rainbutterfly/cve_corpus huggingface dataset:
CVE-2004-2294 
Canonicalize-before-filter error in the send_review function in the Reviews module for PHP-Nuke 6.0 to 7.3 allows remote attackers to inject arbitrary web script or HTML via hex-encoded XSS sequences in the text parameter, which is checked for dangerous sequences before it is canonicalized, leading to a cross-site scripting (XSS) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-04T04:00:00.000Z
CVE-2004-2295 
SQL injection vulnerability in the Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to execute arbitrary SQL commands via the order parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-04T04:00:00.000Z
CVE-2004-2296 
The preview_review function in the Reviews module in PHP-Nuke 6.0 to 7.3, when running on Windows systems, allows remote attackers to obtain sensitive information via an invalid date parameter, which generates an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-04T04:00:00.000Z
CVE-2004-2297 
The Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a large, out-of-range score parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-04T04:00:00.000Z
CVE-2004-2298 
Novell Internet Messaging System (NIMS) 2.6 and 3.0, and NetMail 3.1 and 3.5, is installed with a default NMAP authentication credential, which allows remote attackers to read and write mail store data if the administrator does not change the credential by using the NMAP Credential Generator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-05T04:00:00.000Z
CVE-2004-2299 
Buffer overflow in Omnicron OmniHTTPd 3.0a and earlier allows remote attackers to execute arbitrary code via an HTTP GET request with a long Range header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-05T04:00:00.000Z
CVE-2004-2300 
Buffer overflow in snmpd in ucd-snmp 4.2.6 and earlier, when installed setuid root, allows local users to execute arbitrary code via a long -p command line argument.  NOTE: it is not clear whether there are any standard configurations in which snmpd is installed setuid or setgid. If not, then this issue should not be included in CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-05T04:00:00.000Z
CVE-2004-2301 
Eudora before 6.1.1 allows remote attackers to cause a denial of service (crash) via an e-mail with a long "To:" field, possibly due to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-05T04:00:00.000Z
CVE-2004-2302 
Race condition in the sysfs_read_file and sysfs_write_file functions in Linux kernel before 2.6.10 allows local users to read kernel memory and cause a denial of service (crash) via large offsets in sysfs files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-08T04:00:00.000Z
CVE-2004-2303 
MTools Mformat before 3.9.9, when installed setuid root, creates files with world-readable and world-writable permissions, which allows local users to read and overwrite files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2304 
Integer overflow in Trillian 0.74 and earlier, and Trillian Pro 2.01 and earlier, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a directIM packet that triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2305 
Computer Associates eTrust Antivirus EE 6.0 through 7.0 allows remote attackers to bypass virus scanning by including a password-protected file in a ZIP file, which causes eTrust to scan only the password protected file and skip the other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2306 
Sun Solaris 7 through 9, when Basic Security Module (BSM) is enabled and the SUNWscpu package has been removed as a result of security hardening, disables mail alerts from the audit_warn script, which might allow attackers to escape detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2307 
Microsoft Internet Explorer 6.0.2600 on Windows XP allows remote attackers to cause a denial of service (browser crash) via a shell: URI with double backslashes (\\) in an HTML tag such as IFRAME or A.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2308 
Cross-site scripting (XSS) vulnerability in cPanel 9.1.0 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the dir parameter in dohtaccess.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2309 
Directory traversal vulnerability in Crob FTP Server 3.5.1 allows local users to browse outside the FTP root via multiple ../ (dot dot slash) in the DIR command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2310 
Cross-site scripting (XSS) vulnerability in webadmin.nsf in Lotus Domino R6 6.5.1 allows remote attackers to inject arbitrary web script or HTML via a Domino command in the Quick Console.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2311 
Directory traversal vulnerability in webadmin.nsf in Lotus Domino R6 6.5.1 allows local users to create folders or determine the existence of files via a .. (dot dot) in the new folder dialog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2312 
Buffer overflow in GNU make for IBM AIX 4.3.3, when installed setgid, allows local users to gain privileges via a long CC argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2313 
Inter7 SqWebMail 3.4.1 through 3.6.1 generates different error messages for incorrect passwords versus correct passwords on non-mail-enabled accounts (such as root), which allows remote attackers to guess the root password via brute force attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2314 
The Telnet listener for Novell iChain Server before 2.2 Field Patch 3b 2.2.116 does not have a password by default, which allows remote attackers to gain access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2315 
Mbedthis AppWeb HTTP server before 1.0.2 allows remote attackers to cause a denial of service (crash) via an empty OPTIONS request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2316 
Mbedthis AppWeb HTTP server before 1.0.2 allows remote attackers to cause a denial of service (crash) via a GET request containing an MS-DOS device name such as COM1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2317 
Information leak in Mbedthis AppWeb HTTP server 1.0 through 1.1.2 allows remote attackers to obtain sensitive information via a user message that is generated when Mbedthis denies access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2318 
The administrative interface (surgeftpmgr.cgi) for SurgeFTP Server 1.0b through 2.2k1 allows remote attackers to cause a temporary denial of service (crash) via requests with two percent (%) signs in the CMD parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2319 
IBM Informix Dynamic Server (IDS) before 9.40.xC3 allows local users to (1) create or overwrite files via the /001 log file to onedcu or (2) read arbitrary files via a symlink attack on a file in /tmp to onshowaudit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2320 
The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2321 
BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including (1) ServerStartMBean.Password and (2) NodeManagerMBean.CertificatePassword.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2322 
SQL injection vulnerability in the (1) announce and (2) notes modules of phpWebSite before 0.9.3-2 allows remote attackers to execute arbitrary SQL queries, as demonstrated using the ANN_id parameter to the announce module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2323 
DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to obtain sensitive information, including the SQL server username and password, via a GET request for source or configuration files such as Web.config.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2324 
SQL injection vulnerability in DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to modify the backend database via the (1) table and (2) field parameters in LinkClick.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2325 
Cross-site scripting (XSS) vulnerability in EditModule.aspx for DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to inject arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2326 
SQL injection vulnerability in IP3 Networks NetAccess Appliance before firmware 3.1.18b13 allows remote attackers to bypass authentication via the (1) login or (2) password.  NOTE: this issue was later reported to also affect firmware 4.0.34.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2327 
Vizer Web Server 1.9.1 allows remote attackers to cause a denial of service (crash) via multiple malformed requests including (1) requests without GET, (2) GET requests without HTTP, (3) or long GET requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2328 
Clearswift MAILsweeper for SMTP before 4.3_13 allows remote attackers to cause a denial of service (infinite loop) via an e-mail with a crafted RAR archive attached.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2329 
Kerio Personal Firewall (KPF) 2.1.5 allows local users to execute arbitrary code with SYSTEM privileges via the Load button in the Firewall Configuration Files option, which does not drop privileges before opening the file loading dialog box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2330 
ColdFusion MX 6.1 and 6.1 J2EE allows remote attackers to cause a denial of service via an HTTP request containing a large number of form fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2331 
ColdFusion MX 6.1 and 6.1 J2EE allows local users to bypass sandbox security restrictions and obtain sensitive information by using Java reflection methods to access trusted Java objects without using the CreateObject function or cfobject tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2332 
Multiple cross-site scripting (XSS) vulnerabilities in CPAN WWW::Form before 1.13 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2333 
Bodington 2.1.0 RC1 and earlier does not secure the file upload area, which allows remote attackers to read uploaded files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2334 
Multiple cross-site scripting (XSS) vulnerabilities in EMU Webmail 5.2.7 allow remote attackers to inject arbitrary web script or HTML via (1) a hex-encoded value to the variable parameter in emumail.fcgi, (2) the folder parameter in emumail.fcgi, or Javascript in the (3) username or (4) password field in the login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2335 
The Macromedia installers and e-licensing client on Mac OS X, as used for Macromedia Contribute 2, Director, Dreamweaver, Fireworks, Flash, and Studio, install the AuthenticationService setuid and writable by other users, which allows local users to gain privileges by modifying the program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2336 
Unknown vulnerability in Novell GroupWise and GroupWise WebAccess 6.0 through 6.5, when running with Apache Web Server 1.3 for NetWare where Apache is loaded using GWAPACHE.CONF, allows remote attackers to read directories and files on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2337 
The /.inlook/.crypt file for inlook 0.7.3 and earlier is installed with world readable permissions, which allows local users to obtain user POP3 credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2338 
OpenBSD 3.3 and 3.4 does not properly parse Accept and Deny rules without netmasks on big-endian 64-bit platforms such as SPARC64, which may allow remote attackers to bypass access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2339 
Microsoft Windows 2000, XP, and possibly 2003 allows local users with the SeDebugPrivilege privilege to execute arbitrary code as kernel and read or write kernel memory via the NtSystemDebugControl function, which does not verify its pointer arguments.  Note: this issue has been disputed, since Administrator privileges are typically required to exploit this issue, thus privilege boundaries are not crossed
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2340 
** UNVERIFIABLE **  SQL injection vulnerability in PunkBuster Screenshot Database (PB-DB) Alpha 6 allows remote attackers to execute arbitrary SQL commands via the username and password fields of the login form.  NOTE: the original vulnerability report contains several significant inconsistencies that make it unclear whether the report is accurate, including (1) PB-DB is really the "PunkBuster Screenshot Database" and not "PunkBuster" itself; (2) there is no apparent association between PunkBuster and "Punky Brewster"; (3) the claimed source code is not anywhere in Alpha 6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2341 
PHP file include injection vulnerability in isearch.inc.php for iSearch allows remote attackers to execute arbitrary code via the isearch_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2342 
ChatterBox 2.0 allows remote attackers to cause a denial of service (server crash) via a malformed request to the server, as demonstrated using "aaaaaa".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2343 
Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2344 
Unknown vulnerability in the ASN.1/H.323/H.225 stack of VocalTec VGW120 and VGW480 allows remote attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2345 
Unknown multiple vulnerabilities in Oracle9i Database Server 9.0.1.4, 9.0.1.5, 9.2.0.3, and 9.2.0.4 allow local users with the ability to invoke SQL to cause a denial of service or obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2346 
Multiple cross-site scripting (XSS) vulnerabilities in Forum Web Server 1.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the Subject field in post1.htm and (2) the File Description field in postfile2.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2347 
blog.cgi in Leif M. Wright Web Blog 1.1 and 1.1.5 allows remote attackers to execute arbitrary commands via shell metacharacters such as '|' in the file parameter of ViewFile requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2348 
Sybari AntiGen for Domino 7.0 Build 722 SR2 allows remote attackers to cause a denial of service (hang) via an encrypted ZIP file with the "include full path info" option set, as used by certain variants of the Beagle/Bagle worm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2349 
Multiple SQL injection vulnerabilities in Tunez before 1.20-pre2 allow remote attackers to execute arbitrary SQL queries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2350 
SQL injection vulnerability in search.php for phpBB 1.0 through 2.0.6 allows remote attackers to execute arbitrary SQL and gain privileges via the search_results parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2351 
Cross-site scripting (XSS) vulnerability in GBook for Php-Nuke 1.0 allows remote attackers to inject arbitrary web script or HTML via multiple parameters, including (1) name, (2) email, (3) city, and (4) message, which do not use the <script> and <style> tags, which are filtered by PHP-Nuke.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2352 
Cross-site scripting (XSS) vulnerability in GBook for PHP-Nuke 1.0 allows remote attackers to inject arbitrary web script or HTML via cookies that are stored in the $_COOKIE PHP variable, which is not cleansed by PHP-Nuke.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2353 
BugPort before 1.099 stores its configuration file (conf/config.conf) under the web document root with a file extension that is not normally parsed by web servers, which allows remote attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2354 
SQL injection vulnerability in 4nGuestbook 0.92 for PHP-Nuke 6.5 through 6.9 allows remote attackers to modify SQL statements via the entry parameter to modules.php, which can also facilitate cross-site scripting (XSS) attacks when MySQL errors are triggered.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2355 
Cross-site scripting (XSS) vulnerability in Crafty Syntax Live Help (CSLH) before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the name field of a livehelp or chat session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2356 
Early termination vulnerability in Fizmez Web Server 1.0 allows remote attackers to cause a denial of service (crash) by connecting to the server and then disconnecting without sending any data, which triggers a null pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2357 
The embedded MySQL 4.0 server for Proofpoint Protection Server does not require a password for the root user of MySQL, which allows remote attackers to read or modify the backend database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2358 
Cross-site scripting (XSS) vulnerability in admin_words.php for phpBB 2.0.6c allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2359 
Dell TrueMobile 1300 WLAN Mini-PCI Card Util TrayApplet 3.10.39.0 does not properly drop SYSTEM privileges when started from the systray applet, which allows local users to gain privileges by accessing the Help functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2360 
Targem Battle Mages 1.0 allows remote attackers to cause a denial of service (infinite loop) via a UDP packet with incomplete data, which causes the server to enter an infinite loop while waiting to read the rest of the data that is not sent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2361 
Digital Reality game engine, as used in Haegemonia 1.0 through 1.0.7 and Desert Rats vs. Afrika Korps 1.0, allows remote attackers to cause a denial of service (crash) via a chat message with a large message size, which triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z
CVE-2004-2362 
PHPX 3.2.6 and earlier allows remote attackers to obtain the physical path of PHPX via a null or invalid value in the limit parameter, which leaks the pathname in a database error message, as demonstrated using forums.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-16T04:00:00.000Z