rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-5916 
gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4.3 allows local repository owners to execute arbitrary commands by modifying the diff.external configuration variable and executing a crafted gitweb query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T02:00:00.000Z
CVE-2008-5917 
Cross-site scripting (XSS) vulnerability in the XSS filter (framework/Text_Filter/Filter/xss.php) in Horde Application Framework 3.2.2 and 3.3, when Internet Explorer is being used, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to style attributes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T02:00:00.000Z
CVE-2008-5918 
Cross-site scripting (XSS) vulnerability in the getParameterisedSelfUrl function in index.php in WebSVN 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T02:00:00.000Z
CVE-2008-5919 
Directory traversal vulnerability in rss.php in WebSVN 2.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to overwrite arbitrary files via directory traversal sequences in the rev parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T02:00:00.000Z
CVE-2008-5920 
The create_anchors function in utils.inc in WebSVN 1.x allows remote attackers to execute arbitrary PHP code via a crafted username that is processed by the preg_replace function with the eval switch.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T02:00:00.000Z
CVE-2008-5921 
SQL injection vulnerability in albums.php in Umer Inc Songs Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T18:00:00.000Z
CVE-2008-5922 
Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Cant Find A Gaming CMS (CFAGCMS) 1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) main and (2) right parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T18:00:00.000Z
CVE-2008-5923 
SQL injection vulnerability in default.asp in ASP-DEv XM Events Diary allows remote attackers to execute arbitrary SQL commands the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T18:00:00.000Z
CVE-2008-5924 
SQL injection vulnerability in diary_viewC.asp in ASP-DEv XM Events Diary allows remote attackers to execute arbitrary SQL commands via the cat parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T18:00:00.000Z
CVE-2008-5925 
ASP-DEv XM Events Diary stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for diary.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T18:00:00.000Z
CVE-2008-5926 
Multiple SQL injection vulnerabilities in login.asp in ASP-DEv Internal E-Mail System allow remote attackers to execute arbitrary SQL commands via the (1) login parameter (aka user field) or the (2) password parameter (aka pass field).  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T18:00:00.000Z
CVE-2008-5927 
Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPNews 0.0.6 allow remote attackers to execute arbitrary SQL commands via the (1) checkuser parameter (aka username field) or (2) checkpass parameter (aka password field) to admin/index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T18:00:00.000Z
CVE-2008-5928 
SQL injection vulnerability in redir.php in Free Links Directory Script (FLDS) 1.2a allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T18:00:00.000Z
CVE-2008-5929 
VP-ASP Shopping Cart 6.50 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database containing the password via a direct request for database/shopping650.mdb.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T18:00:00.000Z
CVE-2008-5930 
SQL injection vulnerability in admin/blog_comments.asp in The Net Guys ASPired2Blog allows remote attackers to execute arbitrary SQL commands via the BlogID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T18:00:00.000Z
CVE-2008-5931 
The Net Guys ASPired2Blog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing usernames and passwords via a direct request for admin/blog.mdb.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T18:00:00.000Z
CVE-2008-5932 
CodeAvalanche FreeForum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the password via a direct request for _private/CAForum.mdb.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T18:00:00.000Z
CVE-2008-5933 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in CMS ISWEB 3.0 allow remote attackers to inject arbitrary web script or HTML via (1) the strcerca parameter (aka the input field for the cerca action) or (2) the id_oggetto parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T18:00:00.000Z
CVE-2008-5934 
SQL injection vulnerability in index.php in CMS ISWEB 3.0 allows remote attackers to execute arbitrary SQL commands via the id_sezione parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T18:00:00.000Z
CVE-2008-5935 
Facto stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the password via a direct request for database/facto.mdb.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T18:00:00.000Z
CVE-2008-5936 
front-end/edit.php in mini-pub 0.3 and earlier allows remote attackers to read files and obtain PHP source code via a filename in the sFileName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-22T02:00:00.000Z
CVE-2008-5937 
AyeView 2.20 allows user-assisted attackers to cause a denial of service (memory consumption or application crash) via a bitmap (aka .bmp) file with large height and width values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-22T02:00:00.000Z
CVE-2008-5938 
PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the reflect_base parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-22T11:00:00.000Z
CVE-2008-5939 
Cross-site scripting (XSS) vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field, possibly related to snippet.ditto.php.  NOTE: some sources list the id parameter as being affected, but this is probably incorrect based on the original disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-22T11:00:00.000Z
CVE-2008-5940 
SQL injection vulnerability in index.php in MODx 0.9.6.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the searchid parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-22T11:00:00.000Z
CVE-2008-5941 
Cross-site request forgery (CSRF) vulnerability in MODx 0.9.6.1p2 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-22T11:00:00.000Z
CVE-2008-5942 
Multiple cross-site scripting (XSS) vulnerabilities in MODx before 0.9.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the preserveUrls function and (2) "username input." NOTE: vector 2 may be related to CVE-2008-5939.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-22T11:00:00.000Z
CVE-2008-5943 
Multiple directory traversal vulnerabilities in NavBoard 16 (2.6.0) allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module parameter to (1) admin_modules.php and (2) modules.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-22T11:00:00.000Z
CVE-2008-5944 
Cross-site scripting (XSS) vulnerability in modules.php in NavBoard 16 (2.6.0) allows remote attackers to inject arbitrary web script or HTML via the module parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-22T11:00:00.000Z
CVE-2008-5945 
Nukeviet 2.0 Beta allows remote attackers to bypass authentication and gain administrative access by setting the admf cookie to 1.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-22T11:00:00.000Z
CVE-2008-5946 
SQL injection vulnerability in readmore.php in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the news_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-22T11:00:00.000Z
CVE-2008-5947 
PHP remote file inclusion vulnerability in include/class_yapbbcooker.php in YapBB 1.2.Beta 2 allows remote attackers to execute arbitrary PHP code via a URL in the cfgIncludeDirectory parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-22T11:00:00.000Z
CVE-2008-5948 
Directory traversal vulnerability in index.php in BNCwi 1.04 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the newlanguage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-23T18:38:00.000Z
CVE-2008-5949 
Multiple PHP remote file inclusion vulnerabilities in ccTiddly 1.7.4 and 1.7.6 allow remote attackers to execute arbitrary PHP code via a URL in the cct_base parameter to (1) index.php; (2) handle/proxy.php; (3) header.php, (4) include.php, and (5) workspace.php in includes/; and (6) plugins/RSS/files/rss.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-23T18:38:00.000Z
CVE-2008-5950 
SQL injection vulnerability in media/media_level.asp in ASP Template Creature allows remote attackers to execute arbitrary SQL commands via the mcatid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-23T18:38:00.000Z
CVE-2008-5951 
ASP Template Creature stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for workDB/templatemonster.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-23T18:38:00.000Z
CVE-2008-5952 
SQL injection vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the tid parameter in a vtech action to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-23T18:38:00.000Z
CVE-2008-5953 
Directory traversal vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the p parameter to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-23T18:38:00.000Z
CVE-2008-5954 
SQL injection vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the lname parameter in a login action to an unspecified component.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-23T18:38:00.000Z
CVE-2008-5955 
SQL injection vulnerability in show.php in Wbstreet (aka PHPSTREET Webboard) 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-23T18:38:00.000Z
CVE-2008-5956 
Wbstreet (aka PHPSTREET Webboard) 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database credentials via a direct request to connect.inc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-23T18:38:00.000Z
CVE-2008-5957 
SQL injection vulnerability in the Mydyngallery (com_mydyngallery) component 1.4.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the directory parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-23T18:38:00.000Z
CVE-2008-5958 
Multiple SQL injection vulnerabilities in Active Test 2.1 allow remote attackers to execute arbitrary SQL commands via the QuizID parameter to (1) questions.asp, (2) importquestions.asp, and (3) quiztakers.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-23T18:38:00.000Z
CVE-2008-5959 
Multiple SQL injection vulnerabilities in start.asp in Active Test 2.1 allow remote attackers to execute arbitrary SQL commands via the (1) useremail parameter (aka username field) or (2) password parameter (aka password field).  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-23T18:38:00.000Z
CVE-2008-5960 
SQL injection vulnerability in index.php in Tribiq CMS Community 5.0.10B and 5.0.11E allows remote attackers to execute arbitrary SQL commands via the cID parameter in a document action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-23T18:38:00.000Z
CVE-2008-5961 
Cross-site scripting (XSS) vulnerability in index.php in Tribiq CMS Community 5.0.10B and 5.0.11E allows remote attackers to inject arbitrary web script or HTML via the cID parameter in a document action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-23T18:38:00.000Z
CVE-2008-5962 
Directory traversal vulnerability in library/setup/rpc.php in Gravity Getting Things Done (GTD) 0.4.5 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the objectname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-23T18:38:00.000Z
CVE-2008-5963 
Eval injection vulnerability in library/setup/rpc.php in Gravity Getting Things Done (GTD) 0.4.5 and earlier allows remote attackers to execute arbitrary PHP code via the objectname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-23T18:38:00.000Z
CVE-2008-5964 
Session fixation vulnerability in Social ImpressCMS before 1.1.1 RC1 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-23T18:38:00.000Z
CVE-2008-5965 
Directory traversal vulnerability in index.php in LokiCMS 0.3.4 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to check for the existence of arbitrary files via a .. (dot dot) in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-26T20:00:00.000Z
CVE-2008-5966 
globsy_edit.php in Globsy 1.0 and earlier allows remote attackers to create or overwrite arbitrary files via a filename in the file parameter and file contents in the data parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-26T20:00:00.000Z
CVE-2008-5967 
admin/index.php in PHP iCalendar 2.3.4, 2.24, and earlier does not require administrative authentication for an addupdate action, which allows remote attackers to upload a calendar (aka .ics) file with arbitrary content to the calendars/ directory outside the web root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-26T20:00:00.000Z
CVE-2008-5968 
Directory traversal vulnerability in print.php in PHP iCalendar 2.24 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cookie_language parameter in a phpicalendar_* cookie, a different vector than CVE-2006-1292.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-26T20:00:00.000Z
CVE-2008-5969 
SQL injection vulnerability in popupproduct.php in Sunbyte e-Flower allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-27T01:00:00.000Z
CVE-2008-5970 
SQL injection vulnerability in profile_social.php in i-Net Solution Orkut Clone allows remote authenticated users to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-27T01:00:00.000Z
CVE-2008-5971 
Cross-site scripting (XSS) vulnerability in profile_social.php in i-Net Solution Orkut Clone allows remote authenticated users to inject arbitrary web script or HTML via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-27T01:00:00.000Z
CVE-2008-5972 
SQL injection vulnerability in default.asp in Active Business Directory 2 allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-27T01:00:00.000Z
CVE-2008-5973 
SQL injection vulnerability in login.aspx in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL commands via the password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-27T01:00:00.000Z
CVE-2008-5974 
Multiple SQL injection vulnerabilities in login.aspx in Active Price Comparison 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) password and (2) username fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-27T01:00:00.000Z
CVE-2008-5975 
SQL injection vulnerability in links.asp in Active Price Comparison 4.0 allows remote attackers to execute arbitrary SQL commands via the linkid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-27T01:00:00.000Z
CVE-2008-5976 
Multiple cross-site scripting (XSS) vulnerabilities in siteadmin/forgot.php in PHP JOBWEBSITE PRO allow remote attackers to inject arbitrary web script or HTML via (1) the adname parameter in a Submit action or (2) the UserName field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-27T01:00:00.000Z
CVE-2008-5977 
SQL injection vulnerability in siteadmin/forgot.php in PHP JOBWEBSITE PRO allows remote attackers to execute arbitrary SQL commands via the adname parameter in a Submit action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-27T01:00:00.000Z
CVE-2008-5978 
Multiple SQL injection vulnerabilities in Ocean12 Mailing List Manager Gold allow remote attackers to execute arbitrary SQL commands via the Email parameter to (1) default.asp and (2) s_edit.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-27T01:00:00.000Z
CVE-2008-5979 
Cross-site scripting (XSS) vulnerability in default.asp in Ocean12 Mailing List Manager Gold allows remote attackers to inject arbitrary web script or HTML via the Email parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-27T01:00:00.000Z
CVE-2008-5980 
Ocean12 Mailing List Manager Gold stores sensitive data under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for o12mail.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-27T01:00:00.000Z
CVE-2008-5981 
PacPoll 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) poll.mdb or (2) poll97.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-27T01:00:00.000Z
CVE-2008-5982 
Format string vulnerability in BMC PATROL Agent before 3.7.30 allows remote attackers to execute arbitrary code via format string specifiers in an invalid version number to TCP port 3181, which are not properly handled when writing a log message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-27T22:00:00.000Z
CVE-2008-5983 
Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-28T02:00:00.000Z