rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-0541 
WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback service calls with a source URI that corresponds to a local pathname, which triggers different fault codes for existing and non-existing files, and in certain configurations causes a brief file excerpt to be published as a blog comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T17:00:00.000Z
CVE-2007-0542 
Cross-site scripting (XSS) vulnerability in show.php in 212cafe Guestbook 4.00 beta allows remote attackers to inject arbitrary web script or HTML via the user parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T17:00:00.000Z
CVE-2007-0543 
ZixForum 1.14 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for Zixforum.mdb.  NOTE: a followup post suggests that this issue only occurs if the administrator does not properly follow installation directions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T17:00:00.000Z
CVE-2007-0544 
Cross-site scripting (XSS) vulnerability in private.php in MyBB (aka MyBulletinBoard) allows remote authenticated users to inject arbitrary web script or HTML via the Subject field, a different vector than CVE-2006-2949.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T17:00:00.000Z
CVE-2007-0545 
Maxtricity Tagger 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for tagger.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T17:00:00.000Z
CVE-2007-0546 
Toxiclab Shoutbox 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T17:00:00.000Z
CVE-2007-0547 
Cross-site scripting (XSS) vulnerability in CGI-RESCUE WebFORM 4.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T17:00:00.000Z
CVE-2007-0548 
KarjaSoft Sami HTTP Server 2.0.1 allows remote attackers to cause a denial of service (daemon hang) via a large number of requests for nonexistent objects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T17:00:00.000Z
CVE-2007-0549 
Cross-site scripting (XSS) vulnerability in list3.php in 212cafeBoard 6.30 Beta allows remote attackers to inject arbitrary web script or HTML via the user parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T17:00:00.000Z
CVE-2007-0550 
Cross-site scripting (XSS) vulnerability in search.php in 212cafeBoard 0.08 Beta allows remote attackers to inject arbitrary web script or HTML via keyword parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T17:00:00.000Z
CVE-2007-0551 
Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pth[file][config] and (2) pth[file][image] parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T17:00:00.000Z
CVE-2007-0552 
Cross-site scripting (XSS) vulnerability in install/default/error404.html in Oh no! Not another CMS (Onnac) 0.0.8.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the error_url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T17:00:00.000Z
CVE-2007-0553 
Multiple cross-site scripting (XSS) vulnerabilities in index.inc.php in PHProxy before 0.5 beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) data[realm] and (2) _url parameters, different vectors than CVE-2004-2604.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T17:00:00.000Z
CVE-2007-0554 
SQL injection vulnerability in print.asp in Guo Xu Guos Posting System (GPS) 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T17:00:00.000Z
CVE-2007-0555 
PostgreSQL 7.3 before 7.3.13, 7.4 before 7.4.16, 8.0 before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2 allows attackers to disable certain checks for the data types of SQL function arguments, which allows remote authenticated users to cause a denial of service (server crash) and possibly access database content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-06T01:00:00.000Z
CVE-2007-0556 
The query planner in PostgreSQL before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2 does not verify that a table is compatible with a "previously made query plan," which allows remote authenticated users to cause a denial of service (server crash) and possibly access database content via an "ALTER COLUMN TYPE" SQL statement, which can be leveraged to read arbitrary memory from the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-06T01:00:00.000Z
CVE-2007-0557 
rMake before 1.0.4 drops root privileges in a way that retains the original supplemental groups, which might allow attackers to gain privileges via a crafted recipe file, a different vulnerability than CVE-2007-0536.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T22:00:00.000Z
CVE-2007-0558 
PHP remote file inclusion vulnerability in modules/mail/main.php in Inter7 vHostAdmin 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the MODULES_DIR parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T16:00:00.000Z
CVE-2007-0559 
PHP remote file inclusion vulnerability in config.php in RPW 1.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the sql_language parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T16:00:00.000Z
CVE-2007-0560 
SQL injection vulnerability in user.asp in ASP EDGE 1.2b and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T16:00:00.000Z
CVE-2007-0561 
Multiple PHP remote file inclusion vulnerabilities in Xero Portal 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) admin_linkdb.php, (2) admin_forum_prune.php, (3) admin_extensions.php, (4) admin_board.php, (5) admin_attachments.php, or (6) admin_users.php in admin/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T16:00:00.000Z
CVE-2007-0562 
Windows Explorer (explorer.exe) 6.0.2900.2180 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted .avi file, which triggers the crash when the user right clicks on the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T16:00:00.000Z
CVE-2007-0563 
Multiple cross-site scripting (XSS) vulnerabilities in Symantec Web Security (SWS) before 3.0.1.85 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) error messages and (2) blocked page messages produced by SWS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T16:00:00.000Z
CVE-2007-0564 
The license registering interface in Symantec Web Security (SWS) before 3.0.1.85 allows attackers to cause a denial of service (CPU consumption) by submitting a large file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T16:00:00.000Z
CVE-2007-0565 
CGI-Rescue Shopping Basket Professional 7.50 and earlier allows remote attackers to inject arbitrary operating system commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T16:00:00.000Z
CVE-2007-0566 
SQL injection vulnerability in news_detail.asp in ASP NEWS 3 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T16:00:00.000Z
CVE-2007-0567 
Cross-site scripting (XSS) vulnerability in admin.php in Interactive-Scripts.Com PHP Membership Manager 1.5 allows remote attackers to inject arbitrary web script or HTML via the _p parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0568 
PHP remote file inclusion vulnerability in system/lib/package.php in MyPHPCommander 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the gl_root parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0569 
SQL injection vulnerability in xNews.php in xNews 1.3 allows remote attackers to execute arbitrary SQL commands via the id parameter in a shownews action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0570 
PHP remote file inclusion vulnerability in ains_main.php in Johannes Gijsbers (aka Taradino) Ad Fundum Integratable News Script (AINS) 0.02b allows remote attackers to execute arbitrary PHP code via a URL in the ains_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0571 
PHP remote file inclusion vulnerability in include/lib/lib_head.php in phpMyReports 3.0.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cfgPathModule parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0572 
PHP remote file inclusion vulnerability in include/irc/phpIRC.php in Drunken:Golem Gaming Portal 0.5.1 Alpha 2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0573 
PHP remote file inclusion vulnerability in includes/config.inc.php in nsGalPHP 0.41 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the racineTBS parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0574 
SQL injection vulnerability in rss/show_webfeed.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.40 allows remote attackers to execute arbitrary SQL commands via the wcHeadlines parameter, a different vector than CVE-2006-4715.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0575 
Multiple SQL injection vulnerabilities in the administrative login page (admin/login.asp) in ASPCode.net AdMentor allow remote attackers to execute arbitrary SQL commands via the (1) Userid and (2) Password fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0576 
PHP remote file inclusion vulnerability in xt_counter.php in Xt-Stats 2.3.x up to 2.4.0.b3 allows remote attackers to execute arbitrary PHP code via a URL in the server_base_dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0577 
PHP remote file inclusion vulnerability in function.inc.php in ACGVclick 0.2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0578 
The http_open function in httpget.c in mpg123 before 0.64 allows remote attackers to cause a denial of service (infinite loop) by closing the HTTP connection early.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0579 
Unspecified vulnerability in the calendar component in Horde Groupware Webmail Edition before 1.0, and Groupware before 1.0, allows remote attackers to include certain files via unspecified vectors.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0580 
PHP remote file inclusion vulnerability in menu.php in Foro Domus 2.10 allows remote attackers to execute arbitrary PHP code via a URL in the sesion_idioma parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0581 
PHP remote file inclusion vulnerability in functions.php in EclipseBB 0.5.0 Lite allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0582 
SQL injection vulnerability in default.asp in ChernobiLe 1.0 allows remote attackers to execute arbitrary SQL commands via the User (username) field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0583 
Multiple cross-site scripting (XSS) vulnerabilities in HTTP Commander 6.0, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) LogoffMessage parameter to logofflast.aspx or the (2) txtUsername parameter to Default.aspx. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0584 
PHP remote file inclusion vulnerability in membres/membreManager.php in PhP Generic Library & Framework for comm (g-neric) allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0585 
include/debug.php in Webfwlog 0.92 and earlier, when register_globals is enabled, allows remote attackers to obtain source code of files via the conffile parameter.  NOTE: some of these details are obtained from third party information.  It is likely that this issue can be exploited to conduct directory traversal attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0588 
The InternalUnpackBits function in Apple QuickDraw, as used by Quicktime 7.1.3 and other applications on Mac OS X 10.4.8 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PICT file that triggers memory corruption in the _GetSrcBits32ARGB function. NOTE: this issue might overlap CVE-2007-0462.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T18:00:00.000Z
CVE-2007-0589 
SQL injection vulnerability in Forum Livre 1.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to info_user.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T18:00:00.000Z
CVE-2007-0590 
Cross-site scripting (XSS) vulnerability in busca2.asp in Forum Livre 1.0 remote attackers to inject arbitrary web script or HTML via the palavra parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T18:00:00.000Z
CVE-2007-0591 
PHP remote file inclusion vulnerability in configure.php in Vu Le An Virtual Path (VirtualPath) 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T18:00:00.000Z
CVE-2007-0592 
Cross-site scripting (XSS) vulnerability in EzDatabase 2.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to admin/login.php and the Admin Panel Database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T18:00:00.000Z
CVE-2007-0593 
Siteman 1.1.11 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing password hashes via a direct request for data/members.txt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T18:00:00.000Z
CVE-2007-0594 
Siteman 2.0.x2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing password hashes via a direct request for db/siteman/users.MYD.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T18:00:00.000Z
CVE-2007-0595 
Cross-site scripting (XSS) vulnerability in search in High 5 Review Site allows remote attackers to inject arbitrary web script or HTML via the q parameter (aka the search box).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T18:00:00.000Z
CVE-2007-0596 
PHP remote file inclusion vulnerability in index/main.php in Aztek Forum 4.00 allows remote authenticated administrators to execute arbitrary PHP code via a URL in the PF[top_url] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T18:00:00.000Z
CVE-2007-0597 
Aztek Forum 4.00 allows remote attackers to obtain sensitive information via a direct request to forum.php with the fid=XD query string, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T18:00:00.000Z
CVE-2007-0598 
SQL injection vulnerability in forum/load.php in Aztek Forum 4.00 allows remote attackers to execute arbitrary SQL commands via the fid cookie to forum.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T18:00:00.000Z
CVE-2007-0599 
Variable overwrite vulnerability in common/config.php in Aztek Forum 4.00 allows remote attackers to overwrite arbitrary program variables and conduct other unauthorized activities, such as copying arbitrary files using index/common_actions.php, via vectors associated with extract operations on the (1) POST, (2) GET, (3) COOKIE, and (4) SERVER superglobal arrays.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T18:00:00.000Z
CVE-2007-0600 
SQL injection vulnerability in news_page.asp in Martyn Kilbryde Newsposter Script (aka makit news/blog poster) 3 and earlier allows remote attackers to execute arbitrary SQL commands via the uid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T18:00:00.000Z
CVE-2007-0601 
common/safety.php in Aztek Forum 4.00 allows remote attackers to enter certain data containing %22 sequences (URL encoded double quotes) and other potentially dangerous manipulations by sending a cookie, which bypasses the blacklist matching against the GET and PUT superglobal arrays.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T18:00:00.000Z
CVE-2007-0602 
Buffer overflow in libvsapi.so in the VSAPI library in Trend Micro VirusWall 3.81 for Linux, as used by IScan.BASE/vscan, allows local users to gain privileges via a long command line argument, a different vulnerability than CVE-2005-0533.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T18:00:00.000Z
CVE-2007-0603 
PGP Desktop before 9.5.1 does not validate data objects received over the (1) \pipe\pgpserv named pipe for PGPServ.exe or the (2) \pipe\pgpsdkserv named pipe for PGPsdkServ.exe, which allows remote authenticated users to gain privileges by sending a data object representing an absolute pointer, which causes code execution at the corresponding address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T18:00:00.000Z
CVE-2007-0604 
Cross-site scripting (XSS) vulnerability in Movable Type (MT) before 3.34 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the MTCommentPreviewIsStatic tag, which can open the "comment entry screen," a different vulnerability than CVE-2007-0231.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T18:00:00.000Z
CVE-2007-0605 
Cross-site scripting (XSS) vulnerability in picture.php in Advanced Guestbook 2.4.2 allows remote attackers to inject arbitrary web script or HTML via the picture parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T17:00:00.000Z
CVE-2007-0606 
w-agora 4.2.1 allows remote attackers to obtain sensitive information by via the (1) bn[] array parameter to index.php, which expects a string, and (2) certain parameters to delete_forum.php, which displays the path name in the resulting error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-21T19:00:00.000Z
CVE-2007-0607 
W-Agora (Web-Agora) 4.2.1, when register_globals is enabled, stores globals.inc under the web document root with insufficient access control, which allows remote attackers to obtain application path information via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-20T20:00:00.000Z
CVE-2007-0608 
Advanced Guestbook 2.4.2 allows remote attackers to obtain sensitive information via an invalid (1) GB_TBL parameter to (a) lang/codes-english.php or (b) image.php, which reveal the database name; (2) an invalid GB_DB parameter to index.php, coupled with a ../index lang cookie, which reveals the installation path; or (3) a direct request to index.php with no parameters or cookies, which reveals the installation path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T17:00:00.000Z
CVE-2007-0609 
Directory traversal vulnerability in Advanced Guestbook 2.4.2 allows remote attackers to bypass .htaccess settings, and execute arbitrary PHP local files or read arbitrary local templates, via a .. (dot dot) in a lang cookie, followed by a filename without its .php extension, as demonstrated via a request to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T17:00:00.000Z
CVE-2007-0610 
Cross-site scripting (XSS) vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-31T01:00:00.000Z