rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-3338 
Cross-site scripting (XSS) vulnerability in Atlassian JIRA 3.6.2-#156 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a direct request to secure/ConfigureReleaseNote.jspa, which are not sanitized before being returned in an error page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-03T18:00:00.000Z
CVE-2006-3339 
secure/ConfigureReleaseNote.jspa in Atlassian JIRA 3.6.2-#156 allows remote attackers to obtain sensitive information via unspecified manipulations of the projectId parameter, which displays the installation path and other system information in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-03T18:00:00.000Z
CVE-2006-3340 
Multiple PHP remote file inclusion vulnerabilities in Pearl For Mambo module 1.6 for Mambo, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via the (1) phpbb_root_path parameter in (a) includes/functions_cms.php and the (2) GlobalSettings[templatesDirectory] parameter in multiple files in the "includes" directory including (b) adminSensored.php, (c) adminBoards.php, (d) adminAttachments.php, (e) adminAvatars.php, (f) adminBackupdatabase.php, (g) adminBanned.php, (h) adminForums.php, (i) adminPolls.php, (j) adminSmileys.php, (k) poll.php, and (l) move.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-03T18:00:00.000Z
CVE-2006-3341 
SQL injection vulnerability in annonces-p-f.php in MyAds module 2.04jp for Xoops allows remote attackers to execute arbitrary SQL commands via the lid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-03T18:00:00.000Z
CVE-2006-3342 
Cross-site scripting (XSS) vulnerability in index.php in Arctic 1.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search cmd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-03T18:00:00.000Z
CVE-2006-3343 
PHP remote file inclusion vulnerability in recipe/cookbook.php in CrisoftRicette 1.0pre15b allows remote attackers to execute arbitrary PHP code via a URL in the crisoftricette parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-03T18:00:00.000Z
CVE-2006-3344 
Siemens Speedstream Wireless Router 2624 allows local users to bypass authentication and access protected files by using the Universal Plug and Play UPnP/1.0 component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-03T19:00:00.000Z
CVE-2006-3345 
Cross-site scripting (XSS) vulnerability in AliPAGER, possibly 1.5 and earlier, allows remote attackers to inject arbitrary web script or HTML via a chat line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-03T19:00:00.000Z
CVE-2006-3346 
SQL injection vulnerability in tree.php in MyNewsGroups 0.6 allows remote attackers to execute arbitrary SQL commands via the grp_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-03T19:00:00.000Z
CVE-2006-3347 
SQL injection vulnerability in index.php in deV!Lz Clanportal DZCP 1.3.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-03T19:00:00.000Z
CVE-2006-3348 
Multiple SQL injection vulnerabilities in HSPcomplete 3.2.2 and 3.3 Beta and earlier allow remote attackers to execute arbitrary SQL commands via the (1) type parameter in report.php and (2) level parameter in custom_buttons.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-03T19:00:00.000Z
CVE-2006-3349 
Multiple SQL injection vulnerabilities in SmS Script allow remote attackers to execute arbitrary SQL commands via the CatID parameter in (1) cat.php and (2) add.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-03T19:00:00.000Z
CVE-2006-3350 
Stack-based buffer overflow in AutoVue SolidModel Professional Desktop Edition 19.1 Build 5993 allows user-assisted remote attackers to execute arbitrary code via a long filename in a (1) ARJ, (2) RAR, or (3) ZIP archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-28T00:00:00.000Z
CVE-2006-3351 
Buffer overflow in Windows Explorer (explorer.exe) on Windows XP and 2003 allows user-assisted attackers to cause a denial of service (repeated crash) and possibly execute arbitrary code via a .url file with an InternetShortcut tag containing a long URL and a large number of "file:" specifiers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T01:00:00.000Z
CVE-2006-3352 
Cross-domain vulnerability in Mozilla Firefox allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object.  NOTE: this description was based on a report that has since been retracted by the original authors. The authors misinterpreted their test results. Other third parties also disputed the original report. Therefore, this is not a vulnerability. It is being assigned a candidate number to provide a clear indication of its status
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T01:00:00.000Z
CVE-2006-3353 
Opera 9 allows remote attackers to cause a denial of service (crash) via a crafted web page that triggers an out-of-bounds memory access, related to an iframe and JavaScript that accesses certain style sheets properties.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T01:00:00.000Z
CVE-2006-3354 
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the Filter property of an ADODB.Recordset ActiveX object to certain values multiple times, which triggers a null dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T01:00:00.000Z
CVE-2006-3355 
Heap-based buffer overflow in httpdget.c in mpg123 before 0.59s-rll allows remote attackers to execute arbitrary code via a long URL, which is not properly terminated before being used with the strncpy function.  NOTE: This appears to be the result of an incomplete patch for CVE-2004-0982.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3356 
The TIFFFetchAnyArray function in ImageIO in Apple OS X 10.4.7 and earlier allows remote user-assisted attackers to cause a denial of service (application crash) via an invalid tag value in a TIFF image, possibly triggering a null dereference.  NOTE: This is a different issue than CVE-2006-1469.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3357 
Heap-based buffer overflow in HTML Help ActiveX control (hhctrl.ocx) in Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code by repeatedly setting the Image field of an Internet.HHCtrl.1 object to certain values, possibly related to improper escaping and long strings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3358 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in NewsPHP 2006 PRO allow remote attackers to inject arbitrary web script or HTML via the (1) words, (2) id, (3) cat_id, and (4) tim parameters, which are not sanitized before being returned in an error page.  NOTE: it is possible that some of these vectors are resultant from an SQL injection issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3359 
Multiple SQL injection vulnerabilities in index.php in NewsPHP 2006 PRO allow remote attackers to inject arbitrary web script or HTML via the (1) words, (2) id, (3) topmenuitem, and (4) cat_id parameters in (a) index.php; and the (5) category parameter in (b) inc/rss_feed.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3360 
Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error message if the file exists.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T00:00:00.000Z
CVE-2006-3361 
PHP remote file inclusion vulnerability in Stud.IP 1.3.0-2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the (1) _PHPLIB[libdir] parameter in studip-phplib/oohforms.inc and (2) ABSOLUTE_PATH_STUDIP parameter in studip-htdocs/archiv_assi.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3362 
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3363 
PHP remote file inclusion vulnerability in index.php in the Glossaire module 1.7 for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the pa parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3364 
SQL injection vulnerability in index.php in the NP_SEO plugin in BLOG:CMS before 4.1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3365 
V3 Chat allows remote attackers to obtain the installation path via (1) an invalid id parameter to mail/index.php or (2) membername parameter to messenger/online.php, which displays the path in an error page due to an incorrect SQL statement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3366 
Multiple cross-site scripting (XSS) vulnerabilities in V3 Chat allow remote attackers to inject arbitrary web script or HTML via crafted HTML tags, as demonstrated by the IMG tag, in the (1) id parameter in (a) mail/index.php and (b) mail/reply.php; (2) login_id parameter in (c) members/is_online.php; (3) site_id parameter in (d) messenger/online.php, (e) messenger/search.php, and (f) messenger/profile.php; (4) contact_name parameter in messenger/search.php; (5) membername parameter in (g) messenger/profileview.php; (6) unspecified parameters used when "editing a profile"; and (7) cust_name parameter in (h) messenger/expire.php.  NOTE: The vendor disputes the vectors involving files in the messenger directory, stating "... the referenced folder 'messenger' was never available to the general public...".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3367 
Mp3 JudeBox Server (Mp3NetBox) Beta 1 stores config.inc under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information, including the database configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3368 
Efone 20000723 stores config.inc under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3369 
Kamikaze-QSCM 0.1 stores config.inc under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information, including the database configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3370 
Blueboy 1.0.3 stores bb_news_config.inc under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information, including the database configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3371 
Eupla Foros 1.0 stores the inc/config.inc file under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information, including the database configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3372 
Apple Safari 2.0.4/419.3 allows remote attackers to cause a denial of service (application crash) via a DHTML setAttributeNode function call with zero arguments, which triggers a null dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3373 
Unspecified vulnerability in the client/bin/logfetch script in Hobbit 4.2-beta allows local users to read arbitrary files, related to logfetch running as setuid root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3374 
PHP remote file inclusion vulnerability in index.php in Randshop 1.2 and earlier, including 0.9.3, allows remote attackers to execute arbitrary PHP code via a URL in the incl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3375 
PHP remote file inclusion vulnerability in includes/header.inc.php in Randshop 1.1.1 allows remote attackers to execute arbitrary PHP code via the dateiPfad parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3376 
Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3377 
Cross-site scripting (XSS) vulnerability in JMB Software AutoRank PHP 3.02 and earlier, and AutoRank Pro 5.01 and earlier, allows remote attackers to inject arbitrary web script or HTML via the (1) Keyword parameter in search.php and the (2) Username parameter in main.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3378 
passwd command in shadow in Ubuntu 5.04 through 6.06 LTS, when called with the -f, -g, or -s flag, does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3379 
Algorithmic complexity vulnerability in Hiki Wiki 0.6.0 through 0.6.5 and 0.8.0 through 0.8.5 allows remote attackers to cause a denial of service (CPU consumption) by performing a diff between large, crafted pages that trigger the worst case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3380 
Algorithmic complexity vulnerability in FreeStyle Wiki before 3.6.2 allows remote attackers to cause a denial of service (CPU consumption) by performing a diff between large, crafted pages that trigger the worst case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3381 
SturGeoN Upload allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension, then directly accessing the file.  NOTE: It is uncertain whether this is a vulnerability or a feature of the product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3382 
Cross-site scripting (XSS) vulnerability in search.php in mAds 1.0 allows remote attackers to inject arbitrary web script or HTML via the "search string".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3383 
Cross-site scripting (XSS) vulnerability in index.php in mAds 1.0 allows remote attackers to inject arbitrary web script or HTML via Javascript events such as onmouseover within a URL.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party reports.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3384 
SQL injection vulnerability in divers.php in Vincent Leclercq News 5.2 allows remote attackers to execute arbitrary SQL commands via the (1) id and (2) texte parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3385 
Cross-site scripting (XSS) vulnerability in divers.php in Vincent Leclercq News 5.2 allows remote attackers to inject arbitrary web script or HTML via the (1) id and (2) disabled parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3386 
index.php in Vincent Leclercq News 5.2 allows remote attackers to obtain sensitive information, such as the installation path, via a mail[] parameter with invalid values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3387 
Directory traversal vulnerability in sources/post.php in Fusion News 1.0, when register_globals is enabled, allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the fil_config parameter, which can be used to execute PHP code that has been injected into a log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3388 
Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the table parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3389 
index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message.  NOTE: this issue has been disputed by a third party who states that the issue does not leak any target-specific information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3390 
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3391 
The Execute function in iMBCContents ActiveX Control before 2.0.0.59 allows remote attackers to execute arbitrary files via the file URI handler.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3392 
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename.  NOTE: This is a different issue than CVE-2006-3274.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3393 
Papyrus NASCAR Racing 4 4.1.3.1.6 and earlier, 2002 Season 1.1.0.2 and earlier, and 2003 Season 1.2.0.1 and earlier allows remote attackers to cause a denial of service (CPU consumption) by sending an empty UDP datagram, which is not properly discarded due to use of the FIONREAD asynchronous socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3394 
SQL injection vulnerability in the files mod in index.php in BXCP 0.3.0.4 allows remote attackers to execute arbitrary SQL commands via the where parameter in a view action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3395 
PHP remote file inclusion vulnerability in top.php in SiteBuilder-FX 3.5 allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3396 
PHP remote file inclusion vulnerability in galleria.html.php in Galleria Mambo Module 1.0 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3397 
Multiple cross-site scripting (XSS) vulnerabilities in Taskjitsu before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via multiple unspecified parameters, including the (1) title and (2) description parameters when creating a task.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3398 
The "change password forms" in Taskjitsu before 2.0.1 includes password hashes in hidden form fields, which allows remote attackers to obtain sensitive information from the (1) Category Editor and (2) User Information editor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3399 
Cross-site scripting (XSS) vulnerability in wiki.php in MoniWiki before 1.1.2-20060702 allows remote attackers to inject arbitrary Javascript via the URL, which is reflected back in an error message, a variant of CVE-2004-1632.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3400 
Stack-based buffer overflow in the CG_ServerCommand function in Quake 3 Engine as used by Soldier of Fortune 2 (SOF2MP) GOLD 1.03 allows remote attackers to cause a denial of service and possibly execute code by sending a long command from the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z
CVE-2006-3401 
Stack-based buffer overflow in Quake 3 Engine as used by Quake 3: Arena 1.32b and 1.32c allows remote attackers to cause a denial of service and possibly execute code via long CS_ITEMS values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-06T20:00:00.000Z