rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-0028 
Microsoft Excel 2000, 2002, 2003, Viewer 2003, Office 2004 for Mac, and Office v.X for Mac does not properly handle certain opcodes, which allows user-assisted remote attackers to execute arbitrary code via a crafted XLS file, which results in an "Improper Memory Access Vulnerability."  NOTE: an early disclosure of this issue used CVE-2006-3432, but only CVE-2007-0028 should be used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-09T23:00:00.000Z
CVE-2007-0029 
Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via a malformed string, aka "Excel Malformed String Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-09T23:00:00.000Z
CVE-2007-0030 
Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via an Excel file with an out-of-range Column field in certain BIFF8 record types, which references arbitrary memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-09T23:00:00.000Z
CVE-2007-0031 
Heap-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via a BIFF8 spreadsheet with a PALETTE record that contains a large number of entries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-09T23:00:00.000Z
CVE-2007-0033 
Microsoft Outlook 2002 and 2003 allows user-assisted remote attackers to execute arbitrary code via a malformed VEVENT record in an .iCal meeting request or ICS file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-09T23:00:00.000Z
CVE-2007-0034 
Buffer overflow in the Advanced Search (Finder.exe) feature of Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted Outlook Saved Searches (OSS) file that triggers memory corruption, aka "Microsoft Outlook Advanced Find Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-09T23:00:00.000Z
CVE-2007-0035 
Word (or Word Viewer) in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, 2004 for Mac, and Works Suite 2004, 2005, and 2006 does not properly handle data in a certain array, which allows user-assisted remote attackers to execute arbitrary code, aka the "Word Array Overflow Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-08T22:00:00.000Z
CVE-2007-0038 
Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a large length value in the second (or later) anih block of a RIFF .ANI, cur, or .ico file, which results in memory corruption when processing cursors, animated cursors, and icons, a variant of CVE-2005-0416, as originally demonstrated using Internet Explorer 6 and 7. NOTE: this might be a duplicate of CVE-2007-1765; if so, then CVE-2007-0038 should be preferred.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T20:00:00.000Z
CVE-2007-0039 
The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remote attackers to cause a denial of service (crash) via an Internet Calendar (iCal) file containing multiple X-MICROSOFT-CDO-MODPROPS (MODPROPS) properties in which the second MODPROPS is longer than the first, which triggers a NULL pointer dereference and an unhandled exception.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-08T23:00:00.000Z
CVE-2007-0040 
The LDAP service in Windows Active Directory in Microsoft Windows 2000 Server SP4, Server 2003 SP1 and SP2, Server 2003 x64 Edition and SP2, and Server 2003 for Itanium-based Systems SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted LDAP request with an unspecified number of "convertible attributes."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-10T22:00:00.000Z
CVE-2007-0041 
The PE Loader service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to execute arbitrary code via unspecified vectors involving an "unchecked buffer" and unvalidated message lengths, probably a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-10T22:00:00.000Z
CVE-2007-0042 
Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to access configuration files and obtain sensitive information, and possibly bypass security mechanisms that try to constrain the final substring of a string, via %00 characters, related to use of %00 as a string terminator within POSIX functions but a data character within .NET strings, aka "Null Byte Termination Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-10T22:00:00.000Z
CVE-2007-0043 
The Just In Time (JIT) Compiler service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows user-assisted remote attackers to execute arbitrary code via unspecified vectors involving an "unchecked buffer," probably a buffer overflow, aka ".NET JIT Compiler Vulnerability".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-10T22:00:00.000Z
CVE-2007-0044 
Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the (1) FDF, (2) xml, and (3) xfdf AJAX request parameters, following the # (hash) character, aka "Universal CSRF and session riding."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-03T20:00:00.000Z
CVE-2007-0045 
Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, for Mozilla Firefox, Microsoft Internet Explorer 6 SP1, Google Chrome, Opera 8.5.4 build 770, and Opera 9.10.8679 on Windows allow remote attackers to inject arbitrary JavaScript and conduct other attacks via a .pdf URL with a javascript: or res: URI with (1) FDF, (2) XML, and (3) XFDF AJAX parameters, or (4) an arbitrarily named name=URI anchor identifier, aka "Universal XSS (UXSS)."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-03T20:00:00.000Z
CVE-2007-0046 
Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to execute arbitrary code by causing an error via a javascript: URI call to document.write in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-03T20:00:00.000Z
CVE-2007-0047 
CRLF injection vulnerability in Adobe Acrobat Reader Plugin before 8.0.0, when used with the Microsoft.XMLHTTP ActiveX object in Internet Explorer, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the javascript: URI in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-03T20:00:00.000Z
CVE-2007-0048 
Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, when used with Internet Explorer, Google Chrome, or Opera, allows remote attackers to cause a denial of service (memory consumption) via a long sequence of # (hash) characters appended to a PDF URL, related to a "cross-site scripting issue."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-03T20:00:00.000Z
CVE-2007-0049 
Geckovich TaskTracker Pro 1.5 and earlier allows remote attackers to add administrative or other accounts via an Add action with a modified GroupID in a direct request to Customize.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-04T11:00:00.000Z
CVE-2007-0050 
PHP remote file inclusion vulnerability in index.php in OpenPinboard 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the language parameter.  NOTE: this issue has been disputed by the developer and a third party, since the variable is set before use. CVE analysis suggests that there is a small time window of risk before the installation is complete
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-04T11:00:00.000Z
CVE-2007-0051 
Format string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows remote user-assisted attackers to execute arbitrary code via a crafted photocast with format string specifiers in the title of an RSS iPhoto feed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-04T18:00:00.000Z
CVE-2007-0052 
SQL injection vulnerability in haberdetay.asp in Vizayn Haber allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-04T22:00:00.000Z
CVE-2007-0053 
SQL injection vulnerability in detail.asp in ASP SiteWare autoDealer 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the iPro parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-04T22:00:00.000Z
CVE-2007-0054 
Cross-site scripting (XSS) vulnerability in gbrowse.php in Belchior Foundry vCard PRO allows remote attackers to inject arbitrary web script or HTML via the sortby parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-04T22:00:00.000Z
CVE-2007-0055 
Directory traversal vulnerability in formbankcgi.exe/AbfrageForm in Formbankserver 1.9 allows remote attackers to read arbitrary files via directory traversal sequences in the Name parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-04T22:00:00.000Z
CVE-2007-0056 
Multiple cross-site scripting (XSS) vulnerabilities in AShop Deluxe 4.5 and AShop Administration Panel allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to (a) ashop/catalogue.php and (b) ashop/basket.php, the (2) exp parameter to ashop/catalogue.php, the (3) searchstring parameter to (c) ashop/search.php, the (4) checkout and (5) action parameters to (d) ashop/shipping.php, the cat parameter to (f) cart-path/admin/editcatalogue.php, and the (7) resultpage parameter to (g) cart-path/admin/salesadmin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-04T22:00:00.000Z
CVE-2007-0057 
Cisco Clean Access (CCA) 3.6.x through 3.6.4.2 and 4.0.x through 4.0.3.2 does not properly configure or allow modification of a shared secret authentication key, which causes all devices to have the same shared sercet and allows remote attackers to gain unauthorized access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-04T22:00:00.000Z
CVE-2007-0058 
Cisco Clean Access (CCA) 3.5.x through 3.5.9 and 3.6.x through 3.6.1.1 on the Clean Access Manager (CAM) allows remote attackers to bypass authentication and download arbitrary manual database backups by guessing the snapshot filename using brute force, then making a direct request for the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-04T22:00:00.000Z
CVE-2007-0059 
Cross-zone scripting vulnerability in Apple Quicktime 3 to 7.1.3 allows remote user-assisted attackers to execute arbitrary code and list filesystem contents via a QuickTime movie (.MOV) with an HREF Track (HREFTrack) that contains an automatic action tag with a local URI, which is executed in a local zone during preview, as exploited by a MySpace worm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-05T00:00:00.000Z
CVE-2007-0060 
Stack-based buffer overflow in the Message Queuing Server (Cam.exe) in CA (formerly Computer Associates) Message Queuing (CAM / CAFT) software before 1.11 Build 54_4 on Windows and NetWare, as used in CA Advantage Data Transport, eTrust Admin, certain BrightStor products, certain CleverPath products, and certain Unicenter products, allows remote attackers to execute arbitrary code via a crafted message to TCP port 3104.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-26T00:00:00.000Z
CVE-2007-0061 
The DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows remote attackers to execute arbitrary code via a malformed packet that triggers "corrupt stack memory."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-21T18:00:00.000Z
CVE-2007-0062 
Integer overflow in the ISC dhcpd 3.0.x before 3.0.7 and 3.1.x before 3.1.1; and the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528; allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a malformed DHCP packet with a large dhcp-max-message-size that triggers a stack-based buffer overflow, related to servers configured to send many DHCP options to clients.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-21T18:00:00.000Z
CVE-2007-0063 
Integer underflow in the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows remote attackers to execute arbitrary code via a malformed DHCP packet that triggers a stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-21T18:00:00.000Z
CVE-2007-0064 
Heap-based buffer overflow in Windows Media Format Runtime 7.1, 9, 9.5, 9.5 x64 Edition, 11, and Windows Media Services 9.1 for Microsoft Windows 2000, XP, Server 2003, and Vista allows user-assisted remote attackers to execute arbitrary code via a crafted Advanced Systems Format (ASF) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-12T00:00:00.000Z
CVE-2007-0065 
Heap-based buffer overflow in Object Linking and Embedding (OLE) Automation in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, Office 2004 for Mac, and Visual basic 6.0 SP6 allows remote attackers to execute arbitrary code via a crafted script request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-02-12T22:00:00.000Z
CVE-2007-0066 
The kernel in Microsoft Windows 2000 SP4, XP SP2, and Server 2003, when ICMP Router Discovery Protocol (RDP) is enabled, allows remote attackers to cause a denial of service via fragmented router advertisement ICMP packets that trigger an out-of-bounds read, aka "Windows Kernel TCP/IP/ICMP Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T20:00:00.000Z
CVE-2007-0067 
Unspecified vulnerability in the Lotus Domino Web Server 6.0, 6.5.x before 6.5.6, and 7.0.x before 7.0.3 allows remote attackers to cause a denial of service (daemon crash) via requests for URLs that reference certain files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-06T10:00:00.000Z
CVE-2007-0068 
IBM Lotus Domino 7.0.x before 7.0.3 does not revalidate the signature on a signed scheduled agent after the agent is modified, which allows remote authenticated users to gain privileges via a modified agent in a server database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-06T21:00:00.000Z
CVE-2007-0069 
Unspecified vulnerability in the kernel in Microsoft Windows XP SP2, Server 2003, and Vista allows remote attackers to cause a denial of service (CPU consumption) and possibly execute arbitrary code via crafted (1) IGMPv3 and (2) MLDv2 packets that trigger memory corruption, aka "Windows Kernel TCP/IP/IGMPv3 and MLDv2 Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T20:00:00.000Z
CVE-2007-0071 
Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file with a negative Scene Count value, which passes a signed comparison, is used as an offset of a NULL pointer, and triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-09T21:00:00.000Z
CVE-2007-0072 
Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a read operation over RPC.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T23:00:00.000Z
CVE-2007-0073 
Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a file read operation over RPC.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T23:00:00.000Z
CVE-2007-0074 
Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a folder read operation over RPC.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T23:00:00.000Z
CVE-2007-0075 
AspBB stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user passwords via a direct request for db/aspbb.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-05T11:00:00.000Z
CVE-2007-0076 
Openforum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user passwords via a direct request for openforum.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-05T11:00:00.000Z
CVE-2007-0077 
lblog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for a certain file in admin/db/newFolder/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-05T11:00:00.000Z
CVE-2007-0078 
BattleBlog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/blankmaster.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-05T11:00:00.000Z
CVE-2007-0079 
rblog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) data/admin.mdb or (2) data/rblog.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-05T11:00:00.000Z
CVE-2007-0080 
Buffer overflow in the SMB_Connect_Server function in FreeRadius 1.1.3 and earlier allows attackers to execute arbitrary code related to the server desthost field of an SMB_Handle_Type instance.  NOTE: the impact of this issue has been disputed by a reliable third party and the vendor, who states that exploitation is limited "only to local administrators who have write access to the server configuration files."  CVE concurs with the dispute
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-05T11:00:00.000Z
CVE-2007-0081 
Sunbelt Kerio Personal Firewall (SKPF) 4.3.268 and 4.3.246, and possibly other versions allows local users to provide a Trojan horse iphlpapi.dll to SKPF by placing it in the installation directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-05T11:00:00.000Z
CVE-2007-0082 
users_adm/start1.php in IMGallery 2.5 and earlier does not properly handle files with multiple extensions, which allows remote authenticated users to upload and execute arbitrary PHP scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-05T11:00:00.000Z
CVE-2007-0083 
Cross-site scripting (XSS) vulnerability in Nuked Klan 1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a getURL statement in a .swf file, as demonstrated by "Remote Cookie Disclosure."  NOTE: it could be argued that this is an issue in Shockwave instead of Nuked Klan.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-05T11:00:00.000Z
CVE-2007-0084 
Buffer overflow in the Windows NT Message Compiler (MC) 1.00.5239 on Microsoft Windows XP allows local users to gain privileges via a long MC-filename.  NOTE: this issue has been disputed by a reliable third party who states that the compiler is not a privileged program, so privilege boundaries cannot be crossed
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-05T11:00:00.000Z
CVE-2007-0085 
Unspecified vulnerability in sys/dev/pci/vga_pci.c in the VGA graphics driver for wscons in OpenBSD 3.9 and 4.0, when the kernel is compiled with the PCIAGP option and a non-AGP device is being used, allows local users to gain privileges via unspecified vectors, possibly related to agp_ioctl NULL pointer reference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-05T11:00:00.000Z
CVE-2007-0086 
The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment.  NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-05T18:00:00.000Z