rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-7070 
Argument injection vulnerability in the URI handler in KVIrc 3.4.2 Shiny allows remote attackers to execute arbitrary commands via a " (quote) followed by command line switches in a (1) irc:///, (2) irc6:///, (3) ircs:///, or (4) and ircs6:/// URI.  NOTE: this might be due to an incomplete fix for CVE-2007-2951.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7071 
SQL injection vulnerability in authenticate.php in Chipmunk Topsites allows remote attackers to execute arbitrary SQL commands via the username parameter, related to login.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7072 
Cross-site scripting (XSS) vulnerability in index.php in Chipmunk Topsites allows remote attackers to inject arbitrary web script or HTML via the start parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7073 
PHP remote file inclusion vulnerability in lib/action/rss.php in RSS module 0.1 for Pie Web M{a,e}sher, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the lib parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7074 
Format string vulnerability in MemeCode Software i.Scribe 1.88 through 2.00 before Beta9 allows remote SMTP servers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in a server response, which is not properly handled "when displaying the signon message."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7075 
Multiple SQL injection vulnerabilities in Kalptaru Infotech Ltd. Star Articles 6.0 allow remote attackers to inject arbitrary SQL commands via (1) the subcatid parameter to article.list.php; or the artid parameter to (2) article.print.php, (3) article.comments.php, (4) article.publisher.php, or (5) article.download.php; and (6) the PATH_INFO to article.download.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7076 
Unrestricted file upload vulnerability in user.modify.profile.php in Kalptaru Infotech Ltd. Star Articles 6.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile photo, then accessing it via a direct request to the file in authorphoto/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7077 
Multiple SQL injection vulnerabilities in SailPlanner 0.3a allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7078 
Multiple buffer overflows in Rumpus before 6.0.1 allow remote attackers to (1) cause a denial of service (segmentation fault) via a long HTTP verb in the HTTP component; and allow remote authenticated users to execute arbitrary code via a long argument to the (2) MKD, (3) XMKD, (4) RMD, and other unspecified commands in the FTP component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7079 
Buffer overflow in Nero ShowTime 5.0.15.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long entry in a .M3U playlist file.  NOTE: this issue might be related to CVE-2008-0619.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7080 
Team PHP PHP Classifieds Script stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database credentials via a direct request for admin/backup/datadump.sql.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7081 
userHandler.cgi in RaidSonic ICY BOX NAS firmware 2.3.2.IB.2.RS.1 allows remote attackers to bypass authentication and gain administrator privileges by setting the login parameter to admin. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7082 
MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key parameter in URLs to moderation.php with the (1) mergeposts, (2) split, and (3) deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery (CSRF) protection mechanism to hijack the authentication of moderators by reading the token from the HTTP Referer header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7083 
Multiple SQL injection vulnerabilities in ReVou Micro Blogging Twitter clone allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-25T10:00:00.000Z
CVE-2008-7084 
Directory traversal vulnerability in the web server 1.0 in Velocity Security Management System allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-26T14:00:00.000Z
CVE-2008-7085 
Multiple SQL injection vulnerabilities in TheHockeyStop HockeySTATS Online 2.0 Basic and Advanced allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in the viewpage action to the default URI, probably index.php, or (2) divid parameter in the schedule action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-26T14:00:00.000Z
CVE-2008-7086 
Maian Greetings 2.1 allows remote attackers to bypass authentication and gain administrative privileges by setting the mecard_admin_cookie cookie to admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-26T14:00:00.000Z
CVE-2008-7087 
PHP remote file inclusion vulnerability in search_wA.php in OpenPro 1.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the LIBPATH parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-26T14:00:00.000Z
CVE-2008-7088 
Unrestricted file upload vulnerability in upload.php in PhotoPost vBGallery 2.4.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in a certain path.  NOTE: this may be the same vulnerability as CVE-2008-0251, but this is not clear due to lack of details from the vendor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-26T14:00:00.000Z
CVE-2008-7089 
Cross-site scripting (XSS) vulnerability in Pligg 9.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in a search action to user.php and other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-26T14:00:00.000Z
CVE-2008-7090 
Multiple directory traversal vulnerabilities in Pligg 9.9 and earlier allow remote attackers to (1) determine the existence of arbitrary files via a .. (dot dot) in the $tb_url variable in trackback.php, or (2) include arbitrary files via a .. (dot dot) in the template parameter to settemplate.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-26T14:00:00.000Z
CVE-2008-7091 
Multiple SQL injection vulnerabilities in Pligg 9.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to vote.php, which is not properly handled in libs/link.php; (2) id parameter to trackback.php; (3) an unspecified parameter to submit.php; (4) requestTitle variable in a query to story.php; (5) requestID and (6) requestTitle variables in recommend.php; (7) categoryID parameter to cloud.php; (8) title parameter to out.php; (9) username parameter to login.php; (10) id parameter to cvote.php; and (11) commentid parameter to edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-26T14:00:00.000Z
CVE-2008-7092 
Multiple cross-site scripting (XSS) vulnerabilities in Unica Affinium Campaign 7.2.1.0.55 allow remote attackers to inject arbitrary web script or HTML via a Javascript event in the (1) url, (2) PageName, and (3) title parameters in a CustomBookMarkLink action to Campaign/Campaign; (4) a Javascript event in the displayIcon parameter to Campaign/updateOfferTemplateSubmit.do (aka the templates web page); (5) crafted input to Campaign/CampaignListener (aka the listener server), which is not properly handled when displaying the status log; and (6) id parameter to Campaign/campaignDetails.do, (7) id parameter to Campaign/offerDetails.do, (8) function parameter to Campaign/Campaign, (9) sessionID parameter to Campaign/runAllFlowchart.do, (10) id parameter in an edit action to Campaign/updateOfferTemplatePage.do, (11) Frame parameter in a LoadFrame action to Campaign/Campaign, (12) affiniumUserName parameter to manager/jsp/test.jsp, (13) affiniumUserName parameter to Campaign/main.do, and possibly other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-26T14:00:00.000Z
CVE-2008-7093 
Multiple directory traversal vulnerabilities in Unica Affinium Campaign 7.2.1.0.55 allow remote attackers to (1) create arbitrary directories or files via a .. (dot dot) in the folder name in the new folder functionality or (2) list arbitrary files via a crafted request to Campaign/CampaignListener.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-26T14:00:00.000Z
CVE-2008-7094 
Campaign/CampaignListener in the listener server in Unica Affinium Campaign 7.2.1.0.55 allows remote attackers to cause a denial of service (server crash) via a crafted length field that triggers (1) connection exhaustion or (2) memory allocation failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-26T14:00:00.000Z
CVE-2008-7095 
The SNMP daemon in ArubaOS 3.3.2.6 in Aruba Mobility Controller does not restrict SNMP access, which allows remote attackers to (1) read all SNMP community strings via SNMP-COMMUNITY-MIB::snmpCommunityName (1.3.6.1.6.3.18.1.1.1.2) or SNMP-VIEW-BASED-ACM-MIB::vacmGroupName (1.3.6.1.6.3.16.1.2.1.3) with knowledge of one community string, and (2) read SNMPv3 user names via SNMP-USER-BASED-SM-MIB or SNMP-VIEW-BASED-ACM-MIB.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-27T18:00:00.000Z
CVE-2008-7096 
Intel Desktop and Intel Mobile Boards with BIOS firmware DQ35JO, DQ35MP, DP35DP, DG33FB, DG33BU, DG33TL, MGM965TW, D945GCPE, and DX38BT allows local administrators with ring 0 privileges to gain additional privileges and modify code that is running in System Management Mode, or access hypervisory memory as demonstrated at Black Hat 2008 by accessing certain remapping registers in Xen 3.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-27T20:00:00.000Z
CVE-2008-7097 
Multiple SQL injection vulnerabilities in Qsoft K-Rate Premium allow remote attackers to execute arbitrary SQL commands via (1) the $id variable in admin/includes/dele_cpac.php, (2) $ord[order_id] variable in payments/payment_received.php, (3) $id variable in includes/functions.php, and (4) unspecified variables in modules/chat.php, as demonstrated via the (a) show parameter in an online action to index.php; (b) PATH_INTO to the room/ handler; (c) image and (d) id parameters in a vote action to index.php; (e) PATH_INFO to the blog/ handler; and (f) id parameter in a blog_edit action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-27T20:00:00.000Z
CVE-2008-7098 
Multiple cross-site scripting (XSS) vulnerabilities in Qsoft K-Rate Premium allow remote attackers to inject arbitrary web script or HTML via the blog, possibly the (1) Title and (2) Text fields; (3) the gallery, possibly the Description field in Your Pictures; (4) the forum, possibly the Your Message field when posting a new thread; or (5) the vote parameter in a view action to index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-27T20:00:00.000Z
CVE-2008-7099 
Unspecified vulnerability in the Manage Templates feature in Qsoft K-Rate Premium allows remote attackers to execute arbitrary PHP code via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-27T20:00:00.000Z
CVE-2008-7100 
Unspecified vulnerability in DotNetNuke 4.4.1 through 4.8.4 allows remote authenticated users to bypass authentication and gain privileges via unknown vectors related to a "unique id" for user actions and improper validation of a "user identity."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-27T20:00:00.000Z
CVE-2008-7101 
Unspecified vulnerability in DotNetNuke 4.0 through 4.8.4 and 5.0 allows remote attackers to obtain sensitive information (portal number) by accessing the install wizard page via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-27T20:00:00.000Z
CVE-2008-7102 
DotNetNuke 2.0 through 4.8.4 allows remote attackers to load .ascx files instead of skin files, and possibly access privileged functionality, via unknown vectors related to parameter validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-27T20:00:00.000Z
CVE-2008-7103 
Stack-based buffer overflow in an ActiveX control in najdisitoolbar.dll in Najdi.si Toolbar 2.0.4.1 allows remote attackers to cause a denial of service (browser crash) or execute arbitrary code via a long Document.Location property value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-27T20:00:00.000Z
CVE-2008-7104 
Sophos PureMessage Scanner service (PMScanner.exe) in PureMessage for Microsoft Exchange 3.0 before 3.0.2 allows remote attackers to cause a denial of service (message queue delay and incomplete spam rule update) via a crafted (1) RTF or (2) PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-27T20:00:00.000Z
CVE-2008-7105 
Sophos PureMessage for Microsoft Exchange 3.0 before 3.0.2 allows remote attackers to cause a denial of service (EdgeTransport.exe termination) via a TNEF-encoded message with a crafted rich text body that is not properly handled during conversion to plain text.  NOTE: this might be related to CVE-2008-7104.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-27T20:00:00.000Z
CVE-2008-7106 
The installation of Sophos PureMessage for Microsoft Exchange 3.0 before 3.0.2, when both anti-virus and anti-spam are supported, does not create or launch the associated scan engines when the system is under heavy load, which has unspecified impact, probably remote bypass of scanner protection or a denial of service (message loss or delay).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-27T20:00:00.000Z
CVE-2008-7107 
easdrv.sys in ESET Smart Security 3.0.667.0 allows local users to cause a denial of service (crash) via a crafted IOCTL 0x222003 request to the \\.\easdrv device interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-28T15:00:00.000Z
CVE-2008-7108 
Multiple cross-site scripting (XSS) vulnerabilities in Carmosa phpCart 3.4 through 4.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) quantity or (2) Add Engraving fields to the default URI; (3) Quantity field to phpcart.php; (4) Name, (5) Company, (6) Address, (7) City, and (8) Province/State fields in a checkout action to phpcart.php; and other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-28T15:00:00.000Z
CVE-2008-7109 
The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 allows remote attackers to bypass authorization and upload arbitrary files to the client system via a modified program that does not prompt the user for a password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-28T15:00:00.000Z
CVE-2008-7110 
Directory traversal vulnerability in the Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 allows remote attackers to upload files to arbitrary locations via a .. (dot dot) in a request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-28T15:00:00.000Z
CVE-2008-7111 
The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 does not restrict the filenames or extensions of uploaded files, which makes it easier for remote attackers to execute arbitrary code or overwrite files by leveraging CVE-2008-7110 and CVE-2008-7109.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-28T15:00:00.000Z
CVE-2008-7112 
The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 allows remote attackers to cause a denial of service (hang or crash) via invalid field length values in a malformed (1) document or (2) request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-28T15:00:00.000Z
CVE-2008-7113 
The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 uses a small space of predictable user identification numbers for access control, which allows remote attackers to upload documents via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-28T15:00:00.000Z
CVE-2008-7114 
SQL injection vulnerability in members_search.php in iFusion Services iFdate 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-28T15:00:00.000Z
CVE-2008-7115 
The web interface to the Belkin Wireless G router and ADSL2 modem F5D7632-4V6 with firmware 6.01.08 allows remote attackers to bypass authentication and gain administrator privileges via a direct request to (1) statusprocess.exe, (2) system_all.exe, or (3) restore.exe in cgi-bin/.  NOTE: the setup_dns.exe vector is already covered by CVE-2008-1244.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-28T15:00:00.000Z
CVE-2008-7116 
SQL injection vulnerability in the admin panel (admin/) in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-28T15:00:00.000Z
CVE-2008-7117 
eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets (CSS) files via a certain request with the file parameter set to style.css.  NOTE: this can probably be leveraged for cross-site scripting (XSS) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-28T15:00:00.000Z
CVE-2008-7118 
WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain SQL query logs via a direct request for logs/cron.log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-28T15:00:00.000Z
CVE-2008-7119 
SQL injection vulnerability in item.php in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-28T15:00:00.000Z
CVE-2008-7120 
SQL injection vulnerability in Mr. CGI Guy Hot Links SQL-PHP 3 and earlier allows remote attackers to execute arbitrary SQL commands via the news.php parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-28T15:00:00.000Z
CVE-2008-7121 
Cross-site scripting (XSS) vulnerability in Mr. CGI Guy Hot Links SQL-PHP 3 and earlier allows remote attackers to inject arbitrary web script or HTML via the search bar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-28T15:00:00.000Z
CVE-2008-7122 
Multiple insecure method vulnerabilities in an ActiveX control in (epRegPro.ocx) in Evans Programming Registry Pro allow remote attackers to read and modify sensitive registry keys via the (1) About, (2) CreateKey, (3) DeleteBranch, (4) DeleteKey, (5) DeleteValue, (6) EnumKeys, (7) EnumValues, (8) QueryType, (9) QueryValue, (10) RenameKey, and (11) SetValue methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-31T10:00:00.000Z
CVE-2008-7123 
Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attackers to inject arbitrary PHP code into fichiers/config.php via a null byte (%00) in the login parameter in an ajout action, which bypasses the regular expression check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-31T10:00:00.000Z
CVE-2008-7124 
zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allows remote attackers to gain administrator privileges via a direct request, as demonstrated by adding a new administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-31T10:00:00.000Z
CVE-2008-7125 
pphoto in Ariadne before 2.6 allows remote authenticated users with certain privileges to execute arbitrary shell commands via vectors related to PINP programs and the annotate command.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-31T10:00:00.000Z
CVE-2008-7126 
Integer overflow in osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet with a large string length value to UDP port 14000, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-31T10:00:00.000Z
CVE-2008-7127 
osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of service (crash) via a crafted packet with a large string length value to UDP port 14000, which triggers a memory allocation failure that is not properly handled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-31T10:00:00.000Z
CVE-2008-7128 
The ssl_parse_client_key_exchange function in XySSL before 0.9 does not protect against certain Bleichenbacher attacks using chosen ciphertext, which allows remote attackers to recover keys via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-31T10:00:00.000Z