTLM or SPNEGO credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-01-29T05:00:00.000Z