rainbutterfly/cve_corpus huggingface dataset:
CVE-2005-4819 
Cross-site scripting (XSS) vulnerability in Lotus Domino versions before 6.5.4 fix pack 1 (FP1) and versions before 7.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-29T11:00:00.000Z
CVE-2005-4820 
SMC Wireless Router model SMC7904WBRA allows remote attackers to cause a denial of service (reboot) by flooding the router with traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-29T11:00:00.000Z
CVE-2005-4821 
Multiple SQL injection vulnerabilities in Land Down Under (LDU) v801 and earlier allow remote attackers to execute arbitrary SQL commands via parameters including (1) the m parameter in auth.php, (2) the f parameter in events.php, or (3) the e parameter in plug.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-29T11:00:00.000Z
CVE-2005-4822 
SQL injection vulnerability in projects/project-edit.asp in Digger Solutions Intranet Open Source (IOS) version 2.7.2 allows remote attackers to execute arbitrary SQL commands via the project_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-29T11:00:00.000Z
CVE-2005-4823 
Buffer overflow in the HP HTTP Server 5.0 through 5.95 of the HP Web-enabled Management Software allows remote attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-12T01:00:00.000Z
CVE-2005-4824 
PHP remote file inclusion vulnerability in web/classes.php in Siteframe before 3.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the LOCAL_PATH parameter, a different vulnerability than CVE-2005-1965.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-24T01:00:00.000Z
CVE-2005-4825 
Cisco Clean Access 3.5.5 and earlier on the Secure Smart Manager allows remote attackers to bypass authentication and cause a denial of service (disk consumption), or make unauthorized files accessible, by uploading files through requests to certain JSP scripts, a related issue to CVE-2005-4332.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T16:00:00.000Z
CVE-2005-4826 
Unspecified vulnerability in the VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(22)EA3 on Catalyst 2950T switches allows remote attackers to cause a denial of service (device reboot) via a crafted Subset-Advert message packet, a different issue than CVE-2006-4774, CVE-2006-4775, and CVE-2006-4776.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-31T11:00:00.000Z
CVE-2005-4827 
Internet Explorer 6.0, and possibly other versions, allows remote attackers to bypass the same origin security policy and make requests outside of the intended domain by calling open on an XMLHttpRequest object (Microsoft.XMLHTTP) and using tab, newline, and carriage return characters within the first argument (method name), which is supported by some proxy servers that convert tabs to spaces.  NOTE: this issue can be leveraged to conduct referer spoofing, HTTP Request Smuggling, and other attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-07T20:00:00.000Z
CVE-2005-4828 
Kolab Server 2.0.0 and 2.0.1 does not properly handle when a large email is sent with a "." in the wrong place, which causes kolabfilter to add another ".", which might break clear-text signatures and attachments.  NOTE: it is not clear whether this issue crosses privilege boundaries, so this might not be a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T11:00:00.000Z
CVE-2005-4829 
VirtueMart before 1.0.1 does not properly handle errors when a user is forbidden to read a requested page, which has unknown impact and remote attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-26T17:00:00.000Z
CVE-2005-4830 
CRLF injection vulnerability in viewcvs in ViewCVS 0.9.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the content-type parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2005-4831 
viewcvs in ViewCVS 0.9.2 allows remote attackers to set the Content-Type header to arbitrary values via the content-type parameter, which can be leveraged for cross-site scripting (XSS) and other attacks, as demonstrated using (1) "text/html", or (2) "image/jpeg" with an image that is rendered as HTML by Internet Explorer, a different vulnerability than CVE-2004-1062.  NOTE: it was later reported that 0.9.4 is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T19:00:00.000Z
CVE-2005-4832 
SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the (1) SYS.DBMS_CDC_SUBSCRIBE and (2) SYS.DBMS_CDC_ISUBSCRIBE packages, a different vector than CVE-2005-1197.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-03T20:00:00.000Z
CVE-2005-4833 
IBM WebSphere Application Server (WAS) 6.0 before 20050201, when serving pages in an Application WAR or an Extended Document Root, allows remote attackers to obtain the JSP source code and other sensitive information via "a specific JSP URL," related to lack of normalization of the URL format.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-20T10:00:00.000Z
CVE-2005-4834 
IBM WebSphere Application Server (WAS) 5.0.2.5 through 5.1.1.3 allows remote attackers to obtain JSP source code and other sensitive information, related to incorrect request processing by the web container.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-20T10:00:00.000Z
CVE-2005-4835 
The ath_rate_sample function in the ath_rate/sample/sample.c sample code in MadWifi before 0.9.3 allows remote attackers to cause a denial of service (failed KASSERT and system crash) by moving a connected system to a location with low signal strength, and possibly other vectors related to a race condition between interface enabling and packet transmission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T01:00:00.000Z
CVE-2005-4836 
The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T22:00:00.000Z
CVE-2005-4837 
snmp_api.c in snmpd in Net-SNMP 5.2.x before 5.2.2, 5.1.x before 5.1.3, and 5.0.x before 5.0.10.2, when running in master agentx mode, allows remote attackers to cause a denial of service (crash) by causing a particular TCP disconnect, which triggers a free of an incorrect variable, a different vulnerability than CVE-2005-2177.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-10T23:00:00.000Z
CVE-2005-4838 
Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-25T21:00:00.000Z
CVE-2005-4839 
PureTLS before 0.9b5 does not clear optional Extensions and Algorithm.Parameters values before parsing, which might trigger an information leak of values from earlier certificates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T20:00:00.000Z
CVE-2005-4840 
The Outlook Express Address Book control, when using Internet Explorer 6, allows remote attackers to cause a denial of service (NULL dereference and browser crash) by creating the OutlookExpress.AddressBook COM object, which is not intended for use within Internet Explorer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-07T21:00:00.000Z
CVE-2005-4841 
The Outlook Progress Ctl control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-11T18:00:00.000Z
CVE-2005-4842 
The System Monitor Source Properties control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-11T18:00:00.000Z
CVE-2005-4843 
The SmartConnect Class control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-11T18:00:00.000Z
CVE-2005-4844 
The CLSID_ApprenticeICW control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-11T18:00:00.000Z
CVE-2005-4845 
The Java Plug-in 1.4.2_03 and 1.4.2_04 controls, and the 1.4.2_03 and 1.4.2_04 <applet> redirector controls, allow remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet Explorer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-11T18:00:00.000Z
CVE-2005-4846 
Format string vulnerability in Logger.cc for Spey 0.3.3 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in a syslog call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T22:00:00.000Z
CVE-2005-4847 
Unspecified vulnerability in Spey 0.3.3 has unknown impact and attack vectors related to "A number of security holes which could lead to compromise," a different issue than CVE-2005-4846.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T22:00:00.000Z
CVE-2005-4848 
Buffer overflow in the decompression algorithm in Research in Motion BlackBerry Enterprise Server 4.0 SP1 and earlier before 20050607 might allow remote attackers to execute arbitrary code via certain data packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-29T18:00:00.000Z
CVE-2005-4849 
Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2005-4850 
eZ publish 3.5 through 3.7 before 20050608 requires both edit and create permissions in order to submit data, which allows remote attackers to edit data submitted by arbitrary anonymous users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2005-4851 
eZ publish 3.4.4 through 3.7 before 20050722 applies certain permissions on the node level, which allows remote authenticated users to bypass the original permissions on embedded objects in XML fields and read these objects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2005-4852 
The siteaccess URIMatching implementation in eZ publish 3.5 through 3.8 before 20050812 converts all non-alphanumeric characters in a URI to '_' (underscore), which allows remote attackers to bypass access restrictions by inserting certain characters in a URI, as demonstrated by a request for /admin:de, which matches a rule allowing only /admin_de to access /admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2005-4853 
The default configuration of the forum package in eZ publish 3.5 before 3.5.5, 3.6 before 3.6.2, 3.7 before 3.7.0rc2, and 3.8 before 20050818 does not restrict edit permissions to a posting's owner, which allows remote authenticated users to edit arbitrary postings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2005-4854 
eZ publish 3.5 through 3.7 before 20050830 does not use a folder's read permissions to restrict notifications, which allows remote authenticated users to obtain sensitive information about changes to content in arbitrary folders.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2005-4855 
Unrestricted file upload vulnerability in eZ publish 3.5 before 3.5.5, 3.6 before 3.6.2, 3.7 before 3.7.0rc2, and 3.8 before 20050922 does not restrict Image datatype uploads to image content types, which allows remote authenticated users to upload certain types of files, as demonstrated by .js files, which may enable cross-site scripting (XSS) attacks or other attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2005-4856 
The admin interface in eZ publish 3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051110 does not properly handle authorization errors, which allows remote attackers to obtain sensitive information and see the admin pagelayout and associated templates via a request with (1) "anything after the url" or (2) a "wrong url".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2005-4857 
eZ publish 3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051128 allows remote authenticated users to cause a denial of service (Apache httpd segmentation fault) via a request to content/advancedsearch.php with an empty SearchContentClassID parameter, reportedly related to a "memory addressing error".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2005-4858 
Multiple cross-site scripting (XSS) vulnerabilities in mimic2.cgi in mimicboard2 (Mimic2) 086 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters associated with the (1) name, (2) title, and (3) comment sections, as demonstrated by referencing a remote document through the SRC attribute of an IFRAME element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2005-4859 
mimicboard2 (Mimic2) 086 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for mimic2.dat.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2005-4860 
Spectrum Cash Receipting System before 6.504 uses weak cryptography (static substitution) in the PASSFILE password file, which makes it easier for local users to gain privileges by decrypting a password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-08T01:52:00.000Z
CVE-2005-4861 
functions.php in Ragnarok Online Control Panel (ROCP) 4.3.4a allows remote attackers to bypass authentication by requesting account_manage.php with a trailing "/login.php" PHP_SELF value, which is not properly handled by the CHECK_AUTH function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-05T19:00:00.000Z
CVE-2005-4862 
The search functionality in XWiki 0.9.793 indexes cleartext user passwords, which allows remote attackers to obtain sensitive information via a search string that matches a password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-14T00:00:00.000Z
CVE-2005-4863 
Stack-based buffer overflow in db2fmp in IBM DB2 7.x and 8.1 allows local users to execute arbitrary code via a long parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-06T21:00:00.000Z
CVE-2005-4864 
Stack-based buffer overflow in libdb2.so in IBM DB2 7.x and 8.1 allows local users to execute arbitrary code via a long DB2LPORT environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-06T21:00:00.000Z
CVE-2005-4865 
Stack-based buffer overflow in call in IBM DB2 7.x and 8.1 allows remote attackers to execute arbitrary code via a long libname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-06T21:00:00.000Z
CVE-2005-4866 
Stack-based buffer overflow in JDBC Applet Server in IBM DB2 8.1 allows remote attackers to execute arbitrary by connecting and sending a long username, then disconnecting gracefully and reconnecting and sending a short username and an unexpected db2java.zip version, which causes a null terminator to be removed and leads to the overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-06T21:00:00.000Z
CVE-2005-4867 
Stack-based buffer overflow in the SATENCRYPT function in IBM DB2 8.1, when Satellite Administration (SATADMIN) is enabled, allows remote attackers to execute arbitrary code via a long parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-06T21:00:00.000Z
CVE-2005-4868 
Shared memory sections and events in IBM DB2 8.1 have default permissions of read and write for the Everyone group, which allows local users to gain unauthorized access, gain sensitive information, such as cleartext passwords, and cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-06T21:00:00.000Z
CVE-2005-4869 
The (1) to_char and (2) to_date function in IBM DB2 8.1 allows local users to cause a denial of service (application crash) via an empty string in the second parameter, which causes a null pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-06T21:00:00.000Z
CVE-2005-4870 
Stack-based buffer overflows in the (1) xmlvarcharfromfile, (2) xmlclobfromfile, (3) xmlfilefromvarchar, and (4) xmlfilefromclob function calls in IBM DB2 8.1 allow remote attackers to execute arbitrary code via a 94-byte second argument, which causes the return address to be overwritten with a pointer to the argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-06T21:00:00.000Z
CVE-2005-4871 
Certain XML functions in IBM DB2 8.1 run with the privileges of DB2 instead of the logged-in user, which allows remote attackers to create or overwrite files via (1) XMLFileFromVarchar or (2) XMLFileFromClob, or read files via (3) XMLVarcharFromFile or (4) XMLClobFromFile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-06T21:00:00.000Z
CVE-2005-4872 
Perl-Compatible Regular Expression (PCRE) library before 6.2 does not properly count the number of named capturing subpatterns, which allows context-dependent attackers to cause a denial of service (crash) via a regular expression with a large number of named subpatterns, which triggers a buffer overflow.  NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-14T21:00:00.000Z
CVE-2005-4873 
Multiple stack-based buffer overflows in the phpcups PHP module for CUPS 1.1.23rc1 might allow context-dependent attackers to execute arbitrary code via vectors that result in long function parameters, as demonstrated by the cups_get_dest_options function in phpcups.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-24T10:00:00.000Z
CVE-2005-4874 
The XMLHttpRequest object in Mozilla 1.7.8 supports the HTTP TRACE method, which allows remote attackers to obtain (1) proxy authentication passwords via a request with a "Max-Forwards: 0" header or (2) arbitrary local passwords on the web server that hosts this object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-03-28T23:00:00.000Z
CVE-2005-4875 
TYPO3 3.8.0 and earlier allows remote attackers to obtain sensitive information via a direct request to misc/phpcheck/, which invokes the phpinfo function and prints values of unspecified environment variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-05-19T10:00:00.000Z
CVE-2005-4876 
Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.2.2, and possibly other versions before 2.3.0 Beta 2, allows remote attackers to inject arbitrary web script or HTML via the username parameter, a different vulnerability than CVE-2005-4877.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-14T22:00:00.000Z
CVE-2005-4877 
Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.3.0 Beta 2 allows remote attackers to inject arbitrary web script or HTML via Javascript events in the username parameter, a different vulnerability than CVE-2005-4876.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-14T22:00:00.000Z
CVE-2005-4878 
Multiple cross-site scripting (XSS) vulnerabilities in (1) acid_qry_main.php in Analysis Console for Intrusion Databases (ACID) 0.9.6b20 and (2) base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.2, and unspecified other console scripts in these products, allow remote attackers to inject arbitrary web script or HTML via the sig[1] parameter and possibly other parameters, a different vulnerability than CVE-2007-6156.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-18T20:00:00.000Z
CVE-2005-4879 
Multiple cross-site scripting (XSS) vulnerabilities in jax_guestbook.php in Jax Guestbook 3.1 and 3.31 allow remote attackers to inject arbitrary web script or HTML via the (1) gmt_ofs and (2) language parameters.  NOTE: the page parameter is already covered by CVE-2006-1913.  NOTE: it was later reported that 3.50 is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T17:00:00.000Z