rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-2331 
Finder in Apple Mac OS X 10.5 through 10.5.4 does not properly update permission data in the Get Info window after a lock operation that modifies Sharing & Permissions in a filesystem, which might allow local users to leverage weak permissions that were not intended by an administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-16T23:00:00.000Z
CVE-2008-2332 
ImageIO in Apple Mac OS X 10.4.11 and 10.5 through 10.5.4 allows context-dependent attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a crafted TIFF image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-16T23:00:00.000Z
CVE-2008-2333 
Cross-site scripting (XSS) vulnerability in ldap_test.cgi in Barracuda Spam Firewall (BSF) before 3.5.11.025 allows remote attackers to inject arbitrary web script or HTML via the email parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-23T15:00:00.000Z
CVE-2008-2334 
Multiple SQL injection vulnerabilities in W1L3D4 Philboard 0.5 allow remote attackers to execute arbitrary SQL commands via the (1) forumid parameter to (a) admin/philboard_admin-forumedit.asp, (b) admin/philboard_admin-forum.asp, and (c) W1L3D4_foruma_yeni_konu_ac.asp; the (2) id parameter to (d) W1L3D4_konuoku.asp and (e) W1L3D4_konuya_mesaj_yaz.asp; and the (3) topic parameter to W1L3D4_konuya_mesaj_yaz.asp, different vectors than CVE-2008-1939, CVE-2007-2641, and CVE-2007-0920.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-19T10:00:00.000Z
CVE-2008-2335 
Cross-site scripting (XSS) vulnerability in search_results.php in Vastal I-Tech phpVID 1.1 and 1.2 allows remote attackers to inject arbitrary web script or HTML via the query parameter.  NOTE: some of these details are obtained from third party information.  NOTE: it was later reported that 1.2.3 is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-19T10:00:00.000Z
CVE-2008-2336 
SQL injection vulnerability in category.php in 68 Classifieds 4.0.1 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-19T10:00:00.000Z
CVE-2008-2337 
Multiple SQL injection vulnerabilities in IMGallery 2.5, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) kategoria parameter to (a) galeria.php and the (2) id_phot parameter to (b) popup/koment.php and (c) popup/opis.php in, different vectors than CVE-2006-3163.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-19T10:00:00.000Z
CVE-2008-2338 
Interspire ActiveKB 1.5 and earlier allows remote attackers to gain privileges by setting the auth cookie to true when accessing unspecified scripts in /admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-19T10:00:00.000Z
CVE-2008-2339 
SQL injection vulnerability in index.php in Turnkey Web Tools SunShop Shopping Cart 3.5.1 allows remote attackers to execute arbitrary SQL commands via the id parameter in an item action, a different vector than CVE-2008-2038, CVE-2007-4597, and CVE-2007-2549.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-19T10:00:00.000Z
CVE-2008-2340 
Multiple SQL injection vulnerabilities in News Manager 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) lang parameter to (a) advsearch.php, (b) archive.php, and (c) index.php, and the (2) pid parameter to (d) list_tagitems.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-19T10:00:00.000Z
CVE-2008-2341 
PHP remote file inclusion vulnerability in ch_readalso.php in News Manager 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the read_xml_include parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-19T10:00:00.000Z
CVE-2008-2342 
Directory traversal vulnerability in attachments.php in News Manager 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-19T10:00:00.000Z
CVE-2008-2343 
News Manager 2.0 allows remote attackers to bypass restrictions and obtain sensitive information via a direct request to (1) db/connect_str.php and (2) login/info.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-19T10:00:00.000Z
CVE-2008-2344 
Cross-site scripting (XSS) vulnerability in the air_filemanager 0.6.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-19T10:00:00.000Z
CVE-2008-2345 
Unspecified vulnerability in the air_filemanager 0.6.0 and earlier extension for TYPO3 allows remote attackers to execute arbitrary PHP code via unspecified vectors related to "insufficient file filtering."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-19T10:00:00.000Z
CVE-2008-2346 
AlkalinePHP 0.77.35 and earlier allows remote attackers to bypass authentication and gain administrative access by creating an admin account via a direct request to adduser.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-20T10:00:00.000Z
CVE-2008-2347 
MyPicGallery 1.0 allows remote attackers to bypass application authentication and gain administrative access by setting the userID parameter to "admin" in a direct request to admin/addUser.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-20T10:00:00.000Z
CVE-2008-2348 
MeltingIce File System 1.0 allows remote attackers to bypass application authentication, create new user accounts, and exceed application quotas via a direct request to admin/adduser.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-20T10:00:00.000Z
CVE-2008-2349 
Zomplog 3.8.2 and earlier allows remote attackers to gain administrative access by creating an admin account via a direct request to install/newuser.php with the admin parameter set to 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-20T10:00:00.000Z
CVE-2008-2350 
Directory traversal vulnerability in highlight.php in bcoos 1.0.9 through 1.0.13 allows remote attackers to read arbitrary files via (1) .. (dot dot) or (2) C: folder sequences in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-20T10:00:00.000Z
CVE-2008-2351 
Multiple SQL injection vulnerabilities in index.php in CMS WebManager-Pro allow remote attackers to execute arbitrary SQL commands via the (1) lang_id and (2) menu_id parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-20T10:00:00.000Z
CVE-2008-2352 
Directory traversal vulnerability in index.php in Smeego 1.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-20T10:00:00.000Z
CVE-2008-2353 
Directory traversal vulnerability in admin.php in GNU/Gallery 1.1.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the show parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-20T10:00:00.000Z
CVE-2008-2354 
Unspecified vulnerability in the data export function in testMaker before 3.0p10 allows test authors to obtain access to export data via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-20T10:00:00.000Z
CVE-2008-2355 
Directory traversal vulnerability in index.php in WR-Meeting 1.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the msnum parameter in a coment event.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-20T10:00:00.000Z
CVE-2008-2356 
SQL injection vulnerability in index.php in Archangel Weblog 0.90.02 and earlier allows remote attackers to execute arbitrary SQL commands via the post_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-20T10:00:00.000Z
CVE-2008-2357 
Stack-based buffer overflow in the split_redraw function in split.c in mtr before 0.73, when invoked with the -p (aka --split) option, allows remote attackers to execute arbitrary code via a crafted DNS PTR record.  NOTE: it could be argued that this is a vulnerability in the ns_name_ntop function in resolv/ns_name.c in glibc and the proper fix should be in glibc; if so, then this should not be treated as a vulnerability in mtr.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-21T10:00:00.000Z
CVE-2008-2358 
Integer overflow in the dccp_feat_change function in net/dccp/feat.c in the Datagram Congestion Control Protocol (DCCP) subsystem in the Linux kernel 2.6.18, and 2.6.17 through 2.6.20, allows local users to gain privileges via an invalid feature length, which leads to a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-10T00:00:00.000Z
CVE-2008-2359 
The default configuration of consolehelper in system-config-network before 1.5.10-1 on Fedora 8 lacks the USER=root directive, which allows local users of the workstation console to gain privileges and change the network configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-02T14:00:00.000Z
CVE-2008-2360 
Integer overflow in the AllocateGlyph function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to execute arbitrary code via unspecified request fields that are used to calculate a heap buffer size, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-16T19:00:00.000Z
CVE-2008-2361 
Integer overflow in the ProcRenderCreateCursor function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to cause a denial of service (daemon crash) via unspecified request fields that are used to calculate a glyph buffer size, which triggers a dereference of unmapped memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-16T19:00:00.000Z
CVE-2008-2362 
Multiple integer overflows in the Render extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via a (1) SProcRenderCreateLinearGradient, (2) SProcRenderCreateRadialGradient, or (3) SProcRenderCreateConicalGradient request with an invalid field specifying the number of bytes to swap in the request data, which triggers heap memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-16T19:00:00.000Z
CVE-2008-2363 
The PartsBatch class in Pan 0.132 and earlier does not properly manage the data structures for Parts batches, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted .nzb file that triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-02T14:00:00.000Z
CVE-2008-2364 
The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-13T18:00:00.000Z
CVE-2008-2365 
Race condition in the ptrace and utrace support in the Linux kernel 2.6.9 through 2.6.25, as used in Red Hat Enterprise Linux (RHEL) 4, allows local users to cause a denial of service (oops) via a long series of PTRACE_ATTACH ptrace calls to another user's process that trigger a conflict between utrace_detach and report_quiescent, related to "late ptrace_may_attach() check" and "race around &dead_engine_ops setting," a different vulnerability than CVE-2007-0771 and CVE-2008-1514.  NOTE: this issue might only affect kernel versions before 2.6.16.x.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-30T21:00:00.000Z
CVE-2008-2366 
Untrusted search path vulnerability in a certain Red Hat build script for OpenOffice.org (OOo) 1.1.x on Red Hat Enterprise Linux (RHEL) 3 and 4 allows local users to gain privileges via a malicious library in the current working directory, related to incorrect quoting of the ORIGIN symbol for use in the RPATH library path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-16T18:26:00.000Z
CVE-2008-2367 
Red Hat Certificate System 7.2 uses world-readable permissions for password.conf and unspecified other configuration files, which allows local users to discover passwords by reading these files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-20T16:00:00.000Z
CVE-2008-2368 
Red Hat Certificate System 7.2 stores passwords in cleartext in the UserDirEnrollment log, the RA wizard installer log, and unspecified other debug log files, and uses weak permissions for these files, which allows local users to discover passwords by reading the files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-20T16:00:00.000Z
CVE-2008-2369 
manzier.pxt in Red Hat Network Satellite Server before 5.1.1 has a hard-coded authentication key, which allows remote attackers to connect to the server and obtain sensitive information about user accounts and entitlements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-14T20:00:00.000Z
CVE-2008-2370 
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T01:00:00.000Z
CVE-2008-2371 
Heap-based buffer overflow in pcre_compile.c in the Perl-Compatible Regular Expression (PCRE) library 7.7 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a regular expression that begins with an option and contains multiple branches.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-07T23:00:00.000Z
CVE-2008-2372 
The Linux kernel 2.6.24 and 2.6.25 before 2.6.25.9 allows local users to cause a denial of service (memory consumption) via a large number of calls to the get_user_pages function, which lacks a ZERO_PAGE optimization and results in allocation of "useless newly zeroed pages."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-02T16:00:00.000Z
CVE-2008-2374 
src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-07T23:00:00.000Z
CVE-2008-2375 
Memory leak in a certain Red Hat deployment of vsftpd before 2.0.5 on Red Hat Enterprise Linux (RHEL) 3 and 4, when PAM is used, allows remote attackers to cause a denial of service (memory consumption) via a large number of invalid authentication attempts within the same session, a different vulnerability than CVE-2007-5962.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T00:00:00.000Z
CVE-2008-2376 
Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial of service (crash) or possibly have unspecified other impact via a call to the Array#fill method with a start (aka beg) argument greater than ARY_MAX_SIZE.  NOTE: this issue exists because of an incomplete fix for other closely related integer overflows.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-09T00:00:00.000Z
CVE-2008-2377 
Use-after-free vulnerability in the _gnutls_handshake_hash_buffers_clear function in lib/gnutls_handshake.c in libgnutls in GnuTLS 2.3.5 through 2.4.0 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via TLS transmission of data that is improperly used when the peer calls gnutls_handshake within a normal session, leading to attempted access to a deallocated libgcrypt handle.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-08T19:00:00.000Z
CVE-2008-2378 
Untrusted search path vulnerability in hfkernel in hf 0.7.3 and 0.8 allows local users to gain privileges via a Trojan horse killall program in a directory in the PATH, related to improper handling of the -k option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-26T23:00:00.000Z
CVE-2008-2379 
Cross-site scripting (XSS) vulnerability in SquirrelMail before 1.4.17 allows remote attackers to inject arbitrary web script or HTML via a crafted hyperlink in an HTML part of an e-mail message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-05T00:00:00.000Z
CVE-2008-2380 
SQL injection vulnerability in authpgsqllib.c in Courier-Authlib before 0.62.0, when a non-Latin locale Postgres database is used, allows remote attackers to execute arbitrary SQL commands via query parameters containing apostrophes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-22T15:00:00.000Z
CVE-2008-2381 
SQL injection vulnerability in the create function in common/include/GroupJoinRequest.class in GForge 4.5 and 4.6 allows remote attackers to execute arbitrary SQL commands via the comments variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-02T19:00:00.000Z
CVE-2008-2382 
The protocol_client_msg function in vnc.c in the VNC server in (1) Qemu 0.9.1 and earlier and (2) KVM kvm-79 and earlier allows remote attackers to cause a denial of service (infinite loop) via a certain message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-24T17:00:00.000Z
CVE-2008-2383 
CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF (aka \n) characters surrounding a command name within a Device Control Request Status String (DECRQSS) escape sequence in a text file, a related issue to CVE-2003-0063 and CVE-2003-0071.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-02T00:00:00.000Z
CVE-2008-2384 
SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when configured to use a multibyte character set that allows a \ (backslash) as part of the character encoding, allows remote attackers to execute arbitrary SQL commands via unspecified inputs in a login request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-22T18:00:00.000Z
CVE-2008-2388 
Multiple off-by-one errors in opensuse-updater in openSUSE 10.2 have unspecified impact and attack vectors.  NOTE: the vendor states that these "can be considered no security problem."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-06T22:00:00.000Z
CVE-2008-2389 
opensuse-updater in openSUSE 10.2 allows local users to access arbitrary files via a symlink attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-06-06T22:00:00.000Z
CVE-2008-2390 
Hpufunction.dll 4.0.0.1 in HP Software Update exposes the unsafe (1) ExecuteAsync and (2) Execute methods, which allows remote attackers to execute arbitrary code via an absolute pathname in the first argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-21T10:00:00.000Z
CVE-2008-2391 
SubSonic allows remote attackers to bypass pagesize limits and cause a denial of service (CPU consumption) via a pageindex (aka data page number) of -1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-21T10:00:00.000Z
CVE-2008-2392 
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-21T10:00:00.000Z
CVE-2008-2393 
SQL injection vulnerability in play.php in EntertainmentScript 1.4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-21T10:00:00.000Z
CVE-2008-2394 
Multiple SQL injection vulnerabilities in TAGWORX.CMS 3.00.02 allow remote attackers to execute arbitrary SQL commands via the (1) cid parameter to contact.php and the (2) nid parameter to news.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-21T10:00:00.000Z
CVE-2008-2395 
SQL injection vulnerability in thread.php in AlkalinePHP 0.80.00 beta and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-21T10:00:00.000Z
CVE-2008-2396 
PHP remote file inclusion vulnerability in index.php in Wajox Software microSSys CMS 1.5 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in an arbitrary element of the PAGES array parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-21T10:00:00.000Z
CVE-2008-2397 
Cross-site scripting (XSS) vulnerability in search-results.dot in dotCMS 1.x allows remote attackers to inject arbitrary web script or HTML via the search_query parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-21T10:00:00.000Z
CVE-2008-2398 
Cross-site scripting (XSS) vulnerability in index.php in AppServ Open Project 2.5.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the appservlang parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-21T10:00:00.000Z