rainbutterfly/cve_corpus huggingface dataset:
CVE-2005-2642 
Buffer overflow in the mutt_decode_xbit function in Handler.c for Mutt 1.5.10 allows remote attackers to execute arbitrary code, possibly due to interactions with libiconv or gettext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-21T04:00:00.000Z
CVE-2005-2643 
Tor 0.1.0.13 and earlier, and experimental versions 0.1.1.4-alpha and earlier, does not reject certain weak keys when using ephemeral Diffie-Hellman (DH) handshakes, which allows malicious Tor servers to obtain the keys that a client uses for other systems in the circuit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-21T04:00:00.000Z
CVE-2005-2644 
Buffer overflow in JaguarEditControl.dll in Isemarket JaguarControl allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long Jtext field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-21T04:00:00.000Z
CVE-2005-2645 
Unknown vulnerability in Xerox MicroServer Web Server in Document Centre 220 through 265, 332 and 340, 420 through 490, and 535 through 555 allows remote attackers to bypass authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-21T04:00:00.000Z
CVE-2005-2646 
Unknown vulnerability in Xerox MicroServer Web Server in Document Centre 220 through 265, 332 and 340, 420 through 490, and 535 through 555 allows remote attackers to cause a denial of service or read files via unknown vectors involving crafted HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-21T04:00:00.000Z
CVE-2005-2647 
Cross-site scripting (XSS) vulnerability in Xerox MicroServer Web Server in Document Centre 220 through 265, 332 and 340, 420 through 490, and 535 through 555 allows remote attackers to inject arbitrary web script or HTML and modify web pages via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-21T04:00:00.000Z
CVE-2005-2648 
Directory traversal vulnerability in index.php in W-Agora 4.2.0 and earlier allows remote attackers to read arbitrary files via the site parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-21T04:00:00.000Z
CVE-2005-2649 
Cross-site scripting (XSS) vulnerability in ATutor 1.5.1 allows remote attackers to inject arbitrary web script or HTML via (1) course parameter in login.php or (2) words parameter in search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-21T04:00:00.000Z
CVE-2005-2650 
Cross-site scripting (XSS) vulnerability in sign.asp in Emefa Guestbook 1.2 allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) location, and (3) email parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-21T04:00:00.000Z
CVE-2005-2651 
gorum/prod.php in Zorum 3.5 allows remote attackers to execute arbitrary code via shell metacharacters in the argv parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-21T04:00:00.000Z
CVE-2005-2652 
Zorum 3.5 allows remote attackers to obtain the full installation path via direct requests to (1) gorum/notification.php, (2) user.php, (3) attach.php, (4) blacklist.php, (5) zorum/forum.php, (6) globalstat.php, (7) gorum/trace.php, (8) gorum/badwords.php, or (9) gorum/flood.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-21T04:00:00.000Z
CVE-2005-2653 
Cross-site scripting (XSS) vulnerability in BBCaffe 2.0 allows remote attackers to inject arbitrary web script or HTML via e-mail data in a message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-21T04:00:00.000Z
CVE-2005-2654 
phpldapadmin before 0.9.6c allows remote attackers to gain anonymous access to the LDAP server, even when disable_anon_bind is set, via an HTTP request to login.php with the anonymous_bind parameter set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-30T04:00:00.000Z
CVE-2005-2655 
lockmail in maildrop before 1.5.3 does not drop privileges before executing commands, which allows local users to gain privileges via command line arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-30T04:00:00.000Z
CVE-2005-2656 
Polygen before 1.0.6 generates precompiled grammar objects with world-writable permissions, which allows local users to cause a denial of service (disk consumption) and possibly perform other unauthorized activities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-06T04:00:00.000Z
CVE-2005-2657 
Unknown vulnerability in common-lisp-controller 4.18 and earlier allows local users to gain privileges by compiling arbitrary code in the cache directory, which is executed by another user if the user has not run Common Lisp before.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-16T04:00:00.000Z
CVE-2005-2658 
Buffer overflow in utility.cpp in Turquoise SuperStat (turqstat) 2.2.4 and earlier might allow remote NNTP servers to execute arbitrary code via a date with a long month.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-15T04:00:00.000Z
CVE-2005-2659 
Buffer overflow in the LZX decompression in CHM Lib (chmlib) 0.35, as used in products such as KchmViewer, has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-16T07:37:00.000Z
CVE-2005-2660 
apachetop 0.12.5 and earlier, when running in debug mode, allows local users to create or append to arbitrary files via a symlink attack on atop.debug.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-30T04:00:00.000Z
CVE-2005-2661 
Format string vulnerability in the ParseBannerAndCapability function in main.c for up-imapproxy 1.2.3 and 1.2.4 allows remote IMAP servers to execute arbitrary code via format string specifiers in a banner or capability line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-14T04:00:00.000Z
CVE-2005-2662 
masqmail before 0.2.18 allows remote attackers to execute arbitrary commands via crafted e-mail addresses that are not properly sanitized when creating a failed delivery message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-21T04:00:00.000Z
CVE-2005-2663 
masqmail before 0.2.18 allows local users to overwrite arbitrary files via a symlink attack on a log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-21T04:00:00.000Z
CVE-2005-2664 
Whisper 32 1.16, and possibly earlier versions, stores passwords in plaintext in memory, which allows local users to obtain the password using a debugger or another mechanism to read process memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-22T04:00:00.000Z
CVE-2005-2665 
Stack-based buffer overflow in expires.c in Elm 2.5 PL5 through PL7, and possibly other versions, allows remote attackers to execute arbitrary code via an e-mail message with a long Expires header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2666 
SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2667 
Unknown vulnerability in Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05, 1.07 before Build 220_13, and 1.11 before Build 29_13 allows attackers to cause a denial of service via unknown vectors, aka the "CAM TCP port vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2668 
Multiple buffer overflows in Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05, 1.07 before Build 220_13, and 1.11 before Build 29_13 allow remote attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2669 
Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05, 1.07 before Build 220_13, and 1.11 before Build 29_13 allows remote attackers to execute arbitrary commands via spoofed CAFT packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2670 
Directory traversal vulnerability in HAURI Anti-Virus products including ViRobot Expert 4.0, Advanced Server, Linux Server 2.0, and LiveCall allows remote attackers to overwrite arbitrary files via ".." sequences in filenames contained in (1) ACE, (2) ARJ, (3) CAB, (4) LZH, (5) RAR, (6) TAR and (7) ZIP files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2672 
pwmconfig in LM_sensors before 2.9.1 creates temporary files insecurely, which allows local users to overwrite arbitrary files via a symlink attack on the fancontrol temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2673 
SQL injection vulnerability in modcp.php in WoltLab Burning Board 2.2.2 and 2.3.3 allows remote authenticated attackers to execute arbitrary SQL commands via the (1) x or (2) y parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2674 
Note: the vendor has disputed this issue. Multiple cross-site scripting (XSS) vulnerabilities in Land Down Under (LDU) 800 allow remote attackers to inject arbitrary web script or HTML via the (1) c or (2) m parameters to index.php or (3) w parameter to journal.php.  NOTE: this issue has been disputed by the vendor, who says "None of the tricks written there are working, the variables are properly sanitized and no LDU version is affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2675 
Note: the vendor has disputed this issue. Multiple SQL injection vulnerabilities in Land Down Under (LDU) 800 allow remote attackers to execute arbitrary SQL commands via the (1) s or (2) m parameter to forums.php, (3) o, (4) w, (5) s, or (6) p parameter to list.php, (7) m parameter to journal.php, (8) x or (9) n parameter to forums.php, or (10) w parameter to links.php.  NOTE: this issue has been disputed by the vendor, who says "None of the tricks written there are working, the variables are properly sanitized and no LDU version is affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2676 
Cross-site scripting (XSS) vulnerability in displayimage.php in Coppermine Photo Gallery before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via EXIF data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2677 
ACNews stores the database in a file under the web document root with a db.inc extension and insufficient access control, which allows remote attackers to obtain sensitive information such as the full pathname of the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2678 
Microsoft IIS 5.1 and 6 allows remote attackers to spoof the SERVER_NAME variable to bypass security checks and conduct various attacks via a GET request with an http://localhost URI, which makes it appear as if the request is coming from localhost.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2679 
Buffer overflow in Sysinternals Process Explorer 9.23, and other versions before 9.25, allows local users to execute arbitrary code via a long CompanyName field in the VersionInfo information in a running process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2680 
Unspecified vulnerability in BEA WebLogic Portal 8.1 through SP4, when using entitlements, allows remote attackers to bypass access restrictions for the pages of a Book via crafted URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2681 
Unspecified vulnerability in the command line processing (CLI) logic in Cisco Intrusion Prevention System 5.0(1) and 5.0(2) allows local users with OPERATOR or VIEWER privileges to gain additional privileges via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2682 
aspell_setup.php in the SpellChecker plugin in DTLink AreaEdit before 0.4.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the dictionary parameter (aka the lang variable).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2683 
Multiple SQL injection vulnerabilities in PHPKit 1.6.1 allow remote attackers to execute arbitrary SQL commands via the (1) letter parameter to login/member.php or (2) im_receiver parameter to login/imcenter.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2684 
nquser.php in Virtual Edge Netquery 3.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the host parameter to a dig query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-23T04:00:00.000Z
CVE-2005-2685 
SaveWebPortal 3.4 allows remote attackers to execute arbitrary PHP code via a direct request to admin/PhpMyExplorer/editerfichier.php, then editing the desired file to contain the PHP code, as demonstrated using header.php in the fichier parameter.  NOTE: it is possible that this vulnerability stems from PhpMyExplorer, which is a separate package.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-24T04:00:00.000Z
CVE-2005-2686 
Directory traversal vulnerability in SaveWebPortal 3.4 allows remote attackers to include arbitrary files and execute arbitrary local PHP programs via ".." sequences in the (1) SITE_Path parameter to menu_dx.php or (2) CONTENTS_Dir parameter to menu_sx.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-24T04:00:00.000Z
CVE-2005-2687 
PHP remote file inclusion vulnerability in SaveWebPortal 3.4 allows remote attackers to execute arbitrary PHP code via the (1) SITE_Path parameter to menu_dx.php or (2) CONTENTS_Dir parameter to menu_sx.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-24T04:00:00.000Z
CVE-2005-2688 
Multiple cross-site scripting (XSS) vulnerabilities in SaveWebPortal 3.4 allow remote attackers to inject arbitrary web script or HTML via a large number of parameters to (1) footer.php, (2) header.php, (3) menu_dx.php, or (4) menu_sx.php, or Javascript code in the (5) HTTP_REFERER (referer) or (6) HTTP_USER_AGENT (user agent) fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-24T04:00:00.000Z
CVE-2005-2689 
Multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.760-RC4b allows remote attackers to inject arbitrary web script or HTML via (1) the moderate parameter to the Comments module or (2) htmltext parameter to html/user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-24T04:00:00.000Z
CVE-2005-2690 
SQL injection vulnerability in the Downloads module in PostNuke 0.760-RC4b allows PostNuke administrators to execute arbitrary SQL commands via the show parameter to dl-viewdownload.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-24T04:00:00.000Z
CVE-2005-2691 
includes/common.php in RunCMS 1.2 and earlier calls the extract function with EXTR_OVERWRITE on HTTP POST variables, which allows remote attackers to overwrite arbitrary variables, possibly allowing execution of arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-24T04:00:00.000Z
CVE-2005-2692 
Multiple SQL injection vulnerabilities in RunCMS 1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) addquery and (2) subquery parameters to the newbb plus module, the forum parameter to (3) newtopic.php, (4) edit.php, or (5) reply.php in the newbb plus module, or (6) the msg_id parameter to print.php in the messages module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-24T04:00:00.000Z
CVE-2005-2693 
cvsbug in CVS 1.12.12 and earlier creates temporary files insecurely, which allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-25T04:00:00.000Z
CVE-2005-2694 
Buffer overflow in WinAce 2.6.0.5, and possibly earlier versions, allows remote attackers to execute arbitrary code via a temporary (.tmp) file that contains an entry with a long file name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-25T04:00:00.000Z
CVE-2005-2695 
Unspecified vulnerability in the SSL certificate checking functionality in Cisco CiscoWorks Management Center for IDS Sensors (IDSMC) 2.0 and 2.1, and Monitoring Center for Security (Security Monitor or Secmon) 1.1 through 2.0 and 2.1, allows remote attackers to spoof a Cisco Intrusion Detection Sensor (IDS) or Intrusion Prevention System (IPS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-25T04:00:00.000Z
CVE-2005-2696 
IBM Lotus Notes does not properly restrict access to password hashes in the Notes Address Book (NAB), which allows remote attackers to obtain sensitive information via the (1) password digest field in the Administration tab of a Lotus Notes client, (2) "PasswordDigest" and "HTTPPassword" fields in the document properties in the NAB, or (3) a direct query to the Domino LDAP server, a different vulnerability than CVE-2005-2428.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-25T04:00:00.000Z
CVE-2005-2697 
SQL injection vulnerability in search.php for MyBulletinBoard (MyBB) 1.00 Release Candidate 1 through 4 allows remote attackers to execute arbitrary SQL commands via the uid parameter.  NOTE: this issue might overlap CVE-2005-0282.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-25T04:00:00.000Z
CVE-2005-2698 
Cross-site scripting (XSS) vulnerability in browse.php in Nephp Publisher Enterprise 3.04 allows remote attackers to inject arbitrary web script or HTML via a hex-encoded keywords parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-25T04:00:00.000Z
CVE-2005-2699 
Unrestricted file upload vulnerability in admin/admin.php in PHPKit 1.6.1 allows remote authenticated administrators to execute arbitrary PHP code by uploading a .php file to the content/images/ directory using images.php.  NOTE: if a PHPKit administrator must already have access to the end system to install or modify configuration of the product, then this issue might not cross privilege boundaries, and should not be included in CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-25T04:00:00.000Z
CVE-2005-2700 
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-06T04:00:00.000Z
CVE-2005-2701 
Heap-based buffer overflow in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to execute arbitrary code via an XBM image file that ends in a large number of spaces instead of the expected end tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-23T04:00:00.000Z
CVE-2005-2702 
Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Unicode sequences with "zero-width non-joiner" characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-23T04:00:00.000Z
CVE-2005-2703 
Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to modify HTTP headers of XML HTTP requests via XMLHttpRequest, and possibly use the client to exploit vulnerabilities in servers or proxies, including HTTP request smuggling and HTTP request splitting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-23T04:00:00.000Z
CVE-2005-2704 
Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to spoof DOM objects via an XBL control that implements an internal XPCOM interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-23T04:00:00.000Z
CVE-2005-2705 
Integer overflow in the JavaScript engine in Firefox before 1.0.7 and Mozilla Suite before 1.7.12 might allow remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-23T04:00:00.000Z
CVE-2005-2706 
Firefox before 1.0.7 and Mozilla before Suite 1.7.12 allows remote attackers to execute Javascript with chrome privileges via an about: page such as about:mozilla.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-23T04:00:00.000Z
CVE-2005-2707 
Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to spawn windows without user interface components such as the address and status bar, which could be used to conduct spoofing or phishing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-09-23T04:00:00.000Z
CVE-2005-2708 
The search_binary_handler function in exec.c in Linux 2.4 kernel on 64-bit x86 architectures does not check a return code for a particular function call when virtual memory is low, which allows local users to cause a denial of service (panic), as demonstrated by running a process using the bash ulimit -v command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-25T04:00:00.000Z
CVE-2005-2709 
The sysctl functionality (sysctl.c) in Linux kernel before 2.6.14.1 allows local users to cause a denial of service (kernel oops) and possibly execute code by opening an interface file in /proc/sys/net/ipv4/conf/, waiting until the interface is unregistered, then obtaining and modifying function pointers in memory that was used for the ctl_table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-20T22:00:00.000Z