rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-6946 
Cross-site scripting (XSS) vulnerability in manageproject.php in Collabtive 0.4.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via the project Name, which is not properly handled when the administrator performs an editform action, related to admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6947 
Collabtive 0.4.8 allows remote attackers to bypass authentication and create new users, including administrators, via unspecified vectors associated with the added mode in a users action to admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6948 
Unrestricted file upload vulnerability in Collabtive 0.4.8 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and using a text/plain MIME type, then accessing it via a direct request to the file in files/, related to (1) the showproject action in managefile.php or (2) the Messages feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6949 
Multiple cross-site request forgery (CSRF) vulnerabilities in Collabtive 0.4.8 allow remote attackers to hijack the authentication of administrators for requests that (1) submit or edit a new project, or (2) upload files to a project, or (3) attach files to messages via unknown vectors.  NOTE: these issues can be leveraged with other vulnerabilities to create remote attack vectors that do not require authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6950 
Multiple SQL injection vulnerabilities in login.asp in Bankoi WebHosting Control Panel 1.20 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6951 
MauryCMS 0.53.2 and earlier does not require administrative authentication for Editors/fckeditor/editor/filemanager/browser/default/browser.html, which allows remote attackers to upload arbitrary files via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6952 
SQL injection vulnerability in Rss.php in MauryCMS 0.53.2 and earlier allows remote attackers to execute arbitrary SQL commands via the c parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6953 
Buffer overflow in oovoo.exe in ooVoo 1.7.1.35, and possibly other versions before 1.7.1.59, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long oovoo: URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6954 
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6955 
mxCamArchive 2.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain configuration details and passwords via a direct request for archive/config.ini.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6956 
Static code injection vulnerability in admin/admin.php in mxCamArchive 2.2 allows remote authenticated administrators to inject arbitrary PHP code into an unspecified program via the description parameter, which is executed by invocation of index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6957 
member.php in Crossday Discuz! Board allows remote attackers to reset passwords of arbitrary users via crafted (1) lostpasswd and (2) getpasswd actions, possibly involving predictable generation of the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6958 
wap/index.php in Crossday Discuz! Board 6.x and 7.x allows remote authenticated users to execute arbitrary PHP code via the creditsformula parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6959 
Insecure method vulnerability in the Chilkat Socket ActiveX control (ChilkatSocket.ChilkatSocket.1) in ChilkatSocket.dll 2.3.1.1 allows remote attackers to overwrite arbitrary files via the SaveLastError method.  NOTE: this might be related to CVE-2008-1647.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6960 
download.php in X10media x10 Automatic Mp3 Search Engine Script 1.5.5 through 1.6 allows remote attackers to read arbitrary files via an encoded url parameter, as demonstrated by obtaining database credentials from includes/constants.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2008-6961 
mailnews in Mozilla Thunderbird before 2.0.0.18 and SeaMonkey before 1.1.13, when JavaScript is enabled in mail, allows remote attackers to obtain sensitive information about the recipient, or comments in forwarded mail, via script that reads the (1) .documentURI or (2) .textContent DOM properties.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-13T16:00:00.000Z
CVE-2008-6962 
Avira AntiVir Premium, Premium Security Suite, AntiVir Professional, and AntiVir Personal - FREE allows local users to execute arbitrary code via a crafted IOCTL request that overwrites a kernel pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-13T16:00:00.000Z
CVE-2008-6963 
admin.php in TurnkeyForms Text Link Sales allows remote attackers to bypass authentication and gain administrative privileges via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-13T16:00:00.000Z
CVE-2008-6964 
SQL injection vulnerability in the login page in X7 Chat 2.0.5 allows remote attackers to execute arbitrary SQL commands via the password field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-13T16:00:00.000Z
CVE-2008-6965 
AJ Square AJ Auction OOPD, Pro Platinum Skin #1, Pro Platinum Skin #2, and Web 2.0 send a redirect but do not exit when certain scripts are called directly, which allows remote attackers to bypass authentication via a direct request to (1) site.php, (2) auction.php, (3) mail.php, (4) fee_setting.php, (5) earnings.php, (6) insertion_fee_settings.php, (7) custom_category.php, (8) subcategory.php, (9) category.php, (10) report.php, (11) store_manager.php, and (12) choose_sell_format.php in admin/, and possibly other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-13T16:00:00.000Z
CVE-2008-6966 
AJ Square AJ Auction Pro Platinum Skin #1 sends a redirect but does not exit when it is called directly, which allows remote attackers to bypass authentication via a direct request to admin/user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-13T16:00:00.000Z
CVE-2008-6967 
Multiple unspecified vulnerabilities in WorldClient in Alt-N MDaemon before 10.02 have unknown impact and attack vectors, probably related to cross-site scripting (XSS) and WorldClient DLL 10.0.1, a different vulnerability than CVE-2008-6893.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-13T16:00:00.000Z
CVE-2008-6968 
Multiple SQL injection vulnerabilities in submit.php in Pligg CMS 9.9.5 allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) id parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-13T16:00:00.000Z
CVE-2008-6969 
Multiple cross-site scripting (XSS) vulnerabilities in checkout.php in Avactis Shopping Cart 1.8.0 and 1.8.1 allow remote attackers to inject arbitrary web script or HTML via the (1) step_id and (2) CHECKOUT_CZ_BLOWFISH_KEY parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-13T16:00:00.000Z
CVE-2008-6970 
SQL injection vulnerability in dosearch.inc.php in UBB.threads 7.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the Forum[] array parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-13T16:00:00.000Z
CVE-2008-6971 
The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before 2.0 beta 4 includes clues about the random number generator state within a hidden form field and generates predictable validation codes, which allows remote attackers to modify passwords of other users and gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-13T16:00:00.000Z
CVE-2008-6972 
Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via the (1) "field label," (2) "help text," or (3) "allowed values" settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-13T16:00:00.000Z
CVE-2008-6973 
Multiple unspecified vulnerabilities in IBM WebSphere Commerce 6.0 before 6.0.0.7 have unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-13T18:00:00.000Z
CVE-2008-6974 
Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp1 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary commands via the ping_ip parameter; (2) change the administrative credentials via the http_username and http_passwd parameters; (3) enable remote administration via the remote_management parameter; or (4) configure port forwarding via certain from, to, ip, and pro parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T15:00:00.000Z
CVE-2008-6975 
Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp2 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary commands via the ping_ip parameter; (2) change the administrative credentials via the http_username and http_passwd parameters; (3) enable remote administration via the remote_management parameter; or (4) configure port forwarding via certain from, to, ip, and pro parameters.  NOTE: This issue reportedly exists because of a "weak ... anti-CSRF fix" implemented in 24 sp2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T15:00:00.000Z
CVE-2008-6976 
MikroTik RouterOS 3.x through 3.13 and 2.x through 2.9.51 allows remote attackers to modify Network Management System (NMS) settings via a crafted SNMP set request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6977 
Cross-site scripting (XSS) vulnerability in album.asp in Full Revolution aspWebAlbum 3.2 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a summary action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6978 
Unrestricted file upload vulnerability in Full Revolution aspWebAlbum 3.2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in pics/, related to the uploadmedia action in album.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6979 
Cross-site scripting (XSS) vulnerability in as_archives.php in phpAdultSite CMS, possibly 2.3.2, allows remote attackers to inject arbitrary web script or HTML via the results_per_page parameter to index.php.  NOTE: some of these details are obtained from third party information.  NOTE: this issue might be resultant from a separate SQL injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6980 
SQL injection vulnerability in as_archives.php in phpAdultSite CMS, possibly 2.3.2, allows remote attackers to execute arbitrary SQL commands via the results_per_page parameter to index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6981 
index.php in phpAdultSite CMS, possibly 2.3.2, allows remote attackers to obtain the full installation path via an invalid results_per_page parameter, which leaks the path in an error message.  NOTE: this issue might be resultant from a separate SQL injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6982 
Cross-site scripting (XSS) vulnerability in index.php in devalcms 1.4a allows remote attackers to inject arbitrary web script or HTML via the currentpath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6983 
modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer header with a target file specified in the gv_folder_data parameter, as demonstrated by modifying modules/tool/url2header.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6984 
Plesk 8.6.0, when short mail login names (SHORTNAMES) are enabled, allows remote attackers to bypass authentication and send spam e-mail via a message with (1) a base64-encoded username that begins with a valid shortname, or (2) a username that matches a valid password, as demonstrated using (a) SMTP and qmail, and (b) Courier IMAP and POP3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6985 
Multiple SQL injection vulnerabilities in includes/classes/shopping_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter when (1) adding or (2) updating the shopping cart.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6986 
SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping_cart.php in Zen Cart 1.3.0 through 1.3.8a, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the products_id array parameter in a multiple_products_add_product action, a different vulnerability than CVE-2008-6985.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6987 
Unrestricted file upload vulnerability in eZoneScripts Dating Website script allows remote attackers to execute arbitrary code via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6988 
Multiple cross-site scripting (XSS) vulnerabilities in Easy Photo Gallery (aka Ezphotogallery) 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) galleryid parameter to gallery.php, and the (2) size or (3) imageid parameters to show.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6989 
SQL injection vulnerability in gallery.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 allows remote attackers to execute arbitrary SQL commands via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6990 
SQL injection vulnerability in gallery.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 allows remote attackers to execute arbitrary SQL commands via the password parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6991 
SQL injection vulnerability in public/page.php in Websens CMSbright allows remote attackers to execute arbitrary SQL commands via the id_rub_page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6992 
GreenSQL Firewall (greensql-fw), possibly before 0.9.2 or 0.9.4, allows remote attackers to bypass the SQL injection protection mechanism via a WHERE clause containing an expression such as "x=y=z", which is successfully parsed by MySQL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6993 
Siemens Gigaset WLAN Camera 1.27 has an insecure default password, which allows remote attackers to conduct unauthorized activities. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6994 
Stack-based buffer overflow in the SaveAs feature (SaveFileAsWithFilter function) in win_util.cc in Google Chrome 0.2.149.27 allows user-assisted remote attackers to execute arbitrary code via a web page with a long TITLE element, which triggers the overflow when the user saves the page and a long filename is generated.  NOTE: it might be possible to exploit this issue via an HTTP response that includes a long filename in a Content-Disposition header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6995 
Integer underflow in net/base/escape.cc in chrome.dll in Google Chrome 0.2.149.27 allows remote attackers to cause a denial of service (browser crash) via a URI with an invalid handler followed by a "%" (percent) character, which triggers a buffer over-read, as demonstrated using an "about:%" URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6996 
Google Chrome BETA (0.2.149.27) does not prompt the user before saving an executable file, which makes it easier for remote attackers or malware to cause a denial of service (disk consumption) or exploit other vulnerabilities via a URL that references an executable file, possibly related to the "ask where to save each file before downloading" setting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6997 
Google Chrome 0.2.149.27 allows user-assisted remote attackers to cause a denial of service (browser crash) via an IMG tag with a long src attribute, which triggers the crash when the victim performs an "Inspect Element" action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6998 
Stack-based buffer overflow in chrome/common/gfx/url_elider.cc in Google Chrome 0.2.149.27 and other versions before 0.2.149.29 might allow user-assisted remote attackers to execute arbitrary code via a link target (href attribute) with a large number of path elements, which triggers the overflow when the status bar is updated after the user hovers over the link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-6999 
phpAuction 3.2, and possibly 3.3.0 GPL Basic edition, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-7000 
PHP remote file inclusion vulnerability in index.php in PHPAuction 3.2 allows remote attackers to execute arbitrary PHP code via a URL in the lan parameter.  NOTE: this might be related to CVE-2005-2255.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-7001 
Unrestricted file upload vulnerability in the file manager in Creative Mind Creator CMS 5.0 allows remote attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-7002 
PHP 5.2.5 does not enforce (a) open_basedir and (b) safe_mode_exec_dir restrictions for certain functions, which might allow local users to bypass intended access restrictions and call programs outside of the intended directory via the (1) exec, (2) system, (3) shell_exec, (4) passthru, or (5) popen functions, possibly involving pathnames such as "C:" drive notation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-7003 
Multiple SQL injection vulnerabilities in login.php in The Rat CMS Alpha 2 allow remote attackers to execute arbitrary SQL commands via the (1) user_id and (2) password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-18T10:00:00.000Z
CVE-2008-7004 
Buffer overflow in Electronic Logbook (ELOG) before 2.7.1 has unknown impact and attack vectors, possibly related to elog.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-19T10:00:00.000Z
CVE-2008-7005 
include/modules/top/1-random_quote.php in Minb Is Not a Blog (minb) 0.1.0 allows remote attackers to execute arbitrary PHP code via the quotes_to_edit parameter.  NOTE: this issue has been reported as an unrestricted file upload by some sources, but that is a potential consequence of code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-19T10:00:00.000Z
CVE-2008-7006 
Free PHP VX Guestbook 1.06 allows remote attackers to bypass authentication and download a backup of the database via a direct request to admin/backupdb.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-19T10:00:00.000Z
CVE-2008-7007 
Free PHP VX Guestbook 1.06 allows remote attackers to bypass authentication and gain administrative access by setting the (1) admin_name and (2) admin_pass cookie values to 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-19T10:00:00.000Z
CVE-2008-7008 
HyperStop Web Host Directory 1.2 allows remote attackers to bypass authentication and download a database backup via a direct request to admin/backup/db.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-19T10:00:00.000Z