rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-6624 
Directory traversal vulnerability in printview.php in PNphpBB2 1.2i and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phpEx parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6625 
The Platform Service Process (asampsp) in Fan-Out Driver Platform Services for Novell Identity Manager (IDM) 3.5.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified network traffic that triggers a syslog message containing invalid format string specifiers, as demonstrated by a Nessus scan.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6626 
Multiple buffer overflows in the RTSP_valid_response_msg function in RTSP_state_machine.c in LScube Feng 0.1.15 and earlier allow remote attackers to execute arbitrary code via (1) a long first line of a response, as demonstrated by a long VER line; or (2) a long second line of a response, as demonstrated by a message that follows a RETURN line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6627 
Integer overflow in the RTSP_remove_msg function in RTSP_lowlevel.c in LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an RTP packet with a size value of 0xffff.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6628 
LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via (1) a malformed Transport header, which triggers misparsing in parse_transport_header in RTSP_setup.c, as demonstrated by a Transport header that contains only a "RTP/AVP;unicast;client_port" sequence; or (2) a malformed Range header, which triggers misparsing in parse_play_time_range in RTSP_Play, as demonstrated by an empty Range header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6629 
Interpretation conflict in LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a User-Agent header line that contains a carriage-return character, which is considered a line delimiter when the header is split into individual lines, but not when log_user_agent in RTSP_utils.c parses the content of the User-Agent line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6630 
The Url_init function in utils/url.c in Netembryo 0.0.4, when used by LScube Feng, allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a malformed URI containing a "/:" sequence, as demonstrated by a "DESCRIBE /: RTSP/1.0" request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6631 
Multiple buffer overflows in LScube libnemesi 0.6.4-rc1 and earlier allow remote attackers to execute arbitrary code via (1) a reply that begins with a long version string, which triggers an overflow in handle_rtsp_pkt in rtsp_handlers.c; long headers that trigger overflows in (2) send_pause_request, (3) send_play_request, (4) send_setup_request, or (5) send_teardown_request in rtsp_send.c, as demonstrated by the Content-Base header; or a long Transport header, which triggers an overflow in (6) get_transport_str_sctp, (7) get_transport_str_tcp, or (8) get_transport_str_udp in rtsp_transport.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6632 
showCode.php in xml2owl 0.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6633 
Multiple cross-site scripting (XSS) vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to inject arbitrary web script or HTML via (1) the cat_name parameter to faq.php; and unspecified parameters to the (2) add categories, (3) edit categories, (4) delete categories, (5) add faq, (6) edit faq, and (7) delete faq Admin scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6634 
Multiple SQL injection vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to execute arbitrary SQL commands via the category_id parameter to faq.php, and unspecified other vectors involving additional scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6635 
FAQMasterFlexPlus, possibly 1.5 or 1.52, stores the admin password in cleartext in a database, which might allow context-dependent attackers to obtain the password via unspecified database access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6636 
Unspecified vulnerability in the StorageFarabDb module in Bitflu before 0.42 allows user-assisted remote attackers to create or append data to arbitrary files via a crafted .torrent file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6637 
Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect.  NOTE: the asfunction: vector is already covered by CVE-2007-6244.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6638 
March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, passwords, device names, and IP addresses via a direct request for scripts/logfiles.tar.gz.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T00:00:00.000Z
CVE-2007-6639 
SQL injection vulnerability in index.php in IPTBB 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewdir action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T01:00:00.000Z
CVE-2007-6640 
Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3 does not properly prevent access to dangerous functions, which allows remote attackers to read the configuration, modify the configuration, or send an HTTP request via the (1) GM_addStyle, (2) GM_log, (3) GM_openInTab, (4) GM_setValue, (5) GM_getValue, or (6) GM_xmlhttpRequest function within a web page on which a userscript is configured.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T01:00:00.000Z
CVE-2007-6641 
Cross-site scripting (XSS) vulnerability in dir.php in milliscripts Redirection allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a browse action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T01:00:00.000Z
CVE-2007-6642 
Multiple cross-site request forgery (CSRF) vulnerabilities in Joomla! before 1.5 RC4 allow remote attackers to (1) add a Super Admin, (2) upload an extension containing arbitrary PHP code, and (3) modify the configuration as administrators via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T01:00:00.000Z
CVE-2007-6643 
Cross-site scripting (XSS) vulnerability in the com_poll component in Joomla! before 1.5 RC4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T01:00:00.000Z
CVE-2007-6644 
Joomla! before 1.5 RC4 allows remote authenticated administrators to promote arbitrary users to the administrator group, in violation of the intended security model.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T01:00:00.000Z
CVE-2007-6645 
Unspecified vulnerability in Joomla! before 1.5 RC4 allows remote authenticated users to gain privileges via unspecified vectors, aka "registered user privilege escalation vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T01:00:00.000Z
CVE-2007-6646 
Multiple cross-site scripting (XSS) vulnerabilities in LiveCart 1.0.1, and possibly other versions before 1.1.0, allow remote attackers to inject arbitrary web script or HTML via (1) the return parameter to user/remindPassword, (2) the q parameter to the category script, (3) the return parameter to the order script, or (4) the email parameter to user/remindComplete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T01:00:00.000Z
CVE-2007-6647 
SQL injection vulnerability in index.php in w-Agora 4.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6648 
Directory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6649 
PHP remote file inclusion vulnerability in includes/tumbnail.php in MatPo Bilder Galerie 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6650 
Unrestricted file upload vulnerability in fisheye/upload.php in Bitweaver R2 CMS allows remote attackers to upload arbitrary files by using the image/gif content type, and possibly other image and PDF content types, as demonstrated by uploading a .htaccess file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6651 
Directory traversal vulnerability in wiki/edit.php in Bitweaver R2 CMS allows remote attackers to obtain sensitive information (script source code) via a .. (dot dot) in the suck_url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6652 
cpie.php in XCMS 1.83 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct direct static code injection attacks and execute arbitrary code via the testo_0 parameter in a cpie admin action to index.php, which writes to dati/generali/footer.dtb (aka the XCMS footer).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6653 
Directory traversal vulnerability in download.php in Mihalism Multi Host 2.0.7 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6654 
Buffer overflow in a certain ActiveX control in Macrovision InstallShield Update Service Web Agent 5.1.100.47363 allows remote attackers to execute arbitrary code via a long string in the ProductCode argument (second argument) to the DownloadAndExecute method, a different vulnerability than CVE-2007-0321, CVE-2007-2419, and CVE-2007-5660.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6655 
PHP remote file inclusion vulnerability in includes/function.php in Kontakt Formular 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6656 
SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6657 
PHP remote file inclusion vulnerability in source/includes/load_forum.php in Mihalism Multi Forum Host 3.0.x and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mfh_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6658 
SQL injection vulnerability in admin.php/vars.php in CustomCMS (CCMS) 3.1 Demo allows remote attackers to execute arbitrary SQL commands via the p parameter in the Console page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6659 
Multiple cross-site scripting (XSS) vulnerabilities in 2z project 0.9.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) contentshort or (2) contentfull parameter in an addnews action to the default URI; (3) the content parameter in a pm write action to 2z/admin.php; (4) the referer parameter to templates/default/usermenu.tpl, accessed through index.php; or the (5) newavatar or (6) newphoto parameter in a profile action to the default URI under 2z/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6660 
2z project 0.9.6.1 allows remote attackers to obtain sensitive information via (1) a request to index.php with an invalid template or (2) a request to the default URI with certain year and month parameters, which reveals the path in various error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6661 
2z project 0.9.6.1 allows attackers to change the password without supplying the old password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6662 
Directory traversal vulnerability in file.php in CuteNews 2.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading the admin username and password hash in data/users.db.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6663 
SQL injection vulnerability in (1) Puarcade.php and (2) PUarcade.html.php in Pragmatic Utopia PU Arcade (com_puarcade) 2.0.3, 2.1.2, and 2.1.3 Beta component for Joomla!  allows remote attackers to execute arbitrary SQL commands via the fid parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6664 
SQL injection vulnerability in index.php in WebPortal CMS 0.6.0 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6665 
SQL injection vulnerability in admin/login.asp in Netchemia oneSCHOOL allows remote attackers to execute arbitrary SQL commands via the txtLoginID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6666 
SQL injection vulnerability in rss.php in Zenphoto 1.1 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the albumnr parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6667 
SQL injection vulnerability in faq.php in MyPHP Forum 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: the member.php vector is already covered by CVE-2005-0413.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-04T11:00:00.000Z
CVE-2007-6668 
admin/uploadgames.php in MySpace Content Zone (MCZ) 3.x does not require administrative privileges, which allows remote attackers to perform unrestricted file uploads, as demonstrated by uploading (1) a .php file and (2) a .php%00.jpeg file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T02:00:00.000Z
CVE-2007-6669 
Cross-site scripting (XSS) vulnerability in search.php in PHCDownload 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the string parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T02:00:00.000Z
CVE-2007-6670 
SQL injection vulnerability in search.php in PHCDownload 1.1.0 allows remote attackers to execute arbitrary SQL commands via the string parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T02:00:00.000Z
CVE-2007-6671 
SQL injection vulnerability in login_form.asp in Instant Softwares Dating Site allows remote attackers to execute arbitrary SQL commands via the Password parameter, a different product than CVE-2006-6021. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T11:00:00.000Z
CVE-2007-6672 
Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) characters in the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T11:00:00.000Z
CVE-2007-6673 
Cross-site scripting (XSS) vulnerability in Makale Scripti allows remote attackers to inject arbitrary web script or HTML via the ara parameter to the default URI under Ara/ in a search action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T11:00:00.000Z
CVE-2007-6674 
Cross-site scripting (XSS) vulnerability in Default.asp in RapidShare Database allows remote attackers to inject arbitrary web script or HTML via the Arayalim parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T19:00:00.000Z
CVE-2007-6675 
The b_system_comments_show function in htdocs/modules/system/blocks/system_blocks.php in XOOPS before 2.0.18 does not check permissions, which allows remote attackers to read the comments in restricted modules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T19:00:00.000Z
CVE-2007-6676 
The default configuration of Uber Uploader (UU) 5.3.6 and earlier does not block uploads of (1) .html, (2) .asp, and other possibly dangerous extensions, which allows remote attackers to use these extensions in uploads via (a) uu_file_upload.php, related to uu_file_upload.js and (b) uber_uploader_file.php, related to uber_uploader_file.js, a different issue than CVE-2007-0123.  NOTE: the vendor disputes the severity of the issue, noting that it is the administrator's responsibility to "add file extensions that you may or may not want uploaded."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-08T19:00:00.000Z
CVE-2007-6677 
Cross-site scripting (XSS) vulnerability in Peter's Random Anti-Spam Image 0.2.4 and earlier plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the comment field in the comment form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T00:00:00.000Z
CVE-2007-6679 
Unspecified vulnerability in the Administrative Console in IBM WebSphere Application Server 6.1 before Fix Pack 13 has unknown impact and attack vectors, related to "security concerns with monitor role users."  NOTE: it was later reported that 6.0.2 before Fix Pack 25 is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T02:00:00.000Z
CVE-2007-6680 
Trusted Execution in IBM AIX 6.1 uses an incorrect pathname argument in a call to the trustchk_block_write function, which might allow local users to modify trusted files, related to an error in the support for links in the TSD_FILES_LOCK policy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-10T23:00:00.000Z
CVE-2007-6681 
Stack-based buffer overflow in modules/demux/subtitle.c in VideoLAN VLC 0.8.6d allows remote attackers to execute arbitrary code via a long subtitle in a (1) MicroDvd, (2) SSA, and (3) Vplayer file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T00:00:00.000Z
CVE-2007-6682 
Format string vulnerability in the httpd_FileCallBack function (network/httpd.c) in VideoLAN VLC 0.8.6d allows remote attackers to execute arbitrary code via format string specifiers in the Connection parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T00:00:00.000Z
CVE-2007-6683 
The browser plugin in VideoLAN VLC 0.8.6d allows remote attackers to overwrite arbitrary files via (1) the :demuxdump-file option in a filename in a playlist, or (2) a EXTVLCOPT statement in an MP3 file, possibly an argument injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T00:00:00.000Z
CVE-2007-6684 
The RTSP module in VideoLAN VLC 0.8.6d allows remote attackers to cause a denial of service (crash) via a request without a Transport parameter, which triggers a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T00:00:00.000Z
CVE-2007-6685 
Unspecified vulnerability in the Publish XP module Menalto Gallery before 2.2.4 allows attackers to create albums and upload files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T01:00:00.000Z
CVE-2007-6686 
The URL rewrite module in Menalto Gallery before 2.2.4 allows attackers to include and execute arbitrary local files via unknown vectors related to the admin controller.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T01:00:00.000Z
CVE-2007-6687 
Multiple cross-site scripting (XSS) vulnerabilities in Menalto Gallery before 2.2.4 allow remote attackers to inject arbitrary web script or HTML via crafted filenames to the (1) Core or (2) add-item modules; or via (3) HTTP PROPPATCH in the WebDAV module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T01:00:00.000Z
CVE-2007-6688 
Unspecified vulnerability in the Installation application in Menalto Gallery before 2.2.4 has unknown impact and attack vectors related to "web-accessibility protection of the storage folder."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T01:00:00.000Z
CVE-2007-6689 
Menalto Gallery before 2.2.4 does not properly check for malicious file extensions during file uploads, which allows attackers to execute arbitrary code via the (1) Core application or (2) MIME module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T01:00:00.000Z
CVE-2007-6690 
The Gallery Remote module in Menalto Gallery before 2.2.4 does not check permissions for unspecified GR commands, which has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-17T01:00:00.000Z