rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-5988 
Unspecified vulnerability in Windows 2000 Advanced Server SP4 running Active Directory allows remote attackers to cause a denial of service via unknown vectors, as demonstrated by a certain VulnDisco Pack module.  NOTE: the provenance of this information is unknown; the details are obtained from third party information. As of 20061116, this disclosure has no actionable information. However, since the VulnDisco Pack author is a reliable researcher, the disclosure is being assigned a CVE identifier for tracking purposes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-20T21:00:00.000Z
CVE-2006-5989 
Off-by-one error in the der_get_oid function in mod_auth_kerb 5.0 allows remote attackers to cause a denial of service (crash) via a crafted Kerberos message that triggers a heap-based buffer overflow in the component array.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-20T21:00:00.000Z
CVE-2006-5990 
VMWare VirtualCenter client 2.x before 2.0.1 Patch 1 (Build 33643) and 1.4.x before 1.4.1 Patch 1 (Build 33425), when server certificate verification is enabled, does not verify the server's X.509 certificate when creating an SSL session, which allows remote malicious servers to spoof valid servers via a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T01:00:00.000Z
CVE-2006-5991 
Multiple SQL injection vulnerabilities in wwweb concepts CactuShop allow remote attackers to execute arbitrary SQL commands via the (1) prodtype parameter in prodtype.asp and the (2) product parameter in product.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T02:00:00.000Z
CVE-2006-5994 
Unspecified vulnerability in Microsoft Word 2000 and 2002, Office Word and Word Viewer 2003, Word 2004 and 2004 v. X for Mac, and Works 2004, 2005, and 2006 allows remote attackers to execute arbitrary code via a Word document with a malformed string that triggers memory corruption, a different vulnerability than CVE-2006-6456.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-06T20:00:00.000Z
CVE-2006-6007 
save_profile.asp in WebEvents (Online Event Registration Template) 2.0 and earlier allows remote attackers to change the profiles, passwords, and other information for arbitrary users via a modified UserID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6008 
ftpd in Linux Netkit (linux-ftpd) 0.17, and possibly other versions, does not check the return status of certain seteuid, setgid, and setuid calls, which might allow remote authenticated users to gain privileges if these calls fail in cases such as PAM failures or resource limits, a different vulnerability than CVE-2006-5778.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6009 
Unspecified vulnerability in the Java Runtime Environment (JRE) Swing library in JDK and JRE 5.0 Update 7 and earlier allows attackers to obtain certain information via unknown attack vectors, related to an untrusted applet accessing data in other applets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6010 
SAP allows remote attackers to obtain potentially sensitive information such as operating system and SAP version via an RFC_SYSTEM_INFO RfcCallReceive request, a different vulnerability than CVE-2003-0747.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6011 
Unspecified vulnerability in SAP Web Application Server before 6.40 patch 6 allows remote attackers to cause a denial of service (enserver.exe crash) via a certain UDP packet to port 64999, aka "two bytes UDP crash," a different vulnerability than CVE-2006-5785.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6012 
Cross-site scripting (XSS) vulnerability in csm/asp/listings.asp in MGinternet Car Site Manager (CSM) allows remote attackers to inject arbitrary web script or HTML via the p parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6013 
Integer signedness error in the fw_ioctl (FW_IOCTL) function in the FireWire (IEEE-1394) drivers (dev/firewire/fwdev.c) in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115, NetBSD-current before 20061116, NetBSD-4 before 20061203, and TrustedBSD, allows local users to read arbitrary memory contents via certain negative values of crom_buf->len in an FW_GCROM command. NOTE: this issue has been labeled as an integer overflow, but it is more like an integer signedness error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6014 
The NetBSD-current kernel before 20061028 does not properly perform bounds checking of an unspecified userspace parameter in the ptrace system call during a PT_DUMPCORE request, which allows local users to have an unknown impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6015 
Buffer overflow in the JavaScript implementation in Safari on Apple Mac OS X 10.4 allows remote attackers to cause a denial of service (application crash) via a long argument to the exec method of a regular expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6016 
wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified user_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6017 
WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of service (application crash) via a string that represents a (1) malformed or (2) large serialized object, because the object triggers automatic unserialization for display.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6018 
PHP remote file inclusion vulnerability in mybic_server.php in Jim Plush My-BIC 0.6.5 allows remote attackers to execute arbitrary PHP code via a URL in the INC_PATH parameter, a different vector than CVE-2006-5089.  NOTE: this issue is disputed by CVE and third party researchers because INC_PATH is a constant
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6019 
Cross-site scripting (XSS) vulnerability in extensions/googiespell/googlespell_proxy.php in Bill Roberts Bloo 1.0 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6020 
Cross-site scripting (XSS) vulnerability in announce.php in Blog Torrent Preview 0.92 allows remote attackers to inject arbitrary web script or HTML via the left parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6021 
SQL injection vulnerability in the login component in BestWebApp Dating Site allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6022 
Cross-site scripting (XSS) vulnerability in login_form.asp in BestWebApp Dating Site allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6023 
PHP remote file inclusion vulnerability in phoo.base.php in Bill Roberts Bloo 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the descriptorFileList parameter.  NOTE: this issue is disputed by CVE since $descriptorFileList is used in a function definition within phoo.base.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6024 
Multiple buffer overflows in Eudora Worldmail, possibly Worldmail 3 version 6.1.22.0, have unknown impact and attack vectors, as demonstrated by the (1) "Eudora WorldMail stack overflow" and (2) "Eudora WorldMail heap overflow" modules in VulnDisco Pack.  NOTE: Some of these details are obtained from third party information. As of 20061118, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6025 
QUALCOMM Eudora WorldMail 4.0 allows remote attackers to cause a denial of service, as demonstrated by a certain module in VulnDisco Pack.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. As of 20061118, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6026 
Heap-based buffer overflow in Real Networks Helix Server and Helix Mobile Server before 11.1.3, and Helix DNA Server 11.0 and 11.1, allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a DESCRIBE request that contains an invalid LoadTestPassword field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6027 
Adobe Reader (Adobe Acrobat Reader) 7.0 through 7.0.8 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long argument string to the LoadFile method in an AcroPDF ActiveX control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6028 
Directory traversal vulnerability in textview.php in Anton Vlasov DoSePa 1.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) sequence or absolute file path in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6029 
SQL injection vulnerability in vir_Login.asp in Property Pro 1.0 allows remote attackers to execute arbitrary SQL commands via the UserName field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6030 
Multiple SQL injection vulnerabilities in E-Calendar Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd (Password) fields in (a) admin/default.asp; or the (3) Event Title, (4) Location, or (5) Description field when making a search engine query in (b) search.asp.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6031 
Multiple SQL injection vulnerabilities in Greater Cincinnati Internet Solutions (GCIS) ASPCart allow remote attackers to execute arbitrary SQL commands via (1) the prodid parameter in (a) prodetails.asp; (2) the page parameter in (b) display.asp; the (3) custid, (4) item, (5) price, (6) custom, (7) department, (8) start, (9) quantity, (10) submit, (11) custom1, (12) custom2, or (13) custom3 parameters in (c) addcart.asp; or the (14) customerid parameter in (d) payment.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6032 
Multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog (SPHPBlog), probably 0.4.8, allow remote attackers to inject arbitrary web script or HTML via (1) the action parameter in add_block.php or (2) the entry parameter in index.php, different vectors than CVE-2005-1135.  NOTE: this has been reported to affect 0.8, but as of 20061121, the most recent version is only 0.4.9.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6033 
Multiple directory traversal vulnerabilities in Simple PHP Blog (SPHPBlog), probably 0.4.8, allow remote attackers to read arbitrary files and possibly include arbitrary PHP code via a .. (dot dot) sequence in the blog_theme parameter in (1) index.php, (2) add_cgi.php, (3) add_link.php, (4) login.php, (5) template.php, or (6) contact.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6034 
Multiple SQL injection vulnerabilities in SitesOutlet E-commerce Kit-1 PayPal Edition allow remote attackers to execute arbitrary SQL commands via the (1) keyword or (2) cid parameter in (a) catalogue.asp, or the (3) pid parameter in (b) viewDetail.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-21T23:00:00.000Z
CVE-2006-6035 
Cross-site scripting (XSS) vulnerability in list.php in BLOG:CMS 4.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the FADDR parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6036 
SQL injection vulnerability in OpenHuman before 1.0 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6037 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Dan Jensen Travelsized CMS 0.4.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) page, (2) page_id, or (3) language parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6038 
SQL injection vulnerability in editpoll.php in Powie's PHP Forum (pForum) 1.29a and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6039 
SQL injection vulnerability in matchdetail.php in Powie's PHP MatchMaker 4.05 and earlier allows remote attackers to execute arbitrary SQL commands via the edit parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6040 
Multiple cross-site scripting (XSS) vulnerabilities in admincp/index.php in Jelsoft vBulletin 3.6.x allow remote attackers to inject arbitrary web script or HTML via (1) the prefs parameter in a buildnavprefs action or (2) the navprefs parameter in a savenavprefs action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6041 
Multiple PHP remote file inclusion vulnerabilities in Laurent Van den Reysen WORK system e-commerce 3.0.2, and other versions before 3.0.4, allow remote attackers to execute arbitrary PHP code via a URL in the g_include parameter to (1) index.php, (2) module/forum/forum.php, (3) unspecified files under module/, and (4) unspecified files under administration/module/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6042 
PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the editor_insert_bottom parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6043 
PHP file inclusion vulnerability in loginform-inc.php in Oliver (formerly Webshare) 1.2.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the conf[motdfile] parameter, which is accessed by the file_exists function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6044 
PHP remote file inclusion vulnerability in gallery_top.inc.php in PHPQuickGallery 1.9 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the textFile parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6045 
Multiple PHP remote file inclusion vulnerabilities in Comdev One Admin Pro 4.1 allow remote attackers to execute arbitrary PHP code via a URL in the path[skin] parameter to (1) adminfoot.php, (2) adminhead.php, or (3) adminlogin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6046 
Multiple cross-site scripting (XSS) vulnerabilities in eggblog 3.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) edit parameter to (a) admin/articles.php or (b) admin/comments.php, or the (2) add parameter to admin/users.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6047 
Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the f parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6048 
SQL injection vulnerability in index.php in Etomite CMS 0.6.1.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6049 
PHP remote file inclusion vulnerability in shambo2.php in the Shambo2 (com_shambo2) component for Mambo 4.5 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6050 
Multiple SQL injection vulnerabilities in ClickTech Texas Rank'em allow remote attackers to execute arbitrary SQL commands via the (1) selPlayer parameter to player.asp or the (2) tournament_id parameter to tournaments.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6051 
PHP remote file inclusion vulnerability in reporter.logic.php in the MosReporter (com_reporter) component for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6052 
NetEpi Case Manager before 0.98 generates different error messages depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T00:00:00.000Z
CVE-2006-6053 
The ext3fs_dirhash function in Linux kernel 2.6.x allows local users to cause a denial of service (crash) via an ext3 stream with malformed data structures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T01:00:00.000Z
CVE-2006-6054 
The ext2 file system code in Linux kernel 2.6.x allows local users to cause a denial of service (crash) via an ext2 stream with malformed data structures that triggers an error in the ext2_check_page due to a length that is smaller than the minimum.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T01:00:00.000Z
CVE-2006-6055 
Stack-based buffer overflow in A5AGU.SYS 1.0.1.41 for the D-Link DWL-G132 wireless adapter allows remote attackers to execute arbitrary code via a 802.11 beacon request with a long Rates information element (IE).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T01:00:00.000Z
CVE-2006-6056 
Linux kernel 2.6.x up to 2.6.18 and possibly other versions, when SELinux hooks are enabled, allows local users to cause a denial of service (crash) via a malformed file stream that triggers a NULL pointer dereference in the superblock_doinit function, as demonstrated using an HFS filesystem image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T01:00:00.000Z
CVE-2006-6057 
The Linux kernel 2.6.x up to 2.6.18, and possibly other versions, on Fedora Core 6 and possibly other operating systems, allows local users to cause a denial of service (crash) via a malformed gfs2 file stream that triggers a NULL pointer dereference in the init_journal function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T01:00:00.000Z
CVE-2006-6058 
The minix filesystem code in Linux kernel 2.6.x before 2.6.24, including 2.6.18, allows local users to cause a denial of service (hang) via a malformed minix file stream that triggers an infinite loop in the minix_bmap function.  NOTE: this issue might be due to an integer overflow or signedness error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T01:00:00.000Z
CVE-2006-6059 
Buffer overflow in MA521nd5.SYS driver 5.148.724.2003 for NetGear MA521 PCMCIA adapter allows remote attackers to execute arbitrary code via (1) beacon or (2) probe 802.11 frame responses with an long supported rates information element.  NOTE: this issue was reported as a "memory corruption" error, but the associated exploit code suggests that it is a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T01:00:00.000Z
CVE-2006-6060 
The NTFS filesystem code in Linux kernel 2.6.x up to 2.6.18, and possibly other versions, allows local users to cause a denial of service (CPU consumption) via a malformed NTFS file stream that triggers an infinite loop in the __find_get_block_slow function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T01:00:00.000Z
CVE-2006-6061 
com.apple.AppleDiskImageController in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to execute arbitrary code via a malformed DMG image that triggers memory corruption.  NOTE: the severity of this issue has been disputed by a third party, who states that the impact is limited to a denial of service (kernel panic) due to a vm_fault call with a non-aligned address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T01:00:00.000Z
CVE-2006-6062 
Unspecified vulnerability in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a malformed UDTO HFS+ disk image, such as with "bad sectors," which triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T01:00:00.000Z