rainbutterfly/cve_corpus huggingface dataset:
CVE-2004-1556 
MyWebServer 1.0.3 allows remote attackers to cause a denial of service (application crash) via a large number of connections within a short time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1557 
MyWebServer 1.0.3 allows remote attackers to bypass authentication, modify configuration, and read arbitrary files via a direct HTTP request to (1) /admin or (2) ServerProperties.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1558 
Multiple stack-based buffer overflows in YPOPs! (aka YahooPOPS) 0.4 through 0.6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) POP3 USER command or (2) SMTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1559 
Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, text, popupurl, or popuptitle parameters to wp-login.php, (2) redirect_url parameter to admin-header.php, (3) popuptitle, popupurl, content, or post_title parameters to bookmarklet.php, (4) cat_ID parameter to categories.php, (5) s parameter to edit.php, or (6) s or mode parameter to edit-comments.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1560 
Microsoft SQL Server 7.0 allows remote attackers to cause a denial of service (mssqlserver service halt) via a long request to TCP port 1433, possibly triggering a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1561 
Buffer overflow in Icecast 2.0.1 and earlier allows remote attackers to execute arbitrary code via an HTTP request with a large number of headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1562 
SQL injection vulnerability in redir_url.php in w-Agora 4.1.6a allows remote attackers to execute arbitrary SQL commands via the key parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1563 
Multiple cross-site scripting (XSS) vulnerabilities in w-Agora 4.1.6a allow remote attackers to execute arbitrary web script or HTML via the (1) thread parameter to download_thread.php, (2) loginuser parameter to login.php, or (3) userid parameter to forgot_password.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1564 
CRLF injection vulnerability in subscribe_thread.php in w-Agora 4.1.6a allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the thread parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1565 
list.php in w-Agora 4.1.6a allows remote attackers to reveal the full path via a crafted HTTP request, possibly involving a malformed id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1566 
Cross-site scripting (XSS) vulnerability in index.php in Silent Storm Portal 2.1 and 2.2 allows remote attackers to execute arbitrary web script or HTML via the module parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1567 
profile.php in Silent Storm Portal 2.1 and 2.2 allows remote attackers to gain privileges by setting the mail parameter to 1, which is the value for an administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1568 
Directory traversal vulnerability in ParaChat Server 5.5 allows remote attackers to read arbitrary files via a ..%5C (hex-encoded dot dot) in the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1569 
Buffer overflow in (1) MusicConverter.exe, (2) playlist.exe, and (3) amp.exe in dBpowerAMP Audio Player 2.0 and dbPowerAmp Music Converter 10.0 allows remote attackers to cause a denial of service or execute arbitrary code via a .pls or .m3u playlist that contains long File1 (filename) fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1570 
SQL injection vulnerability in bBlog 0.7.2 and 0.7.3 allows remote attackers to execute arbitrary SQL commands via the p parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1571 
AJ-Fork 167 allows remote attackers to gain sensitive information via a direct request to (1) auto-acronyms.php, (2) auto-archive.php, (3) ount-article-views.php, (4) kses.php, (5) custom-quick-tags.php, (6) disable-all-comments.php, (7) easy-date-format.php, (8) enable-disable-comments.php, (9) filter-by-author.php, (10) format-switcher.php, (11) long-to-short.php, (12) prospective-posting.php, or (13) sort-by-xfield.php, which displays the full path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1572 
AJ-Fork 167 does not restrict access to directories such as (1) data, (2) inc, (3) plugins, (4) skins, or (5) tools, which allows remote attackers to list files in those directories via a direct HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1573 
The documentation for AJ-Fork 167 implies that users should set permissions for users.db.php to 777, which allows local users to execute arbitrary PHP code and gain privileges as the administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1574 
Buffer overflow in Vypress Messenger 3.5.1 and earlier allows remote attackers to execute arbitrary code via a message with a long first field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1575 
The XML parser in Xerces-C++ 2.5.0 allows remote attackers to cause a denial of service (CPU consumption) via XML attributes in a crafted XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1576 
Format string vulnerability in Judge Dredd: Dredd vs. Death 1.01 and earlier allows remote attackers to cause a denial of service (application crash) via format string specifiers in a chat message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1577 
index.php in PHP Links allows remote attackers to gain sensitive information via an invalid show parameter, which reveals the full path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1578 
Cross-site scripting (XSS) vulnerability in index.php in Invision Power Board 2.0.0 allows remote attackers to execute arbitrary web script or HTML via the Referer field in the HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1579 
index.php in CubeCart 2.0.1 allows remote attackers to gain sensitive information via an HTTP request with an invalid cat_id parameter, which reveals the full path in a PHP error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1580 
SQL injection vulnerability in index.php in CubeCart 2.0.1 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1581 
BlackBoard 1.5.1 allows remote attackers to gain sensitive information via a direct request to (1) checkdb.inc.php, (2) admin.inc.php or (3) cp.inc.php, which reveals the path in a PHP error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1582 
PHP remote file inclusion vulnerability in BlackBoard 1.5.1 allows remote attackers to execute arbitrary PHP code by modifying the libpath parameter (incorrectly called "libpach") to reference a URL on a remote web server that contains _more.php, as demonstrated using checkdb.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1583 
Directory traversal vulnerability in the FTP server in TriDComm 1.3 and earlier allows remote attackers to read or write arbitrary files via a .. (dot dot) in FTP commands such as (1) DIR, (2) GET, or (3) PUT.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1584 
CRLF injection vulnerability in wp-login.php in WordPress 1.2 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the text parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1585 
Flash Messaging 5.2.0g (rev 1.1.2) and earlier allows remote attackers to cause a denial of service (application crash) via certain wide characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1586 
Flash Messaging clients can ignore disconnecting commands such as "shutdown" from the Flash Messaging Server 5.2.0g (rev 1.1.2), which could allow remote attackers to stay connected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1587 
Buffer overflow in Monolith games including (1) Alien versus Predator 2 1.0.9.6 and earlier, (2) Blood 2 2.1 and earlier, (3) No one lives forever 1.004 and earlier and (4) Shogo 2.2 and earlier allows remote attackers to cause a denial of service (application crash) via a long secure Gamespy query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1588 
SQL injection vulnerability in GoSmart Message Board allows remote attackers to execute arbitrary SQL code via the (1) QuestionNumber and Category parameters to Forum.asp or (2) Username and Password parameter to Login_Exec.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1589 
Cross-site scripting (XSS) vulnerability in GoSmart Message Board allows remote attackers to execute inject web script or HTML via the (1) Category parameter to Forum.asp or (2) MainMessageID parameter to ReplyToQuestion.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1590 
Clientexec allows remote attackers to gain sensitive information via an HTTP request to phpinfo.php, which calls the phpinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1591 
The web interface for Micronet Wireless Broadband Router SP916BM running firmware before 1.9 08/04/2004 resets the password to the default password when the router is shut off, which could allow remote attackers to gain access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1592 
PHP remote file inclusion vulnerability in index.php in ocPortal 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the req_path parameter to reference a URL on a remote web server that contains a malicious funcs.php script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1593 
Cross-site scripting (XSS) vulnerability in render.UserLayoutRootNode.uP in SCT Campus Pipeline allows remote attackers to inject arbitrary web script or HTML via the utf parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1594 
Cross-site scripting (XSS) vulnerability in FuseTalk 4.0 allows remote attackers to execute arbitrary web script via an img src tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1595 
Buffer overflow in ShixxNote 6.net build 117 allows remote attackers to execute arbitrary code via a long font field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1596 
The 3COM Wireless router 3CRADSL72 running Boot Code 1.3d allows remote attackers to gain sensitive information such as passwords and router settings via a direct HTTP request to app_sta.stm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1597 
RIM Blackberry 7230 running RIM Blackberry OS 3.7 SP1 allows remote attackers to cause a denial of service (device reboot and possibly data corruption) via a calendar message with a long Location field, which triggers a watchdog while the message is being stored.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1598 
Adobe Acrobat and Acrobat Reader 6.0 allow remote attackers to read arbitrary files via a PDF file that contains an embedded Shockwave (swf) file that references files outside of the temporary directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1599 
Cross-site scripting (XSS) vulnerability in index.php in CoolPHP 1.0-stable allows remote attackers to execute arbitrary web script or HTML via the (1) query or (2) nick parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1600 
index.php in CoolPHP 1.0-stable allows remote attackers to gain sensitive information via an invalid op parameter, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1601 
Directory traversal vulnerability in index.php in CoolPHP 1.0-stable allows remote attackers to access arbitrary files and execute local PHP scripts via a .. (dot dot) in the op parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1602 
ProFTPD 1.2.x, including 1.2.8 and 1.2.10, responds in a different amount of time when a given username exists, which allows remote attackers to identify valid usernames by timing the server response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1603 
cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1604 
cPanel 9.9.1-RELEASE-3 allows remote authenticated users to chmod arbitrary files via a symlink attack on the _private directory, which is created when Front Page extensions are enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1605 
SalesLogix 6.1 allows remote attackers to bypass authentication by modifying the slxweb cookie to set user=Admin, teams=ADMIN!, and usertype=Administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1606 
slxweb.dll in SalesLogix 6.1 allows remote attackers to cause a denial service (application crash) via an invalid HTTP request, which might also leak sensitive information in the ErrorLogMsg cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1607 
slxweb.dll in SalesLogix 6.1 allows remote attackers to obtain sensitive information via a (1) Library or (2) Attachment request with an invalid file parameter, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1608 
SQL injection vulnerability in SalesLogix 6.1 allows remote attackers to execute arbitrary SQL statements via the id parameter in a view operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1609 
SalesLogix 6.1 includes usernames, passwords, and other sensitive information in the headers of an HTTP response, which could allow remote attackers to gain access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1610 
SalesLogix 6.1 uses client-specified pathnames for writing certain files, which might allow remote authenticated users to create arbitrary files and execute code via the (1) vMME.AttachmentPath or (2) vMME.LibraryPath variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1611 
SalesLogix 6.1 does not verify if a user is authenticated before performing sensitive operations, which could allow remote attackers to (1) execute arbitrary SLX commands on the server or spoof the server via a man-in-the-middle (MITM) attack, or (2) obtain the database password via a GetConnection request to TCP port 1707.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1612 
Directory traversal vulnerability in SalesLogix 6.1 allows remote attackers to upload arbitrary files via a .. (dot dot) in a ProcessQueueFile request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1613 
Mozilla allows remote attackers to cause a denial of service (application crash from null dereference or infinite loop) via a web page that contains a (1) TEXTAREA, (2) INPUT, (3) FRAMESET or (4) IMG tag followed by a null character and some trailing characters, as demonstrated by mangleme.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1614 
Mozilla allows remote attackers to cause a denial of service (application crash from invalid memory access) via an "unusual combination of visual elements," including several large MARQUEE tags with large height parameters, as demonstrated by mangleme.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1615 
Opera allows remote attackers to cause a denial of service (invalid memory reference and application crash) via a web page or HTML email that contains a TBODY tag with a large COL SPAN value, as demonstrated by mangleme.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1616 
Links allows remote attackers to cause a denial of service (memory consumption) via a web page or HTML email that contains a table with a td element and a large rowspan value,as demonstrated by mangleme.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1617 
Lynx, lynx-ssl, and lynx-cur before 2.8.6dev.8 allow remote attackers to cause a denial of service (infinite loop) via a web page or HTML email that contains invalid HTML including (1) a TEXTAREA tag with a large COLS value and (2) a large tag name in an element that is not terminated, as demonstrated by mangleme.  NOTE: a followup suggests that the relevant trigger for this issue is the large COLS value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1618 
Vypress Tonecast 1.3 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed mp2 stream.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1619 
Buffer overflow in Privateer's Bounty: Age of Sail II allows remote attackers to execute arbitrary code via a long nickname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1620 
CRLF injection vulnerability in Serendipity before 0.7rc1 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the url parameter in (1) index.php and (2) exit.php, or (3) the HTTP Referer field in comment.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1621 
NOTE: this issue has been disputed by the vendor.  Cross-site scripting (XSS) vulnerability in IBM Lotus Notes R6 and Domino R6, and possibly earlier versions, allows remote attackers to execute arbitrary web script or HTML via square brackets at the beginning and end of (1) computed for display, (2) computed when composed, or (3) computed text element fields.  NOTE: the vendor has disputed this issue, saying that it is not a problem with Notes/Domino itself, but with the applications that do not properly handle this feature
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1622 
SQL injection vulnerability in dosearch.php in UBB.threads 3.4.x allows remote attackers to execute arbitrary SQL statements via the Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1623 
The WAV file property handler in Windows XP SP1 allows remote attackers to cause a denial of service (infinite loop in Explorer) via a WAV file with an invalid file header whose fmt chunk length is set to 0xFFFFFFFF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1624 
Carbon Copy 6.0.5257 does not drop system privileges when opening external programs through the help topic interface, which allows local users to gain privileges via (1) the help topic interface in CCW32.exe, which launches Notepad, or (2) the help button in the Carbon Copy Scheduler (CCSched.exe).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1625 
pGina 1.7.6 and possibly older versions, when the Restart or Shutdown options are enabled on the login screen, allows remote attackers to cause a denial of service by connecting via Remote Desktop and clicking restart or shutdown.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1626 
Buffer overflow in Ability Server 2.34, and possibly other versions, allows remote attackers to execute arbitrary code via a long STOR command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z
CVE-2004-1627 
Buffer overflow in Ability Server 2.25, 2.32, 2.34, and possibly other versions, allows remote attackers to execute arbitrary code via a long APPE command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-02-20T05:00:00.000Z