rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-6484 
SQL injection vulnerability in login.php in Mole Group Taxi Map Script (aka Taxi Calc Dist Script) allows remote attackers to execute arbitrary SQL commands via the user field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-18T15:00:00.000Z
CVE-2008-6485 
SQL injection vulnerability in index.php in SoftComplex PHP Image Gallery allows remote attackers to execute arbitrary SQL commands via the ctg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-18T15:00:00.000Z
CVE-2008-6486 
PHP remote file inclusion vulnerability in slideshow_uploadvideo.content.php in SharedLog, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[root_dir] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-18T15:00:00.000Z
CVE-2008-6487 
Multiple SQL injection vulnerabilities in login.asp in Digiappz DigiAffiliate 1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) admin and (2) password fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-18T15:00:00.000Z
CVE-2008-6488 
SQL injection vulnerability in index.php in SoftComplex PHP Image Gallery 1.0 allows remote attackers to execute arbitrary SQL commands via the Admin field in a login action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-18T15:00:00.000Z
CVE-2008-6489 
SQL injection vulnerability in MyAlbum component (com_myalbum) 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the album parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-19T10:00:00.000Z
CVE-2008-6490 
function/update_xml.php in FLABER 1.1 and earlier allows remote attackers to overwrite arbitrary files by specifying the target filename in the target_file parameter.  NOTE: this can be leveraged for code execution by overwriting a PHP file, as demonstrated using function/upload_file.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-19T10:00:00.000Z
CVE-2008-6491 
PHP remote file inclusion vulnerability in connexion.php in PHPGKit 0.9 allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-19T10:00:00.000Z
CVE-2008-6492 
Unrestricted file upload vulnerability in process.php in Tizag Countdown Creator 3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via index.php, then accessing the uploaded file via a direct request to the file in pics/. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-20T00:00:00.000Z
CVE-2008-6493 
Easy Content Management Publishing stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for Database/News.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-20T00:00:00.000Z
CVE-2008-6494 
ASP User Engine.NET stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for users.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-20T00:00:00.000Z
CVE-2008-6495 
Cross-site scripting (XSS) vulnerability in index.php in Fritz Berger yet another php photo album - next generation (yappa-ng) 2.3.2 allows remote attackers to inject arbitrary web script or HTML via the album parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-20T00:00:00.000Z
CVE-2008-6496 
Insecure method vulnerability in the VSPDFEditorX.VSPDFEdit ActiveX control in VSPDFEditorX.ocx 1.0.200.0 in VISAGESOFT eXPert PDF EditorX allows remote attackers to create or overwrite arbitrary files via the first argument to the extractPagesToFile method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-20T00:00:00.000Z
CVE-2008-6497 
The Neostrada Livebox ADSL Router allows remote attackers to cause a denial of service (network outage) via multiple HTTP requests for the /- URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-20T00:00:00.000Z
CVE-2008-6498 
Cross-site request forgery (CSRF) vulnerability in security/xamppsecurity.php in XAMPP 1.6.8 allows remote attackers to hijack the authentication of users for requests that change a certain .htaccess password via the xampppasswd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-20T00:00:00.000Z
CVE-2008-6499 
security/xamppsecurity.php in XAMPP 1.6.8 performs an extract operation on the SERVER superglobal array, which allows remote attackers to spoof critical variables, as demonstrated by setting the REMOTE_ADDR variable to 127.0.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-20T00:00:00.000Z
CVE-2008-6500 
Cross-site scripting (XSS) vulnerability in CodeToad ASP Shopping Cart Script allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-20T18:00:00.000Z
CVE-2008-6501 
Cross-site scripting (XSS) vulnerability in profiles/index.php in Pro Chat Rooms 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the gud parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-20T18:00:00.000Z
CVE-2008-6502 
Directory traversal vulnerability in Pro Chat Rooms 3.0.2 allows remote authenticated users to select an arbitrary local PHP script as an avatar via a .. (dot dot) in the avatar parameter, and cause other users to execute this script by using sendData.php to send a message to (1) an individual user or (2) a room, leading to cross-site request forgery (CSRF), cross-site scripting (XSS), or other impacts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-20T18:00:00.000Z
CVE-2008-6503 
Multiple cross-site scripting (XSS) vulnerabilities in PrestaShop 1.1.0.3 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) admin/login.php and (2) order.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-20T18:00:00.000Z
CVE-2008-6504 
ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-23T14:00:00.000Z
CVE-2008-6505 
Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-23T14:00:00.000Z
CVE-2008-6506 
Unspecified vulnerability in phpBB before 3.0.4 allows attackers to bypass intended access restrictions and activate de-activated accounts via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-23T16:00:00.000Z
CVE-2008-6507 
Unspecified vulnerability in phpBB before 3.0.4 allows attackers to obtain sensitive information via unknown vectors related to the lack of password prompts for a private message that quotes a post in a password-protected forum.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-23T16:00:00.000Z
CVE-2008-6508 
Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. (dot dot) in a URI that matches the Exclude-Strings list, as demonstrated by a /setup/setup-/.. sequence in a URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-23T19:26:00.000Z
CVE-2008-6509 
SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execute arbitrary SQL commands via the type parameter to sipark-log-summary.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-23T19:26:00.000Z
CVE-2008-6510 
Cross-site scripting (XSS) vulnerability in login.jsp in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-23T19:26:00.000Z
CVE-2008-6511 
Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-23T19:26:00.000Z
CVE-2008-6512 
Cross-domain vulnerability in the WorkerPool API in Google Gears before 0.5.4.2 allows remote attackers to bypass the Same Origin Policy and the intended access restrictions of the allowCrossOrigin function by hosting an assumed-safe file type containing Google Gear commands on the target domain, then accessing that file from the attacking domain, whose response headers are not checked and cause the worker code to run in the target domain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-24T14:00:00.000Z
CVE-2008-6513 
Unrestricted file upload vulnerability in saa.php in Andy's PHP Knowledgebase (aphpkb) 0.92.9 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a link that is listed by authors.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-24T14:00:00.000Z
CVE-2008-6514 
The Expo plugin in Compiz Fusion 0.7.8 allows local users with physical access to drag the screen saver aside and access the locked desktop by using Expo mouse shortcuts, a related issue to CVE-2007-3920.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-24T14:00:00.000Z
CVE-2008-6515 
Cross-site scripting (XSS) vulnerability in Fritz Berger yet another php photo album - next generation (yappa-ng) allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-24T14:00:00.000Z
CVE-2008-6516 
Multiple directory traversal vulnerabilities in phpKF-Portal 1.10 allow remote attackers to include arbitrary files via a .. (dot dot) in the (1) tema_dizin parameter to baslik.php and (2) portal_ayarlarportal_dili parameter to anket_yonetim.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T18:00:00.000Z
CVE-2008-6517 
SQL injection vulnerability in NewsHOWLER 1.03 Beta allows remote attackers to execute arbitrary SQL commands via the news_user cookie parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T18:00:00.000Z
CVE-2008-6518 
Unrestricted file upload vulnerability in the profile feature in VidiScript allows registered remote authenticated users to execute arbitrary code by uploading a PHP file as an Avatar, then accessing the avatar via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T18:00:00.000Z
CVE-2008-6519 
Format string vulnerability in Xitami Web Server 2.2a through 2.5c2, and possibly other versions, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in a Long Running Web Process (LRWP) request, which triggers incorrect logging code involving the sendfmt function in the SMT kernel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T18:00:00.000Z
CVE-2008-6520 
Multiple format string vulnerabilities in the SSI filter in Xitami Web Server 2.5c2, and possibly other versions, allow remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in a URI that ends in (1) .ssi, (2) .shtm, or (3) .shtml, which triggers incorrect logging code involving the sendfmt function in the SMT kernel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T18:00:00.000Z
CVE-2008-6521 
index.php in Terracotta (aka OpenTerracotta) 0.6.1 allows remote attackers to obtain sensitive information via an invalid File parameter, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T18:00:00.000Z
CVE-2008-6522 
Multiple directory traversal vulnerabilities in the RenderFile function in ContentRender.class.php in Terracotta (aka OpenTerracotta) 0.6.1, and possibly other versions, allow remote attackers to list arbitrary directories and read arbitrary files via a .. (dot dot) in the (1) CurrentDirectory and (2) File parameters to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T18:00:00.000Z
CVE-2008-6523 
auth.php in openInvoice 0.90 beta and earlier allows remote attackers to bypass authentication and gain privileges by setting the oiauth cookie.  NOTE: this can be leveraged with a separate vulnerability in resetpass.php to modify passwords for arbitrary users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T18:00:00.000Z
CVE-2008-6524 
resetpass.php in openInvoice 0.90 beta and earlier allows remote authenticated users to change the passwords of arbitrary users via a modified uid parameter.  NOTE: this can be leveraged with a separate vulnerability in auth.php to modify passwords without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T18:00:00.000Z
CVE-2008-6525 
SQL injection vulnerability in the Admin Panel in Nice PHP FAQ Script (Knowledge base Script) allows remote attackers to execute arbitrary SQL commands via the Password parameter (aka the pass field).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T18:00:00.000Z
CVE-2008-6526 
SQL injection vulnerability in index.php in BosDev BosClassifieds allows remote attackers to execute arbitrary SQL commands via the cat_id parameter, a different vector than CVE-2008-1838.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T18:00:00.000Z
CVE-2008-6527 
SQL injection vulnerability in forum.asp in GO4I.NET ASP Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the iFor parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T18:00:00.000Z
CVE-2008-6528 
NTFS TmaxSoft JEUS 5 before Fix 26 allows remote attackers to read the source code for scripts by appending ::$DATA to the URL, which accesses the alternate data stream.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-26T14:00:00.000Z
CVE-2008-6529 
Cross-site scripting (XSS) vulnerability in listtest.php in eZoneScripts Living Local 1.1 allows remote attackers to inject arbitrary web script or HTML via the r parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-26T20:28:00.000Z
CVE-2008-6530 
Unrestricted file upload vulnerability in editimage.php in eZoneScripts Living Local 1.1 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the uploaded file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-26T20:28:00.000Z
CVE-2008-6531 
The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-26T20:28:00.000Z
CVE-2008-6532 
Multiple cross-site request forgery (CSRF) vulnerabilities in the update feature in Drupal 5.x before 5.13 and 6.x before 6.7 allow remote attackers to perform unauthorized actions as the superuser via unspecified vectors, as demonstrated by causing the superuser to "execute old updates" that modify the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-26T20:28:00.000Z
CVE-2008-6533 
Drupal 5.x before 5.13 and 6.x before 6.7 does not delete all related content when an input format is deleted, which prevents the content from being properly filtered and allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-26T20:28:00.000Z
CVE-2008-6534 
Incomplete blacklist vulnerability in NULL FTP Server Free and Pro 1.1.0.7 allows remote authenticated users to execute arbitrary commands via a custom SITE command containing shell metacharacters such as "&" (ampersand) in the middle of an argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-26T20:28:00.000Z
CVE-2008-6535 
admin/settings.php in PayPal eStores allows remote attackers to bypass intended access restrictions and change the administrative password via a direct request with a modified NewAdmin parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-26T20:28:00.000Z
CVE-2008-6536 
Unspecified vulnerability in 7-zip before 4.5.7 has unknown impact and remote attack vectors, as demonstrated by the PROTOS GENOME test suite for Archive Formats (c10).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T01:00:00.000Z
CVE-2008-6537 
LightNEasy/lightneasy.php in LightNEasy No database version 1.2 allows remote attackers to obtain the hash of the administrator password via the setup "do" action to LightNEasy.php, which is cleared from $_GET but later accessed using $_REQUEST.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T01:00:00.000Z
CVE-2008-6538 
DeStar 0.2.2-5 allows remote attackers to add arbitrary users via a direct request to config/add/CfgOptUser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T01:00:00.000Z
CVE-2008-6539 
Static code injection vulnerability in user/settings/ in DeStar 0.2.2-5 allows remote authenticated users to add arbitrary administrators and inject arbitrary Python code into destar_cfg.py via a crafted pin parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T01:00:00.000Z
CVE-2008-6540 
DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T01:00:00.000Z
CVE-2008-6541 
Unrestricted file upload vulnerability in the file manager module in DotNetNuke before 4.8.2 allows remote administrators to upload arbitrary files and gain privileges to the server via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T01:00:00.000Z
CVE-2008-6542 
Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side execution of application logic" by uploading a static file that is converted into a dynamic script via unknown vectors related to HTM or HTML files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T01:00:00.000Z
CVE-2008-6543 
Multiple PHP remote file inclusion vulnerabilities in ComScripts TEAM Quick Classifieds 1.0 via the DOCUMENT_ROOT parameter to (1) index.php3, (2) locate.php3, (3) search_results.php3, (4) classifieds/index.php3, and (5) classifieds/view.php3; (6) index.php3, (7) manager.php3, (8) pass.php3, (9) remember.php3 (10) sign-up.php3, (11) update.php3, (12) userSet.php3, and (13) verify.php3 in controlcenter/; (14) alterCats.php3, (15) alterFeatured.php3, (16) alterHomepage.php3, (17) alterNews.php3, (18) alterTheme.php3, (19) color_help.php3, (20) createdb.php3, (21) createFeatured.php3, (22) createHomepage.php3, (23) createL.php3, (24) createM.php3, (25) createNews.php3, (26) createP.php3, (27) createS.php3, (28) createT.php3, (29) index.php3, (30) mailadmin.php3, and (31) setUp.php3 in controlpannel/; (32) include/sendit.php3 and (33) include/sendit2.php3; and possibly (34) include/adminHead.inc, (35) include/usersHead.inc, and (36) style/default.scheme.inc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T01:00:00.000Z
CVE-2008-6544 
Multiple PHP remote file inclusion vulnerabilities in Simple Machines Forum (SMF) 1.1.4 allow remote attackers to execute arbitrary PHP code via a URL in the (1) settings[default_theme_dir] parameter to Sources/Subs-Graphics.php and (2) settings[default_theme_dir] parameter to Sources/Themes.php.  NOTE: CVE and multiple third parties dispute this issue because the files contain a protection mechanism against direct request
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T01:00:00.000Z
CVE-2008-6545 
PHP remote file inclusion vulnerability in news/include/createdb.php in Web Server Creator Web Portal 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the langfile parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T01:00:00.000Z
CVE-2008-6546 
Unspecified vulnerability in phpns before 2.1.3 has unknown impact and attack vectors related to "activation permissions."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T01:00:00.000Z
CVE-2008-6547 
schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass intended access restrictions via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T01:00:00.000Z