rainbutterfly/cve_corpus huggingface dataset:
CVE-2005-1843 
VCNative for Adobe Version Cue 1.0 and 1.0.1, as used in Creative Suite 1.0 and 1.3, and when running on Mac OS X with Version Cue Workspace, allows local users to load arbitrary libraries and execute arbitrary code via the -lib command line argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-24T04:00:00.000Z
CVE-2005-1846 
Multiple directory traversal vulnerabilities in YaMT before 0.5_2 allow attackers to overwrite arbitrary files via the (1) rename or (2) sort options.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-03T04:00:00.000Z
CVE-2005-1847 
Multiple buffer overflows in YaMT before 0.5_2 allow attackers to execute arbitrary code via the (1) rename or (2) sort options.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-03T04:00:00.000Z
CVE-2005-1848 
The dhcpcd DHCP client before 1.3.22 allows remote attackers to cause a denial of service (daemon crash) via unknown vectors that cause an out-of-bounds memory read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-11T04:00:00.000Z
CVE-2005-1849 
inftrees.h in zlib 1.2.2 allows remote attackers to cause a denial of service (application crash) via an invalid file that causes a large dynamic tree to be produced.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-1850 
Certain contributed scripts for ekg Gadu Gadu client 1.5 and earlier create temporary files insecurely, with unknown impact and attack vectors, a different vulnerability than CVE-2005-1916.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-19T04:00:00.000Z
CVE-2005-1851 
A certain contributed script for ekg Gadu Gadu client 1.5 and earlier allows attackers to execute shell commands via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-19T04:00:00.000Z
CVE-2005-1852 
Multiple integer overflows in libgadu, as used in Kopete in KDE 3.2.3 to 3.4.1, ekg before 1.6rc3, GNU Gadu, CenterICQ, Kadu, and other packages, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an incoming message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-1853 
gopher.c in the Gopher client 3.0.5 does not properly create temporary files, which allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-1854 
Unknown vulnerability in apt-cacher in Debian 3.1, related to "missing input sanitising," allows remote attackers to execute arbitrary commands on the caching server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-05T04:00:00.000Z
CVE-2005-1855 
Backup Manager (backup-manager) before 0.5.8 creates backup files with world-readable default permissions, which allows local users to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-29T04:00:00.000Z
CVE-2005-1856 
The CD-burning feature in backup-manager 0.5.8 and earlier uses a fixed filename in a world-writable directory for logging, which allows local users to overwrite files via a symlink attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-29T04:00:00.000Z
CVE-2005-1857 
Format string vulnerability in simpleproxy before 3.4 allows remote malicious HTTP proxies to execute arbitrary code via format string specifiers in a reply.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-02T04:00:00.000Z
CVE-2005-1858 
FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfilled pages when the filesystem returns a short byte count to a read request, which may allow local users to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-06T04:00:00.000Z
CVE-2005-1859 
Unknown vulnerability in arshell in the Array Service (arrayd) for SGI ProPack 3 with SP 5 and 6, and SGI ProPack 4, allows local users to execute arbitrary shells as root on other hosts in the cluster or array.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-12T04:00:00.000Z
CVE-2005-1864 
PHP remote file inclusion vulnerability in cal_admintop.php in Calendarix Advanced 1.5 allows remote attackers to execute arbitrary PHP code via the calpath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1865 
Multiple SQL injection vulnerabilities in Calendarix Advanced 1.5 allow remote attackers to execute arbitrary SQL commands via the catview parameter to (1) cal_week.php, (2) cal_cat.php, or (3) cal_day.php, or (4) id parameter to cal_pophols.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1866 
Cross-site scripting (XSS) vulnerability in calendar.php in Calendarix Advanced 1.5 allows remote attackers to inject arbitrary web script or HTML via the year parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1867 
Symantec Brightmail AntiSpam before 6.0.2 has a hard-coded database administrator password, which allows remote attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1868 
I-Man 0.9, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code by uploading a file attachment with a .php extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1869 
PHP remote file inclusion vulnerability in start_lobby.php in MWChat 6.x allows remote attackers to execute arbitrary PHP code via the CONFIG[MWCHAT_Libs] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1870 
PHP remote file inclusion vulnerability in childwindow.inc.php in Popper 1.41-r2 and earlier allows remote attackers to execute arbitrary PHP code via the form parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1871 
Unknown vulnerability in the privilege system in Drupal 4.4.0 through 4.6.0, when public registration is enabled, allows remote attackers to gain privileges, due to an "input check" that "is not implemented properly."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1872 
Buffer overflow in the administrative console in IBM WebSphere Application Server 5.x, when the global security option is enabled, allows remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1873 
Multiple buffer overflows in Crob FTP 3.6.1, and possibly earlier versions, allow remote attackers to execute arbitrary code via (1) an FTP command with a large string followed by the RMD command with a long string or (2) a globbing ("*") character followed by a long string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1874 
Directory traversal vulnerability in Dzip before 2.9 allows remote attackers to create arbitrary files via a filename containing a .. (dot dot) in a .dz archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1875 
Multiple SQL injection vulnerabilities in list.php in Exhibit Engine (EE) 1.22 allow remote attackers to execute arbitrary SQL commands via the (1) search_row, (2) sort_row, (3) order or (4) perpage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1876 
Direct code injection vulnerability in CuteNews 1.3.6 and earlier allows remote attackers with administrative privileges to execute arbitrary PHP code via certain inputs that are injected into a template (.tpl) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1877 
Cross-site scripting (XSS) vulnerability in view_ticket.php in Lpanel 1.59 and earlier allows remote attackers to inject arbitrary web script or HTML and obtain sensitive information via the pid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1878 
GIPTables Firewall 1.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on the temp.ip.addresses temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1879 
LutelWall 0.97 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file created by a system call to wget.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1880 
everybuddy 0.4.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file created by a system call to wget.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1881 
upload.php in YaPiG 0.92b, 0.93u and 0.94u does not properly restrict the file extension for uploaded image files, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1882 
PHP remote file inclusion vulnerability in last_gallery.php in YaPiG 0.93u and 0.94u allows remote attackers to execute arbitrary PHP code via the YAPIG_PATH parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1883 
global.php in YaPiG 0.92b allows remote attackers to include arbitrary local files via the BASE_DIR parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1884 
Directory traversal vulnerability in the (1) rmdir or (2) mkdir commands in upload.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to create or delete arbitrary directories via a .. (dot dot) in the dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1885 
view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to obtain sensitive information via a phid parameter that is not an integer, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1886 
Cross-site scripting (XSS) vulnerability in view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to inject arbitrary web script or HTML via (1) the phid parameter or (2) unknown parameters when posting a new comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-07T04:00:00.000Z
CVE-2005-1887 
Unknown vulnerability in the Sun Solaris C library (libc and libproject) in Solaris 10 allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1888 
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.5 allows remote attackers to inject arbitrary web script via HTML attributes in page templates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1889 
Unknown vulnerability in Sun ONE Application Server 6.5 SP1 Maintenance Update 6 and earlier allows attackers to read files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1890 
Unknown vulnerability in Mortiforo before 0.9.1 allows users to access private forums via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1891 
The GIF parser in ateimg32.dll in AOL Instant Messenger (AIM) 5.9.3797 and earlier allows remote attackers to cause a denial of service (crash) via a malformed buddy icon that causes an integer underflow in a loop counter variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1892 
FlatNuke 2.5.3 allows remote attackers to cause a denial of service or obtain sensitive information via (1) a direct request to foot_news.php, which triggers an infinite loop, or (2) direct requests to unknown scripts, which reveals the web document root in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1893 
FlatNuke 2.5.3 allows remote attackers to obtain sensitive information via invalid parameters to certain scripts, which leaks the web document root in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1894 
Direct code injection vulnerability in FlatNuke 2.5.3 allows remote attackers to execute arbitrary PHP code by placing the code into the Referer header of an HTTP request, which causes the code to be injected into referer.php, which can then be accessed by the attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1895 
Cross-site scripting (XSS) vulnerability in FlatNuke 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the border or back parameters to (1) help.php or (2) footer.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1896 
Directory traversal vulnerability in thumb.php in FlatNuke 2.5.3 allows remote attackers to read arbitrary images or obtain the installation path via the image parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1897 
Unknown vulnerability in FlexCast Audio Video Streaming Server before 2.0 has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1898 
The passthrough functionality in phpThumb.php in phpThumb() before 1.5.4 allows remote attackers to read files that are not images.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1899 
Rakkarsoft RakNet network library 2.33 and earlier, when released before 30 May 2005, and as used in multiple products including nFusion Elite Warriors: Vietnam, allows remote attackers to cause a denial of service (infinite loop) via a zero-byte UDP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1900 
Sawmill before 7.1.6 allows remote attackers to bypass authentication and (1) gain administrative privileges or (2) add a license.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1901 
Multiple cross-site scripting (XSS) vulnerabilities in Sawmill before 7.1.6 allow remote attackers to inject arbitrary web script or HTML via (1) the username in the Add User window or (2) the license key in the Licensing page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1902 
Directory traversal vulnerability in the IMAP service for SPA-PRO Mail @Solomon 4.00 allows remote authenticated users to read other users' mail and perform operations on arbitrary directories via .. sequences in the (1) SELECT, (2) CREATE, (3) DELETE, and (4) RENAME commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1903 
Buffer overflow in the IMAP service for SPA-PRO Mail @Solomon 4.00 allows remote authenticated users to execute arbitrary code via a long CREATE command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1904 
SQL injection vulnerability in login.asp in JiRo's Upload System (JUS) 1 allows remote attackers to execute arbitrary SQL commands via the password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1905 
The klif.sys driver in Kaspersky Labs Anti-Virus 5.0.227, 5.0.228, and 5.0.335 on Windows 2000 allows local users to gain privileges by modifying certain critical code addresses that are later accessed by privileged programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1906 
SQL injection vulnerability in login.asp in livingmailing 1.3 allows remote attackers to execute arbitrary SQL commands via the password. NOTE: there is little public information about this product and its vendor, and the original researcher announcement is no longer available.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1907 
The ISA Firewall service in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service (Wspsrv.exe crash) via a large amount of SecureNAT network traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1908 
Perception LiteWeb allows remote attackers to bypass access controls for files via an extra leading / (slash) or leading \ (backslash) in the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1909 
The web server control panel in 602LAN SUITE 2004 allows remote attackers to make it more difficult for the administrator to read portions of log files via a "</pre><!-" sequence in an HTTP GET request in the logon, possibly due to a cross-site scripting (XSS) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1910 
SQL injection vulnerability in login.asp for WWWeb Concepts Events System 1.0 allows remote attackers to execute arbitrary SQL commands via the password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1911 
The fetchnews NNTP client in leafnode 1.11.2 and earlier can hang while waiting for input that never arrives, which allows remote NNTP servers to cause a denial of service (news loss).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-08T04:00:00.000Z
CVE-2005-1913 
The Linux kernel 2.6 before 2.6.12.1 allows local users to cause a denial of service (kernel panic) via a non group-leader thread executing a different program than was pending in itimer, which causes the signal to be delivered to the old group-leader task, which does not exist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-14T04:00:00.000Z
CVE-2005-1914 
CenterICQ 4.20.0 and earlier creates temporary files with predictable file names, which allows local users to overwrite arbitrary files via a symlink attack on the gg.token.PID temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-17T04:00:00.000Z
CVE-2005-1915 
The log4sh_readProperties function in log4sh 1.2.5 and earlier allows local users to overwrite arbitrary files via a symlink attack on predictable log4sh.$$ filenames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-02T04:00:00.000Z
CVE-2005-1916 
linki.py in ekg 2005-06-05 and earlier allows local users to overwrite or create arbitrary files via a symlink attack on temporary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-06T04:00:00.000Z
CVE-2005-1917 
kpopper 1.0 and earlier allows local users to create and overwrite arbitrary files via a symlink attack on the .popper-new temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-05T04:00:00.000Z
CVE-2005-1918 
The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that allows user-assisted attackers to overwrite arbitrary files via a crafted tar file, probably involving "/../" sequences with a leading "/".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-21T19:00:00.000Z
CVE-2005-1920 
The (1) Kate and (2) Kwrite applications in KDE KDE 3.2.x through 3.4.0 do not properly set the same permissions on the backup file as were set on the original file, which could allow local users and possibly remote attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-1921 
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-01T04:00:00.000Z
CVE-2005-1922 
The MS-Expand file handling in Clam AntiVirus (ClamAV) before 0.86 allows remote attackers to cause a denial of service (file descriptor and memory consumption) via a crafted file that causes repeated errors in the cli_msexpand function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-30T04:00:00.000Z
CVE-2005-1923 
The ENSURE_BITS macro in mszipd.c for Clam AntiVirus (ClamAV) 0.83, and other versions vefore 0.86, allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a cabinet (CAB) file with the cffile_FolderOffset field set to 0xff, which causes a zero-length read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-06-30T04:00:00.000Z
CVE-2005-1924 
The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the fpr parameter to the deleteKey function in gpg_keyring.php, as called by (a) import_key_file.php, (b) import_key_text.php, and (c) keyring_main.php; and (2) the keyserver parameter to the gpg_recv_key function in gpg_key_functions.php, as called by gpg_options.php.  NOTE: this issue may overlap CVE-2007-3636.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T22:00:00.000Z
CVE-2005-1925 
Multiple directory traversal vulnerabilities in Tikiwiki before 1.9.1 allow remote attackers to read arbitrary files and execute commands via (1) the suck_url parameter to tiki-editpage.php or (2) language parameter to tiki-user_preferences.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-18T11:00:00.000Z