rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-3395 
Calacode @Mail 5.41 on Linux uses weak world-readable permissions for (1) webmail/libs/Atmail/Config.php and (2) webmail/webadmin/.htpasswd, which allows local users to obtain sensitive information by reading these files.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T16:00:00.000Z
CVE-2008-3396 
Unreal Tournament 2004 (UT2004) 3369 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a certain sequence of malformed packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T16:00:00.000Z
CVE-2008-3397 
Cross-site scripting (XSS) vulnerability in Runesoft Cerberus CMS before 3_1.4_0.9 allows remote attackers to inject arbitrary web script or HTML via a cerberus_user cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T16:00:00.000Z
CVE-2008-3398 
Multiple cross-site scripting (XSS) vulnerabilities in XRMS CRM 1.99.2 allow remote attackers to inject arbitrary web script or HTML via the msg parameter to unspecified components, possibly including login.php. NOTE: this may overlap CVE-2008-1129.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T16:00:00.000Z
CVE-2008-3399 
PHP remote file inclusion vulnerability in activities/workflow-activities.php in XRMS CRM 1.99.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the include_directory parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T16:00:00.000Z
CVE-2008-3400 
XRMS CRM 1.99.2 allows remote attackers to obtain configuration information via a direct request to tests/info.php, which calls the phpinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T16:00:00.000Z
CVE-2008-3401 
PHP remote file inclusion vulnerability in hioxRandomAd.php in HIOX Random Ad (HRA) 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the hm parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T16:00:00.000Z
CVE-2008-3402 
Multiple PHP remote file inclusion vulnerabilities in HIOX Browser Statistics (HBS) 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the hm parameter to (1) hioxupdate.php and (2) hioxstats.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T16:00:00.000Z
CVE-2008-3403 
SQL injection vulnerability in mojoClassified.cgi in MojoPersonals allows remote attackers to execute arbitrary SQL commands via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T16:00:00.000Z
CVE-2008-3404 
Cross-site scripting (XSS) vulnerability in guestbook.js.php in MJGuest 6.8 GT allows remote attackers to inject arbitrary web script or HTML via the link parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T16:00:00.000Z
CVE-2008-3405 
Directory traversal vulnerability in index.php in Ricardo Amaral nzFotolog 0.4.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action_file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T16:00:00.000Z
CVE-2008-3406 
SQL injection vulnerability in showcat.php in phpLinkat 0.1 allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T16:00:00.000Z
CVE-2008-3407 
phpLinkat 0.1 allows remote attackers to bypass authentication and access unspecified pages under admin/ by sending a login=right cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T16:00:00.000Z
CVE-2008-3408 
Stack-based buffer overflow in CoolPlayer 2.18, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via a crafted m3u file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T17:00:00.000Z
CVE-2008-3409 
Buffer overflow in Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a UDP packet containing a large value in a certain size field, followed by a data string of that size, aka attack 1 in ut3mendo.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T17:00:00.000Z
CVE-2008-3410 
Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a UDP packet in which the value of a certain size field is greater than the total packet length, aka attack 2 in ut3mendo.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T17:00:00.000Z
CVE-2008-3411 
The Axesstel AXW-D800 modem with D2_ETH_109_01_VEBR Jun-14-2006 software does not require authentication for (1) etc/config/System.html, (2) etc/config/Network.html, (3) etc/config/Security.html, (4) cgi-bin/sysconf.cgi, and (5) cgi-bin/route.cgi, which allows remote attackers to change the modem's configuration via direct requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T17:00:00.000Z
CVE-2008-3412 
SQL injection vulnerability in Comsenz EPShop (aka ECShop) before 3.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter in a (1) pro_show or (2) disppro action to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T17:00:00.000Z
CVE-2008-3413 
SQL injection vulnerability in category.php in Greatclone GC Auction Platinum allows remote attackers to execute arbitrary SQL commands via the cate_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T17:00:00.000Z
CVE-2008-3414 
SQL injection vulnerability in line2.php in SiteAdmin allows remote attackers to execute arbitrary SQL commands via the art parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T17:00:00.000Z
CVE-2008-3415 
Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bit parameter, as demonstrated by an upload to avatar/ of a .jpg file containing PHP sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T17:00:00.000Z
CVE-2008-3416 
SQL injection vulnerability in modules/members.php in IceBB before 1.0-rc9.3 allows remote attackers to execute arbitrary SQL commands via the username parameter in a members action to index.php, related to an incorrect protection mechanism in the clean_string function in includes/functions.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T17:00:00.000Z
CVE-2008-3417 
SQL injection vulnerability in home/index.asp in fipsCMS light 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the r parameter, a different vector than CVE-2006-6115 and CVE-2007-2561.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T17:00:00.000Z
CVE-2008-3418 
SQL injection vulnerability in browse.php in TriO 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T17:00:00.000Z
CVE-2008-3419 
SQL injection vulnerability in ugroups.php in Youtuber Clone allows remote attackers to execute arbitrary SQL commands via the UID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T17:00:00.000Z
CVE-2008-3420 
Multiple SQL injection vulnerabilities in Mobius for Mimsy XG 1 1.4.4.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to browse.php or (2) the s parameter in an exhibitions action to detail.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T17:00:00.000Z
CVE-2008-3421 
Multiple cross-site request forgery (CSRF) vulnerabilities in Blackboard Academic Suite 8.0.260.7 allow remote attackers to hijack the authentication of student users for requests that change configuration and enrollments via unspecified input to (1) update_module.jsp, (2) enroll_course.pl, and (3) unenroll.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T17:00:00.000Z
CVE-2008-3422 
Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted attributes related to (1) HtmlControl.cs (PreProcessRelativeReference), (2) HtmlForm.cs (RenderAttributes), (3) HtmlInputButton (RenderAttributes), (4) HtmlInputRadioButton (RenderAttributes), and (5) HtmlSelect (RenderChildren).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T21:00:00.000Z
CVE-2008-3423 
IBM WebSphere Portal 5.1 through 6.1.0.0 allows remote attackers to bypass authentication and obtain administrative access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T01:00:00.000Z
CVE-2008-3424 
Condor before 7.0.4 does not properly handle wildcards in the ALLOW_WRITE, DENY_WRITE, HOSTALLOW_WRITE, or HOSTDENY_WRITE configuration variables in authorization policy lists, which might allow remote attackers to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T22:00:00.000Z
CVE-2008-3425 
Unspecified vulnerability in the Sun Java System Web Server 7.0 plugin in Sun N1 Service Provisioning System (SPS) 5.2 and 6.0 allows remote authenticated SPS users to gain administrative access to the web server via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T22:00:00.000Z
CVE-2008-3426 
Unspecified vulnerability in the Solaris Platform Information and Control Library daemon (picld) in Sun Solaris 8 through 10, and OpenSolaris builds snv_01 through snv_95, allows local users to cause a denial of service via unknown vectors that prevent operation of utilities such as prtdiag, prtpicl, and prtfru.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T22:00:00.000Z
CVE-2008-3428 
Session fixation vulnerability in phpFreeChat 1.1 allows remote authenticated users to hijack web sessions by setting the session_id parameter to match the victim's nickid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T22:00:00.000Z
CVE-2008-3429 
Buffer overflow in URI processing in HTTrack and WinHTTrack before 3.42-3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T22:00:00.000Z
CVE-2008-3430 
Buffer overflow in the CoVideoWindow.ocx ActiveX control 5.0.907.1 in Eyeball MessengerSDK, as used in products such as SiOL Komunikator 1.3, allows remote attackers to execute arbitrary code via a large argument supplied to the BGColor method.  NOTE: this might only be a vulnerability in certain insecure configurations of Internet Explorer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-07-31T22:00:00.000Z
CVE-2008-3431 
The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-05T19:20:00.000Z
CVE-2008-3432 
Heap-based buffer overflow in the mch_expand_wildcards function in os_unix.c in Vim 6.2 and 6.3 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames, as demonstrated by the netrw.v3 test case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-10T10:00:00.000Z
CVE-2008-3433 
SpeedBit Download Accelerator Plus (DAP) before 8.6.3.9 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-01T14:00:00.000Z
CVE-2008-3434 
Apple iTunes before 10.5.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-01T14:00:00.000Z
CVE-2008-3435 
LinkedIn Browser Toolbar 3.0.3.1100 and earlier does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-01T14:00:00.000Z
CVE-2008-3436 
The GUP generic update process in Notepad++ before 4.8.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-01T14:00:00.000Z
CVE-2008-3437 
OpenOffice.org (OOo) before 2.1.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-01T14:00:00.000Z
CVE-2008-3438 
Apple Mac OS X does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-01T14:00:00.000Z
CVE-2008-3439 
SpeedBit Video Acceleration before 2.2.1.8 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-01T14:00:00.000Z
CVE-2008-3440 
Sun Java 1.6.0_03 and earlier versions, and possibly later versions, does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-01T14:00:00.000Z
CVE-2008-3441 
Nullsoft Winamp before 5.24 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-01T14:00:00.000Z
CVE-2008-3442 
WinZip before 11.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-01T14:00:00.000Z
CVE-2008-3443 
The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service (infinite loop and crash) via multiple long requests to a Ruby socket, related to memory allocation failure, and as demonstrated against Webrick.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-14T23:00:00.000Z
CVE-2008-3444 
The content layout component in Mozilla Firefox 3.0 and 3.0.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted but well-formed web page that contains "a simple set of legitimate HTML tags."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T10:00:00.000Z
CVE-2008-3445 
SQL injection vulnerability in index.php in phpMyRealty (PMR) 2.0.0 allows remote attackers to execute arbitrary SQL commands via the location parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T17:00:00.000Z
CVE-2008-3446 
Directory traversal vulnerability in inc/wysiwyg.php in LetterIt 2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T17:00:00.000Z
CVE-2008-3447 
The scanning engine in F-Prot Antivirus 6.2.1 4252 allows remote attackers to cause a denial of service (infinite loop) via a malformed ZIP archive, probably related to invalid offsets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T17:00:00.000Z
CVE-2008-3448 
Cross-site scripting (XSS) vulnerability in index.php in common solutions csphonebook 1.02 allows remote attackers to inject arbitrary web script or HTML via the letter parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T17:00:00.000Z
CVE-2008-3449 
MailEnable Professional 3.5.2 and Enterprise 3.52 allow remote attackers to cause a denial of service (crash) via multiple IMAP connection requests to the same folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T17:00:00.000Z
CVE-2008-3450 
Unspecified vulnerability in the namefs kernel module in Sun Solaris 8 through 10 allows local users to gain privileges or cause a denial of service (panic) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T18:00:00.000Z
CVE-2008-3451 
PhpWebGallery 1.7.0 and 1.7.1 allows remote authenticated users with advisor privileges to obtain the real e-mail addresses of other users by editing the user's profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T19:00:00.000Z
CVE-2008-3452 
SQL injection vulnerability in the Calendar module in eNdonesia 8.4 allows remote attackers to execute arbitrary SQL commands via the loc_id parameter in a list_events action to mod.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T19:00:00.000Z
CVE-2008-3453 
Multiple unspecified vulnerabilities in ImpressCMS 1.0 have unknown impact and attack vectors, related to modules/admin.php and "a few files."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T19:00:00.000Z
CVE-2008-3454 
JnSHosts PHP Hosting Directory 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the "adm" cookie value to 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T19:00:00.000Z
CVE-2008-3455 
PHP remote file inclusion vulnerability in include/admin.php in JnSHosts PHP Hosting Directory 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the rd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T19:00:00.000Z
CVE-2008-3456 
phpMyAdmin before 2.11.8 does not sufficiently prevent its pages from using frames that point to pages in other domains, which makes it easier for remote attackers to conduct spoofing or phishing activities via a cross-site framing attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T19:00:00.000Z
CVE-2008-3457 
Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments.  NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T19:00:00.000Z
CVE-2008-3458 
Vtiger CRM before 5.0.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read mail merge templates via a direct request to the wordtemplatedownload directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T19:00:00.000Z
CVE-2008-3459 
Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when running on non-Windows systems, allows remote servers to execute arbitrary commands via crafted (1) lladdr and (2) iproute configuration directives, probably related to shell metacharacters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-04T19:00:00.000Z
CVE-2008-3460 
WPGIMP32.FLT in Microsoft Office 2000 SP3, XP SP3, and 2003 SP2; Office Converter Pack; and Works 8 does not properly parse the length of a WordPerfect Graphics (WPG) file, which allows remote attackers to execute arbitrary code via a crafted WPG file, aka the "WPG Image File Heap Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-12T23:00:00.000Z
CVE-2008-3464 
afd.sys in the Ancillary Function Driver (AFD) component in Microsoft Windows XP SP2 and SP3 and Windows Server 2003 SP1 and SP2 does not properly validate input sent from user mode to the kernel, which allows local users to gain privileges via a crafted application, as demonstrated using crafted pointers and lengths that bypass intended ProbeForRead and ProbeForWrite restrictions, aka "AFD Kernel Overwrite Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-15T00:00:00.000Z
CVE-2008-3465 
Heap-based buffer overflow in an API in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows context-dependent attackers to cause a denial of service or execute arbitrary code via a WMF file with a malformed file-size parameter, which would not be properly handled by a third-party application that uses this API for a copy operation, aka "GDI Heap Overflow Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-12-10T13:33:00.000Z