rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-4178 
SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and Downline Goldmine Builder allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-23T15:00:00.000Z
CVE-2008-4179 
Multiple cross-site scripting (XSS) vulnerabilities in NooMS 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) page_id parameter to smileys.php and the (2) q parameter to search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-23T15:00:00.000Z
CVE-2008-4180 
Unspecified vulnerability in db.php in NooMS 1.1 allows remote attackers to conduct brute force attacks against passwords via a username in the g_dbuser parameter and a password in the g_dbpwd parameter, and possibly a "localhost" g_dbhost parameter value, related to a "Mysql Remote Brute Force Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-23T15:00:00.000Z
CVE-2008-4181 
Directory traversal vulnerability in includes/xml.php in the Netenberg Fantastico De Luxe module before 2.10.4 r19 for cPanel, when cPanel PHP Register Globals is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) or absolute pathname in the fantasticopath parameter.  NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-23T15:00:00.000Z
CVE-2008-4182 
Cross-site scripting (XSS) vulnerability in imp/test.php in Horde Turba Contact Manager H3 2.2.1 and other versions before 2.3.1, and possibly other Horde Project products, allows remote attackers to inject arbitrary web script or HTML via the User field in an IMAP session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-23T15:00:00.000Z
CVE-2008-4183 
IntegraMOD 1.4.x stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a backup via a direct request to a backup/backup-yyyy-dd-mm.sql filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-23T15:00:00.000Z
CVE-2008-4184 
Cross-site scripting (XSS) vulnerability in index.php in webCMS Portal Edition allows remote attackers to inject arbitrary web script or HTML via the patron parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-23T15:00:00.000Z
CVE-2008-4185 
SQL injection vulnerability in index.php in webCMS Portal Edition allows remote attackers to execute arbitrary SQL commands via the id parameter in a documentos action, a different vector than CVE-2008-3213.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-23T15:00:00.000Z
CVE-2008-4186 
SQL injection vulnerability in index.php in webCMS Portal Edition allows remote attackers to execute arbitrary SQL commands via the id_doc parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-23T15:00:00.000Z
CVE-2008-4187 
Directory traversal vulnerability in index.php in ProActive CMS allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-23T16:00:00.000Z
CVE-2008-4188 
Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before 1.0.2 allows remote attackers to execute arbitrary code via unknown vectors related to "injection of control characters."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-23T16:00:00.000Z
CVE-2008-4190 
The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log temporary files.  NOTE: in many distributions and the upstream version, this tool has been disabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-24T10:00:00.000Z
CVE-2008-4191 
extract-table.pl in Emacspeak 26 and 28 allows local users to overwrite arbitrary files via a symlink attack on the extract-table.csv temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-24T10:00:00.000Z
CVE-2008-4192 
The pserver_shutdown function in fence_egenera in cman 2.20080629 and 2.20080801 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/eglog temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-29T17:00:00.000Z
CVE-2008-4193 
Stack-based buffer overflow in SecurityGateway.dll in Alt-N Technologies SecurityGateway 1.0.1 allows remote attackers to execute arbitrary code via a long username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-24T10:00:00.000Z
CVE-2008-4194 
The p_exec_query function in src/dns_query.c in pdnsd before 1.2.7-par allows remote attackers to cause a denial of service (daemon crash) via a long DNS reply with many entries in the answer section, related to a "dangling pointer bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-24T10:00:00.000Z
CVE-2008-4195 
Opera before 9.52 does not properly restrict the ability of a framed web page to change the address associated with a different frame, which allows remote attackers to trigger the display of an arbitrary address in a frame via unspecified use of web script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-27T00:00:00.000Z
CVE-2008-4196 
Cross-site scripting (XSS) vulnerability in Opera before 9.52 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-27T00:00:00.000Z
CVE-2008-4197 
Opera before 9.52 on Windows, Linux, FreeBSD, and Solaris, when processing custom shortcut and menu commands, can produce argument strings that contain uninitialized memory, which might allow user-assisted remote attackers to execute arbitrary code or conduct other attacks via vectors related to activation of a shortcut.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-27T00:00:00.000Z
CVE-2008-4198 
Opera before 9.52, when rendering an http page that has loaded an https page into a frame, displays a padlock icon and offers a security information dialog reporting a secure connection, which might allow remote attackers to trick a user into performing unsafe actions on the http page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-27T00:00:00.000Z
CVE-2008-4199 
Opera before 9.52 does not prevent use of links from web pages to feed source files on the local disk, which might allow remote attackers to determine the validity of local filenames via vectors involving "detection of JavaScript events and appropriate manipulation."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-27T00:00:00.000Z
CVE-2008-4200 
Opera before 9.52 does not ensure that the address field of a news feed represents the feed's actual URL, which allows remote attackers to change this field to display the URL of a page containing web script controlled by the attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-27T00:00:00.000Z
CVE-2008-4201 
Heap-based buffer overflow in the decodeMP4file function (frontend/main.c) in FAAD2 2.6.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MPEG-4 (MP4) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-24T10:00:00.000Z
CVE-2008-4202 
SQL injection vulnerability in index.php in Gonafish LinksCaffePRO 4.5 allows remote attackers to execute arbitrary SQL commands via the idd parameter in a deadlink action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-24T14:00:00.000Z
CVE-2008-4203 
SQL injection vulnerability in cn_users.php in CzarNews 1.20 and earlier allows remote attackers to execute arbitrary SQL commands via a recook cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-24T14:00:00.000Z
CVE-2008-4204 
SQL injection vulnerability in city.asp in SoftAcid Hotel Reservation System (HRS) allows remote attackers to execute arbitrary SQL commands via the city parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-24T14:00:00.000Z
CVE-2008-4205 
SQL injection vulnerability in search.php Attachmax Dolphin 2.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the category parameter in a Search action to index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-24T14:00:00.000Z
CVE-2008-4206 
PHP remote file inclusion vulnerability in config.php in Attachmax Dolphin 2.1.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the rel_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-24T14:00:00.000Z
CVE-2008-4207 
Attachmax Dolphin 2.1.0 and earlier does not properly protect info.php in the main folder, which allows remote attackers to obtain sensitive information via a direct request, which invokes the phpinfo function. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-24T14:00:00.000Z
CVE-2008-4208 
Unspecified vulnerability in OSADS Alliance Database before 2.1 has unknown impact and attack vectors, possibly related to includes/functions.php, a different issue than CVE-2006-2874.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-24T14:00:00.000Z
CVE-2008-4210 
fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable file in a setgid directory through the (1) truncate or (2) ftruncate function in conjunction with memory-mapped I/O.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-29T17:00:00.000Z
CVE-2008-4211 
Integer signedness error in (1) QuickLook in Apple Mac OS X 10.5.5 and (2) Office Viewer in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted Microsoft Excel file that triggers an out-of-bounds memory access, related to "handling of columns."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-10T10:00:00.000Z
CVE-2008-4212 
Unspecified vulnerability in rlogind in the rlogin component in Mac OS X 10.4.11 and 10.5.5 applies hosts.equiv entries to root despite what is stated in documentation, which might allow remote attackers to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-10T10:00:00.000Z
CVE-2008-4214 
Unspecified vulnerability in Script Editor in Mac OS X 10.4.11 and 10.5.5 allows local users to cause the scripting dictionary to be written to arbitrary locations, related to an "insecure file operation" on temporary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-10T10:00:00.000Z
CVE-2008-4215 
Weblog in Mac OS X Server 10.4.11 does not properly check an error condition when a weblog posting access control list is specified for a user that has multiple short names, which might allow attackers to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-10T10:00:00.000Z
CVE-2008-4216 
The plug-in interface in WebKit in Apple Safari before 3.2 does not prevent plug-ins from accessing local URLs, which allows remote attackers to obtain sensitive information via vectors that "launch local files."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T18:00:00.000Z
CVE-2008-4217 
Integer signedness error in BOM in Apple Mac OS X before 10.5.6 allows remote attackers to execute arbitrary code via the headers in a crafted CPIO archive, leading to a stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T01:00:00.000Z
CVE-2008-4218 
Multiple integer overflows in the kernel in Apple Mac OS X before 10.5.6 on Intel platforms allow local users to gain privileges via a crafted call to (1) i386_set_ldt or (2) i386_get_ldt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T01:00:00.000Z
CVE-2008-4219 
The kernel in Apple Mac OS X before 10.5.6 allows local users to cause a denial of service (infinite loop and system halt) by running an application that is dynamically linked to libraries on an NFS server, related to occurrence of an exception in this application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T01:00:00.000Z
CVE-2008-4220 
Integer overflow in the inet_net_pton API in Libsystem in Apple Mac OS X before 10.5.6 allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.  NOTE: this may be related to the WLB-2008080064 advisory published by SecurityReason on 20080822; however, as of 20081216, there are insufficient details to be sure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T01:00:00.000Z
CVE-2008-4221 
The strptime API in Libsystem in Apple Mac OS X before 10.5.6 allows context-dependent attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a crafted date string, related to improper memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T01:00:00.000Z
CVE-2008-4222 
natd in network_cmds in Apple Mac OS X before 10.5.6, when Internet Sharing is enabled, allows remote attackers to cause a denial of service (infinite loop) via a crafted TCP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T01:00:00.000Z
CVE-2008-4223 
Podcast Producer in Apple Mac OS X 10.5 before 10.5.6 allows remote attackers to bypass authentication and gain administrative access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T01:00:00.000Z
CVE-2008-4224 
UDF in Apple Mac OS X before 10.5.6 allows user-assisted attackers to cause a denial of service (system crash) via a malformed UDF volume in a crafted ISO file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T01:00:00.000Z
CVE-2008-4225 
Integer overflow in the xmlBufferResize function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (infinite loop) via a large XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-25T23:00:00.000Z
CVE-2008-4226 
Integer overflow in the xmlSAX2Characters function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a large XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-25T23:00:00.000Z
CVE-2008-4227 
Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 changes the encryption level of PPTP VPN connections to a lower level than was previously used, which makes it easier for remote attackers to obtain sensitive information or hijack a connection by decrypting network traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-25T23:00:00.000Z
CVE-2008-4228 
The Passcode Lock feature in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 allows physically proximate attackers to leverage the emergency-call ability of locked devices to make a phone call to an arbitrary number.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-25T23:00:00.000Z
CVE-2008-4229 
Race condition in the Passcode Lock feature in Apple iPhone OS 2.0 through 2.1 and iPhone OS for iPod touch 2.0 through 2.1 allows physically proximate attackers to remove the lock and launch arbitrary applications by restoring the device from a backup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-25T23:00:00.000Z
CVE-2008-4230 
The Passcode Lock feature in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 displays SMS messages when the emergency-call screen is visible, which allows physically proximate attackers to obtain sensitive information by reading these messages.  NOTE: this might be a duplicate of CVE-2008-4593.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-25T23:00:00.000Z
CVE-2008-4231 
Safari in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 does not properly handle HTML TABLE elements, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-25T23:00:00.000Z
CVE-2008-4232 
Safari in Apple iPhone OS 2.0 through 2.1 and iPhone OS for iPod touch 2.1 through 2.1 does not restrict an IFRAME's content display to the boundaries of the IFRAME, which allows remote attackers to spoof a user interface via a crafted HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-25T23:00:00.000Z
CVE-2008-4233 
Safari in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 does not isolate the call-approval dialog from the process of launching new applications, which allows remote attackers to make arbitrary phone calls via a crafted HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-25T23:00:00.000Z
CVE-2008-4234 
Incomplete blacklist vulnerability in the Quarantine feature in CoreTypes in Apple Mac OS X 10.5 before 10.5.6 allows user-assisted remote attackers to execute arbitrary code via an executable file with the content type indicating no application association for the file, which does not trigger a "potentially unsafe" warning message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T01:00:00.000Z
CVE-2008-4236 
Apple Type Services (ATS) in Apple Mac OS X 10.5 before 10.5.6 allows remote attackers to cause a denial of service (infinite loop) via a crafted embedded font in a PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T01:00:00.000Z
CVE-2008-4237 
Managed Client in Apple Mac OS X before 10.5.6 sometimes misidentifies a system when installing per-host configuration settings, which allows context-dependent attackers to have an unspecified impact by leveraging unintended settings, as demonstrated by the screen saver lock setting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-17T01:00:00.000Z
CVE-2008-4241 
SQL injection vulnerability in CJ Ultra Plus 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via an SID cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-25T19:00:00.000Z
CVE-2008-4242 
ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-25T19:00:00.000Z
CVE-2008-4243 
Directory traversal vulnerability in ImageServer (aka UTImageServer) in WebAdmin before 1.7 for Epic Games Unreal Tournament 3 (UT3) 1.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-25T19:00:00.000Z
CVE-2008-4244 
Rianxosencabos CMS 0.9 allows remote attackers to bypass authentication and gain administrative access by setting the usuario and pass cookies to 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-25T19:00:00.000Z
CVE-2008-4245 
The Admin Control Panel in Rianxosencabos CMS 0.9 does not require administrator privileges, which allows remote authenticated users to (1) change a user's privileges, (2) delete a user account, or perform unspecified other administrative actions via vectors involving an admin lista action to the default URI, possibly related to useradmin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-25T19:00:00.000Z
CVE-2008-4246 
Unspecified vulnerability in Denora IRC Stats Server before 1.4.1 allows remote IRC servers to cause a denial of service (application crash) via a crafted CTCP response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-25T19:00:00.000Z
CVE-2008-4247 
ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-25T19:00:00.000Z
CVE-2008-4250 
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-23T21:00:00.000Z